joyce8/EMBER2024-capa huggingface dataset:
Function at 0x682c24d0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x682c51f0]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x682c253d
mov rcx, r8
call fcn.682c23b0
test eax, eax
je 0x682c253d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x682c253d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x682c2534
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x682c253f
add rax, 0x28
cmp rax, r9
jne 0x682c2520
xor eax, eax
add rsp, 0x28
ret

Function at 0x682c2ac0
Capabilities:
Write file on windows

Disassembly:
lea rcx, [0x682c13a0]
jmp 0x682c1380
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.682c29b0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.682c29b0
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
jmp 0x682c1390
Function at 0x14003b82c
Capabilities:
Create restart manager session
Enumerate processes that use resource

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0xb0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x28], 0xfffffffffffffffe
mov qword [rbp + 8], rcx
mov dword [rbp + 0x24], 0
mov eax, dword [0x1401cefdc]
mov ecx, dword [0x1401de370]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14003b9c1
vxorps xmm0, xmm0, xmm0
lea r8, [rbp - 0x40]
vmovups ymmword [r8 + 0x20], ymm0
vmovups ymmword [r8], ymm0
mov word [r8 + 0x40], 0
lea rcx, [rbp + 0x24]
xor esi, esi
xor edx, edx
vzeroupper
call sub.RstrtMgr.DLL_RmStartSession
test eax, eax
jne 0x14003b9a5
mov ecx, dword [rbp + 0x24]
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0
lea r8, [rbp + 8]
mov edx, 1
xor r9d, r9d
call sub.RstrtMgr.DLL_RmRegisterResources
test eax, eax
jne 0x14003b99b
xor eax, eax
lea rsi, [rbp + 4]
mov dword [rsi], eax
lea rdx, [rbp + 0x20]
mov dword [rdx], eax
lea r8, [rbp + 0x1c]
mov dword [r8], eax
mov qword [rbp + 0x10], 0
mov ecx, dword [rbp + 0x24]
mov qword [rsp + 0x20], rsi
xor r9d, r9d
call sub.RstrtMgr.DLL_RmGetList
cmp eax, 0xea
jne 0x14003b98b
mov edi, dword [rbp + 0x20]
test edi, edi
je 0x14003b98b
imul rcx, rdi, 0x29c
call fcn.1400bef70
mov qword [rbp + 0x10], rax
test rax, rax
je 0x14003b98b
lea r8, [rbp + 0x1c]
mov dword [r8], edi
mov ecx, dword [rbp + 0x24]
mov qword [rsp + 0x20], rsi
lea rdx, [rbp + 0x20]
mov r9, rax
call sub.RstrtMgr.DLL_RmGetList
test eax, eax
jne 0x14003b982
cmp dword [rbp + 0x20], 0
je 0x14003b982
mov r8d, dword [rbp + 0x1c]
mov al, 1
test r8, r8
je 0x14003b995
mov rcx, qword [rbp + 0x10]
mov edx, dword [0x1401cefd8]
imul r8, r8, 0x29c
xor r9d, r9d
mov esi, dword [rcx + r9]
cmp esi, edx
jne 0x14003b9b2
add r9, 0x29c
cmp r8, r9
jne 0x14003b96c
jmp 0x14003b995
mov rcx, qword [rbp + 0x10]
call fcn.1400bdd60
mov ecx, dword [rbp + 0x24]
call sub.RstrtMgr.DLL_RmEndSession
xor eax, eax
xor esi, esi
test al, al
je 0x14003b9a5
mov ecx, dword [rbp + 0x24]
call sub.RstrtMgr.DLL_RmEndSession
xor esi, esi
mov eax, esi
add rsp, 0xb0
pop rdi
pop rsi
pop rbp
ret
call fcn.1400bdd60
mov ecx, dword [rbp + 0x24]
call sub.RstrtMgr.DLL_RmEndSession
jmp 0x14003b9a5
lea rcx, [0x1401cefdc]
call fcn.1400b8578
cmp dword [0x1401cefdc], 0xffffffff
jne 0x14003b876
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov dword [0x1401cefd8], eax
lea rcx, [0x1401cefdc]
call fcn.1400b850c
jmp 0x14003b876
Function at 0x14003be5f
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x198
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x110], 0xfffffffffffffffe
mov rdi, rdx
mov rsi, rcx
mov rcx, rdx
call fcn.14000d074
test al, al
je 0x14003bfe6
mov rcx, rdi
call fcn.14000f04a
mov dword [rsp + 0x20], 1
lea rbx, [rbp - 0x58]
mov rcx, rbx
mov rdx, rax
mov r8d, 0x20
mov r9d, 0x40
call fcn.140072678
vxorps xmm0, xmm0, xmm0
vmovaps xmmword [rbp + 0xf0], xmm0
mov qword [rbp + 0x100], 0
mov qword [rbp + 0x108], socket
cmp qword [rbx + 0x90], 0
je 0x14003bfef
lea rcx, [rbp - 0x58]
mov rax, qword [rcx]
movsxd rax, dword [rax + 4]
and dword [rbp + rax - 0x40], 0xfffffffe
xor edx, edx
mov r8d, 2
call fcn.14003c110
lea rcx, [rbp - 0x58]
lea rdx, [rbp + 0xd8]
call fcn.14003c26c
mov rdx, qword [rbp + 0xe0]
add rdx, qword [rbp + 0xd8]
lea rcx, [rbp + 0xf0]
call fcn.140012450
lea rcx, [rbp - 0x58]
xor edx, edx
xor r8d, r8d
call fcn.14003c110
lea r8, [rbp + 0xb8]
mov qword [r8], 0
mov word [r8 + 8], 1
mov rax, qword [rbp - 0x58]
movsxd rax, dword [rax + 4]
mov rax, qword [rbp + rax - 0x10]
lea rdx, [rbp + 0xc8]
mov qword [rdx], rax
test rax, rax
sete byte [rdx + 8]
mov byte [rdx + 9], 0
lea rcx, [rbp + 0xf0]
call fcn.14003c350
mov rax, qword [rbp - 0x58]
movsxd rax, dword [rax + 4]
lea rcx, [rax + rbp]
add rcx, 0xffffffffffffffa8
xor edx, edx
cmp qword [rcx + 0x48], 0
sete dl
shl edx, 2
xor r8d, r8d
call fcn.140017368
lea rcx, [rbp - 0x58]
call fcn.14003c41e
vmovups ymm0, ymmword [rbp + 0xf0]
vmovups ymmword [rsi], ymm0
mov qword [rbp + 0x100], 0
mov qword [rbp + 0x108], socket
mov byte [rbp + 0xf0], 0
mov byte [rsi + 0x20], 1
jmp 0x14003c0b5
mov byte [rsi + 0x20], 0
jmp 0x14003c0cd
mov rcx, rdi
call fcn.14000f04a
mov rcx, rax
call fcn.14003b82c
mov rcx, rdi
mov edx, eax
call fcn.14003ba28
mov rdi, rax
test rax, rax
je 0x14003c0aa
mov rcx, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
mov edx, eax
lea rcx, [rbp + 0xf0]
xor r8d, r8d
call fcn.140012596
mov dword [rbp + 0xd8], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea rcx, [rbp + 0xf0]
call fcn.140011f5e
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0xd8]
mov rcx, rdi
mov rdx, rax
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14003c0b0
vmovups ymm0, ymmword [rbp + 0xf0]
vmovups ymmword [rsi], ymm0
mov qword [rbp + 0x100], 0
mov qword [rbp + 0x108], socket
mov byte [rbp + 0xf0], 0
mov al, 1
jmp 0x14003c0b2
mov byte [rsi + 0x20], 0
jmp 0x14003c0b5
xor eax, eax
mov byte [rsi + 0x20], al
lea rcx, [rbp + 0xf0]
vzeroupper
call fcn.14000e914
lea rcx, [rbp - 0x58]
call fcn.14003c4bc
mov rax, rsi
add rsp, 0x198
pop rbx
pop rdi
pop rsi
pop rbp
ret
Function at 0x140041574
Capabilities:
Generate random numbers using a mersenne twister
Get system information on windows

Disassembly:
push rsi
push rdi
push rbx
mov eax, 0x13f0
call fcn.1400b8450
sub rsp, rax
mov rsi, rcx
mov rax, qword [0x1401c6840]
xor rax, rsp
mov qword [rsp + 0x13e8], rax
call fcn.1400e4f54
movabs rcx, 0x346dc5d63886594b
imul rcx
mov rdi, rdx
shr rdi, 0x3f
sar rdx, 0xb
add rdi, rdx
lea rbx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movsxd rcx, dword [rbx + 0x20]
mov rax, rdi
cqo
idiv rcx
lea edi, [rdx + 1]
call fcn.1400e4f84
lea rbx, [rsp + 0x60]
mov dword [rbx + 0x1384], 0xffffffff
mov rcx, rbx
mov edx, eax
mov r8d, 0x6c078965
call fcn.14007c46c
lea rcx, [rsp + 0x28]
mov dword [rcx], 1
mov dword [rcx + 4], edi
mov rdx, rbx
mov r8d, 1
mov r9d, edi
call fcn.14007c528
mov dword [rsi], eax
mov rcx, qword [rsp + 0x13e8]
xor rcx, rsp
call fcn.1400b84b0
nop
add rsp, 0x13f0
pop rbx
pop rdi
pop rsi
ret

Function at 0x140041638
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push rsi
push rdi
mov eax, 0x13b8
call fcn.1400b8450
sub rsp, rax
mov rsi, rcx
mov rax, qword [0x1401c6840]
xor rax, rsp
mov qword [rsp + 0x13b0], rax
call fcn.1400e4f84
lea rdi, [rsp + 0x28]
mov dword [rdi + 0x1384], 0xffffffff
mov rcx, rdi
mov edx, eax
mov r8d, 0x6c078965
call fcn.14007c46c
movabs rax, 0xf00000005
lea rcx, [rsp + 0x20]
mov qword [rcx], rax
mov rdx, rdi
mov r8d, 5
mov r9d, send
call fcn.14007c528
mov dword [rsi], eax
mov rcx, qword [rsp + 0x13b0]
xor rcx, rsp
call fcn.1400b84b0
nop
add rsp, 0x13b8
pop rdi
pop rsi
ret
Function at 0x1400416c4
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x1478
call fcn.1400b8450
sub rsp, rax
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x13f0], 0xfffffffffffffffe
mov edi, edx
mov qword [rbp + 0x13e8], rcx
vxorps xmm0, xmm0, xmm0
lea rsi, [rbp + 0x13a0]
vmovups ymmword [rsi], ymm0
lea rdx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789
mov r8d, 0x3e
mov rcx, rsi
vzeroupper
call fcn.14000d802
call fcn.1400e4f84
lea rbx, [rbp - 0x60]
mov dword [rbx + 0x1384], 0xffffffff
mov rcx, rbx
mov edx, eax
mov r8d, 0x6c078965
call fcn.14007c46c
mov eax, dword [rbp + 0x13b0]
dec eax
mov dword [rbp + 0x13e0], 0
mov dword [rbp + 0x13e4], eax
movsxd r8, edi
lea rcx, [rbp + 0x13c0]
vxorps xmm0, xmm0, xmm0
vmovups ymmword [rcx], ymm0
xor edx, edx
vzeroupper
call fcn.140072492
lea r14, [rbp + 0x1328]
mov qword [r14], rsi
lea rax, [rbp + 0x13e0]
mov qword [r14 + 8], rax
mov qword [r14 + 0x10], rbx
lea rcx, [rbp + 0x13c0]
call fcn.140011f5e
lea rcx, [rbp + 0x1360]
mov rdx, rax
mov r8d, edi
mov r9, r14
call fcn.140041a46
lea rcx, [0x1401df660]
lea rdx, str.chromium_collect
call fcn.14000c603
mov rcx, rax
call fcn.14000cc2d
mov rdi, qword [0x1401cef18]
mov r14, qword [0x1401cef20]
lea rbx, [rbp + 0x1380]
lea r15, [rbp + 0x1360]
lea r12, [rbp + 0x1340]
lea r13, [0x140186360]
cmp rdi, r14
je 0x140041890
lea rsi, [rdi + 0x20]
mov rcx, rbx
mov rdx, rsi
call fcn.140018d28
mov rcx, r15
lea rdx, [0x140186340]
mov r8, rbx
call fcn.14000cc61
mov rcx, rbx
call fcn.140010ac0
mov rcx, r15
call fcn.14000d074
test al, al
je 0x14004183f
mov rcx, r15
mov rdx, rdi
call fcn.14003cf27
mov rcx, r12
mov rdx, rsi
call fcn.140018d28
mov rcx, rbx
mov rdx, r13
mov r8, r12
call fcn.14000cc61
mov rcx, r12
call fcn.140010ac0
mov rcx, rbx
call fcn.14000d074
test al, al
je 0x140041877
mov rcx, rbx
mov rdx, rdi
call fcn.14003cf27
mov rcx, rbx
call fcn.140010ac0
mov rcx, r15
call fcn.140010ac0
add rdi, 0x40
jmp 0x1400417f6
mov rax, qword [rbp + 0x13e8]
lea rcx, [rax + 8]
lea rdx, [rbp + 0x13c0]
call fcn.140041b7a
lea rsi, [rbp + 0x13c0]
mov rcx, qword [rbp + 0x13e8]
mov rdx, rsi
call fcn.140041c24
mov edi, eax
mov rcx, rsi
call fcn.14000e914
lea rcx, [rbp + 0x13a0]
call fcn.14000e914
mov eax, edi
add rsp, 0x1478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x140049b6e
Capabilities:
Hash data using fnv

Disassembly:
sub r8, rdx
movabs rcx, 0xcbf29ce484222325
jmp 0x140049b80
push r15
push r14
push rsi
push rdi
push rbx
mov rax, rcx
movabs rcx, 0x43aa2c72b3e81295
movabs r9, 0x43aa2c7230f03a98
xor r10d, r10d
lea r11, [r9 - 0x2de8f007]
lea rsi, [r9 - 0x30ae5bea]
lea rdi, [r9 - 0x2f34cd41]
movabs rbx, 0x100000001b3
mov r14, r9
cmp r10, r8
mov r15, r11
cmovb r15, rsi
cmp r14, r11
jge 0x140049bde
cmp r14, rdi
jge 0x140049bef
cmp r14, rsi
jne 0x140049bcd
jmp 0x140049c01
cmp r14, r9
jb 0x140049bf3
cmp r14, rcx
jae 0x140049c12
cmp r14, r9
jne 0x140049bcd
jmp 0x140049bfc
jne 0x140049bcd
jmp 0x140049c17
cmp r14, r11
cmove r14, rdi
jmp 0x140049bcd
mov r14, r15
jmp 0x140049bcd
movzx r14d, byte [rdx + r10]
xor rax, r14
imul rax, rbx
mov r14, rcx
jmp 0x140049bc3
inc r10
jmp 0x140049bc0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x140049b80
Capabilities:
Hash data using fnv

Disassembly:
sub r8, rdx
movabs rcx, 0xcbf29ce484222325
jmp 0x140049b80
push r15
push r14
push rsi
push rdi
push rbx
mov rax, rcx
movabs rcx, 0x43aa2c72b3e81295
movabs r9, 0x43aa2c7230f03a98
xor r10d, r10d
lea r11, [r9 - 0x2de8f007]
lea rsi, [r9 - 0x30ae5bea]
lea rdi, [r9 - 0x2f34cd41]
movabs rbx, 0x100000001b3
mov r14, r9
cmp r10, r8
mov r15, r11
cmovb r15, rsi
cmp r14, r11
jge 0x140049bde
cmp r14, rdi
jge 0x140049bef
cmp r14, rsi
jne 0x140049bcd
jmp 0x140049c01
cmp r14, r9
jb 0x140049bf3
cmp r14, rcx
jae 0x140049c12
cmp r14, r9
jne 0x140049bcd
jmp 0x140049bfc
jne 0x140049bcd
jmp 0x140049c17
cmp r14, r11
cmove r14, rdi
jmp 0x140049bcd
mov r14, r15
jmp 0x140049bcd
movzx r14d, byte [rdx + r10]
xor rax, r14
imul rax, rbx
mov r14, rcx
jmp 0x140049bc3
inc r10
jmp 0x140049bc0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14005970e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
movabs rdx, 0x2c11c034d0cb6588
movabs r8, 0x2c11c034a898b045
mov qword [rsp], rcx
mov rax, qword [rsp]
mov ecx, pe_nt_image_headers64
and ecx, dword [rax + 0xbc]
mov dword [rsp + 0xc], ecx
lea rcx, [r8 - 0x387b51a6]
lea r9, [r8 + 0xb787dfc]
lea r10, [r8 - 0x3324effc]
lea r11, [r8 - 0x63fee839]
lea rsi, [r8 - 0x674cb748]
lea rdi, [r8 + 0x12c5dcb7]
lea rbx, [r8 + 0xc0526a2]
lea r14, [rdx + 0x228be10d]
lea r15, [r8 - 0x1bf87682]
lea rax, [rdx + 0x170a8b27]
mov qword [rsp + 0x10], rax
lea rbp, [rdx + 0x35356ab]
mov qword [rsp + 0x18], rcx
mov r8, rcx
cmp r8, r9
jge 0x1400597d6
cmp r8, r10
jge 0x1400597f0
cmp r8, r11
jge 0x140059845
cmp r8, rsi
jne 0x1400597a3
mov rcx, qword [rsp]
mov r8, qword [rsp]
mov rcx, qword [rcx]
cmp rcx, qword [r8 + 0xa0]
mov r8, rdi
cmove r8, rbx
jmp 0x1400597a3
cmp r8, rdx
jae 0x14005981e
cmp r8, rbx
jae 0x140059873
cmp r8, r9
movzx ecx, r13b
jmp 0x1400598eb
cmp r8, r15
jae 0x14005989b
cmp r8, r10
jne 0x1400597a3
mov rcx, qword [rsp]
mov rcx, qword [rcx]
movzx ecx, byte [rcx - 1]
lea r8, [0x14010fbe0]
cmp byte [rcx + r8], 0
setne r13b
mov r8, r9
jmp 0x1400597a3
lea rcx, [rdx + 0x170a8b27]
cmp r8, rcx
jae 0x1400598db
cmp r8, rbp
jae 0x1400598fa
cmp r8, rdx
jne 0x1400597a3
jmp 0x1400599c1
cmp r8, qword [rsp + 0x18]
jae 0x140059936
cmp r8, r11
jne 0x1400597a3
mov rcx, qword [rsp]
test byte [rcx + 0xbc], 8
mov r8, r9
cmove r8, r10
xor r13d, r13d
jmp 0x1400597a3
cmp r8, rdi
jae 0x140059954
cmp r8, rbx
jne 0x1400597a3
mov rax, qword [rsp]
test byte [rax + 0xbc], 0xc
sete al
mov r8, rdx
jmp 0x1400597a3
movabs rcx, 0x2c11c034a898b045
cmp r8, rcx
jae 0x140059978
cmp r8, r15
jne 0x1400597a3
mov rcx, qword [rsp]
mov rcx, qword [rcx]
movzx ecx, byte [rcx]
lea r8, [0x14010fbe0]
cmp byte [rcx + r8], 0
setne r12b
mov r8, qword [rsp + 0x10]
jmp 0x1400597a3
cmp r8, r14
jae 0x14005999c
cmp r8, rcx
movzx ecx, r12b
movzx eax, al
cmove eax, ecx
cmove r8, rdx
jmp 0x1400597a3
jne 0x1400597a3
mov rax, qword [rsp]
mov rax, qword [rax]
movzx eax, byte [rax - 1]
lea r8, [0x14010fbe0]
cmp byte [rax + r8], 0
setne cl
mov rax, qword [rsp]
mov rax, qword [rax]
movzx eax, byte [rax]
cmp byte [rax + r8], 0
setne al
xor al, cl
mov r8, rdx
jmp 0x1400597a3
jne 0x1400597a3
cmp dword [rsp + 0xc], 0
movabs r8, 0x2c11c034a898b045
cmove r8, r14
jmp 0x1400597a3
jne 0x1400597a3
mov rcx, qword [rsp]
test byte [rcx + 0xbc], 4
lea r8, [rdx + 0x170a8b27]
cmove r8, r15
xor r12d, r12d
jmp 0x1400597a3
jne 0x1400597a3
mov rcx, qword [rsp]
mov r8, qword [rsp]
mov rcx, qword [rcx]
cmp rcx, qword [r8 + 0xa0]
mov r8, rbp
cmove r8, r11
jmp 0x1400597a3
mov rcx, qword [rsp]
mov r8, qword [rsp]
mov rcx, qword [rcx]
cmp rcx, qword [r8 + 0x98]
movabs r8, 0x2c11c034a898b045
cmove r8, rsi
jmp 0x1400597a3
and al, 1
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14007c874
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
movabs rsi, 0x68fe536593e1bbbb
movabs rdi, 0x68fe536514e5ff70
mov qword [rsp + 0x28], rcx
mov rax, qword [rsp + 0x28]
mov eax, dword [rax]
mov dword [rsp + 0x34], eax
lea rbx, [rsi + 0x357a71ac]
lea r14, [rsi + 0x178cbecf]
lea r15, [rdi - 0x1000ba5a]
lea r12, [rsi + 0x3fb28ba3]
mov rax, rbx
cmp rax, r14
jge 0x14007c8df
cmp rax, rdi
jge 0x14007c8fe
cmp rax, r15
jne 0x14007c8c4
mov rcx, qword [rsp + 0x28]
call fcn.14007ca80
jmp 0x14007c8f9
cmp rax, rbx
jae 0x14007c913
cmp rax, r14
jne 0x14007c8c4
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4e0
mov rax, r15
jae 0x14007c8c4
mov rax, rdi
jmp 0x14007c8c4
cmp rax, rsi
jae 0x14007c931
mov rcx, r12
cmp rax, rdi
je 0x14007c90e
mov rcx, rax
mov rax, rcx
jmp 0x14007c8c4
cmp rax, r12
jae 0x14007c942
cmp rax, rbx
jne 0x14007c8c4
mov ecx, dword [rsp + 0x34]
mov rax, rsi
cmp ecx, 0x270
je 0x14007c8c4
mov rax, r14
jmp 0x14007c8c4
jne 0x14007c8c4
mov rcx, qword [rsp + 0x28]
call fcn.14007c99a
mov rax, r12
jmp 0x14007c8c4
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x28]
mov edx, dword [rcx]
lea r8d, [rdx + 1]
mov dword [rcx], r8d
mov eax, dword [rax + rdx*4 + 4]
mov ecx, eax
shr ecx, 0xb
mov rdx, qword [rsp + 0x28]
and ecx, dword [rdx + 0x1384]
xor ecx, eax
mov eax, ecx
shl eax, 7
and eax, 0x9d2c5680
xor eax, ecx
mov ecx, eax
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x14007c99a
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push rsi
push rdi
push rbp
push rbx
push rax
movabs rax, 0x7a5a5fef830f875
movabs rdx, 0x7a5a5fe604b96b5
mov qword [rsp], rcx
mov ecx, 0x270
lea r8, [rax - 0x47c75698]
lea r9, [rax + 0x55eb441]
lea r10, [rdx - 0x4d89b8e2]
mov r11d, 0x80000000
mov rdi, rax
cmp rcx, 0x4e0
mov rsi, r8
cmovb rsi, r9
cmp rdi, r8
jge 0x14007c9f9
cmp rdi, rdx
jge 0x14007ca64
cmp rdi, r10
jne 0x14007c9e8
jmp 0x14007ca76
cmp rdi, rax
jb 0x14007ca56
cmp rdi, r9
jae 0x14007ca0a
cmp rdi, rax
jne 0x14007c9e8
jmp 0x14007ca5f
jne 0x14007c9e8
mov rdi, qword [rsp]
mov edi, dword [rdi + rcx*4 - 0x9bc]
and edi, r11d
mov rbx, qword [rsp]
mov ebx, dword [rbx + rcx*4 - 0x9b8]
mov ebp, ebx
and ebp, 0x7ffffffe
or ebp, edi
shr ebp, 1
and ebx, 1
neg ebx
and ebx, 0x9908b0df
mov rdi, qword [rsp]
xor ebx, dword [rdi + rcx*4 - 0x388]
xor ebx, ebp
mov rdi, qword [rsp]
mov dword [rdi + rcx*4 + 4], ebx
mov rdi, rdx
jmp 0x14007c9e8
cmp rdi, r8
cmove rdi, r10
jmp 0x14007c9e8
mov rdi, rsi
jmp 0x14007c9e8
sete bl
movzx esi, bl
cmove rdi, rax
add rcx, rsi
jmp 0x14007c9da
add rsp, 8
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x14007ca80
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
push rax
movabs rax, 0x114df709c8ad5d53
movabs rdx, 0x114df709463ef1df
mov qword [rsp], rcx
xor ecx, ecx
lea r8, [rdx + 0x4dce79f9]
lea r9, [rdx - 0x106e6292]
lea r10, [rdx - 0x1b652529]
lea r11, [rdx + 0x642ac8aa]
lea rsi, [rdx + 0x11102d5]
lea rdi, [rax + 0x2c33a82]
lea rbx, [rax + 0x1800f9bf]
lea r14, [rdx + 0x78277fe]
mov r13, rdx
cmp r13, r8
jge 0x14007cb06
cmp r13, rdx
jge 0x14007cb1a
cmp r13, r9
jge 0x14007cb54
cmp r13, r10
jne 0x14007cae2
cmp r12, 0x26f
mov r13, r9
cmovb r13, r11
jmp 0x14007cae2
cmp r13, rax
jae 0x14007cb38
cmp r13, r11
jae 0x14007cb5a
cmp r13, r8
jne 0x14007cae2
jmp 0x14007cc57
cmp r13, rsi
jae 0x14007cbbb
cmp r13, rdx
jne 0x14007cae2
cmp rcx, 0xe3
mov r13, rdi
cmovb r13, rbx
jmp 0x14007cae2
cmp r13, rdi
jae 0x14007cbd6
xor r15d, r15d
cmp r13, rax
sete r15b
cmove r13, rdx
add rcx, r15
jmp 0x14007cae2
cmove r13, r8
jmp 0x14007cae2
jne 0x14007cae2
mov r15, qword [rsp]
mov ebp, dword [r15 + r12*4 + 0x9c4]
mov r15d, 0x80000000
and ebp, r15d
mov r15, qword [rsp]
mov r15d, dword [r15 + r12*4 + 0x9c8]
mov r13d, r15d
and r13d, 0x7ffffffe
or r13d, ebp
shr r13d, 1
and r15d, 1
neg r15d
and r15d, 0x9908b0df
mov rbp, qword [rsp]
xor r15d, dword [rbp + r12*4 - 0x388]
xor r15d, r13d
mov r13, qword [rsp]
mov dword [r13 + r12*4 + 4], r15d
mov r13, r14
jmp 0x14007cae2
cmp r13, r14
jae 0x14007cbe7
cmp r13, rsi
mov r15d, 0xe3
cmove r12, r15
cmove r13, r10
jmp 0x14007cae2
cmp r13, rbx
jae 0x14007cbfb
cmp r13, rdi
cmove r13, rsi
jmp 0x14007cae2
sete r15b
movzx r15d, r15b
cmove r13, r10
add r12, r15
jmp 0x14007cae2
mov r15, qword [rsp]
mov r15d, dword [r15 + rcx*4 + 0x9c4]
mov ebp, 0x80000000
and r15d, ebp
mov r13, qword [rsp]
mov r13d, dword [r13 + rcx*4 + 0x9c8]
mov ebp, r13d
and ebp, 0x7ffffffe
or ebp, r15d
shr ebp, 1
and r13d, 1
neg r13d
and r13d, 0x9908b0df
mov r15, qword [rsp]
xor r13d, dword [r15 + rcx*4 + 0xff8]
xor r13d, ebp
mov r15, qword [rsp]
mov dword [r15 + rcx*4 + 4], r13d
mov r13, rax
jmp 0x14007cae2
mov rax, qword [rsp]
mov ecx, 0x80000000
and ecx, dword [rax + 0x1380]
mov rax, qword [rsp]
mov eax, dword [rax + 4]
mov edx, eax
and edx, 0x7ffffffe
or edx, ecx
shr edx, 1
and eax, 1
neg eax
and eax, 0x9908b0df
mov rcx, qword [rsp]
xor eax, dword [rcx + 0x634]
xor eax, edx
mov rcx, qword [rsp]
mov dword [rcx + 0x9c0], eax
mov rax, qword [rsp]
mov dword [rax], 0
add rsp, 8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400844c1
Capabilities:
Get hostname

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rsi, rcx
mov rax, qword [0x1401c6840]
xor rax, rsp
mov qword [rsp + 0x40], rax
movabs r13, 0xaf4e93e2d5707bf7
movabs rbp, 0xaf4e93e221871d83
lea rdx, [rsp + 0x2c]
mov dword [rdx], send
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov dword [rsp + 0x28], eax
lea rbx, [rbp + 0x37c83e52]
lea r14, [rbp - 0x1d0cc9a6]
lea r12, [0x1401df9b0]
lea r15, str.Error_getting_computer_name._Error_code:
mov rax, rbp
cmp rax, rbx
jae 0x140084566
cmp rax, rbp
jae 0x1400845ca
cmp rax, r14
jne 0x140084530
vxorps xmm0, xmm0, xmm0
vmovups ymmword [rsi], ymm0
lea rdi, [rsp + 0x30]
mov rcx, rdi
vzeroupper
call fcn.14010bb40
mov rcx, rsi
mov rdx, rdi
mov r8, rax
jmp 0x1400845ba
cmp rax, r13
jae 0x1400845e1
cmp rax, rbx
jne 0x140084530
mov rcx, r12
mov rdx, r15
call fcn.14000c603
mov rdi, r15
mov r15, r12
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, r12
mov r12, r15
mov r15, rdi
mov edx, eax
call fcn.140084602
mov rcx, rax
call fcn.14000cc2d
vxorps xmm0, xmm0, xmm0
vmovups ymmword [rsi], ymm0
mov r8d, 0x1b
mov rcx, rsi
lea rdx, str.Error_getting_computer_name
vzeroupper
call fcn.14000d802
mov rax, r13
jmp 0x140084530
jne 0x140084530
cmp dword [rsp + 0x28], 0
mov rax, r14
cmove rax, rbx
jmp 0x140084530
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400b84b0
mov rax, rsi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140084edf
Capabilities:
Get memory capacity

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
mov rsi, rcx
mov rax, qword [0x1401c6840]
xor rax, rsp
mov qword [rsp + 0xb0], rax
movabs r13, 0x235fa5829ac6df81
movabs rbp, 0x235fa58217f7a2c0
lea rcx, [rsp + 0x28]
mov dword [rcx], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov dword [rsp + 0x24], eax
lea rdi, [rsp + 0xa5]
lea r14, [r13 + 0x19ee9281]
lea r15, [r13 + 0x2c857081]
lea rbx, [rsp + 0x70]
lea r12, str.Error_retrieving_system_memory_information.
mov rax, r14
cmp rax, r14
jae 0x140084fcc
cmp rax, r13
jae 0x140084feb
cmp rax, rbp
jne 0x140084f55
mov rdx, qword [rsp + 0x30]
shr rdx, 0x1e
mov rcx, rdi
call fcn.14006aacf
mov rcx, rbx
mov rdx, rax
mov r8, rdi
lea r9, [rsp + 0x6f]
call fcn.140020346
mov r8d, 3
mov rcx, rbx
lea rdx, [0x140111587]
call fcn.140011e6c
vmovups ymm0, ymmword [rax]
vmovups ymmword [rsi], ymm0
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], send
mov byte [rax], 0
mov rcx, rbx
vzeroupper
call fcn.14000e914
mov rax, r13
jmp 0x140084f55
cmp rax, r15
jae 0x140084ff3
cmp rax, r14
jne 0x140084f55
cmp dword [rsp + 0x24], 0
mov rax, rbp
cmove rax, r15
jmp 0x140084f55
jne 0x140084f55
jmp 0x140085017
vxorps xmm0, xmm0, xmm0
vmovups ymmword [rsi], ymm0
mov r8d, 0x2b
mov rcx, rsi
mov rdx, r12
vzeroupper
call fcn.14000d802
mov rax, r13
jmp 0x140084f55
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1400b84b0
mov rax, rsi
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret