joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140186590
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
push r15
mov r12d, 4
lea rbx, [rcx + 0x10278]
mov ebp, r12d
lea rsi, [rcx + 0x10680]
mov r10, rcx
lea r13, [0x1401e7b50]
xor edi, edi
nop
mov eax, dword [r10 + 0x10e78]
xor r11d, r11d
test eax, eax
je 0x140186637
nop
xor r9d, r9d
lea eax, [r11 + 0x40]
nop word [rax + rax]
mov edx, eax
shr eax, 1
and edx, 1
mov ecx, eax
add rcx, rdi
movzx r8d, word [r10 + rcx*2 + 0x6ee4]
mov ecx, edx
neg ecx
shr r8, 4
shr rcx, 4
and ecx, 0x7f
xor r8, rcx
movzx ecx, byte [r8 + r13]
add r9d, ecx
cmp eax, 1
jne 0x1401865f0
mov dword [rbx + r11*4], r9d
inc r11d
mov eax, dword [r10 + 0x10e78]
cmp r11d, eax
jb 0x1401865e0
mov edx, recvfrom
cmp eax, edx
jbe 0x140186660
mov eax, edx
lea rcx, [rbx + rax*4]
mov eax, edx
shr eax, 1
inc edx
shl eax, 4
sub eax, 0x50
add dword [rcx], eax
cmp edx, dword [r10 + 0x10e78]
jb 0x140186640
nop dword [rax]
mov eax, dword [rbx]
add rdi, 0x40
mov dword [rsi - 8], eax
mov eax, dword [rbx + 4]
mov dword [rsi - 4], eax
mov eax, dword [rbx + 8]
mov dword [rsi], eax
mov eax, dword [rbx + 0xc]
add rbx, 0x100
mov dword [rsi + 4], eax
add rsi, 0x200
sub rbp, 1
jne 0x1401865d0
mov r15, r12
lea r14, [0x1401e7bd4]
lea r11, [r10 + 0x10a88]
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r14]
mov ebx, r12d
mov edi, eax
mov r9d, eax
and eax, 1
shr edi, 1
dec edi
or eax, 2
mov ecx, edi
shl eax, cl
sub ebx, eax
mov ebp, eax
xor r8d, r8d
lea esi, [r8 + 1]
nop word [rax + rax]
mov eax, esi
mov edx, ebx
sub rax, r9
shr ebx, 1
add rax, rbp
and edx, 1
movzx ecx, word [r10 + rax*2 + 0x70e2]
lea esi, [rdx + rsi*2]
mov eax, edx
shr rcx, 4
neg eax
shr rax, 4
and eax, 0x7f
xor rcx, rax
movzx eax, byte [rcx + r13]
add r8d, eax
add edi, 0xffffffff
jne 0x1401866e0
mov ecx, dword [r10 + r9*4 + 0x10278]
inc r12d
add ecx, r8d
inc r15
mov dword [r11 - 0x400], ecx
inc r14
mov ecx, dword [r10 + r9*4 + 0x10378]
add ecx, r8d
mov dword [r11 - 0x200], ecx
mov ecx, dword [r10 + r9*4 + 0x10478]
add ecx, r8d
mov dword [r11], ecx
mov ecx, dword [r10 + r9*4 + 0x10578]
add ecx, r8d
mov dword [r11 + 0x200], ecx
add r11, 4
cmp r12d, 0x80
jb 0x1401866b0
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov dword [r10 + 0x10e7c], edi
mov rdi, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
ret
Function at 0x1401867a0
Capabilities:
Encode data using xor

Disassembly:
push rdi
mov r10d, dword [rcx + 0xb7c]
mov r11, rcx
mov ecx, 8
sub ecx, r10d
shr r8d, cl
mov ecx, r10d
mov eax, dword [r11 + 0xb80]
xor r10d, r10d
and eax, edx
shl eax, cl
mov ecx, dword [rsp + 0x38]
add r8d, eax
add ecx, 0x100
lea rdi, [r8 + r8*2]
shl rdi, 9
add rdi, r11
lea r11, [0x1401e7b50]
test r9b, r9b
jne 0x140186826
nop dword [rax]
mov r8d, ecx
shr ecx, 1
and r8d, 1
neg r8d
shr r8, 4
movzx r9d, word [rdi + rcx*2 + 0xb84]
and r8d, 0x7f
shr r9, 4
xor r9, r8
movzx edx, byte [r9 + r11]
add r10d, edx
cmp ecx, 1
jne 0x1401867f0
mov eax, r10d
pop rdi
ret
mov qword [rsp + 0x10], rbx
mov r9d, 0x100
mov ebx, dword [rsp + 0x30]
nop word [rax + rax]
mov edx, ecx
add ebx, ebx
shr edx, 8
mov eax, r9d
and eax, ebx
add eax, r9d
add edx, eax
movzx r8d, word [rdi + rdx*2 + 0xb84]
mov edx, ecx
shr edx, 7
add ecx, ecx
and edx, 1
shr r8, 4
neg edx
shr rdx, 4
and edx, 0x7f
xor r8, rdx
movzx eax, byte [r8 + r11]
add r10d, eax
mov eax, ebx
xor eax, ecx
not eax
and r9d, eax
cmp ecx, 0x10000
jb 0x140186840
mov rbx, qword [rsp + 0x10]
mov eax, r10d
pop rdi
ret
Function at 0x1400b396e
Capabilities:
Terminate process

Disassembly:
jmp 0x140215740
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400b3d4c
Capabilities:
Write file on windows

Disassembly:
jmp 0x1400f9260
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x1402ab5ee]
call fcn.1400b4e22
mov r9, qword [rbp + 0xf8]
mov r8, qword [rbp + 0xf0]
mov rdx, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.ucrtbased.dll_fwrite]
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x1400b3ef5
Capabilities:
Read file on windows

Disassembly:
jmp 0x1400f91f0
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x1402ab5ee]
call fcn.1400b4e22
mov r9, qword [rbp + 0xf8]
mov r8, qword [rbp + 0xf0]
mov rdx, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.ucrtbased.dll_fread]
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret
Function at 0x1400b3f0e
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x1400fb0e0
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x198
lea rbp, [rsp + 0x20]
lea rcx, [0x1402ab5ee]
call fcn.1400b4e22
mov eax, dword [rbp + 0x1a0]
not eax
mov dword [rbp + 0x1a0], eax
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x190]
mov qword [rbp + 0x28], rax
lea rax, [0x140226d50]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x198], 0
je 0x1400fb225
mov rax, qword [rbp + 0x198]
mov qword [rbp + 0x158], rax
mov rax, qword [rbp + 0x198]
dec rax
mov qword [rbp + 0x198], rax
cmp qword [rbp + 0x158], 0
je 0x1400fb179
mov dword [rbp + 0x160], 1
jmp 0x1400fb183
mov dword [rbp + 0x160], 0
cmp dword [rbp + 0x160], 0
je 0x1400fb220
mov rax, qword [rbp + 0x28]
movzx eax, byte [rax]
mov byte [rbp + 0x154], al
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
movzx eax, byte [rbp + 0x154]
mov byte [rbp + 0x64], al
movzx eax, byte [rbp + 0x64]
cmp eax, 0x23
jne 0x1400fb1fa
cmp qword [rbp + 0x198], 2
jb 0x1400fb1fa
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1400fb1fa
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1400fb1fa
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
movzx edx, byte [rbp + 0x64]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
jmp 0x1400fb144
jmp 0x1400fb2bf
mov rax, qword [rbp + 0x28]
movzx eax, byte [rax]
mov byte [rbp + 0x154], al
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
movzx eax, byte [rbp + 0x154]
mov byte [rbp + 0x84], al
movzx eax, byte [rbp + 0x84]
test eax, eax
je 0x1400fb2bf
movzx eax, byte [rbp + 0x84]
cmp eax, 0x23
jne 0x1400fb296
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1400fb296
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1400fb296
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
movzx edx, byte [rbp + 0x84]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
jmp 0x1400fb225
mov eax, dword [rbp + 4]
not eax
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret
Function at 0x1400b4030
Capabilities:
Parse pe header

Disassembly:
jmp 0x1402178e0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140217900
xor al, al
jmp 0x140217981
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140217913
xor al, al
jmp 0x140217981
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14021793d
xor al, al
jmp 0x140217981
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140217951
xor al, al
jmp 0x140217981
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140217963
xor al, al
jmp 0x140217981
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14021797f
xor al, al
jmp 0x140217981
mov al, 1
add rsp, 0x38
ret
Function at 0x1400b4a8a
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x1400fafc0
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x158
lea rbp, [rsp + 0x20]
lea rcx, [0x1402ab5ee]
call fcn.1400b4e22
mov eax, dword [rbp + 0x160]
not eax
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x150]
mov qword [rbp + 0x28], rax
lea rax, [0x140226d50]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x158]
mov qword [rbp + 0x118], rax
mov rax, qword [rbp + 0x158]
dec rax
mov qword [rbp + 0x158], rax
cmp qword [rbp + 0x118], 0
je 0x1400fb03f
mov dword [rbp + 0x120], 1
jmp 0x1400fb049
mov dword [rbp + 0x120], 0
cmp dword [rbp + 0x120], 0
je 0x1400fb092
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
mov rdx, qword [rbp + 0x28]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 0x114], eax
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
mov eax, dword [rbp + 0x114]
mov dword [rbp + 4], eax
jmp 0x1400fb00a
mov eax, dword [rbp + 4]
not eax
lea rsp, [rbp + 0x138]
pop rdi
pop rbp
ret

Function at 0x1401a0560
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x20]
lea rcx, [0x1402ab7b9]
call fcn.1400b4e22
call fcn.14019e930
mov qword [rbp + 8], rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
shr rax, 0x10
and rax, 0xffff
movzx eax, ax
mov dword [rbp + 0x44], eax
mov rax, qword [rbp + 8]
add rax, 0x2c
mov r9d, 4
mov r8, rax
mov edx, 0x20001004
mov ecx, dword [rbp + 0x44]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x1401a05d2
mov rax, qword [rbp + 8]
mov dword [rax + 0x2c], 0
lea rsp, [rbp + 0x128]
pop rdi
pop rbp
ret
Function at 0x1402101c0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x16
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x168]
mov rax, qword [0x1402920c0]
xor rax, rbp
mov qword [rbp + 0x100], rax
lea rcx, [0x1402ab972]
call fcn.1400b4e22
mov edx, 8
lea rcx, [rbp + 8]
call fcn.140211c90
mov rdx, qword [rbp + 0x138]
lea rcx, [rbp + 8]
call fcn.140210b80
nop
lea rax, [0x14020fd80]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x130]
add rax, 8
mov qword [rbp + 0xf8], rax
lea rcx, [rbp + 8]
call fcn.140211ee0
mov rcx, qword [rbp + 0xf8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rbp + 0x28]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll__beginthreadex]
mov rcx, qword [rbp + 0x130]
mov qword [rcx], rax
mov rax, qword [rbp + 0x130]
cmp qword [rax], 0
je 0x14021029a
lea rcx, [rbp + 8]
call fcn.140212050
jmp 0x1402102b3
mov rax, qword [rbp + 0x130]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.1400b2a05
nop
lea rcx, [rbp + 8]
call fcn.1402111b0
lea rcx, [rbp - 0x30]
lea rdx, [0x1402758a0]
call fcn.1400b460c
mov rcx, qword [rbp + 0x100]
xor rcx, rbp
call fcn.1400b35d1
lea rsp, [rbp + 0x118]
pop rdi
pop rbp
ret

Function at 0x140210330
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x16
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x168]
mov rax, qword [0x1402920c0]
xor rax, rbp
mov qword [rbp + 0x100], rax
lea rcx, [0x1402ab972]
call fcn.1400b4e22
mov edx, 8
lea rcx, [rbp + 8]
call fcn.140211cd0
mov rdx, qword [rbp + 0x138]
lea rcx, [rbp + 8]
call fcn.140210c50
nop
lea rax, [0x14020fe90]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x130]
add rax, 8
mov qword [rbp + 0xf8], rax
lea rcx, [rbp + 8]
call fcn.140211f20
mov rcx, qword [rbp + 0xf8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rbp + 0x28]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll__beginthreadex]
mov rcx, qword [rbp + 0x130]
mov qword [rcx], rax
mov rax, qword [rbp + 0x130]
cmp qword [rax], 0
je 0x14021040a
lea rcx, [rbp + 8]
call fcn.1402120b0
jmp 0x140210423
mov rax, qword [rbp + 0x130]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.1400b2a05
nop
lea rcx, [rbp + 8]
call fcn.140211240
lea rcx, [rbp - 0x30]
lea rdx, [0x140275920]
call fcn.1400b460c
mov rcx, qword [rbp + 0x100]
xor rcx, rbp
call fcn.1400b35d1
lea rsp, [rbp + 0x118]
pop rdi
pop rbp
ret
Function at 0x1402104a0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x16
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x168]
mov rax, qword [0x1402920c0]
xor rax, rbp
mov qword [rbp + 0x100], rax
lea rcx, [0x1402ab972]
call fcn.1400b4e22
mov edx, 8
lea rcx, [rbp + 8]
call fcn.140211d10
mov rdx, qword [rbp + 0x138]
lea rcx, [rbp + 8]
call fcn.140210d20
nop
lea rax, [0x14020ffa0]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x130]
add rax, 8
mov qword [rbp + 0xf8], rax
lea rcx, [rbp + 8]
call fcn.140211f60
mov rcx, qword [rbp + 0xf8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rbp + 0x28]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll__beginthreadex]
mov rcx, qword [rbp + 0x130]
mov qword [rcx], rax
mov rax, qword [rbp + 0x130]
cmp qword [rax], 0
je 0x14021057a
lea rcx, [rbp + 8]
call fcn.140212110
jmp 0x140210593
mov rax, qword [rbp + 0x130]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.1400b2a05
nop
lea rcx, [rbp + 8]
call fcn.1402112d0
lea rcx, [rbp - 0x30]
lea rdx, [0x1402759a0]
call fcn.1400b460c
mov rcx, qword [rbp + 0x100]
xor rcx, rbp
call fcn.1400b35d1
lea rsp, [rbp + 0x118]
pop rdi
pop rbp
ret

Function at 0x140210610
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x16
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x168]
mov rax, qword [0x1402920c0]
xor rax, rbp
mov qword [rbp + 0x100], rax
lea rcx, [0x1402ab972]
call fcn.1400b4e22
mov edx, 8
lea rcx, [rbp + 8]
call fcn.140211d50
mov rdx, qword [rbp + 0x138]
lea rcx, [rbp + 8]
call fcn.140210df0
nop
lea rax, [0x1402100b0]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x130]
add rax, 8
mov qword [rbp + 0xf8], rax
lea rcx, [rbp + 8]
call fcn.140211fa0
mov rcx, qword [rbp + 0xf8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rbp + 0x28]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll__beginthreadex]
mov rcx, qword [rbp + 0x130]
mov qword [rcx], rax
mov rax, qword [rbp + 0x130]
cmp qword [rax], 0
je 0x1402106ea
lea rcx, [rbp + 8]
call fcn.140212170
jmp 0x140210703
mov rax, qword [rbp + 0x130]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.1400b2a05
nop
lea rcx, [rbp + 8]
call fcn.140211360
lea rcx, [rbp - 0x30]
lea rdx, [0x140275a20]
call fcn.1400b460c
mov rcx, qword [rbp + 0x100]
xor rcx, rbp
call fcn.1400b35d1
lea rsp, [rbp + 0x118]
pop rdi
pop rbp
ret
Function at 0x1400021f0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x270
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x140002251
lea r8, [r10 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x140002210
mov ecx, dword [r10]
jmp 0x14000233a
cmp ecx, 0x4e0
jb 0x14000233a
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0xe3
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140002270
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1400022c0
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x1400025f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x40
mov r9, qword [rcx]
movabs rax, 0xffffffff00000000
mov r8d, dword [rcx + 0x68]
mov rsi, rcx
mov r12d, r8d
neg r12
movzx edi, word [r9 + 0x14]
mov r10, qword [r9 + 0x30]
add rdi, r9
and r10, rax
mov qword [rsp + 0x70], r10
mov ebp, dword [rdi + 0x20]
mov eax, dword [rdi + 0x28]
or rbp, r10
and r12, rbp
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x28], r12
test eax, eax
jne 0x14000265a
mov ecx, dword [rdi + 0x3c]
test cl, 0x40
je 0x140002652
mov eax, dword [r9 + 0x20]
jmp 0x14000265a
test cl, cl
jns 0x14000265a
mov eax, dword [r9 + 0x24]
mov ecx, dword [rdi + 0x3c]
mov edx, eax
mov eax, 1
mov r13d, eax
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], r14
mov qword [rsp + 0x88], r15
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x3c], 0
cmp ax, word [r9 + 6]
jae 0x140002762
add rdi, 0x64
nop dword [rax]
mov r15d, dword [rdi - 0x1c]
mov eax, r8d
or r15, r10
mov ebx, r8d
mov r10d, dword [rdi - 0x14]
neg rbx
and rbx, r15
test r10d, r10d
jne 0x1400026d7
mov r11d, dword [rdi]
test r11b, 0x40
je 0x1400026cb
mov r10d, dword [r9 + 0x20]
jmp 0x1400026d7
test r11b, r11b
jns 0x1400026d7
mov r10d, dword [r9 + 0x24]
mov eax, dword [rsi + 0x68]
mov r14d, r10d
cmp r12, rbx
je 0x140002717
mov r8d, eax
lea rax, [rdx + rbp]
cmp rax, rbx
ja 0x140002717
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140002500
test eax, eax
je 0x140002759
mov ecx, dword [rdi]
mov rbp, r15
mov r8d, dword [rsi + 0x68]
mov r12, rbx
mov qword [rsp + 0x20], r15
mov edx, r14d
mov qword [rsp + 0x28], rbx
jmp 0x140002732
mov edx, dword [rdi]
mov eax, edx
and eax, ecx
or ecx, edx
bt eax, 0x19
jb 0x140002729
btr ecx, 0x19
mov rdx, r14
sub rdx, rbp
add rdx, r15
mov r9, qword [rsi]
inc r13d
add rdi, 0x28
mov dword [rsp + 0x38], ecx
mov qword [rsp + 0x30], rdx
movzx eax, word [r9 + 6]
cmp r13d, eax
jge 0x14000275d
mov r10, qword [rsp + 0x70]
jmp 0x1400026a0
xor eax, eax
jmp 0x14000277d
mov eax, 1
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x3c], eax
mov rcx, rsi
call fcn.140002500
test eax, eax
mov eax, 0
setne al
mov r15, qword [rsp + 0x88]
mov r14, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140004620
Capabilities:
Create thread
Hash data with md5

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xb0
mov rax, qword [0x140043030]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov ecx, 0x72fe00
call fcn.140012010
mov r8d, 0x72fe00
lea rdx, [0x140043c30]
mov rcx, rax
mov rbx, rax
call fcn.14000a930
xor edi, edi
mov dword [rsp + 0x38], 0x67452301
mov r8d, 0x72fe00
mov qword [rsp + 0x30], rdi
mov rdx, rbx
mov dword [rsp + 0x3c], 0xefcdab89
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x40], 0x98badcfe
mov dword [rsp + 0x44], 0x10325476
call fcn.140005570
lea rcx, [rsp + 0x30]
call fcn.140005840
movups xmm0, xmmword [rsp + 0x88]
mov ecx, 0xc8
movups xmmword [0x14077cfa0], xmm0
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, [0x140004330]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x140004720
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, [0x1400040a0]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x140004720
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
jmp 0x140004725
mov eax, 1
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140008c30
mov rbx, qword [rsp + 0xc0]
add rsp, 0xb0
pop rdi
ret
Function at 0x140005c70
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0xa0
mov rax, qword [0x140043030]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rdi, rcx
mov esi, edx
mov ecx, edx
mov rbp, r8
call fcn.140012010
mov r8d, esi
mov rdx, rdi
mov rcx, rax
mov rbx, rax
call fcn.14000a930
mov r8d, esi
mov qword [rsp + 0x20], 0
mov rdx, rbx
mov dword [rsp + 0x28], 0x67452301
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x2c], 0xefcdab89
mov dword [rsp + 0x30], 0x98badcfe
mov dword [rsp + 0x34], 0x10325476
call fcn.140005570
lea rcx, [rsp + 0x20]
call fcn.140005840
movups xmm0, xmmword [rsp + 0x78]
movups xmmword [rbp], xmm0
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140008c30
mov rbx, qword [rsp + 0xd8]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret

Function at 0x140009558
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400095a2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400095a2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400095a2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400095a2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400095a2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400095a4
xor al, al
add rsp, 0x28
ret