joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ed750
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x1a0
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x140126038]
xor rax, rsp
mov qword [rsp + 0x198], rax
cmp byte [rcx + 0x17], 0
jns 0x1400ed77a
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400ed79c
mov edi, eax
test bl, bl
jne 0x1400ed794
mov eax, edi
and eax, 0x400
jne 0x1400ed7aa
and edi, 0x10
shr edi, 4
jmp 0x1400ed7ac
mov ecx, 2
call fcn.140069620
test al, al
jne 0x1400ed7c9
xor edi, edi
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.14008cfb0
mov eax, edi
add rsp, 0x1a0
pop rbx
pop rdi
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rcx, [rsp + 0x58]
mov r8d, 0x82
mov r9d, 2
call fcn.1400d75a0
lea rcx, [rsp + 0x68]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1400bddf0
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x30]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x40]
mov rcx, rsi
call fcn.140064d10
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x1400ed848
mov r8, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rcx, rdi
mov rdx, rsi
call fcn.1400bddf0
cmp byte [rsp + 0x57], 0
jns 0x1400ed864
mov rcx, qword [rsp + 0x40]
call fcn.14008ba68
lea rcx, [rsp + 0x58]
call fcn.1400d7620
jmp 0x1400ed7aa

Function at 0x1400ed880
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x198
mov rsi, rcx
mov rax, qword [0x140126038]
xor rax, rsp
mov qword [rsp + 0x190], rax
cmp byte [rcx + 0x17], 0
jns 0x1400ed8a7
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400ed8d7
test eax, 0x410
sete sil
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.14008cfb0
mov eax, esi
add rsp, 0x198
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.140069620
test al, al
jne 0x1400ed8e9
xor esi, esi
jmp 0x1400ed8bb
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rcx, [rsp + 0x50]
mov r8d, 0x75
mov r9d, 2
call fcn.1400d75a0
lea rcx, [rsp + 0x60]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1400bddf0
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x28]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x38]
mov rcx, rsi
call fcn.140064d10
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x1400ed968
mov r8, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rcx, rdi
mov rdx, rsi
call fcn.1400bddf0
cmp byte [rsp + 0x4f], 0
jns 0x1400ed984
mov rcx, qword [rsp + 0x38]
call fcn.14008ba68
lea rcx, [rsp + 0x50]
call fcn.1400d7620
jmp 0x1400ed8e5
Function at 0x1400ed9a0
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x198
mov rsi, rcx
mov rax, qword [0x140126038]
xor rax, rsp
mov qword [rsp + 0x190], rax
cmp byte [rcx + 0x17], 0
jns 0x1400ed9c7
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400ed9de
and eax, 0x410
cmp eax, 0x410
je 0x1400eda25
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x1400ed9ea
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dil, 1
test eax, eax
je 0x1400eda13
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.14008cfb0
mov eax, edi
add rsp, 0x198
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.140069620
test al, al
jne 0x1400eda46
xor edi, edi
jmp 0x1400ed9f7
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.14008cfb0
mov rcx, rsi
add rsp, 0x198
pop rdi
pop rsi
jmp fcn.1400edaf0
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rcx, [rsp + 0x50]
mov r8d, 0x95
mov r9d, 2
call fcn.1400d75a0
lea rcx, [rsp + 0x60]
lea rdx, str.DeleteFile
mov r8d, 0xb
call fcn.1400bddf0
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x28]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x38]
mov rcx, rsi
call fcn.140064d10
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x1400edac5
mov r8, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rcx, rdi
mov rdx, rsi
call fcn.1400bddf0
cmp byte [rsp + 0x4f], 0
jns 0x1400edae1
mov rcx, qword [rsp + 0x38]
call fcn.14008ba68
lea rcx, [rsp + 0x50]
call fcn.1400d7620
jmp 0x1400eda21

Function at 0x1400edaf0
Capabilities:
Delete directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x1a0
mov rdi, rcx
mov rax, qword [0x140126038]
xor rax, rsp
mov qword [rsp + 0x198], rax
cmp byte [rcx + 0x17], 0
jns 0x1400edb18
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, eax
test eax, eax
jne 0x1400edb32
mov ecx, 2
call fcn.140069620
test al, al
jne 0x1400edb54
test esi, esi
setne bl
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.14008cfb0
mov eax, ebx
add rsp, 0x1a0
pop rbx
pop rdi
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rcx, [rsp + 0x58]
mov r8d, 0x30
mov r9d, 2
call fcn.1400d75a0
lea rcx, [rsp + 0x68]
lea rdx, str.RemoveDirectory
mov r8d, 0x10
call fcn.1400bddf0
mov rbx, rax
movzx eax, byte [rdi + 0x17]
test al, al
mov rcx, qword [rdi]
cmovns rcx, rdi
lea rdx, [rsp + 0x30]
mov qword [rdx], rcx
cmovs rax, qword [rdi + 8]
mov qword [rdx + 8], rax
lea rdi, [rsp + 0x40]
mov rcx, rdi
call fcn.140064d10
movzx r8d, byte [rdi + 0x17]
test r8b, r8b
jns 0x1400edbd3
mov r8, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
mov rcx, rbx
mov rdx, rdi
call fcn.1400bddf0
cmp byte [rsp + 0x57], 0
jns 0x1400edbef
mov rcx, qword [rsp + 0x40]
call fcn.14008ba68
lea rcx, [rsp + 0x58]
call fcn.1400d7620
jmp 0x1400edb32
Function at 0x1400efe00
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rbx, rdx
mov rsi, rcx
mov rax, qword [rcx + 8]
cmp rax, qword [rcx + 0x10]
je 0x1400efe3e
test rax, rax
je 0x1400eff07
mov rcx, qword [rbx]
mov qword [rax], rcx
add rax, 8
mov qword [rsi + 8], rax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
sub rax, qword [rsi]
mov r15, rax
sar r15, 3
lea rcx, [r15 + 1]
mov rdx, rcx
shr rdx, 0x3d
jne 0x1400eff33
movabs rdx, 0x1fffffffffffffff
lea rdi, [rsi + 0x18]
mov r14, rax
shr r14, 2
cmp r14, rcx
cmovbe r14, rcx
movabs rcx, 0x7ffffffffffffff8
cmp rax, rcx
cmovae r14, rdx
test r14, r14
jne 0x1400efefa
xor eax, eax
shl r15, 3
add r15, rax
je 0x1400eff07
lea rax, [rax + r14*8]
mov rcx, qword [rbx]
mov qword [r15], rcx
lea rcx, [r15 + 8]
mov rdx, qword [rsi]
mov r8, qword [rsi + 8]
cmp r8, rdx
je 0x1400efec8
mov r9, qword [r8 - 8]
add r8, 0xfffffffffffffff8
mov qword [r15 - 8], r9
add r15, 0xfffffffffffffff8
cmp r8, rdx
jne 0x1400efeb0
mov rdx, qword [rsi]
mov qword [rsi], r15
mov qword [rsi + 8], rcx
mov r8, qword [rsi + 0x10]
mov qword [rsi + 0x10], rax
test rdx, rdx
je 0x1400efe32
sub r8, rdx
sar r8, 3
mov rcx, rdi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.1400f0470
mov rcx, rdi
mov rdx, r14
call fcn.1400f09f0
jmp 0x1400efe8d
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x25
call fcn.1400be640
mov rcx, rsi
call fcn.1400be5b0
int3

Function at 0x1400f4ed0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test rdx, rdx
je 0x1400f4f0c
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x1400f4f16
add rdi, rbx
sub rsi, rbx
jne 0x1400f4eea
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.1400a1300
int3

Function at 0x1400f8da0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140126038]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
add rsi, rdi
xor r15d, r15d
lea r14, [rsp + 0x2c]
mov r12, qword [sym.imp.KERNEL32.dll_WriteFile]
cmp rdi, rsi
jae 0x1400f8e28
mov dword [rsp + 0x2c], 0
mov r8d, esi
sub r8d, edi
mov qword [rsp + 0x20], r15
mov rcx, rbx
mov rdx, rdi
mov r9, r14
call r12
test eax, eax
sete dl
mov ecx, dword [rsp + 0x2c]
test rcx, rcx
sete al
or al, dl
mov edx, 0
jne 0x1400f8e21
mov rdx, rcx
add rdi, rdx
cmp al, 1
jne 0x1400f8de2
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14008cfb0
nop
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140001490
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x10], rdx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov r15, rdx
mov rsi, rcx
sub r15, rcx
mov r9d, 4
mov qword [rsp + 0x38], r15
nop dword [rax]
mov r8d, 4
nop word [rax + rax]
movzx eax, byte [r15 + rcx]
xor byte [rcx], al
inc rcx
sub r8, 1
jne 0x1400014d0
sub r9, 1
jne 0x1400014c0
mov r15, qword [rsp + 0x40]
mov r12b, 1
lea r10, str.cw
mov r8, rsi
mov r9d, 4
nop
mov rcx, r8
mov edx, 4
nop dword [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 4]
movzx eax, byte [rax + r10]
mov byte [rcx - 4], al
sub rdx, 1
jne 0x140001510
inc r8
sub r9, 1
jne 0x140001500
movzx eax, byte [rsi + 5]
movzx ecx, byte [rsi + 1]
mov byte [rsi + 1], al
movzx eax, byte [rsi + 9]
mov byte [rsi + 5], al
movzx eax, byte [rsi + 0xd]
mov byte [rsi + 9], al
movzx eax, byte [rsi + 0xa]
mov byte [rsi + 0xd], cl
movzx ecx, byte [rsi + 2]
mov byte [rsi + 2], al
movzx eax, byte [rsi + 0xe]
mov byte [rsi + 0xa], cl
movzx ecx, byte [rsi + 6]
mov byte [rsi + 6], al
movzx eax, byte [rsi + 0xf]
mov byte [rsi + 0xe], cl
movzx ecx, byte [rsi + 3]
mov byte [rsi + 3], al
movzx eax, byte [rsi + 0xb]
mov byte [rsi + 0xf], al
movzx eax, byte [rsi + 7]
mov byte [rsi + 0xb], al
mov byte [rsi + 7], cl
cmp r12b, 0xa
je 0x14000169e
lea r14, [rsi + 2]
lea ebp, [rdx + 4]
nop dword [rax]
nop word [rax + rax]
movzx edi, byte [r14 - 2]
movzx r8d, byte [r14 - 1]
movzx edx, dil
movzx ebx, byte [r14 + 1]
xor dl, r8b
movzx r10d, byte [r14]
lea r14, [r14 + 4]
movzx eax, dl
movzx r9d, bl
shr al, 7
add dl, dl
movzx eax, al
xor r9b, r10b
imul ecx, eax, 0x1b
movzx r11d, r9b
xor r11b, dil
xor r11b, r8b
xor cl, dl
movzx edx, r8b
xor cl, dil
xor dl, r10b
xor cl, r11b
movzx eax, dl
mov byte [r14 - 6], cl
xor dil, bl
shr al, 7
add dl, dl
movzx eax, al
imul ecx, eax, 0x1b
movzx eax, r9b
shr al, 7
add r9b, r9b
movzx eax, al
xor cl, dl
xor cl, r8b
xor cl, r11b
mov byte [r14 - 5], cl
imul ecx, eax, 0x1b
movzx eax, dil
shr al, 7
add dil, dil
movzx eax, al
xor cl, r9b
xor cl, r10b
xor cl, r11b
mov byte [r14 - 4], cl
imul ecx, eax, 0x1b
xor cl, dil
xor cl, bl
xor cl, r11b
mov byte [r14 - 3], cl
sub rbp, 1
jne 0x1400015a0
movzx r8d, r12b
lea r9d, [rbp + 4]
shl r8, 4
mov rax, rsi
sub r8, rsi
add r8, r15
nop word [rax + rax]
mov edx, 4
nop word [rax + rax]
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
inc rax
sub rdx, 1
jne 0x140001680
sub r9, 1
jne 0x140001670
inc r12b
jmp 0x1400014ee
mov r15, qword [rsp + 0x38]
mov edx, 4
nop dword [rax + rax]
mov ecx, 4
nop word [rax + rax]
movzx eax, byte [r15 + rsi + 0xa0]
xor byte [rsi], al
inc rsi
sub rcx, 1
jne 0x1400016c0
sub rdx, 1
jne 0x1400016b0
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140004490
Capabilities:
Create process on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
push rbx
sub rsp, 0xe0
xorps xmm1, xmm1
xor eax, eax
movups xmmword [rsp + 0x70], xmm1
mov qword [r11 - 0x18], rax
mov rcx, rdx
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
movups xmmword [r11 - 0x68], xmm1
lea rax, str.winsta0default
movups xmmword [r11 - 0x58], xmm1
movups xmmword [r11 - 0x48], xmm1
movups xmmword [r11 - 0x38], xmm1
movups xmmword [r11 - 0x28], xmm1
mov dword [rsp + 0x70], 0x68
mov qword [r11 - 0x68], rax
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.Qt5Core.dll_public:_unsigned_short_int_const____ptr64___cdecl_QString::utf16_void_const___ptr64]
mov rbx, rax
mov qword [rsp + 0xf0], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x100]
mov edx, 0xf01ff
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp eax, 1
jne 0x140004538
mov rdx, qword [rsp + 0x100]
lea rcx, [rsp + 0xf0]
xor r8d, r8d
call qword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea rax, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x40], rax
mov rcx, rbx
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x628
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1400045aa
mov rcx, qword [rsp + 0x50]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov rcx, qword [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0xe0
pop rbx
ret
Function at 0x140008b00
Capabilities:
Accept command line arguments

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x70
xor ebx, ebx
mov dword [rsp + 0x40], ebx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0x50], rax
mov rdi, rax
test rax, rax
jne 0x140008b3d
lea rax, [rbx - 1]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret
mov eax, dword [rsp + 0x40]
mov r15, 0xffffffffffffffff
inc eax
mov qword [rsp + 0x98], rsi
movsxd rcx, eax
mov eax, 8
mul rcx
mov qword [rsp + 0x60], r14
cmovo rax, r15
mov rcx, rax
call fcn.140008c9c
mov r14, rax
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x140008c3c
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0xa0], r12
mov r12, r14
mov qword [rsp + 0x68], r13
mov r13, rdi
sub r13, r14
mov r14d, ebx
nop dword [rax]
nop word [rax + rax]
mov rbp, qword [r12 + r13]
mov r9d, r15d
mov qword [rsp + 0x38], rbx
mov r8, rbp
mov qword [rsp + 0x30], rbx
xor edx, edx
mov dword [rsp + 0x28], ebx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rdi, eax
mov rcx, rdi
call fcn.140008c9c
mov qword [rsp + 0x38], rbx
mov r9d, r15d
mov qword [rsp + 0x30], rbx
mov r8, rbp
mov dword [rsp + 0x28], edi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov qword [r12], rsi
lea r12, [r12 + 8]
mov eax, dword [rsp + 0x40]
inc r14d
cmp r14d, eax
jne 0x140008bb0
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov r13, qword [rsp + 0x68]
mov r12, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0x90]
cdqe
mov rcx, rdi
mov qword [r14 + rax*8], rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [rsp + 0x40]
mov rdx, r14
call fcn.140004170
mov esi, eax
cmp dword [rsp + 0x40], ebx
je 0x140008c7b
mov rdi, r14
mov rcx, qword [rdi]
test rcx, rcx
je 0x140008c7b
call fcn.140007b8c
inc ebx
add rdi, 8
cmp ebx, dword [rsp + 0x40]
jne 0x140008c62
mov rcx, r14
call fcn.140007b8c
mov r14, qword [rsp + 0x60]
mov eax, esi
mov rsi, qword [rsp + 0x98]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret
Function at 0x1400031b0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x13f0
call fcn.140068300
sub rsp, rax
mov rax, qword [0x140086080]
xor rax, rsp
mov qword [rsp + 0x13e0], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor edi, edi
mov dword [rsp + 0x20], edi
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
lea ecx, [rdi + 0x40]
call fcn.140067b48
mov rsi, rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], 0x3f
mov qword [rsp + 0x48], 0x3f
movaps xmm0, xmmword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789.]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x14007a5f0]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x14007a600]
movups xmmword [rax + 0x20], xmm0
movsd xmm0, qword [0x14007a610]
movsd qword [rax + 0x30], xmm0
mov eax, dword [0x14007a618]
mov dword [rsi + 0x38], eax
movzx eax, word [0x14007a61c]
mov word [rsi + 0x3c], ax
movzx eax, byte [reloc.WLDAP32.dll_Ordinal_46]
mov byte [rsi + 0x3e], al
mov byte [rsi + 0x3f], dil
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], dil
mov dword [rsp + 0x20], 1
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov edx, eax
mov dword [rsp + 0x13d4], 0xffffffff
mov dword [rsp + 0x54], eax
lea ecx, [rdi + 1]
nop dword [rax + rax]
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [rsp + rcx*4 + 0x54], edx
inc rcx
cmp rcx, 0x270
jb 0x1400032a0
mov dword [rsp + 0x50], 0x270
mov edi, 0xa
nop dword [rax]
lea rcx, [rsp + 0x50]
call fcn.140005eb0
mov ecx, eax
imul rax, rcx, 0x3f
cmp eax, 3
ja 0x1400032fa
lea rcx, [rsp + 0x50]
call fcn.140005eb0
mov ecx, eax
imul rax, rcx, 0x3f
cmp eax, 4
jb 0x1400032e5
shr rax, 0x20
movsxd rcx, eax
movzx r9d, byte [rcx + rsi]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x140003332
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x140003327
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140003341
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rbx
call fcn.140005890
sub rdi, 1
jne 0x1400032d0
lea edx, [rdi + 0x40]
mov rcx, rsi
call fcn.140067b40
mov rax, rbx
mov rcx, qword [rsp + 0x13e0]
xor rcx, rsp
call fcn.140067b20
lea r11, [rsp + 0x13f0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140005eb0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x140005f11
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x140005ed0
mov ecx, dword [r9]
jmp 0x140005ff8
cmp ecx, 0x4e0
jb 0x140005ff8
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x140005f30
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x140005f80
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x1400067d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x140006804
mov eax, esi
lea ecx, [rax - 0x65]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x1400067f0
mov byte [r8 + 7], sil
add r8, 6
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140006310
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140006829
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140012d30
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x1400068a3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000689e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000689e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140067b40
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400068b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x1400068e4
mov eax, esi
lea ecx, [rax - 0x65]
xor byte [r8 + rax], cl
inc rax
cmp rax, 8
jb 0x1400068d0
mov byte [r8 + 9], sil
add r8, 8
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140006310
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140006909
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140012d30
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140006983
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000697e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000697e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140067b40
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret