joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400066c0
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x14000f960], rbx
je 0x140006727
cmp rax, rbx
jne 0x14000671a
mov ebx, 1
mov esi, ebx
jmp 0x14000672c
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x1400066ff
mov ebx, 1
mov eax, dword [0x14000f968]
cmp eax, ebx
jne 0x140006744
mov edi, 0x1f
mov ecx, edi
call sub.msvcrt.dll__amsg_exit
jmp 0x1400067b0
mov eax, dword [0x14000f968]
test eax, eax
jne 0x1400067a5
mov dword [0x14000f968], ebx
lea r15, [0x1400089b8]
lea rdi, [0x1400089a0]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x140006797
test eax, eax
jne 0x14000679b
cmp qword [rdi], r14
je 0x14000678c
mov rax, qword [rdi]
mov rcx, qword [0x140008920]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14000676e
test eax, eax
je 0x1400067ab
mov eax, 0xff
jmp 0x140006906
mov dword [0x14000d3e4], ebx
mov edi, 0x1f
mov eax, dword [0x14000f968]
cmp eax, ebx
jne 0x1400067d7
lea rdx, [0x140008998]
lea rcx, [0x140008928]
call sub.msvcrt.dll__initterm
mov dword [0x14000f968], 2
test esi, esi
jne 0x1400067e5
mov rax, r14
xchg qword [0x14000f960], rax
cmp qword [0x14000f970], r14
je 0x140006818
lea rcx, [0x14000f970]
call fcn.140006b30
test eax, eax
je 0x140006818
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x14000f970]
mov r9, qword [0x140008920]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x140006831
mov eax, 0xff
jmp 0x140006906
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x1400068b7
test ax, ax
je 0x14000684c
test edx, edx
jne 0x1400068b7
sub ax, bx
cmp ax, di
ja 0x140006862
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x14000684c
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.1400013dc
mov dword [0x14000d3e0], eax
cmp dword [0x14000d400], r14d
jne 0x1400068a0
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14000d3e4], r14d
jne 0x1400068b5
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14000d3e0]
jmp 0x140006906
cmp ax, 0x22
jne 0x1400068cb
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14000683a
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.140158000
add rsp, 0x28
jmp 0x1400066c0
Function at 0x39ac81620
Capabilities:
Access peb ldr_data

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x130
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov r13, qword [rax + 0x20]
lea r14, [rax + 0x20]
mov esi, ecx
cmp r14, r13
je 0x39ac816f9
mov rbp, qword [sym.imp.USER32.dll_CharLowerA]
xor ebx, ebx
mov r12d, 0x104
jmp 0x39ac81675
mov r13, qword [r13]
cmp r14, r13
je 0x39ac816f9
cmp qword [r13 + 0x30], 0
je 0x39ac81668
mov rax, qword [r13 + 0x50]
lea rdi, [rsp + 0x20]
movzx edx, word [rax]
xor eax, eax
test dx, dx
jne 0x39ac816a0
jmp 0x39ac816b4
cmp rax, 0x103
je 0x39ac816b4
mov byte [rdi + rax], dl
mov rdx, qword [r13 + 0x50]
add rax, 1
movzx edx, word [rdx + rax*2]
test dx, dx
jne 0x39ac81698
mov rcx, rdi
mov byte [rsp + rax + 0x20], 0
call rbp
mov edx, 0x641a
lea rcx, [rax + 1]
movsx eax, byte [rax]
test al, al
je 0x39ac816e1
nop
lea eax, [rax + rdx*8]
add rcx, 1
add edx, eax
movsx eax, byte [rcx - 1]
test al, al
jne 0x39ac816d0
cmp esi, edx
je 0x39ac8170d
mov rcx, r12
mov eax, ebx
rep stosb byte [rdi], al
mov r13, qword [r13]
cmp r14, r13
jne 0x39ac81675
xor eax, eax
add rsp, 0x130
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rax, qword [r13 + 0x20]
jmp 0x39ac816fb

Function at 0x39ac81720
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push rbp
push rdi
push rsi
push rbx
xor eax, eax
cmp word [rcx], 0x5a4d
mov r9, rcx
mov r10d, edx
jne 0x39ac817c1
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x39ac817c1
mov edx, dword [rdx + 0x88]
add rdx, rcx
mov r11d, dword [rdx + 0x20]
mov esi, dword [rdx + 0x1c]
mov ebx, dword [rdx + 0x24]
mov edx, dword [rdx + 0x14]
test edx, edx
je 0x39ac817c1
lea rax, [rcx + rbx + 2]
sub edx, 1
lea r8, [rcx + rbx]
sub r11, rcx
lea rdi, [rax + rdx*2]
nop dword [rax + rax]
mov rax, r8
movzx edx, word [r8]
sub rax, rbx
mov eax, dword [r11 + rax*2]
lea rdx, [r9 + rdx*4]
mov ebp, dword [rdx + rsi]
mov edx, 0x641a
add rax, r9
lea rcx, [rax + 1]
movsx eax, byte [rax]
test al, al
je 0x39ac817b1
lea eax, [rax + rdx*8]
add rcx, 1
add edx, eax
movsx eax, byte [rcx - 1]
test al, al
jne 0x39ac817a0
cmp r10d, edx
je 0x39ac817c6
add r8, 2
cmp rdi, r8
jne 0x39ac81778
xor eax, eax
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov eax, ebp
add rax, r9
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x39ac821e0
Capabilities:
Access peb ldr_data
Enumerate pe sections
Parse pe header

Disassembly:
push r14
push r13
push r12
push rbx
sub rsp, 0x38
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x20]
mov rax, qword [rax]
mov r9, rcx
mov rcx, qword [rax + 0x20]
test rcx, rcx
je 0x39ac82228
xor r8d, r8d
cmp word [rcx], 0x5a4d
je 0x39ac82228
mov eax, r8d
add rsp, 0x38
pop rbx
pop r12
pop r13
pop r14
ret
movsxd rdx, dword [rcx + 0x3c]
xor r8d, r8d
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x39ac82215
movzx eax, word [rdx + 0x14]
lea rax, [rdx + rax + 0x18]
movzx edx, word [rdx + 6]
test dx, dx
je 0x39ac82215
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r8, [rax + rdx*8 + 0x28]
jmp 0x39ac8226d
add rax, 0x28
cmp r8, rax
je 0x39ac822f8
mov edx, dword [rax]
or edx, 0x20202020
cmp edx, 0x7865742e
jne 0x39ac82260
mov r13d, dword [rax + 0xc]
mov r14d, dword [rax + 8]
add rcx, r13
sete dl
add r13, r9
mov r12, rcx
sete al
or dl, al
jne 0x39ac822f8
test r14, r14
je 0x39ac822f8
lea rbx, [rsp + 0x2c]
mov dword [rsp + 0x2c], 0
mov r8d, pe_nt_image_headers64
mov rdx, r14
mov r9, rbx
call qword [0x39ad63088]
test eax, eax
je 0x39ac82310
mov r8, r14
mov rdx, r13
mov rcx, r12
call sub.msvcrt.dll_memcpy
mov r8d, dword [rsp + 0x2c]
mov r9, rbx
mov rdx, r14
mov rcx, r12
call qword [0x39ad63088]
test eax, eax
je 0x39ac82310
mov r8d, 1
jmp 0x39ac82215
xor r8d, r8d
mov eax, r8d
add rsp, 0x38
pop rbx
pop r12
pop r13
pop r14
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor r8d, r8d
jmp 0x39ac82215

Function at 0x39ac824f0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
sub rsp, 0x28
xor eax, eax
mov rdx, qword gs:[0x60]
cmp byte [rdx + 2], 1
jne 0x39ac82515
mov ecx, 1
call qword [0x39ad63050]
mov eax, 1
add rsp, 0x28
ret
Function at 0x39ac83080
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x260
mov rbp, qword [rsp + 0x2c0]
lea r12, [rsp + 0x20]
mov rdi, rcx
movsxd rsi, edx
mov edx, 0xa
mov rcx, r12
mov r13, r8
mov r14d, r9d
call fcn.39ac82e10
mov r8, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
cmp r8, rdx
je 0x39ac832c0
mov rax, r8
mov ebx, 0xef
nop word [rax + rax]
add ebx, dword [rax]
add rax, 4
cmp rdx, rax
jne 0x39ac830d8
mov r10d, dword [r8 + 4]
test ebx, ebx
jle 0x39ac83143
xor ecx, ecx
jmp 0x39ac83123
cmp ecx, 2
jle 0x39ac83290
movsxd rax, r10d
mov byte [rsp + rax + 0x160], cl
mov eax, r10d
add r10d, 1
cdq
idiv r14d
movsxd rdx, edx
movzx eax, byte [r13 + rdx]
mov byte [rsp + rcx + 0x60], al
add rcx, 1
cmp ebx, ecx
jle 0x39ac83143
mov eax, ecx
test rcx, rcx
jne 0x39ac830f0
movzx eax, byte [r13]
add rcx, 1
mov byte [rsp + 0x160], 0
mov byte [rsp + 0x60], al
cmp ebx, ecx
jg 0x39ac83123
lea rcx, [rsp + 0x40]
mov edx, 3
call fcn.39ac82e10
mov r12, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov ecx, 0xfb
mov rax, r12
cmp rdx, r12
je 0x39ac8317f
nop dword [rax]
add ecx, dword [rax]
add rax, 4
cmp rdx, rax
jne 0x39ac83170
test ecx, ecx
jle 0x39ac831cd
xor r8d, r8d
xor edx, edx
lea r11, [rsp + 0x60]
lea r10, [rsp + 0x160]
nop dword [rax]
movzx eax, byte [r10 + r8]
mov r9d, eax
add eax, edx
movzx edx, byte [r11 + r8]
add eax, edx
cdq
idiv ebx
movsxd rax, edx
movzx r13d, byte [rsp + rax + 0x160]
mov byte [rsp + rax + 0x160], r9b
mov byte [r10 + r8], r13b
add r8, 1
cmp ecx, r8d
jg 0x39ac83198
xor r8d, r8d
xor r9d, r9d
xor r10d, r10d
test esi, esi
jle 0x39ac83247
nop word [rax + rax]
lea eax, [r9 + 1]
cdq
idiv ecx
movsxd r11, edx
movzx eax, byte [rsp + r11 + 0x160]
mov r9, r11
mov r13d, eax
add eax, r10d
cdq
idiv ebx
movsxd rax, edx
movzx edx, byte [rsp + rax + 0x160]
mov r10, rax
mov byte [rsp + rax + 0x160], r13b
mov byte [rsp + r11 + 0x160], dl
movzx eax, byte [rsp + rax + 0x160]
add eax, edx
cdq
idiv ecx
movsxd rdx, edx
movzx eax, byte [rsp + rdx + 0x160]
xor al, byte [rdi + r8]
mov byte [rbp + r8], al
add r8, 1
cmp rsi, r8
jne 0x39ac831e0
test r12, r12
je 0x39ac8325c
mov rdx, qword [rsp + 0x50]
mov rcx, r12
sub rdx, r12
call fcn.39ad317d0
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x39ac83274
mov rdx, qword [rsp + 0x30]
sub rdx, rcx
call fcn.39ad317d0
nop
add rsp, 0x260
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov edx, dword [r8]
lea r9d, [rdx + rcx - 2]
mov byte [rsp + rcx + 0x160], r9b
lea r9d, [rdx + rcx - 2]
cdq
idiv r14d
movsxd r9, r9d
movsxd rdx, edx
movzx eax, byte [r13 + rdx]
mov byte [rsp + r9 + 0x60], al
jmp 0x39ac8311b
mov r10d, dword [r8 + 4]
mov ebx, 0xef
jmp 0x39ac830eb
Function at 0x39ac834a0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, rdx
mov edx, dword [rdx]
mov rdi, rcx
mov rcx, qword [rcx + 0x9c0]
mov ebp, dword [rbx + 4]
sub ebp, edx
cmp ebp, 0xffffffff
je 0x39ac83558
add ebp, 1
mov eax, 0xffffffff
xor edx, edx
div ebp
imul ebp, eax
mov esi, eax
jmp 0x39ac8351a
mov eax, dword [rdi + rdx*4]
lea rcx, [rdx + 1]
mov qword [rdi + 0x9c0], rcx
mov edx, eax
shr edx, 0xb
xor eax, edx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor eax, edx
mov edx, eax
shl edx, 0xf
and edx, 0xefc60000
xor eax, edx
mov edx, eax
shr edx, 0x12
xor eax, edx
cmp ebp, eax
ja 0x39ac83540
mov rdx, rcx
cmp rcx, 0x26f
jbe 0x39ac834e0
mov rcx, rdi
call fcn.39ad17660
mov rdx, qword [rdi + 0x9c0]
jmp 0x39ac834e0
xor edx, edx
div esi
mov edx, dword [rbx]
add eax, edx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp rcx, 0x26f
ja 0x39ac835a2
lea rax, [rcx + 1]
mov qword [rdi + 0x9c0], rax
mov eax, dword [rdi + rcx*4]
mov ecx, eax
shr ecx, 0xb
xor eax, ecx
mov ecx, eax
shl ecx, 7
and ecx, 0x9d2c5680
xor eax, ecx
mov ecx, eax
shl ecx, 0xf
and ecx, 0xefc60000
xor eax, ecx
mov ecx, eax
shr ecx, 0x12
xor eax, ecx
add eax, edx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, rdi
call fcn.39ad17660
mov rcx, qword [rdi + 0x9c0]
mov edx, dword [rbx]
jmp 0x39ac83561

Function at 0x39ac835c0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push r13
mov eax, 0x13d0
push r12
push rbx
call fcn.39ac8e5f0
sub rsp, rax
lea r8, [0x39ad380e5]
lea rdx, [r8 - 7]
lea r12, [rsp + 0xa00]
lea rbx, [rsp + 0xa10]
mov rcx, r12
lea r13, [rsp + 0x30]
mov qword [rsp + 0xa00], rbx
call fcn.39ac81420
mov rdx, r12
mov rcx, r13
call fcn.39ad0ab20
mov rcx, qword [rsp + 0xa00]
cmp rcx, rbx
je 0x39ac8362b
mov rax, qword [rsp + 0xa10]
lea rdx, [rax + 1]
call fcn.39ad317d0
mov rcx, r13
call fcn.39ad0ac90
mov edx, 1
mov dword [rsp + 0xa00], eax
mov ecx, eax
jmp 0x39ac8364d
mov ecx, dword [r12 + rdx*4 - 4]
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul eax, eax, 0x6c078965
add eax, edx
mov dword [r12 + rdx*4], eax
add rdx, 1
cmp rdx, 0x270
jne 0x39ac83648
mov rcx, r12
lea rdx, [rsp + 0x28]
movabs rax, 0x1000600000001
mov qword [rsp + 0x13c0], 0x270
mov qword [rsp + 0x28], rax
call fcn.39ac834a0
mov r12d, eax
call fcn.39ad32260
lea eax, [r12 + 4]
add rsp, 0x13d0
pop rbx
pop r12
pop r13
ret
Function at 0x39ac836d0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push r13
mov eax, 0x13d0
push r12
push rbx
call fcn.39ac8e5f0
sub rsp, rax
lea r8, [0x39ad380e5]
lea rdx, [r8 - 7]
lea r12, [rsp + 0xa00]
lea rbx, [rsp + 0xa10]
mov rcx, r12
lea r13, [rsp + 0x30]
mov qword [rsp + 0xa00], rbx
call fcn.39ac81420
mov rdx, r12
mov rcx, r13
call fcn.39ad0ab20
mov rcx, qword [rsp + 0xa00]
cmp rcx, rbx
je 0x39ac8373b
mov rax, qword [rsp + 0xa10]
lea rdx, [rax + 1]
call fcn.39ad317d0
mov rcx, r13
call fcn.39ad0ac90
mov edx, 1
mov dword [rsp + 0xa00], eax
mov ecx, eax
jmp 0x39ac8375d
mov ecx, dword [r12 + rdx*4 - 4]
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul eax, eax, 0x6c078965
add eax, edx
mov dword [r12 + rdx*4], eax
add rdx, 1
cmp rdx, 0x270
jne 0x39ac83758
movabs rax, 0xe4300000001
mov rcx, r12
lea rdx, [rsp + 0x28]
mov qword [rsp + 0x13c0], 0x270
mov qword [rsp + 0x28], rax
call fcn.39ac834a0
add eax, 0xc
add rsp, 0x13d0
pop rbx
pop r12
pop r13
ret

Function at 0x39ac837d0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push r13
mov eax, 0x13d0
push r12
push rbx
call fcn.39ac8e5f0
sub rsp, rax
lea r8, [0x39ad380e5]
lea rdx, [r8 - 7]
lea r12, [rsp + 0xa00]
lea rbx, [rsp + 0xa10]
mov rcx, r12
lea r13, [rsp + 0x30]
mov qword [rsp + 0xa00], rbx
call fcn.39ac81420
mov rdx, r12
mov rcx, r13
call fcn.39ad0ab20
mov rcx, qword [rsp + 0xa00]
cmp rcx, rbx
je 0x39ac8383b
mov rax, qword [rsp + 0xa10]
lea rdx, [rax + 1]
call fcn.39ad317d0
mov rcx, r13
call fcn.39ad0ac90
mov edx, 1
mov dword [rsp + 0xa00], eax
mov ecx, eax
jmp 0x39ac8385d
mov ecx, dword [r12 + rdx*4 - 4]
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul eax, eax, 0x6c078965
add eax, edx
mov dword [r12 + rdx*4], eax
add rdx, 1
cmp rdx, 0x270
jne 0x39ac83858
movabs rax, 0xe4300000001
mov rcx, r12
lea rdx, [rsp + 0x28]
mov qword [rsp + 0x13c0], 0x270
mov qword [rsp + 0x28], rax
call fcn.39ac834a0
add eax, 0xb
add rsp, 0x13d0
pop rbx
pop r12
pop r13
ret

Function at 0x39ac838d0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push r13
mov eax, 0x13d0
push r12
push rbx
call fcn.39ac8e5f0
sub rsp, rax
lea r8, [0x39ad380e5]
lea rdx, [r8 - 7]
lea r12, [rsp + 0xa00]
lea rbx, [rsp + 0xa10]
mov rcx, r12
lea r13, [rsp + 0x30]
mov qword [rsp + 0xa00], rbx
call fcn.39ac81420
mov rdx, r12
mov rcx, r13
call fcn.39ad0ab20
mov rcx, qword [rsp + 0xa00]
cmp rcx, rbx
je 0x39ac8393b
mov rax, qword [rsp + 0xa10]
lea rdx, [rax + 1]
call fcn.39ad317d0
mov rcx, r13
call fcn.39ad0ac90
mov edx, 1
mov dword [rsp + 0xa00], eax
mov ecx, eax
jmp 0x39ac8395d
mov ecx, dword [r12 + rdx*4 - 4]
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul eax, eax, 0x6c078965
add eax, edx
mov dword [r12 + rdx*4], eax
add rdx, 1
cmp rdx, 0x270
jne 0x39ac83958
movabs rax, 0xe4300000001
mov rcx, r12
lea rdx, [rsp + 0x28]
mov qword [rsp + 0x13c0], 0x270
mov qword [rsp + 0x28], rax
call fcn.39ac834a0
add eax, 0xa
add rsp, 0x13d0
pop rbx
pop r12
pop r13
ret
Function at 0x39ac839d0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push r13
mov eax, 0x13d0
push r12
push rbx
call fcn.39ac8e5f0
sub rsp, rax
lea r8, [0x39ad380e5]
lea rdx, [r8 - 7]
lea r12, [rsp + 0xa00]
lea rbx, [rsp + 0xa10]
mov rcx, r12
lea r13, [rsp + 0x30]
mov qword [rsp + 0xa00], rbx
call fcn.39ac81420
mov rdx, r12
mov rcx, r13
call fcn.39ad0ab20
mov rcx, qword [rsp + 0xa00]
cmp rcx, rbx
je 0x39ac83a3b
mov rax, qword [rsp + 0xa10]
lea rdx, [rax + 1]
call fcn.39ad317d0
mov rcx, r13
call fcn.39ad0ac90
mov edx, 1
mov dword [rsp + 0xa00], eax
mov ecx, eax
jmp 0x39ac83a5d
mov ecx, dword [r12 + rdx*4 - 4]
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul eax, eax, 0x6c078965
add eax, edx
mov dword [r12 + rdx*4], eax
add rdx, 1
cmp rdx, 0x270
jne 0x39ac83a58
movabs rax, 0xe4300000001
mov rcx, r12
lea rdx, [rsp + 0x28]
mov qword [rsp + 0x13c0], 0x270
mov qword [rsp + 0x28], rax
call fcn.39ac834a0
add eax, 9
add rsp, 0x13d0
pop rbx
pop r12
pop r13
ret

Function at 0x39ac83ad0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push r13
mov eax, 0x13d0
push r12
push rbx
call fcn.39ac8e5f0
sub rsp, rax
lea r8, [0x39ad380e5]
lea rdx, [r8 - 7]
lea r12, [rsp + 0xa00]
lea rbx, [rsp + 0xa10]
mov rcx, r12
lea r13, [rsp + 0x30]
mov qword [rsp + 0xa00], rbx
call fcn.39ac81420
mov rdx, r12
mov rcx, r13
call fcn.39ad0ab20
mov rcx, qword [rsp + 0xa00]
cmp rcx, rbx
je 0x39ac83b3b
mov rax, qword [rsp + 0xa10]
lea rdx, [rax + 1]
call fcn.39ad317d0
mov rcx, r13
call fcn.39ad0ac90
mov edx, 1
mov dword [rsp + 0xa00], eax
mov ecx, eax
jmp 0x39ac83b5d
mov ecx, dword [r12 + rdx*4 - 4]
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul eax, eax, 0x6c078965
add eax, edx
mov dword [r12 + rdx*4], eax
add rdx, 1
cmp rdx, 0x270
jne 0x39ac83b58
movabs rax, 0xe4300000001
mov rcx, r12
lea rdx, [rsp + 0x28]
mov qword [rsp + 0x13c0], 0x270
mov qword [rsp + 0x28], rax
call fcn.39ac834a0
add eax, 8
add rsp, 0x13d0
pop rbx
pop r12
pop r13
ret

Function at 0x39ac83bd0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push r13
mov eax, 0x13d0
push r12
push rbx
call fcn.39ac8e5f0
sub rsp, rax
lea r8, [0x39ad380e5]
lea rdx, [r8 - 7]
lea r12, [rsp + 0xa00]
lea rbx, [rsp + 0xa10]
mov rcx, r12
lea r13, [rsp + 0x30]
mov qword [rsp + 0xa00], rbx
call fcn.39ac81420
mov rdx, r12
mov rcx, r13
call fcn.39ad0ab20
mov rcx, qword [rsp + 0xa00]
cmp rcx, rbx
je 0x39ac83c3b
mov rax, qword [rsp + 0xa10]
lea rdx, [rax + 1]
call fcn.39ad317d0
mov rcx, r13
call fcn.39ad0ac90
mov edx, 1
mov dword [rsp + 0xa00], eax
mov ecx, eax
jmp 0x39ac83c5d
mov ecx, dword [r12 + rdx*4 - 4]
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul eax, eax, 0x6c078965
add eax, edx
mov dword [r12 + rdx*4], eax
add rdx, 1
cmp rdx, 0x270
jne 0x39ac83c58
movabs rax, 0xe4300000001
mov rcx, r12
lea rdx, [rsp + 0x28]
mov qword [rsp + 0x13c0], 0x270
mov qword [rsp + 0x28], rax
call fcn.39ac834a0
add eax, 7
add rsp, 0x13d0
pop rbx
pop r12
pop r13
ret
Function at 0x39ac83cd0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push r13
mov eax, 0x13d0
push r12
push rbx
call fcn.39ac8e5f0
sub rsp, rax
lea r8, [0x39ad380e5]
lea rdx, [r8 - 7]
lea r12, [rsp + 0xa00]
lea rbx, [rsp + 0xa10]
mov rcx, r12
lea r13, [rsp + 0x30]
mov qword [rsp + 0xa00], rbx
call fcn.39ac81420
mov rdx, r12
mov rcx, r13
call fcn.39ad0ab20
mov rcx, qword [rsp + 0xa00]
cmp rcx, rbx
je 0x39ac83d3b
mov rax, qword [rsp + 0xa10]
lea rdx, [rax + 1]
call fcn.39ad317d0
mov rcx, r13
call fcn.39ad0ac90
mov edx, 1
mov dword [rsp + 0xa00], eax
mov ecx, eax
jmp 0x39ac83d5d
mov ecx, dword [r12 + rdx*4 - 4]
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul eax, eax, 0x6c078965
add eax, edx
mov dword [r12 + rdx*4], eax
add rdx, 1
cmp rdx, 0x270
jne 0x39ac83d58
movabs rax, 0xe4300000001
mov rcx, r12
lea rdx, [rsp + 0x28]
mov qword [rsp + 0x13c0], 0x270
mov qword [rsp + 0x28], rax
call fcn.39ac834a0
add eax, 6
add rsp, 0x13d0
pop rbx
pop r12
pop r13
ret

Function at 0x39ac83dd0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push r13
mov eax, 0x13d0
push r12
push rbx
call fcn.39ac8e5f0
sub rsp, rax
lea r8, [0x39ad380e5]
lea rdx, [r8 - 7]
lea r12, [rsp + 0xa00]
lea rbx, [rsp + 0xa10]
mov rcx, r12
lea r13, [rsp + 0x30]
mov qword [rsp + 0xa00], rbx
call fcn.39ac81420
mov rdx, r12
mov rcx, r13
call fcn.39ad0ab20
mov rcx, qword [rsp + 0xa00]
cmp rcx, rbx
je 0x39ac83e3b
mov rax, qword [rsp + 0xa10]
lea rdx, [rax + 1]
call fcn.39ad317d0
mov rcx, r13
call fcn.39ad0ac90
mov edx, 1
mov dword [rsp + 0xa00], eax
mov ecx, eax
jmp 0x39ac83e5d
mov ecx, dword [r12 + rdx*4 - 4]
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul eax, eax, 0x6c078965
add eax, edx
mov dword [r12 + rdx*4], eax
add rdx, 1
cmp rdx, 0x270
jne 0x39ac83e58
movabs rax, 0xe4300000001
mov rcx, r12
lea rdx, [rsp + 0x28]
mov qword [rsp + 0x13c0], 0x270
mov qword [rsp + 0x28], rax
call fcn.39ac834a0
add eax, 5
add rsp, 0x13d0
pop rbx
pop r12
pop r13
ret

Function at 0x39ac83ed0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push r13
mov eax, 0x13d0
push r12
push rbx
call fcn.39ac8e5f0
sub rsp, rax
lea r8, [0x39ad380e5]
lea rdx, [r8 - 7]
lea r12, [rsp + 0xa00]
lea rbx, [rsp + 0xa10]
mov rcx, r12
lea r13, [rsp + 0x30]
mov qword [rsp + 0xa00], rbx
call fcn.39ac81420
mov rdx, r12
mov rcx, r13
call fcn.39ad0ab20
mov rcx, qword [rsp + 0xa00]
cmp rcx, rbx
je 0x39ac83f3b
mov rax, qword [rsp + 0xa10]
lea rdx, [rax + 1]
call fcn.39ad317d0
mov rcx, r13
call fcn.39ad0ac90
mov edx, 1
mov dword [rsp + 0xa00], eax
mov ecx, eax
jmp 0x39ac83f5d
mov ecx, dword [r12 + rdx*4 - 4]
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul eax, eax, 0x6c078965
add eax, edx
mov dword [r12 + rdx*4], eax
add rdx, 1
cmp rdx, 0x270
jne 0x39ac83f58
movabs rax, 0xe4300000001
mov rcx, r12
lea rdx, [rsp + 0x28]
mov qword [rsp + 0x13c0], 0x270
mov qword [rsp + 0x28], rax
call fcn.39ac834a0
add eax, 3
add rsp, 0x13d0
pop rbx
pop r12
pop r13
ret
Function at 0x39ac83fd0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push r13
mov eax, 0x13d0
push r12
push rbx
call fcn.39ac8e5f0
sub rsp, rax
lea r8, [0x39ad380e5]
lea rdx, [r8 - 7]
lea r12, [rsp + 0xa00]
lea rbx, [rsp + 0xa10]
mov rcx, r12
lea r13, [rsp + 0x30]
mov qword [rsp + 0xa00], rbx
call fcn.39ac81420
mov rdx, r12
mov rcx, r13
call fcn.39ad0ab20
mov rcx, qword [rsp + 0xa00]
cmp rcx, rbx
je 0x39ac8403b
mov rax, qword [rsp + 0xa10]
lea rdx, [rax + 1]
call fcn.39ad317d0
mov rcx, r13
call fcn.39ad0ac90
mov edx, 1
mov dword [rsp + 0xa00], eax
mov ecx, eax
jmp 0x39ac8405d
mov ecx, dword [r12 + rdx*4 - 4]
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul eax, eax, 0x6c078965
add eax, edx
mov dword [r12 + rdx*4], eax
add rdx, 1
cmp rdx, 0x270
jne 0x39ac84058
movabs rax, 0xe4300000001
mov rcx, r12
lea rdx, [rsp + 0x28]
mov qword [rsp + 0x13c0], 0x270
mov qword [rsp + 0x28], rax
call fcn.39ac834a0
add eax, 2
add rsp, 0x13d0
pop rbx
pop r12
pop r13
ret

Function at 0x39ac840d0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push r13
mov eax, 0x13d0
push r12
push rbx
call fcn.39ac8e5f0
sub rsp, rax
lea r8, [0x39ad380e5]
lea rdx, [r8 - 7]
lea r12, [rsp + 0xa00]
lea rbx, [rsp + 0xa10]
mov rcx, r12
lea r13, [rsp + 0x30]
mov qword [rsp + 0xa00], rbx
call fcn.39ac81420
mov rdx, r12
mov rcx, r13
call fcn.39ad0ab20
mov rcx, qword [rsp + 0xa00]
cmp rcx, rbx
je 0x39ac8413b
mov rax, qword [rsp + 0xa10]
lea rdx, [rax + 1]
call fcn.39ad317d0
mov rcx, r13
call fcn.39ad0ac90
mov edx, 1
mov dword [rsp + 0xa00], eax
mov ecx, eax
jmp 0x39ac8415d
mov ecx, dword [r12 + rdx*4 - 4]
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul eax, eax, 0x6c078965
add eax, edx
mov dword [r12 + rdx*4], eax
add rdx, 1
cmp rdx, 0x270
jne 0x39ac84158
movabs rax, 0xe4300000001
mov rcx, r12
lea rdx, [rsp + 0x28]
mov qword [rsp + 0x13c0], 0x270
mov qword [rsp + 0x28], rax
call fcn.39ac834a0
add eax, 1
add rsp, 0x13d0
pop rbx
pop r12
pop r13
ret

Function at 0x39ac841d0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push r13
mov eax, 0x13d0
push r12
push rbx
call fcn.39ac8e5f0
sub rsp, rax
lea r8, [0x39ad380e5]
lea rdx, [r8 - 7]
lea r12, [rsp + 0xa00]
lea rbx, [rsp + 0xa10]
mov rcx, r12
lea r13, [rsp + 0x30]
mov qword [rsp + 0xa00], rbx
call fcn.39ac81420
mov rdx, r12
mov rcx, r13
call fcn.39ad0ab20
mov rcx, qword [rsp + 0xa00]
cmp rcx, rbx
je 0x39ac8423b
mov rax, qword [rsp + 0xa10]
lea rdx, [rax + 1]
call fcn.39ad317d0
mov rcx, r13
call fcn.39ad0ac90
mov edx, 1
mov dword [rsp + 0xa00], eax
mov ecx, eax
jmp 0x39ac8425d
mov ecx, dword [r12 + rdx*4 - 4]
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul eax, eax, 0x6c078965
add eax, edx
mov dword [r12 + rdx*4], eax
add rdx, 1
cmp rdx, 0x270
jne 0x39ac84258
movabs rax, 0xe4300000001
mov rcx, r12
lea rdx, [rsp + 0x28]
mov qword [rsp + 0x13c0], 0x270
mov qword [rsp + 0x28], rax
call fcn.39ac834a0
add rsp, 0x13d0
pop rbx
pop r12
pop r13
ret