joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180004450
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [rax - 0x75], cl
je 0x180004479
cmp byte [rbx - 0x7b76ef8a], cl
and al, 0xe0
add dword [rax], eax
add byte [rcx + 0x1dc248c], cl
mov dword [rsp + 0x1dc], ecx
mov qword [rsp + 0xb8], rdx
mov dword [rsp + 0x1d8], esi
mov ah, 0x24
fadd dword [rcx]
add byte [rax], al
mov rax, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0xb8]
movsxd rcx, dword [rcx + 0x3c]
add rax, rcx
and al, 0xb8
add byte [rax], al
add byte [rax - 0x75], cl
mov word [rax + rdi*4], fs
add byte [rax], al
add byte [rax + 0x63], cl
cmp al, 0x48
add eax, ecx
mov qword [rsp + 0x3f8], rax
mov rax, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x3f8]
mov edx, dword [rsp + 0x1d8]
mov ecx, dword [rcx + rdx*8 + 0x88]
add rax, rcx
mov qword [rsp + 0x178], rax
mov rax, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x178]
mov ecx, dword [rcx + 0x24]
add rax, rcx
mov qword [rsp + 0x3f0], rax
mov rax, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x178]
mov ecx, dword [rcx + 0x20]
add rax, rcx
mov qword [rsp + 0x3e8], rax
mov rax, qword [rsp + 0xb8]
add byte [rax], al
mov rcx, qword [rsp + 0x178]
mov ecx, dword [rcx + 0x1c]
add rax, rcx
mov qword [rsp + 0x3e0], rax
mov dword [rsp + 0x68], 0
mov eax, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x178]
cmp eax, dword [rcx + 0x18]
jae 0x1800046af
mov rax, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x3e8]
mov edx, dword [rsp + 0x68]
mov ecx, dword [rcx + rdx*4]
add rax, rcx
mov qword [rsp + 0x3d8], rax
mov rax, qword [rsp + 0x3d8]
mov ecx, dword [rsp + 0x1e0]
mov qword [rsp + 0x330], rax
invalid
invalid

Function at 0x180004500
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [rax - 0x75], cl
je 0x180004479
cmp byte [rbx - 0x7b76ef8a], cl
and al, 0xe0
add dword [rax], eax
add byte [rcx + 0x1dc248c], cl
mov dword [rsp + 0x1dc], ecx
mov qword [rsp + 0xb8], rdx
mov dword [rsp + 0x1d8], esi
mov ah, 0x24
fadd dword [rcx]
add byte [rax], al
mov rax, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0xb8]
movsxd rcx, dword [rcx + 0x3c]
add rax, rcx
and al, 0xb8
add byte [rax], al
add byte [rax - 0x75], cl
mov word [rax + rdi*4], fs
add byte [rax], al
add byte [rax + 0x63], cl
cmp al, 0x48
add eax, ecx
mov qword [rsp + 0x3f8], rax
mov rax, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x3f8]
mov edx, dword [rsp + 0x1d8]
mov ecx, dword [rcx + rdx*8 + 0x88]
add rax, rcx
mov qword [rsp + 0x178], rax
mov rax, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x178]
mov ecx, dword [rcx + 0x24]
add rax, rcx
mov qword [rsp + 0x3f0], rax
mov rax, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x178]
mov ecx, dword [rcx + 0x20]
add rax, rcx
mov qword [rsp + 0x3e8], rax
mov rax, qword [rsp + 0xb8]
add byte [rax], al
mov rcx, qword [rsp + 0x178]
mov ecx, dword [rcx + 0x1c]
add rax, rcx
mov qword [rsp + 0x3e0], rax
mov dword [rsp + 0x68], 0
mov eax, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x178]
cmp eax, dword [rcx + 0x18]
jae 0x1800046af
mov rax, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x3e8]
mov edx, dword [rsp + 0x68]
mov ecx, dword [rcx + rdx*4]
add rax, rcx
mov qword [rsp + 0x3d8], rax
mov rax, qword [rsp + 0x3d8]
mov ecx, dword [rsp + 0x1e0]
mov qword [rsp + 0x330], rax
invalid
invalid
Function at 0x180004650
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add eax, 1
mov dword [rsp + 0xa8], eax
jmp 0x18000459f

Function at 0x18001b630
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xor r9d, r9d
mov r10, rcx
mov ecx, r9d
cmp rdx, 0x20
jb 0x18001b6b7
mov qword [rsp + 0x10], rbx
lea r11, [r8 + 0x10]
mov qword [rsp], rdi
mov rbx, r10
sub rbx, r8
mov edi, 0x10
sub rdi, r8
nop
movdqu xmm1, xmmword [rbx + r11 - 0x10]
add rcx, 0x20
movdqu xmm2, xmmword [rbx + r11]
lea r11, [r11 + 0x20]
movdqa xmm0, xmm1
lea rax, [rdi + r11]
psrlw xmm1, 8
psllw xmm0, 8
pxor xmm0, xmm1
movdqa xmm1, xmm2
psllw xmm1, 8
psrlw xmm2, 8
pxor xmm1, xmm2
movdqu xmmword [r11 - 0x30], xmm0
movdqu xmmword [r11 - 0x20], xmm1
cmp rax, rdx
jbe 0x18001b660
mov rdi, qword [rsp]
mov rbx, qword [rsp + 0x10]
lea rax, [rcx + 0x10]
cmp rax, rdx
ja 0x18001b6e1
movdqu xmm1, xmmword [rcx + r10]
movdqa xmm0, xmm1
psrlw xmm1, 8
psllw xmm0, 8
pxor xmm0, xmm1
movdqu xmmword [rcx + r8], xmm0
mov rcx, rax
cmp rcx, rdx
jae 0x18001b715
lea rax, [rcx + r8]
sub r10, r8
nop dword [rax]
cmp r9, 0x10
jae 0x18001b715
movzx ecx, word [rax + r10]
add r9, 2
rol cx, 8
mov word [rax], cx
add rax, 2
mov rcx, rax
sub rcx, r8
cmp rcx, rdx
jb 0x18001b6f0
mov rax, rdx
add rsp, 8
ret

Function at 0x18001c620
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rcx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx edx, word [rsp + 0x20]
sub edx, 6
je 0x18001c67e
sub edx, 3
je 0x18001c663
cmp edx, 1
je 0x18001c67e
mov rdx, rbx
mov byte [rsp + 0x68], 0
lea rcx, [rsp + 0x68]
call fcn.18001c040
mov rax, rbx
add rsp, 0x50
pop rbx
ret
mov rdx, rbx
mov byte [rsp + 0x68], 0
lea rcx, [rsp + 0x68]
call fcn.18001c100
mov rax, rbx
add rsp, 0x50
pop rbx
ret
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.18001bed0
mov rax, rbx
add rsp, 0x50
pop rbx
ret
Function at 0x18001cd70
Capabilities:
Get hostname
Initialize winsock library

Disassembly:
push rbx
sub rsp, 0x400
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x1805858b8]
xor rax, rsp
mov qword [rsp + 0x3f0], rax
mov rbx, rcx
mov qword [rsp + 0x20], rcx
mov eax, dword [0x180588630]
cmp eax, 0xfffffffe
jle 0x18001cdce
mov ecx, dword [0x18058f148]
mov rax, qword gs:[0x58]
mov edx, 8
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x180588648], ecx
jg 0x18001ce6e
mov edx, 0x200
lea rcx, [rsp + 0x1f0]
call sub.WS2_32.dll_gethostname
cmp eax, 0xffffffff
jne 0x18001cdf1
lea rax, sym.Qt5Core.dll_struct_QArrayData_const__const_const_QArrayData::shared_null
mov qword [rbx], rax
jmp 0x18001ce2a
mov byte [rsp + 0x3ef], 0
lea rax, [rsp + 0x1f0]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x18001ce10
lea rdx, [rsp + 0x1f0]
mov rcx, rbx
call sym.Qt5Core.dll_private:_static_class_QString___cdecl_QString::fromLocal8Bit_helper_char_const____ptr64__int_
mov rax, rbx
mov rcx, qword [rsp + 0x3f0]
xor rcx, rsp
call fcn.1802e1ba0
add rsp, 0x400
pop rbx
ret
mov dword [0x180588630], 0xffffffff
lea rcx, [0x1802f7010]
call fcn.1802e2070
nop
lea rcx, [0x180588648]
call fcn.1802e2240
jmp 0x18001cdce
lea rcx, [0x180588648]
call fcn.1802e22a0
cmp dword [0x180588648], 0xffffffff
jne 0x18001cdce
mov dword [0x180588644], 0
mov ecx, 2
lea rdx, [rsp + 0x50]
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x18001ced8
mov qword [rsp + 0x28], 2
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
lea rax, [0x1802fa000]
mov qword [rsp + 0x40], rax
lea rdx, str.QTcpSocketAPI:_WinSock_v2.0_initialization_failed.
lea rcx, [rsp + 0x28]
call sym.Qt5Core.dll_public:_void___cdecl_QMessageLogger::warning_char_const____ptr64_const___ptr64
jmp 0x18001ce46
mov dword [0x180588644], 0x20
jmp 0x18001ce46
Function at 0x18001cef0
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0xb0
mov rax, qword [0x1805858b8]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x38], rcx
lea rax, [rsp + 0x38]
mov rdi, rcx
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x38], 0
mov r9d, 0x20119
lea rdx, str.SOFTWAREMicrosoftCryptography
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18001cfd2
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, str.MachineGuid
lea rax, [rsp + 0x50]
mov qword [rsp + 0xc8], rbx
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x30], 0x4a
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
mov rbx, qword [rsp + 0xc8]
jne 0x18001cfd2
mov edx, dword [rsp + 0x30]
lea rax, [rsp + 0x50]
dec edx
mov qword [rsp + 0x48], rax
shr rdx, 1
mov rcx, rdi
mov qword [rsp + 0x40], rdx
lea rdx, [rsp + 0x40]
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call sym.Qt5Core.dll_class_QByteArray___cdecl_QtPrivate::convertToLatin1_class_QStringView_
jmp 0x18001cfdc
lea rax, sym.Qt5Core.dll_struct_QArrayData_const__const_const_QArrayData::shared_null
mov qword [rdi], rax
mov rax, rdi
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1802e1ba0
add rsp, 0xb0
pop rdi
ret
Function at 0x180022e50
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
sub rsp, 0x70
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rbx, rcx
call rdx
movzx edx, byte [rax + 0x12]
test dl, dl
je 0x180022f4d
mov dword [rsp + 0x48], 2
mov rdx, qword [rbx + 0x18]
mov qword [rsp + 0x60], rdx
mov rdx, qword [rbx + 8]
mov qword [rsp + 0x50], rdx
mov ecx, dword [rbx + 4]
mov dword [rsp + 0x4c], ecx
mov rcx, qword [rbx + 0x10]
mov qword [rsp + 0x58], rcx
mov rax, qword [rax + 8]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x98]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x90]
lea r8, [rsp + 0x48]
mov edx, 2
lea rcx, [rsp + 0x30]
call fcn.1800252f0
nop
mov ecx, dword [0x18058f148]
mov rax, qword gs:[0x58]
mov edx, 8
mov rcx, qword [rax + rcx*8]
mov eax, dword [rdx + rcx]
cmp dword [0x180588a90], eax
jg 0x180022f68
mov eax, dword [0x180588a8c]
mov edx, 0xffffffff
test eax, eax
je 0x180022f1c
mov eax, edx
lock xadd dword [0x180588a8c], eax
cmp eax, 1
je 0x180022f53
mov rax, qword [rsp + 0x30]
mov ecx, dword [rax]
test ecx, ecx
je 0x180022f3a
cmp ecx, 0xffffffff
je 0x180022f4d
mov rax, qword [rsp + 0x30]
lock xadd dword [rax], edx
cmp edx, 1
jne 0x180022f4d
mov edx, 2
lea r8d, [rdx + 6]
mov rcx, qword [rsp + 0x30]
call sym.Qt5Core.dll_public:_static_void___cdecl_QArrayData::deallocate_struct_QArrayData____ptr64__unsigned_long_long_unsigned___int64___unsigned_long_long_unsigned___int64__
add rsp, 0x70
pop rbx
ret
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x48]
mov ecx, 2
call fcn.180025360
int3
lea rcx, [0x180588a90]
call fcn.1802e22a0
cmp dword [0x180588a90], 0xffffffff
jne 0x180022efe
lea rcx, str.QT_FATAL_CRITICALS
call fcn.1800229e0
mov dword [0x180588a8c], eax
lea rcx, [0x180588a90]
call fcn.1802e2240
jmp 0x180022efe
Function at 0x180026980
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
sub rsp, 0x70
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rbx, rcx
call rdx
movzx edx, byte [rax + 0x11]
test dl, dl
je 0x180026a7d
mov dword [rsp + 0x48], 2
mov rdx, qword [rbx + 0x18]
mov qword [rsp + 0x60], rdx
mov rdx, qword [rbx + 8]
mov qword [rsp + 0x50], rdx
mov ecx, dword [rbx + 4]
mov dword [rsp + 0x4c], ecx
mov rcx, qword [rbx + 0x10]
mov qword [rsp + 0x58], rcx
mov rax, qword [rax + 8]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x98]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x90]
lea r8, [rsp + 0x48]
mov edx, 1
lea rcx, [rsp + 0x30]
call fcn.1800252f0
nop
mov ecx, dword [0x18058f148]
mov rax, qword gs:[0x58]
mov edx, 8
mov rcx, qword [rax + rcx*8]
mov eax, dword [rdx + rcx]
cmp dword [0x180588a98], eax
jg 0x180026a98
mov eax, dword [0x180588a94]
mov edx, 0xffffffff
test eax, eax
je 0x180026a4c
mov eax, edx
lock xadd dword [0x180588a94], eax
cmp eax, 1
je 0x180026a83
mov rax, qword [rsp + 0x30]
mov ecx, dword [rax]
test ecx, ecx
je 0x180026a6a
cmp ecx, 0xffffffff
je 0x180026a7d
mov rax, qword [rsp + 0x30]
lock xadd dword [rax], edx
cmp edx, 1
jne 0x180026a7d
mov edx, 2
lea r8d, [rdx + 6]
mov rcx, qword [rsp + 0x30]
call sym.Qt5Core.dll_public:_static_void___cdecl_QArrayData::deallocate_struct_QArrayData____ptr64__unsigned_long_long_unsigned___int64___unsigned_long_long_unsigned___int64__
add rsp, 0x70
pop rbx
ret
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x48]
mov ecx, 1
call fcn.180025360
int3
lea rcx, [0x180588a98]
call fcn.1802e22a0
cmp dword [0x180588a98], 0xffffffff
jne 0x180026a2e
lea rcx, str.QT_FATAL_WARNINGS
call fcn.1800229e0
mov dword [0x180588a94], eax
lea rcx, [0x180588a98]
call fcn.1802e2240
jmp 0x180026a2e
Function at 0x180026bf0
Capabilities:
Print debug messages

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x58
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov r15, rcx
lea rbx, [0x180588b80]
mov qword [rsp + 0x38], rbx
mov esi, 1
xor eax, eax
lock cmpxchg qword [0x180588b80], rsi
je 0x180026c33
mov rcx, rbx
call sym.Qt5Core.dll_private:_void___cdecl_QBasicMutex::lockInternal_void____ptr64
mov byte [rsp + 0x40], sil
mov r12, qword [r15]
xor edi, edi
mov r14d, 0x7ffe
cmp r12d, r14d
jg 0x180026c57
mov rcx, qword [r15 + 8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x180026d6d
mov ecx, 0xfffe
call fcn.1802e2554
mov rbx, rax
test r12d, r12d
jle 0x180026d5e
mov r13, qword [r15 + 8]
mov qword [rsp + 0xb8], rdi
mov qword [rsp + 0xa8], rdi
mov qword [rsp + 0x20], rdi
mov rsi, rdi
mov edi, r12d
lea ecx, [r12 - 1]
mov eax, 0x40011
mul ecx
sub ecx, edx
shr ecx, 1
lea ebp, [rdx + rcx]
shr ebp, 0xe
inc ebp
mov eax, edi
cmp edi, r14d
cmovg eax, r14d
mov qword [rsp + 0xa0], rsi
movsxd r8, eax
add r8, rsi
mov qword [rsp + 0xb0], r8
lea r10, [rsp + 0xa0]
cmp r12, rsi
cmovl r10, r15
mov r9, qword [r10]
lea rdx, [rsp + 0xa8]
test r9, r9
cmovg rdx, r10
lea rcx, [rsp + 0xb0]
cmp r12, r8
cmovl rcx, r15
lea rax, [rsp + 0xb8]
cmp qword [rcx], 0
cmovg rax, rcx
mov r14, qword [rax]
sub r14, qword [rdx]
lea rax, [rsp + 0x20]
test r9, r9
cmovg rax, r10
mov rax, qword [rax]
lea rdx, [rax*2]
add rdx, r13
je 0x180026d31
lea r8, [r14 + r14]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
movsxd rax, r14d
xor ecx, ecx
mov word [rbx + rax*2], cx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov r14d, 0x7ffe
sub edi, r14d
add rsi, r14
sub rbp, 1
jne 0x180026ca4
xor edi, edi
lea esi, [rbp + 1]
mov rcx, rbx
call fcn.1802e1b04
lea rbx, [0x180588b80]
mov rax, rsi
lock cmpxchg qword [0x180588b80], rdi
je 0x180026d83
mov rcx, rbx
call sym.Qt5Core.dll_private:_void___cdecl_QBasicMutex::unlockInternal_void____ptr64
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x180026da0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x9f0
mov rax, qword [0x1805858b8]
xor rax, rsp
mov qword [rsp + 0x9e0], rax
mov rbx, rcx
mov dword [rcx + 0x1384], 0xffffffff
mov ecx, 0x1571
mov r10, rdx
mov edx, 1
mov r9d, 0x26f
mov dword [rbx + 4], ecx
lea r8, [rbx + 8]
mov eax, ecx
lea r8, [r8 + 4]
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, edx
inc edx
mov dword [r8 - 4], ecx
sub r9, 1
jne 0x180026de2
lea r8, [rsp + 0x9e0]
mov dword [rbx], 0x270
lea rdx, [rsp + 0x20]
mov rcx, r10
call fcn.1800270b0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r10, rbx
lea r9, [rsp + 0x20]
mov r8d, edx
sub r10, rcx
nop dword [rax]
nop word [rax + rax]
mov eax, dword [r9]
mov ecx, eax
mov dword [r10 + r9 + 4], eax
lea r9, [r9 + 4]
or ecx, edx
mov edx, eax
shr edx, 0x1f
test r8d, r8d
cmovne edx, ecx
inc r8d
cmp r8d, 0x270
jb 0x180026e40
mov rax, rbx
test edx, edx
jne 0x180026e75
mov dword [rbx + 4], 0xffffffff
mov dword [rbx], 0x270
mov rcx, qword [rsp + 0x9e0]
xor rcx, rsp
call fcn.1802e1ba0
add rsp, 0x9f0
pop rbx
ret
Function at 0x1800270b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rcx
push rsi
sub rsp, 0x30
sub r8, rdx
mov rsi, rdx
sar r8, 2
test r8, r8
je 0x1800272a6
mov r9, qword [rcx + 8]
sub r9, qword [rcx]
sar r9, 2
mov qword [rsp + 0x20], rdi
mov qword [rsp + 8], r14
cmp r8, 0x26f
jb 0x1800270f2
mov eax, 0xb
jmp 0x180027120
cmp r8, 0x44
jb 0x1800270ff
mov eax, 7
jmp 0x180027120
cmp r8, 0x27
jb 0x18002710c
mov eax, 5
jmp 0x180027120
cmp r8, 7
jb 0x180027119
mov eax, 3
jmp 0x180027120
lea rax, [r8 - 1]
shr rax, 1
mov r11, r8
lea r14, [r9 + 1]
sub r11, rax
shr r11, 1
lea rdx, [r11 + rax]
mov qword [rsp + 0x48], rdx
cmp r8, r9
jbe 0x18002713e
mov r14, r8
mov qword [rsp + 0x50], rbx
mov eax, 0x8b8b8b8b
mov qword [rsp + 0x28], rbp
mov rdi, rsi
mov rcx, r8
mov qword [rsp + 0x18], r12
rep stosd dword [rdi], eax
xor edi, edi
mov qword [rsp], r15
test r14, r14
je 0x18002720f
mov qword [rsp + 0x10], r13
nop
xor edx, edx
lea rax, [rdi + r11]
div r8
mov r12d, dword [rsi + rdx*4]
lea r15, [rsi + rdx*4]
xor edx, edx
mov rax, rdi
div r8
lea r13, [rsi + rdx*4]
mov r10, rdx
lea rax, [rdi - 1]
xor edx, edx
div r8
mov ecx, dword [rsi + rdx*4]
xor ecx, r12d
xor ecx, dword [r13]
mov eax, ecx
shr eax, 0x1b
xor eax, ecx
imul ebx, eax, 0x19660d
test rdi, rdi
jne 0x1800271ba
mov rax, r9
jmp 0x1800271db
cmp rdi, r9
ja 0x1800271d8
xor edx, edx
lea rax, [rdi - 1]
div r9
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov eax, dword [rax + rdx*4]
add rax, r10
jmp 0x1800271db
mov rax, r10
lea ecx, [rax + rbx]
xor edx, edx
lea eax, [r12 + rbx]
mov dword [r15], eax
mov rax, qword [rsp + 0x48]
add rax, rdi
inc rdi
div r8
add dword [rsi + rdx*4], ecx
mov dword [r13], ecx
cmp rdi, r14
jb 0x180027170
mov rdx, qword [rsp + 0x48]
mov r13, qword [rsp + 0x10]
add r14, r8
cmp rdi, r14
jae 0x180027289
lea rbp, [rdi - 1]
lea r15, [r11 + 1]
lea r12, [rdx + 1]
xor edx, edx
lea rax, [r15 + rbp]
div r8
mov r10d, dword [rsi + rdx*4]
lea r11, [rsi + rdx*4]
xor edx, edx
lea rbx, [rbp + 1]
mov rax, rbx
div r8
mov rax, rbp
mov r9, rdx
xor edx, edx
div r8
mov ecx, dword [rsi + rdx*4]
xor edx, edx
add ecx, dword [rsi + r9*4]
add ecx, r10d
mov eax, ecx
shr eax, 0x1b
xor eax, ecx
imul ecx, eax, 0x5d588b65
lea rax, [r12 + rbp]
div r8
lea rax, [rbx + 1]
mov rbp, rbx
xor r10d, ecx
mov edi, ecx
sub edi, r9d
mov dword [r11], r10d
xor dword [rsi + rdx*4], edi
mov dword [rsi + r9*4], edi
cmp rax, r14
jb 0x180027223
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x28]
mov r15, qword [rsp]
mov rdi, qword [rsp + 0x20]
mov r14, qword [rsp + 8]
add rsp, 0x30
pop rsi
ret
Function at 0x1800277b0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x270
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x180027811
lea r8, [r10 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x1800277d0
mov ecx, dword [r10]
jmp 0x1800278fa
cmp ecx, 0x4e0
jb 0x1800278fa
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0xe3
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x180027830
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop word [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x180027880
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x180027940
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbx
push rbp
push rdi
push r14
sub rsp, 0x28
mov ebx, dword [rcx]
mov rbp, r8
mov rdi, rdx
mov r14, rcx
call fcn.180027f50
test ebx, ebx
je 0x180027a11
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], r12
mov r12d, 1
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x20], r15
lea r15, [rax + 0x40]
cmp r14, r15
jne 0x18002799b
call fcn.180027f50
mov rcx, rax
xor eax, eax
lock cmpxchg qword [rcx], r12
je 0x18002799b
call sym.Qt5Core.dll_private:_void___cdecl_QBasicMutex::lockInternal_void____ptr64
xor r13d, r13d
mov rsi, rbp
sub rsi, rdi
mov ebx, r13d
add rsi, 3
shr rsi, 2
cmp rdi, rbp
cmova rsi, r13
test rsi, rsi
je 0x1800279d7
nop dword [rax + rax]
lea rcx, [r14 + 4]
call fcn.1800277b0
inc rbx
mov dword [rdi], eax
lea rdi, [rdi + 4]
cmp rbx, rsi
jne 0x1800279c0
mov rsi, qword [rsp + 0x58]
cmp r14, r15
mov r15, qword [rsp + 0x20]
jne 0x1800279fd
call fcn.180027f50
mov rcx, rax
mov rax, r12
lock cmpxchg qword [rcx], r13
je 0x1800279fd
call sym.Qt5Core.dll_private:_void___cdecl_QBasicMutex::unlockInternal_void____ptr64
mov r12, qword [rsp + 0x60]
mov r13, qword [rsp + 0x68]
add rsp, 0x28
pop r14
pop rdi
pop rbp
pop rbx
ret
lea rcx, [rax + 0xc]
mov r8, rbp
mov rdx, rdi
add rsp, 0x28
pop r14
pop rdi
pop rbp
pop rbx
jmp fcn.180027c80

Function at 0x180027a80
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rdi
mov rdi, rdx
mov r11, rcx
test rdx, rdx
je 0x180027be7
mov eax, dword [rcx]
mov qword [rsp + 0x10], rbx
cmp eax, 0x270
jne 0x180027af4
lea rax, [r11 + 8]
mov r9d, 0x270
nop dword [rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x180027ab0
mov eax, dword [r11]
jmp 0x180027bd3
cmp eax, 0x4e0
jb 0x180027bd3
lea r10, [r11 + 0x9c4]
mov ebx, 0xe3
mov eax, dword [r10]
nop
mov edx, dword [r10 + 4]
lea r8, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 - 0x9c0], ecx
lea r10, [r8]
sub rbx, 1
jne 0x180027b10
lea r10, [r11 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r10]
nop dword [rax + rax]
mov edx, eax
lea r8, [r10 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd4c]
xor ecx, edx
mov dword [r10 - 0x9c0], ecx
lea r10, [r8]
sub rbx, 1
jne 0x180027b60
mov edx, dword [r11 + 0x1380]
xor edx, dword [r11 + 4]
btr edx, 0x1f
xor edx, dword [r11 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 + 0x9c0], ecx
xor eax, eax
inc eax
mov dword [r11], eax
sub rdi, 1
jne 0x180027a98
mov rbx, qword [rsp + 0x10]
pop rdi
ret