joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14033c7d0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push r12
push r13
sub rsp, 0x78
mov rax, qword [0x140526598]
xor rax, rsp
mov qword [rsp + 0x50], rax
movzx eax, byte [rcx]
mov r13, r8
cmp al, byte [0x1403d4bac]
mov r12, rdx
jne 0x14033c80b
movzx eax, byte [rcx + 1]
cmp al, byte [0x1403d4bad]
jne 0x14033c80b
xor eax, eax
jmp 0x14033c810
sbb eax, eax
or eax, 1
mov qword [rsp + 0xb8], rsi
lea rbx, str._dev_stdin
test eax, eax
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x68], r14
lea rdx, [0x1404d42fc]
cmovne rbx, rcx
mov qword [rsp + 0x60], r15
mov rcx, rbx
call fcn.14036d6a8
mov rbp, rax
test rax, rax
je 0x14033c919
lea rdx, [rsp + 0x20]
mov rcx, rbx
mov edi, 0x1000
call fcn.14036edd4
test eax, eax
jne 0x14033c87a
mov eax, 0x8000
test word [rsp + 0x26], ax
je 0x14033c87a
mov eax, dword [rsp + 0x34]
inc eax
movsxd rdi, eax
lea rcx, [rdi + 1]
call fcn.140369f54
mov rsi, rax
test rax, rax
je 0x14033c911
mov r9, rbp
mov r8, rdi
mov edx, 1
mov rcx, rax
call fcn.14036cbf8
mov r15, rax
mov byte [rax + rsi], 0
cmp rax, rdi
jne 0x14033c8f1
nop
add rdi, rdi
mov rcx, rsi
lea rdx, [rdi + 1]
call fcn.140369d58
mov r14, rax
test rax, rax
je 0x14033c909
mov rbx, rdi
lea rcx, [rax + r15]
shr rbx, 1
mov r9, rbp
mov r8, rbx
mov edx, 1
mov rsi, rax
call fcn.14036cbf8
add r15, rax
mov byte [rsi + r15], 0
cmp rax, rbx
je 0x14033c8b0
mov rcx, rbp
call fcn.14036c3f0
lea rax, [r15 + 1]
mov qword [r12], rsi
mov qword [r13], rax
xor eax, eax
jmp 0x14033c91e
mov rcx, rsi
call fcn.140369ab4
mov rcx, rbp
call fcn.14036c3f0
mov eax, 0xffffffff
mov r15, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140343400
add rsp, 0x78
pop r13
pop r12
pop rbp
pop rbx
ret

Function at 0x140346ee8
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x140346efb
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.140347508
lea rdx, [0x14051dde8]
lea rcx, [rsp + 0x20]
call fcn.1403628d0
int3

Function at 0x140351748
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x140535c08]
xor edx, edx
jmp fcn.140346ee8

Function at 0x1403520c4
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x140535c08]
jmp fcn.140346ee8

Function at 0x14035dcd8
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x14035dd94]
mov r9, qword [r9 + 8]
jmp fcn.14034f100

Function at 0x14035dd6c
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x14035dda4]
mov r9, qword [r9 + 8]
jmp fcn.14034f100

Function at 0x14036f884
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14036f6b0
Function at 0x140375784
Capabilities:
Delete directory

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x1403757a4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140369a10
or eax, 0xffffffff
jmp 0x1403757a6
xor eax, eax
add rsp, 0x28
ret
Function at 0x1401cf340
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x1401cf39d
lea rbx, [0x140329d90]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x1401cf384
cmp r10, 2
jb 0x1401cf384
cmp byte [r9], r8b
jne 0x1401cf384
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x1401cf360
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x1401cf3df
lea rbx, [0x140329d90]
cmp r8b, 0x23
jne 0x1401cf3c3
cmp byte [r9], r8b
jne 0x1401cf3c3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x1401cf3b0
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x1401cf520
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x1401cf53a
mov qword [r8], 0
lea rdx, [0x1403298f8]
call fcn.1401cf3f0
mov rbx, rax
test rax, rax
jne 0x1401cf55a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x1401cf633
xor edx, edx
mov r8d, 2
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1401cf633
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x1401cf633
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1401cf633
cmp rdi, 0xffffffffffffffff
je 0x1401cf633
mov rax, qword [0x140455660]
test rax, rax
je 0x1401cf5d0
inc dword [rax + 0xf4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x1401cf633
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x1401cf620
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x140455660]
test rax, rax
je 0x1401cf615
dec dword [rax + 0xf4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1401cf63c
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x1401cf62e
mov qword [r14], rdi
mov rax, rsi
jmp 0x1401cf63e
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x1401d26b0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov r11, rcx
lea rdi, [0x140329d90]
movsxd rcx, dword [rcx + 0xf0]
mov r10d, edx
shr r10d, 0x18
mov r8d, edx
shr r8d, 8
mov r9d, edx
mov rax, qword [r11 + 0xf8]
shr r9d, 0x10
mov ebx, dword [rax + rcx*4 - 4]
not ebx
movzx eax, dl
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, r8b
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, r9b
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rcx, r10
shr ebx, 8
xor ebx, dword [rdi + rcx*4]
mov rcx, qword [r11]
not ebx
cmp dword [rcx + 0x3f38], ebx
jne 0x1401d2744
movsxd r8, edx
mov ecx, ebx
mov edx, 4
call fcn.1401e5150
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1401d2760
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
movss xmm0, dword [rcx + 0x110]
lea r10, [0x140329d90]
mov rax, qword [rcx + 0xf8]
movss xmm1, dword [rcx + 0x114]
movss xmm2, dword [rdx]
movss xmm4, dword [rdx + 8]
subss xmm2, xmm0
movss xmm3, dword [rdx + 4]
subss xmm4, xmm0
movss xmm0, dword [rdx + 0xc]
subss xmm3, xmm1
movsxd rcx, dword [rcx + 0xf0]
subss xmm0, xmm1
movd r8d, xmm2
movss dword [rsp], xmm2
mov r9d, dword [rax + rcx*4 - 4]
movzx eax, byte [rsp]
not r9d
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
movss dword [rsp + 4], xmm3
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
movss dword [rsp + 8], xmm4
movss dword [rsp + 0xc], xmm0
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 4]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm3
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 8]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm4
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
shr eax, 8
movzx edx, al
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
mov eax, r8d
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 0xc]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm0
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
shr r8, 0x18
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx edx, r9b
shr r9d, 8
xor r8, rdx
xor r9d, dword [r10 + r8*4]
not r9d
mov eax, r9d
add rsp, 0x18
ret
Function at 0x1401dedf0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x14038c0c0]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x140455660]
mov edi, ecx
cmp byte [rbx + 0x4a7d], 0
jne 0x1401dee51
cmp byte [rbx + 0x4a7e], 0
jne 0x1401dee51
movsx r9d, word [rbx + 0x5b8a]
lea r8, str.Tooltip__02d
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
call fcn.1401cf1a0
test dil, 1
je 0x1401def7f
jmp 0x1401deedc
movss xmm1, dword [rbx + 0x38bc]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x5b8a]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x14036ea94]
mov edx, reloc.WS2_32.dll_recv
mulss xmm1, dword [0x14036ea78]
addss xmm0, dword [rbx + 0xe08]
addss xmm1, dword [rbx + 0xe0c]
mov qword [rbx + 0x47e0], rax
mov dword [rbx + 0x47cc], 1
movss dword [rbx + 0x47d8], xmm0
movss dword [rbx + 0x47dc], xmm1
movss xmm0, dword [rbx + 0x3924]
mulss xmm0, dword [0x14036e9f4]
or dword [rbx + 0x47c8], 0x41
movss dword [rbx + 0x4828], xmm0
call fcn.1401cf1a0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x1401def30
lea r11, [0x140329d90]
nop dword [rax]
cmp r9b, 0x23
jne 0x1401def13
cmp byte [r8], r9b
jne 0x1401def13
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x1401def00
not ecx
call fcn.1401d6660
test rax, rax
je 0x1401def7f
cmp byte [rax + 0xb6], 0
je 0x1401def7f
mov byte [rax + 0xbb], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xbd], 1
lea rcx, [rsp + 0x20]
mov byte [rax + 0xd8], 1
mov edx, reloc.WS2_32.dll_recv
inc word [rbx + 0x5b8a]
movsx r9d, word [rbx + 0x5b8a]
call fcn.1401cf1a0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.1401d8d60
mov al, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1402f73e0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x1401e3aa0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5c70], 0
lea rbx, [rcx + 0x5c78]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x1401e3b47
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x1401e3afa
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.1401e5dc0
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.1401cfa40
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5c70]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5c80]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x140455658]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x1401e3b4f
mov rcx, rbx
call fcn.1401cfa40
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x1401e3ee0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x140455660]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x1401e3f43
mov qword [rsp], rbx
lea rbx, [0x140329d90]
nop dword [rax]
cmp r9b, 0x23
jne 0x1401e3f23
cmp byte [r8], r9b
jne 0x1401e3f23
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x1401e3f10
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5be8]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x1401e3f77
mov r10, qword [r10 + 0x5bf0]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x1401e3f7e
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x1401e3f64
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret
Function at 0x1401fe800
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x13d0
call fcn.1402f8180
sub rsp, rax
mov rax, qword [0x14038c0c0]
xor rax, rsp
mov qword [rsp + 0x13c0], rax
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov edi, 1
mov dword [rsp + 0x13b4], 0xffffffff
mov dword [rsp + 0x34], eax
mov edx, edi
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rsp + rdx*4 + 0x34], eax
inc rdx
cmp rdx, 0x270
jb 0x1401fe841
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x270
call fcn.140201e30
mov ecx, eax
imul rbx, rcx, 0x385
cmp ebx, 0x132
ja 0x1401fe89e
lea rcx, [rsp + 0x30]
call fcn.140201e30
mov ecx, eax
imul rbx, rcx, 0x385
cmp ebx, 0x133
jb 0x1401fe883
shr rbx, 0x20
lea rcx, [rsp + 0x20]
sub rbx, 0x7fffff9c
call fcn.1401fe720
xor rbx, 0xffffffff80000000
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x20], rax
je 0x1401fe901
imul rdx, rbx, 0xf4240
movabs r9, 0x7fffffffffffffff
mov rcx, r9
sub rcx, rdx
cmp rax, rcx
je 0x1401fe8fc
mov r8d, 0xff
cmovl edi, r8d
test dil, dil
jns 0x1401fe8fc
lea rcx, [rdx + rax]
mov qword [rsp + 0x20], rcx
jmp 0x1401fe901
mov qword [rsp + 0x20], r9
lea rcx, [rsp + 0x20]
call fcn.140201d50
mov rcx, qword [rsp + 0x13c0]
xor rcx, rsp
call fcn.1402f73e0
mov rbx, qword [rsp + 0x13e0]
add rsp, 0x13d0
pop rdi
ret

Function at 0x1401fed10
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x2160
call fcn.1402f8180
sub rsp, rax
mov rax, qword [0x14038c0c0]
xor rax, rsp
mov qword [rsp + 0x2150], rax
lea rax, str.dbghelp.dll
mov qword [rsp + 0x28], rax
lea rax, str.dbgcore.dll
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9, [rsp + 0x20]
mov r8d, 0x2000
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x1401fede0
xor edi, edi
test dword [rsp + 0x20], 0xfffffff8
jbe 0x1401fede0
nop dword [rax]
mov rbx, qword [rsp + rdi*8 + 0x40]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x104
lea r8, [rsp + 0x2040]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameA]
test eax, eax
je 0x1401fedd3
lea rbx, [rsp + 0x28]
nop
mov rdx, qword [rbx]
lea rcx, [rsp + 0x2040]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x1401fee03
add rbx, 8
lea rax, [rsp + 0x38]
cmp rbx, rax
jne 0x1401fedb0
mov eax, dword [rsp + 0x20]
inc edi
shr eax, 3
cmp edi, eax
jb 0x1401fed80
xor al, al
mov rcx, qword [rsp + 0x2150]
xor rcx, rsp
call fcn.1402f73e0
mov rbx, qword [rsp + 0x2170]
add rsp, 0x2160
pop rdi
ret
mov al, 1
jmp 0x1401fede2
Function at 0x140201470
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [rcx + 0x1384], 0xffffffff
lea r9, [rcx + 8]
mov dword [rcx + 4], edx
mov r8d, 1
nop word [rax + rax]
mov eax, edx
lea r9, [r9 + 4]
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, r8d
inc r8
mov dword [r9 - 4], edx
cmp r8, 0x270
jb 0x140201490
mov dword [rcx], 0x270
mov rax, rcx
ret

Function at 0x140201e30
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x140201e91
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x140201e50
mov ecx, dword [r9]
jmp 0x140201f7b
cmp ecx, 0x4e0
jb 0x140201f7b
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
add r10, 4
mov edx, r11d
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x140201eb0
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x140201f00
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x1402064e0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r15, rdx
mov rsi, rcx
mov qword [rsp + 0x30], rcx
xor ebp, ebp
mov dword [rsp + 0x24], ebp
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
mov r14d, 0x13b8
mov eax, dword [r14 + rdi]
mov r13d, Ordinal_50
test al, 1
jne 0x140206578
or eax, 1
mov dword [r14 + rdi], eax
mov ebx, r13d
add rbx, rdi
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov edx, eax
mov dword [rbx + 0x1384], 0xffffffff
mov dword [rbx + 4], eax
mov ecx, 1
lea r8, [rbx + 8]
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [r8], edx
inc rcx
lea r8, [r8 + 4]
cmp rcx, 0x270
jb 0x140206550
mov dword [rbx], 0x270
mov eax, dword [r14 + rdi]
mov ebx, Ordinal_27
test al, 2
jne 0x140206599
or eax, 2
mov dword [r14 + rdi], eax
mov qword [rbx + rdi], rbp
mov qword [rbx + rdi + 8], reloc.WS2_32.dll_ntohs
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], rbp
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rsi], 0
mov dword [rsp + 0x24], 1
cmp r15, 0xf
jbe 0x1402065cb
mov rdx, r15
mov rcx, rsi
call fcn.14021ce30
mov qword [rsi + 0x10], rbp
lea r12, [rdi + rbx]
mov ebx, r13d
add rbx, rdi
lea r13, str.0123456789ABCDEF
movzx edi, byte [rsp + 0x20]
dec r15
mov qword [rsp + 0x28], rbx
mov rbp, qword [r12]
mov rdx, qword [r12 + 8]
sub rdx, rbp
cmp rdx, 0xffffffffffffffff
jne 0x140206619
mov rcx, rbx
call fcn.140201e30
mov r14d, eax
shl r14, 0x20
mov rcx, rbx
call fcn.140201e30
mov eax, eax
or r14, rax
jmp 0x140206629
inc rdx
lea rcx, [rsp + 0x28]
call fcn.140226250
mov r14, rax
lea rax, [r14 + rbp]
movzx r9d, byte [rax + r13]
mov rcx, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x18]
cmp rcx, rdx
jae 0x14020665e
lea rax, [rcx + 1]
mov qword [rsi + 0x10], rax
mov rax, rsi
cmp rdx, 0xf
jbe 0x140206653
mov rax, qword [rsi]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14020666f
movzx r8d, dil
mov edx, 1
mov rcx, rsi
call fcn.14021f610
test r15, r15
jne 0x1402065e1
mov rax, rsi
mov rbx, qword [rsp + 0x90]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1402069c0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebx, edx
mov esi, ecx
mov ecx, reloc.WS2_32.dll_recv
mov rax, qword gs:[0x58]
mov rax, qword [rax]
lea rbp, [0x140456110]
mov eax, dword [rcx + rax]
cmp dword [0x140456104], eax
jle 0x140206a67
lea rcx, [0x140456104]
call fcn.1402f74a8
cmp dword [0x140456104], 0xffffffff
jne 0x140206a67
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [0x140457494], 0xffffffff
mov dword [0x140456114], eax
mov r8d, 1
nop dword [rax]
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add eax, r8d
mov dword [rbp + r8*4 + 4], eax
inc r8
cmp r8, 0x270
jb 0x140206a30
mov dword [0x140456110], 0x270
lea rcx, [0x140456104]
call fcn.1402f743c
btc esi, 0x1f
btc ebx, 0x1f
sub ebx, esi
mov rcx, rbp
cmp ebx, 0xffffffff
jne 0x140206a82
call fcn.140201e30
mov ecx, eax
jmp 0x140206ab9
inc ebx
call fcn.140201e30
mov edi, ebx
mov ecx, eax
imul rcx, rdi
cmp ecx, ebx
jae 0x140206ab5
mov eax, ebx
neg eax
xor edx, edx
div ebx
mov ebx, edx
cmp ecx, edx
jae 0x140206ab5
mov rcx, rbp
call fcn.140201e30
mov ecx, eax
imul rcx, rdi
cmp ecx, ebx
jb 0x140206aa3
shr rcx, 0x20
lea eax, [rcx + rsi]
xor eax, 0x80000000
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret