joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140107690
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov qword [rax + 0x10], rdx
push rsi
push rdi
push r14
sub rsp, 0x70
mov rsi, r8
mov rbx, rdx
mov r14, rcx
xor ebp, ebp
mov dword [rax - 0x48], ebp
mov dword [rax + 8], ebp
cmp qword [r8 + 0x18], 7
jbe 0x1401076c2
mov r8, qword [r8]
lea rax, [rsp + 0x90]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
xor edx, edx
lea r9d, [rdx + 2]
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x140107864
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], 7
mov word [rbx], bp
mov dword [rsp + 0x40], 1
mov edx, dword [rsp + 0x90]
shr rdx, 1
jne 0x140107723
mov qword [rbx + 0x10], rdx
mov word [rbx + rdx*2], bp
jmp 0x14010775d
cmp rdx, 7
ja 0x14010774d
mov qword [rbx + 0x10], rdx
mov r8, rbx
cmp qword [rbx + 0x18], 7
jbe 0x14010773a
mov r8, qword [rbx]
mov rdi, r8
movzx eax, bp
mov rcx, rdx
rep stosw word [rdi], ax
mov word [r8 + rdx*2], bp
jmp 0x14010775d
mov word [rsp + 0x20], bp
mov r9, rdx
mov rcx, rbx
call fcn.1400eed70
mov rax, rbx
cmp qword [rbx + 0x18], 7
jbe 0x14010776a
mov rax, qword [rbx]
cmp qword [rsi + 0x18], 7
jbe 0x140107774
mov rsi, qword [rsi]
lea rcx, [rsp + 0x90]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbp
mov r9d, 2
mov r8, rsi
xor edx, edx
mov rcx, qword [r14]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x14010783e
mov ecx, dword [rsp + 0x90]
shr rcx, 1
dec rcx
mov r8, qword [rbx + 0x10]
cmp rcx, r8
ja 0x1401077d4
mov qword [rbx + 0x10], rcx
mov rax, rbx
cmp qword [rbx + 0x18], 7
jbe 0x1401077ce
mov rax, qword [rbx]
mov word [rax + rcx*2], bp
jmp 0x140107826
mov rdx, rcx
sub rdx, r8
mov rdi, qword [rbx + 0x18]
mov rax, rdi
sub rax, r8
cmp rdx, rax
ja 0x140107816
mov qword [rbx + 0x10], rcx
mov r9, rbx
cmp rdi, 7
jbe 0x1401077f9
mov r9, qword [rbx]
lea rdi, [r9 + r8*2]
test rdx, rdx
je 0x14010780b
movzx eax, bp
mov rcx, rdx
rep stosw word [rdi], ax
lea rax, [r8 + rdx]
mov word [r9 + rax*2], bp
jmp 0x140107826
mov word [rsp + 0x20], bp
mov r9, rdx
mov rcx, rbx
call fcn.1400eed70
mov rax, rbx
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
mov r8d, eax
lea rdx, str.Cannot_get_string_value:_RegGetValue_failed.
lea rcx, [rsp + 0x48]
call fcn.1400d5280
lea rdx, [0x1405e62d8]
lea rcx, [rsp + 0x48]
call fcn.1403e644c
int3
mov r8d, eax
lea rdx, str.Cannot_get_size_of_string_value:_RegGetValue_failed.
lea rcx, [rsp + 0x48]
call fcn.1400d5280
lea rdx, [0x1405e62d8]
lea rcx, [rsp + 0x48]
call fcn.1403e644c
int3
Function at 0x140107890
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov rax, qword [0x1405f98c0]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rdi, rdx
mov r14, rcx
mov qword [rbp - 9], rdx
xor r15d, r15d
mov dword [rbp - 0xd], r15d
mov dword [rbp - 0x15], r15d
mov dword [rbp - 0x19], r15d
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
lea rax, [rbp - 0x19]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x15]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x140107aa5
mov eax, dword [rbp - 0x19]
inc eax
mov dword [rbp - 0x19], eax
mov ecx, eax
mov eax, 2
mul rcx
mov rbx, rax
mov rax, 0xffffffffffffffff
cmovo rbx, rax
mov rcx, rbx
call fcn.1403e38dc
mov rsi, rax
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.14043d3a0
mov qword [rbp - 1], rsi
mov qword [rdi], r15
mov qword [rdi + 8], r15
mov qword [rdi + 0x10], r15
mov dword [rbp - 0xd], 3
mov ebx, r15d
cmp dword [rbp - 0x15], r15d
jbe 0x140107a51
nop dword [rax]
nop word [rax + rax]
mov eax, dword [rbp - 0x19]
mov dword [rbp - 0x11], eax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x11]
mov r8, rsi
mov edx, ebx
mov rcx, qword [r14]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea rcx, [rbp + 7]
test eax, eax
jne 0x140107a85
mov r8d, dword [rbp - 0x11]
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
mov qword [rbp + 0x17], r15
mov qword [rbp + 0x1f], r15
mov rdx, rsi
call fcn.1400c71d0
nop
mov rdx, qword [rdi + 8]
cmp rdx, qword [rdi + 0x10]
je 0x1401079fe
movups xmm0, xmmword [rbp + 7]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp + 0x17]
movups xmmword [rdx + 0x10], xmm1
mov edx, 7
mov word [rbp + 7], r15w
add qword [rdi + 8], 0x20
jmp 0x140107a0e
lea r8, [rbp + 7]
mov rcx, rdi
call fcn.14011f0c0
mov rdx, qword [rbp + 0x1f]
cmp rdx, 7
jbe 0x140107a46
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140107a41
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140107a7f
call fcn.1403e3650
inc ebx
cmp ebx, dword [rbp - 0x15]
jb 0x140107980
mov rcx, rsi
call fcn.1403e3650
mov rax, rdi
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1403e3630
mov rbx, qword [rsp + 0xf0]
add rsp, 0xb0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.1403fd768
int3
mov r8d, eax
lea rdx, str.Cannot_enumerate_subkeys:_RegEnumKeyEx_failed.
call fcn.1400d5280
lea rdx, [0x1405e62d8]
lea rcx, [rbp + 7]
call fcn.1403e644c
nop
mov r8d, eax
lea rdx, str.RegQueryInfoKey_failed_while_preparing_for_subkey_enumeration.
lea rcx, [rbp + 7]
call fcn.1400d5280
lea rdx, [0x1405e62d8]
lea rcx, [rbp + 7]
call fcn.1403e644c
int3
Function at 0x140108e00
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x1c0
mov rax, qword [0x1405f98c0]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov rsi, r8
mov rbx, rdx
xor edi, edi
mov byte [rsp + 0x30], dil
lea rcx, [rsp + 0x90]
call fcn.1400c7ff0
nop
lea rdx, str.SELECT_COUNT___FROM_sqlite_master_WHERE_type__
lea rcx, [rsp + 0xa0]
call fcn.1400c90c0
mov rcx, rax
lea rdx, [0x140571320]
call fcn.1400c90c0
mov rcx, rax
lea rdx, str._AND_name__
call fcn.1400c90c0
mov r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x140108e7f
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rax
call fcn.1400c8cd0
mov rcx, rax
lea rdx, [0x14054368c]
call fcn.1400c90c0
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0xa8]
call fcn.1400c8630
nop
lea rdx, [rsp + 0x190]
cmp qword [rsp + 0x1a8], 0xf
cmova rdx, qword [rsp + 0x190]
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x30]
lea r8, [0x140108fe0]
mov rcx, rsi
call fcn.1402e36f0
test eax, eax
jne 0x140108f82
movzx ebx, byte [rsp + 0x30]
mov rdx, qword [rsp + 0x1a8]
cmp rdx, 0xf
jbe 0x140108f2e
inc rdx
mov rcx, qword [rsp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140108f29
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140108f7c
call fcn.1403e3650
movdqa xmm0, xmmword [0x14057a8c0]
movdqu xmmword [rsp + 0x1a0], xmm0
mov byte [rsp + 0x190], 0
lea rcx, [rsp + 0x90]
call fcn.1400c77b0
movzx eax, bl
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.1403e3630
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.1403fd768
nop
mov rcx, rsi
call fcn.1402e5f00
mov rdi, rax
call fcn.140107b30
mov rbx, rax
mov rcx, rsi
call fcn.1402e5e30
mov r8, rbx
mov edx, eax
lea rcx, [rsp + 0x50]
call fcn.1400c5100
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x40], xmm0
mov r8, rdi
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.1400c5420
lea rdx, [0x1405e65d0]
lea rcx, [rsp + 0x60]
call fcn.1403e644c
int3
Function at 0x14011ffa0
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov ebx, 1
bsr rcx, rax
mov eax, ebx
shl rax, cl
cmp rdx, rax
ja 0x14012017d
lea rax, [rdx - 1]
mov qword [rsp + 0x38], rdi
mov rdi, qword [0x140891ef8]
or rax, rbx
bsr rcx, rax
mov r8, rdi
inc ecx
shl rbx, cl
lea rcx, [0x140891f08]
lea rdx, [rbx + rbx]
call fcn.1400eda30
mov rcx, qword [0x140891ef8]
lea r9, [rbx - 1]
mov qword [0x140891f20], r9
mov qword [0x140891f28], rbx
mov rcx, qword [rcx]
cmp rcx, rdi
je 0x140120172
mov qword [rsp + 0x30], rsi
mov rax, rcx
movabs rsi, 0xcbf29ce484222325
movabs rbx, 0x100000001b3
nop word [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rbx
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rbx
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rbx
xor r11, rdx
movzx edx, byte [rax + 0x14]
imul r11, rbx
xor r11, rdx
movzx edx, byte [rax + 0x15]
imul r11, rbx
xor r11, rdx
movzx edx, byte [rax + 0x16]
imul r11, rbx
xor r11, rdx
movzx edx, byte [rax + 0x17]
imul r11, rbx
xor r11, rdx
imul r11, rbx
and r11, r9
shl r11, 4
add r11, qword [0x140891f08]
mov r9, qword [r11]
cmp r9, rdi
jne 0x1401200bb
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x140120133
mov rdx, qword [r11 + 8]
mov r8, qword [rax + 0x10]
cmp r8, qword [rdx + 0x10]
jne 0x1401200f8
mov r10, qword [rdx]
cmp r10, rax
je 0x1401200f2
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x140120133
cmp r9, rdx
je 0x14012010f
nop dword [rax]
mov rdx, qword [rdx + 8]
cmp r8, qword [rdx + 0x10]
je 0x140120147
cmp r9, rdx
jne 0x140120100
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rdi
je 0x14012016d
mov r9, qword [0x140891f20]
jmp 0x140120040
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x140120133
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.1403c238c
int3
Function at 0x140144530
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov rax, qword [0x1405f98c0]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
xor edi, edi
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
lea r8d, [rdi + 0xe]
lea rdx, [0x140572e38]
lea rcx, [rsp + 0x40]
call fcn.1400c71d0
nop
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rdi
xor edx, edx
lea ecx, [rdi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
test rax, rax
jne 0x1401445b2
xor ebx, ebx
jmp 0x14014469b
xor edx, edx
mov r8d, 0x234
lea rcx, [rsp + 0x64]
call fcn.14043d3a0
mov dword [rsp + 0x60], 0x238
lea rdx, [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
mov rbx, qword [rsp + 0x28]
nop
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 7
cmova rdx, qword [rsp + 0x40]
lea rcx, [rbp - 0x74]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140144631
cmp rbx, rdi
je 0x140144615
mov eax, dword [rsp + 0x68]
mov dword [rbx], eax
add rbx, 4
mov qword [rsp + 0x28], rbx
jmp 0x140144631
lea r8, [rsp + 0x68]
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.1401873b0
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x28]
lea rdx, [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1401445e0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rsp + 0x20]
sub rbx, rcx
sar rbx, 2
cmp rbx, 2
seta bl
test rcx, rcx
je 0x14014469b
sub rdi, rcx
sar rdi, 2
lea rdx, [rdi*4]
cmp rdx, 0x1000
jb 0x140144695
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140144704
mov rcx, r8
call fcn.1403e3650
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x1401446d9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401446d4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14014470a
call fcn.1403e3650
movzx eax, bl
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.1403e3630
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.1403fd768
nop
call fcn.1403fd768
int3
Function at 0x140148390
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub r8, rdx
movabs rax, 0xcbf29ce484222325
sar r8, 1
mov r9d, 0
add r8, r8
je 0x1401483d4
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx ecx, byte [rdx + r9]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x1401483c0
ret
Function at 0x14014c000
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
mov ebp, 0xfffd
nop word [rax + rax]
movzx ecx, word [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp ax, 9
ja 0x14014c0e3
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x14014c0e3
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x14014c101
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx + 0x10]
cmp rax, rcx
je 0x14014c0d3
cmp word [rax], 0x5c
jne 0x14014c0cc
lea rdx, [rax + 2]
cmp rdx, rcx
je 0x14014c0cc
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x14014c0b7
movzx ecx, word [rdx]
sub cx, 0x28
cmp cx, 1
jbe 0x14014c0c9
test r8b, 0x10
jne 0x14014c0cc
movzx ecx, word [rdx]
sub cx, 0x7b
test bp, cx
jne 0x14014c0cc
mov rax, rdx
add rax, 2
mov qword [rbx], rax
mov rcx, rbx
call fcn.140148c10
test edi, edi
jne 0x14014c030
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
call fcn.1400f7c90
int3
Function at 0x14014e120
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x14f0
call fcn.1403e4120
sub rsp, rax
mov rax, qword [0x1405f98c0]
xor rax, rsp
mov qword [rsp + 0x14e0], rax
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
mov ecx, 8
mov rax, qword gs:[0x58]
mov rax, qword [rax]
lea rsi, [0x140891fc0]
mov eax, dword [rcx + rax]
cmp dword [0x140891fb0], eax
jg 0x14014e1dc
mov rdx, rsi
mov rcx, rdi
call fcn.1400ed1c0
mov rax, rdi
mov rcx, qword [rsp + 0x14e0]
xor rcx, rsp
call fcn.1403e3630
lea r11, [rsp + 0x14f0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
lea rcx, [rsp + 0x50]
call fcn.1401367c0
lea rcx, [0x1404a4730]
call fcn.1403e38c4
nop
lea rcx, [0x140891fb0]
call fcn.1403e3a34
jmp 0x14014e180
lea rcx, [0x140891fb0]
call fcn.1403e3aa0
cmp dword [0x140891fb0], 0xffffffff
jne 0x14014e180
call fcn.1403c4558
mov edx, eax
mov dword [rsp + 0x14d4], 0xffffffff
mov dword [rsp + 0x154], eax
mov eax, 1
nop
mov ecx, edx
shr ecx, 0x1e
xor ecx, edx
imul edx, ecx, 0x6c078965
add edx, eax
mov dword [rsp + rax*4 + 0x154], edx
inc rax
cmp rax, 0x270
jb 0x14014e210
mov dword [rsp + 0x150], 0x270
lea rcx, [rsp + 0x50]
call fcn.14013a6d0
nop
lea rdx, str.https:__api
lea rcx, [rsp + 0x60]
call fcn.140158340
mov rbx, rax
lea rax, [rsp + 0x150]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x28]
call fcn.14015b300
mov edx, eax
shl rdx, 2
shr rdx, 0x20
inc edx
mov rcx, rbx
call fcn.140156430
mov rcx, rax
lea rdx, str..origin.com
call fcn.140158340
nop
xorps xmm0, xmm0
movups xmmword [0x140891fc0], xmm0
mov qword [0x140891fd0], rbp
mov qword [0x140891fd8], 7
mov word [0x140891fc0], bp
mov dword [rsp + 0x20], 8
mov rcx, qword [rsp + 0xd8]
mov eax, ecx
and al, 0x22
cmp al, 2
je 0x14014e2ff
mov rax, qword [rsp + 0xa8]
mov rdx, qword [rax]
test rdx, rdx
je 0x14014e2ff
mov rax, qword [rsp + 0x88]
mov r9, qword [rax]
cmp rdx, qword [rsp + 0xd0]
cmovb rdx, qword [rsp + 0xd0]
jmp 0x14014e336
test cl, 4
jne 0x14014e1b7
mov rax, qword [rsp + 0xa0]
mov rdx, qword [rax]
test rdx, rdx
je 0x14014e1b7
mov rax, qword [rsp + 0x80]
mov r9, qword [rax]
mov rax, qword [rsp + 0xb8]
movsxd rcx, dword [rax]
lea rdx, [rdx + rcx*2]
sub rdx, r9
mov rax, r9
sar rdx, 1
test rax, rax
je 0x14014e1b7
mov rcx, rsi
cmp rdx, 7
ja 0x14014e370
mov qword [0x140891fd0], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
mov rdx, r9
call fcn.14043cc20
mov word [rbx + rsi], bp
jmp 0x14014e1b7
call fcn.140102e90
nop
jmp 0x14014e1b7
Function at 0x14015b300
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, qword [rcx]
mov r10d, 0x270
mov ecx, dword [r9]
cmp ecx, r10d
jne 0x14015b361
lea r8, [r9 + 8]
nop dword [rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x14015b320
mov ecx, dword [r9]
jmp 0x14015b44b
cmp ecx, 0x4e0
jb 0x14015b44b
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x14015b380
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x14015b3d0
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x14015f440
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 8], rcx
push rbp
lea rbp, [rsp - 0xb0]
sub rsp, 0x1b0
mov rbx, r8
mov rdi, rdx
cmp qword [0x140891f40], 0
jne 0x14015f5a9
call fcn.14015d8c0
test al, al
jne 0x14015f5a9
lea r9, str.mania:_failed_to_init_trackmania_accounts...
lea r8, str.NADEO::MANIAPLANET
mov edx, 4
call fcn.1400c6f10
xor al, al
mov byte [rbp - 0x70], al
test al, al
je 0x14015f65e
lea rcx, [rbp - 0x50]
call fcn.14013a6d0
nop
lea rdx, str._titleTM5GPilot_nadeolabs
lea rcx, [rbp - 0x40]
call fcn.140158340
lea rdx, str._login
lea rcx, [rbp - 0x40]
call fcn.140158340
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 7
cmova rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x40]
mov rcx, rax
call fcn.1401431f0
mov rcx, rax
lea rdx, [0x140574be8]
call fcn.140158340
lea rdx, str._password
lea rcx, [rbp - 0x40]
call fcn.140158340
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 7
cmova rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
mov rcx, rax
call fcn.1401431f0
mov rcx, rax
lea rdx, [0x140574be8]
call fcn.140158340
lea rdx, str._validation
lea rcx, [rbp - 0x40]
call fcn.140158340
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 7
cmova rdx, qword [rsp + 0x70]
mov r8, qword [rbp - 0x80]
mov rcx, rax
call fcn.1401431f0
mov rdx, rdi
lea rcx, [rbp - 0x50]
call fcn.140156360
nop
lea rcx, [rbp - 0x50]
call fcn.1401367c0
nop
cmp byte [rbp - 0x70], 0
je 0x14015f686
lea rcx, [rsp + 0x70]
call fcn.1400c63d0
lea rcx, [rsp + 0x50]
call fcn.1400c63d0
lea rcx, [rsp + 0x30]
call fcn.1400c63d0
jmp 0x14015f686
mov r8, qword [rbx + 0x10]
mov rdx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x14015f5ba
mov rdx, qword [rbx]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x14015f5f3
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x14015f5e0
mov r8, rbx
lea rdx, [rbp - 0x60]
call fcn.14015ee00
mov rcx, qword [rax + 8]
mov rbx, qword [0x140891f38]
test rcx, rcx
cmovne rbx, rcx
cmp rbx, qword [0x140891f38]
je 0x14015f498
lea rax, [rsp + 0x30]
mov qword [rbp + 0xc0], rax
lea rdx, [rbx + 0x30]
lea rcx, [rsp + 0x30]
call fcn.1400ed1c0
nop
lea rdx, [rbx + 0x50]
lea rcx, [rsp + 0x50]
call fcn.1400ed1c0
nop
lea rdx, [rbx + 0x70]
lea rcx, [rsp + 0x70]
call fcn.1400ed1c0
nop
mov al, 1
jmp 0x14015f49a
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], 0
xor r8d, r8d
lea rdx, [0x140545d28]
mov rcx, rdi
call fcn.1400c71d0
mov rax, rdi
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret