joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004e53c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
lea r14, [0x140000000]
mov ecx, dword [rcx + 0xa8]
mov eax, ecx
and eax, 0xfff0000
cmp eax, 0x3ff0000
je 0x14004e5f1
mov r8b, 0x60
bt ecx, 0x10
jb 0x14004e59a
movzx eax, byte [rbx + 0xbd]
test byte [rax + r14 + 0xa2810], r8b
jne 0x14004e59a
mov rcx, rbx
call fcn.14004b9b4
jmp 0x14004e769
mov edx, 0xb0000
mov eax, ecx
and eax, edx
cmp eax, edx
je 0x14004e5cf
movzx edx, byte [rbx + 0xbd]
mov al, byte [rdx + r14 + 0xa2810]
and al, r8b
cmp al, 0x40
jne 0x14004e5cf
cmp dl, 0x47
je 0x14004e5cf
mov rcx, rbx
call fcn.140046164
jmp 0x14004e769
mov eax, 0x110000
and ecx, eax
cmp ecx, eax
je 0x14004e5f1
movzx eax, byte [rbx + 0xbd]
mov al, byte [rax + r14 + 0xa2810]
and al, r8b
cmp al, r8b
je 0x14004e5c2
mov ebp, 0x7ffd
movzx r8d, byte [rbx + 0xbd]
movzx eax, word [rbx + 0xb8]
shl r8d, 0x11
cmp eax, dword [rbx + 0x28]
jb 0x14004e649
mov rcx, qword [rbx + 0x20]
mov edx, eax
movzx eax, byte [rcx + rax*8 + 5]
shl eax, 0xa
add r8d, eax
mov rax, qword [rcx + rdx*8]
mov qword [rbx + 0xc0], rax
movzx eax, word [rbx + 0xb8]
cmp ax, bp
jae 0x14004e649
movzx ecx, ax
mov rax, qword [rbx + 0x20]
mov rcx, qword [rax + rcx*8 + 8]
mov qword [rbx + 0xc8], rcx
movzx edx, word [rbx + 0xba]
cmp edx, dword [rbx + 0x28]
jb 0x14004e68c
mov rax, qword [rbx + 0x20]
mov ecx, edx
movzx edx, byte [rax + rdx*8 + 5]
mov rax, qword [rax + rcx*8]
mov qword [rbx + 0xd0], rax
movzx eax, word [rbx + 0xba]
cmp ax, bp
jae 0x14004e692
movzx ecx, ax
mov rax, qword [rbx + 0x20]
mov rcx, qword [rax + rcx*8 + 8]
mov qword [rbx + 0xd8], rcx
jmp 0x14004e692
and edx, 0x3ff
lea esi, [rdx + r8]
xor edi, edi
mov r8d, edi
mov eax, 0x5e1d27b
and r8d, 0x1ffff
or r8d, esi
mov ecx, r8d
ror ecx, 0xb
sub ecx, r8d
rol ecx, 0xe
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 9
imul eax, eax, 0x3e9
sub ecx, eax
mov edx, dword [r14 + rcx*4 + 0xa3670]
mov eax, edx
and eax, 0xffffff
cmp eax, r8d
je 0x14004e6f6
lea eax, [rcx + 1]
mov edx, dword [r14 + rax*4 + 0xa3670]
mov eax, edx
and eax, 0xffffff
cmp eax, r8d
jne 0x14004e70e
mov eax, edx
mov rcx, rbx
shr rax, 0x18
call qword [r14 + rax*8 + 0xa3180]
movzx edx, ax
test edx, edx
jne 0x14004e72c
cmp edi, 0xfffff
je 0x14004e58d
mov eax, edi
shr eax, 0xa
or edi, eax
xor edi, 0xffc00
jmp 0x14004e698
cmp edx, 5
jae 0x14004e75b
cmp edx, 1
je 0x14004e5f6
cmp edx, 2
jne 0x14004e74f
mov edx, dword [rbx + 0xb8]
mov rcx, rbx
call fcn.140046534
jmp 0x14004e769
cmp edx, 3
je 0x14004e784
mov eax, 0xffff
jmp 0x14004e769
mov rax, qword [rbx + 0x20]
movzx eax, byte [rax + rdx*8 + 4]
shl eax, 0x18
add eax, edx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov edx, 0x18
mov rcx, rbx
call fcn.14001506c
int3
Function at 0x14004fa28
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
push r15
movzx r14d, dx
xor r9d, r9d
mov r10, rcx
mov esi, r14d
movzx eax, word [rcx + r14*2 + 0x1a2]
cmp eax, r8d
jbe 0x14004fabd
mov r11, qword [rcx + 0x20]
mov r15d, r8d
movzx ecx, word [r11 + rax*8]
mov ebp, eax
mov al, byte [r11 + rax*8 + 4]
and al, 0x1f
cmp ecx, r8d
je 0x14004faff
test al, al
jne 0x14004fab2
movzx ebx, word [r11 + rcx*8 + 2]
movzx edi, word [r11 + r15*8 + 2]
cmp r14w, 0x42
je 0x14004fa9e
mov dl, byte [r11 + rdi*8 + 4]
xor dl, byte [r11 + rbx*8 + 4]
test dl, 0x1f
jne 0x14004fab2
cmp ebx, edi
je 0x14004fae4
cmp ebx, 0x8000
jae 0x14004fae4
cmp edi, 0x8000
jae 0x14004fae4
movzx eax, word [r11 + rbp*8 + 6]
cmp eax, r8d
ja 0x14004fa61
movzx eax, word [r10 + rsi*2 + 0x192]
cmp eax, r8d
jbe 0x14004fae4
mov rcx, qword [r10 + 0x20]
mov edx, eax
movzx eax, word [rcx + rax*8]
cmp eax, r8d
je 0x14004fb0a
movzx eax, word [rcx + rdx*8 + 6]
cmp eax, r8d
ja 0x14004facf
xor eax, eax
mov rbx, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
pop r15
pop r14
ret
test al, al
setne r9b
mov eax, r9d
jmp 0x14004fae6
test byte [rcx + rdx*8 + 4], 0x1f
jmp 0x14004fb01

Function at 0x140050228
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, edx
mov r8, rcx
and eax, 0x1f000000
cmp eax, 0xe000000
jne 0x14005024f
mov dword [rcx + 0xba], 0x5b93226e
mov word [rcx + 0xb8], dx
jmp fcn.14004e53c
mov r9, qword [rcx + 0x20]
movzx r11d, dx
mov al, byte [r9 + r11*8 + 5]
sub al, 0x35
cmp al, 1
ja 0x1400502bd
movzx r10d, word [r9 + r11*8 + 2]
mov eax, 0x8000
cmp r10w, ax
jae 0x1400502bd
movzx eax, r10w
mov ecx, dword [r9 + rax*8]
add ecx, 0x40000000
cmp ecx, 0x80000000
jae 0x1400502bd
movzx eax, byte [r9 + r11*8 + 5]
movzx ecx, word [r9 + r11*8]
sub ax, 0xc
shl ax, 8
or ax, 0x13
mov word [r8 + 0xb8], cx
mov word [r8 + 0xbc], ax
mov rcx, r8
mov word [r8 + 0xba], r10w
jmp 0x14005024a
mov eax, edx
ret
Function at 0x140050af0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov r10, qword [rcx + 0x20]
mov ebp, r9d
movzx r14d, dx
mov r12d, r8d
mov r9d, edx
mov rsi, rcx
movzx r15d, byte [r10 + r14*8 + 5]
cmp r15d, 0x35
jb 0x140050c1e
cmp r15d, r8d
jg 0x140050c1e
xor edx, edx
lea rax, [rcx + 0xb24]
cmp word [rax], r14w
jne 0x140050b5a
mov ecx, dword [rax + 4]
cmp ecx, ebp
jb 0x140050b5a
xor ecx, ebp
test ecx, 0xfff
je 0x140050b69
inc rdx
add rax, 8
cmp rdx, 0x10
jl 0x140050b43
xor eax, eax
test rax, rax
je 0x140050b82
movzx ecx, word [rax + 2]
movzx eax, byte [r10 + rcx*8 + 4]
shl eax, 0x18
add eax, ecx
jmp 0x140050c66
movzx edx, word [r10 + r14*8]
mov r9d, ebp
movzx ebx, word [r10 + r14*8 + 2]
mov rcx, rsi
call fcn.140050af0
mov r9d, ebp
mov r8d, r12d
mov edx, ebx
mov rcx, rsi
mov edi, eax
call fcn.140050af0
mov ecx, 0xf4
mov word [rsi + 0xb8], di
add r15w, cx
mov word [rsi + 0xba], ax
movzx edx, r15w
mov ecx, 0x100
imul edx, ecx
mov r8d, ebp
shr r8d, 5
mov rcx, rsi
and r8w, 0x1f
or r8w, dx
mov word [rsi + 0xbc], r8w
call fcn.14004e53c
mov r9d, eax
mov eax, dword [rsi + 0xba4]
mov ecx, eax
inc eax
and eax, 0xf
mov dword [rsi + 0xba4], eax
mov word [rsi + rcx*8 + 0xb24], r14w
mov word [rsi + rcx*8 + 0xb26], r9w
mov dword [rsi + rcx*8 + 0xb28], ebp
jmp 0x140050c63
bt ebp, 0xb
jae 0x140050c63
movzx eax, byte [r10 + r14*8 + 4]
mov ecx, 0x1f
and ecx, eax
mov edx, 0x605fd9
shr edx, cl
test dl, 1
jne 0x140050c63
mov eax, 0x5b15
mov word [rsi + 0xb8], r14w
mov rcx, rsi
mov word [rsi + 0xbc], ax
mov word [rsi + 0xba], bp
call fcn.14004e53c
mov r9d, eax
mov eax, r9d
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x140059c64
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, edx
mov rdi, rcx
mov edx, 0x14
call fcn.140046534
mov ecx, 0x548a
mov word [rdi + 0xb8], ax
mov word [rdi + 0xbc], cx
mov rcx, rdi
mov word [rdi + 0xba], bx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14004e53c

Function at 0x140079a80
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x140079913
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140079913
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140079913
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140079913
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140079913
cmp dword [rcx + 0x84], 0xe
jbe 0x140079913
cmp dword [rcx + 0xf8], 0
je 0x140079913
mov ecx, ebx
call fcn.1400799b4
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.1400797a4
cmp dword [rbp + 0x20], 0
je 0x140079960
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140079968
int3
xor r8d, r8d
xor edx, edx
jmp 0x1400798ac
Function at 0x14008cf98
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x14008ccbe
call fcn.140079b44
mov dword [rax], 0x16
call fcn.140087070
jmp 0x14008ce09
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x14008ce09
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x14008ce09
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x14008cced
lock or dword [rcx + 0x14], 0x10
jmp 0x14008ce09
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x14008cd01
call fcn.140090900
mov esi, dword [rbx + 0x10]
cmp esi, 1
jne 0x14008cd11
mov rax, qword [rbx]
mov bpl, byte [rax]
jmp 0x14008cd14
xor bpl, bpl
mov rdi, qword [rbx + 8]
mov rcx, rbx
mov qword [rbx], rdi
call fcn.140078e48
mov r8d, dword [rbx + 0x20]
mov ecx, eax
mov rdx, rdi
call fcn.14008c714
mov dword [rbx + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x14008cdf7
mov eax, dword [rbx + 0x14]
test al, 6
jne 0x14008cda5
mov rcx, rbx
call fcn.140078e48
cmp eax, 0xffffffff
je 0x14008cd90
mov rcx, rbx
call fcn.140078e48
cmp eax, 0xfffffffe
je 0x14008cd90
mov rcx, rbx
call fcn.140078e48
movsxd rdi, eax
lea r14, [0x1400bbbd0]
mov rcx, rbx
sar rdi, 6
call fcn.140078e48
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rdi*8]
lea rdx, [rax + rcx*8]
jmp 0x14008cd97
lea rdx, [0x1400ba330]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x14008cda5
lock or dword [rbx + 0x14], 0x20
cmp dword [rbx + 0x20], 0x200
jne 0x14008cdc9
mov eax, dword [rbx + 0x14]
shr eax, 6
test al, 1
je 0x14008cdc9
mov eax, dword [rbx + 0x14]
shr eax, 8
test al, 1
jne 0x14008cdc9
mov dword [rbx + 0x20], 0x1000
mov rax, qword [rbx]
cmp esi, 1
jne 0x14008cde7
movzx ecx, byte [rax]
dec dword [rbx + 0x10]
shl cx, 8
movzx eax, bpl
or cx, ax
inc qword [rbx]
jmp 0x14008cdf2
movzx ecx, word [rax]
add dword [rbx + 0x10], 0xfffffffe
add qword [rbx], 2
movzx eax, cx
jmp 0x14008ce0e
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rbx + 0x14], eax
and dword [rbx + 0x10], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
jmp 0x14008cc88

Function at 0x140092d94
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140092db4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140079ad4
or eax, 0xffffffff
jmp 0x140092db6
xor eax, eax
add rsp, 0x28
ret
Function at 0x1400013d8
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1308]
mov eax, 0x13e0
call fcn.140002ee0
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x12d0], rax
mov rbx, rcx
mov qword [rsp + 0x38], rcx
xor esi, esi
mov dword [rsp + 0x20], esi
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov edx, eax
or dword [rbp + 0x12c4], 0xffffffff
mov dword [rsp + 0x44], eax
lea ecx, [rsi + 1]
mov r8d, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [rsp + rcx*4 + 0x44], edx
inc rcx
cmp rcx, r8
jb 0x14000143f
mov dword [rsp + 0x40], r8d
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
mov dword [rsp + 0x20], 1
mov edx, 0x3200000
mov rcx, rbx
call fcn.140001bb8
mov qword [rbx + 0x10], rsi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov r13d, esi
lea rcx, [rsp + 0x28]
call fcn.140001f50
mov eax, eax
imul rcx, rax, 0xa3e4
cmp ecx, 0x3c7f
ja 0x1400014d0
lea rcx, [rsp + 0x28]
call fcn.140001f50
mov eax, eax
imul rcx, rax, 0xa3e4
cmp ecx, 0x3c80
jb 0x1400014b5
shr rcx, 0x20
lea r12d, [rcx - 0x7fffffbb]
mov rdi, qword [rbx + 0x10]
mov r14, qword [rbx + 0x18]
cmp rdi, r14
jae 0x14000150b
lea rax, [rdi + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp r14, 7
jbe 0x1400014fc
mov rax, qword [rbx]
mov word [rax + rdi*2], r12w
mov word [rax + rdi*2 + 2], si
jmp 0x1400015ec
movabs r8, 0x7ffffffffffffffe
mov rax, r8
sub rax, rdi
cmp rax, 1
jb 0x140001636
lea r15, [rdi + 1]
mov rcx, r15
or rcx, 7
cmp rcx, r8
jbe 0x14000153a
mov rcx, r8
jmp 0x140001556
mov rdx, r14
shr rdx, 1
mov rax, r8
sub rax, rdx
cmp r14, rax
ja 0x140001535
lea rax, [rdx + r14]
cmp rcx, rax
cmovb rcx, rax
mov qword [rsp + 0x30], rcx
lea rdx, [rsp + 0x30]
call fcn.140001ec0
mov rsi, rax
mov qword [rbx + 0x10], r15
mov rax, qword [rsp + 0x30]
mov qword [rbx + 0x18], rax
lea r15, [rdi + rdi]
mov r8, r15
mov rcx, rsi
cmp r14, 7
jbe 0x1400015d1
mov rdi, qword [rbx]
mov rdx, rdi
call qword [sym.imp.VCRUNTIME140.dll_memcpy]
mov word [rsi + r15], r12w
xor eax, eax
mov word [rsi + r15 + 2], ax
lea rdx, [r14*2 + 2]
cmp rdx, 0x1000
jb 0x1400015c7
add rdx, 0x27
mov rcx, qword [rdi - 8]
sub rdi, rcx
lea rax, [rdi - 8]
cmp rax, 0x1f
ja 0x14000162f
mov rdi, rcx
mov rcx, rdi
call fcn.14000216c
jmp 0x1400015e7
mov rdx, rbx
call qword [sym.imp.VCRUNTIME140.dll_memcpy]
mov word [rsi + r15], r12w
xor eax, eax
mov word [rsi + r15 + 2], ax
mov qword [rbx], rsi
xor esi, esi
inc r13d
cmp r13d, 0x3200000
jl 0x14000149a
mov rax, rbx
mov rcx, qword [rbp + 0x12d0]
xor rcx, rsp
call fcn.140002110
lea r11, [rsp + 0x13e0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400011b4
int3
Function at 0x1400019c0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x68
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov ecx, 8
call fcn.140002130
lea rcx, [0x14000163c]
mov qword [rax], rcx
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
and dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1400020d8]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140001a77
cmp dword [rsp + 0x38], 0
je 0x140001a6b
call qword [sym.imp.MSVCP140.dll__Thrd_id]
cmp dword [rsp + 0x38], eax
je 0x140001a5f
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
xor edx, edx
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll__Thrd_join]
test eax, eax
jne 0x140001a53
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
jmp 0x1400019d3
mov ecx, 2
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
and dword [rsp + 0x38], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x140001f50
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov r9, qword [rcx]
mov ebx, 0x270
mov ecx, dword [r9]
cmp ecx, ebx
jne 0x140001fbb
lea r8, [r9 + 8]
mov r10d, 0x7fffffff
mov r11d, 0x9908b0df
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
and edx, r10d
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, r11d
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub rbx, 1
jne 0x140001f7e
mov ecx, dword [r9]
jmp 0x140002089
cmp ecx, 0x4e0
jb 0x140002089
lea rbx, [r9 + 0x9c4]
mov esi, 0xe3
mov edi, dword [rbx]
mov r10d, 0x7fffffff
mov r11d, 0x9908b0df
mov eax, edi
mov edi, dword [rbx + 4]
mov edx, eax
lea rbx, [rbx + 4]
xor edx, edi
and edx, r10d
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, r11d
xor ecx, dword [rbx + 0x630]
xor ecx, edx
mov dword [rbx - 0x9c4], ecx
sub rsi, 1
jne 0x140001fe1
lea rbx, [r9 + 0xd50]
mov esi, 0x18c
mov edi, dword [rbx]
mov eax, edi
mov edi, dword [rbx + 4]
mov edx, eax
lea rbx, [rbx + 4]
xor edx, edi
and edx, r10d
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, r11d
xor ecx, dword [rbx - 0xd50]
xor ecx, edx
mov dword [rbx - 0x9c4], ecx
sub rsi, 1
jne 0x140002022
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
and edx, r10d
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, r11d
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
ret

Function at 0x140002a90
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002ada
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002ada
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002ada
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002ada
cmp dword [rcx + 0x84], 0xe
jbe 0x140002ada
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002adc
xor al, al
add rsp, 0x28
ret
Function at 0x499940
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x250
movsxd rdi, edx
mov r12, r8
mov rbx, rcx
mov eax, edi
cdq
and edx, 0xf
add eax, edx
and eax, 0xf
cmp eax, edx
jne 0x499b83
mov qword [rsp + 0x268], rsi
movzx esi, byte [rsp + 0x288]
test sil, sil
je 0x49998e
cmp sil, 1
jne 0x499b7b
mov qword [rsp + 0x260], rbp
movzx ebp, byte [rsp + 0x280]
cmp bpl, 1
je 0x4999ad
test bpl, bpl
jne 0x499b73
test r9, r9
je 0x4999c7
mov rax, qword [r9]
lea rcx, [rsp + 0x30]
mov qword [rcx], rax
mov rax, qword [r9 + 8]
mov qword [rcx + 8], rax
jmp 0x4999d3
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x204
call fcn.004a03d0
lea rcx, [rsp + 0x40]
mov r8d, 0x80
mov rdx, r12
call fcn.00497000
test sil, sil
jne 0x499abb
test rdi, rdi
jle 0x499b73
add rdi, 0xffffffffffffffff
shr rdi, 4
add rdi, 1
cmp bpl, 1
jne 0x499a5f
xor ecx, ecx
nop
movzx eax, byte [rbx + rcx]
add rcx, 4
xor al, byte [rsp + rcx + 0x2c]
mov byte [rsp + rcx + 0x1c], al
movzx eax, byte [rbx + rcx - 3]
xor al, byte [rsp + rcx + 0x2d]
mov byte [rsp + rcx + 0x1d], al
movzx eax, byte [rbx + rcx - 2]
xor al, byte [rsp + rcx + 0x2e]
mov byte [rsp + rcx + 0x1e], al
movzx eax, byte [rbx + rcx - 1]
xor al, byte [rsp + rcx + 0x2f]
cmp rcx, 0x10
mov byte [rsp + rcx + 0x1f], al
jl 0x499a20
jmp 0x499a70
mov rax, qword [rbx]
mov qword [rsp + 0x20], rax
mov rax, qword [rbx + 8]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.00497950
cmp bpl, 1
lea rcx, [rsp + 0x20]
mov rax, qword [rcx]
mov qword [rbx], rax
mov rax, qword [rcx + 8]
mov qword [rbx + 8], rax
jne 0x499aa8
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x30], xmm0
add rbx, 0x10
sub rdi, 1
jne 0x499a16
jmp 0x499b73
cmp sil, 1
jne 0x499b73
test rdi, rdi
jle 0x499b73
add rdi, 0xffffffffffffffff
shr rdi, 4
add rdi, 1
nop
nop
mov rax, qword [rbx]
lea rcx, [rsp + 0x20]
lea r8, [rsp + 0x20]
mov qword [rcx], rax
mov rax, qword [rbx + 8]
lea rdx, [rsp + 0x20]
mov qword [rcx + 8], rax
lea rcx, [rsp + 0x40]
call fcn.00498940
cmp bpl, 1
jne 0x499b51
xor ecx, ecx
nop
movzx eax, byte [rsp + rcx + 0x30]
add rcx, 4
xor byte [rsp + rcx + 0x1c], al
movzx eax, byte [rsp + rcx + 0x2d]
xor byte [rsp + rcx + 0x1d], al
movzx eax, byte [rsp + rcx + 0x2e]
xor byte [rsp + rcx + 0x1e], al
movzx eax, byte [rsp + rcx + 0x2f]
xor byte [rsp + rcx + 0x1f], al
cmp rcx, 0x10
jl 0x499b10
mov rax, qword [rbx]
lea rcx, [rsp + 0x30]
mov qword [rcx], rax
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
lea rcx, [rsp + 0x20]
add rbx, 0x10
sub rdi, 1
mov rax, qword [rcx]
mov qword [rbx - 0x10], rax
mov rax, qword [rcx + 8]
mov qword [rbx - 8], rax
jne 0x499ae0
mov rbp, qword [rsp + 0x260]
mov rsi, qword [rsp + 0x268]
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x14000b6a0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x14000b6d1
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rdi
je 0x14000b74b
mov rdi, r14
mov rcx, rbx
call fcn.140005be0
test rax, rax
jle 0x14000b723
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.140013950
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x14000b73b
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x14000b743
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x14000b6e5
sub r14, rdi
jmp 0x14000b82f
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x14000b762
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14000b764
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14000b796
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.140013950
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x14000b82c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000b7d1
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x14000b80d
nop word [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.1400190b8
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x14000b82c
cmp rbp, rax
ja 0x14000b7e0
test rbp, rbp
je 0x14000b82c
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.1400190b8
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x30]
mov rax, r14
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x1400121d8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140012222
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140012222
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140012222
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140012222
cmp dword [rcx + 0x84], 0xe
jbe 0x140012222
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140012224
xor al, al
add rsp, 0x28
ret