joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ec830
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor r8d, r8d
mov rbx, rdx
mov rdx, rcx
cmp byte [rcx + 0x95], r8b
je 0x1400ec868
mov eax, r8d
nop dword [rax + rax]
lea ecx, [rax - 0x65]
xor byte [rdx + rax], cl
inc rax
cmp rax, 0x94
jb 0x1400ec850
mov byte [rdx + 0x95], r8b
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbx], xmm0
lea rax, [rdx + 0x94]
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], r8
cmp rdx, rax
jne 0x1400ec89c
mov qword [rbx + 0x10], r8
mov rax, rbx
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
add rsp, 0x30
pop rbx
ret
mov r8d, __WSAFDIsSet
mov rcx, rbx
call fcn.1400e7f50
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x1400ec8c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor r8d, r8d
mov rbx, rdx
mov rdx, rcx
cmp byte [rcx + 0xa2], r8b
je 0x1400ec8f8
mov eax, r8d
nop dword [rax + rax]
lea ecx, [rax - 0x65]
xor byte [rdx + rax], cl
inc rax
cmp rax, 0xa1
jb 0x1400ec8e0
mov byte [rdx + 0xa2], r8b
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbx], xmm0
lea rax, [rdx + 0xa1]
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], r8
cmp rdx, rax
jne 0x1400ec92c
mov qword [rbx + 0x10], r8
mov rax, rbx
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
add rsp, 0x30
pop rbx
ret
mov r8d, 0xa1
mov rcx, rbx
call fcn.1400e7f50
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x1400ec950
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor r8d, r8d
mov rbx, rdx
mov rdx, rcx
cmp byte [rcx + 0xa6], r8b
je 0x1400ec988
mov eax, r8d
nop dword [rax + rax]
lea ecx, [rax - 0x65]
xor byte [rdx + rax], cl
inc rax
cmp rax, 0xa5
jb 0x1400ec970
mov byte [rdx + 0xa6], r8b
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbx], xmm0
lea rax, [rdx + 0xa5]
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], r8
cmp rdx, rax
jne 0x1400ec9bc
mov qword [rbx + 0x10], r8
mov rax, rbx
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
add rsp, 0x30
pop rbx
ret
mov r8d, 0xa5
mov rcx, rbx
call fcn.1400e7f50
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x1400ec9e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor r8d, r8d
mov rbx, rdx
mov rdx, rcx
cmp byte [rcx + 0xa7], r8b
je 0x1400eca18
mov eax, r8d
nop dword [rax + rax]
lea ecx, [rax - 0x65]
xor byte [rdx + rax], cl
inc rax
cmp rax, 0xa6
jb 0x1400eca00
mov byte [rdx + 0xa7], r8b
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbx], xmm0
lea rax, [rdx + 0xa6]
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], r8
cmp rdx, rax
jne 0x1400eca4c
mov qword [rbx + 0x10], r8
mov rax, rbx
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
add rsp, 0x30
pop rbx
ret
mov r8d, 0xa6
mov rcx, rbx
call fcn.1400e7f50
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x1400eca70
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor r8d, r8d
mov rbx, rdx
mov rdx, rcx
cmp byte [rcx + 0xa8], r8b
je 0x1400ecaa8
mov eax, r8d
nop dword [rax + rax]
lea ecx, [rax - 0x65]
xor byte [rdx + rax], cl
inc rax
cmp rax, 0xa7
jb 0x1400eca90
mov byte [rdx + 0xa8], r8b
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbx], xmm0
lea rax, [rdx + 0xa7]
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], r8
cmp rdx, rax
jne 0x1400ecadc
mov qword [rbx + 0x10], r8
mov rax, rbx
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
add rsp, 0x30
pop rbx
ret
mov r8d, 0xa7
mov rcx, rbx
call fcn.1400e7f50
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x1400ecb00
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor r8d, r8d
mov rbx, rdx
mov rdx, rcx
cmp byte [rcx + 0xaa], r8b
je 0x1400ecb38
mov eax, r8d
nop dword [rax + rax]
lea ecx, [rax - 0x65]
xor byte [rdx + rax], cl
inc rax
cmp rax, 0xa9
jb 0x1400ecb20
mov byte [rdx + 0xaa], r8b
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbx], xmm0
lea rax, [rdx + 0xa9]
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], r8
cmp rdx, rax
jne 0x1400ecb6c
mov qword [rbx + 0x10], r8
mov rax, rbx
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
add rsp, 0x30
pop rbx
ret
mov r8d, 0xa9
mov rcx, rbx
call fcn.1400e7f50
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x1400ecb90
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor r8d, r8d
mov rbx, rdx
mov rdx, rcx
cmp byte [rcx + 0xab], r8b
je 0x1400ecbc8
mov eax, r8d
nop dword [rax + rax]
lea ecx, [rax - 0x65]
xor byte [rdx + rax], cl
inc rax
cmp rax, 0xaa
jb 0x1400ecbb0
mov byte [rdx + 0xab], r8b
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbx], xmm0
lea rax, [rdx + 0xaa]
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], r8
cmp rdx, rax
jne 0x1400ecbfc
mov qword [rbx + 0x10], r8
mov rax, rbx
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
add rsp, 0x30
pop rbx
ret
mov r8d, 0xaa
mov rcx, rbx
call fcn.1400e7f50
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x1400ecc20
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor r8d, r8d
mov rbx, rdx
mov rdx, rcx
cmp byte [rcx + 0xad], r8b
je 0x1400ecc58
mov eax, r8d
nop dword [rax + rax]
lea ecx, [rax - 0x65]
xor byte [rdx + rax], cl
inc rax
cmp rax, 0xac
jb 0x1400ecc40
mov byte [rdx + 0xad], r8b
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbx], xmm0
lea rax, [rdx + 0xac]
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], r8
cmp rdx, rax
jne 0x1400ecc8c
mov qword [rbx + 0x10], r8
mov rax, rbx
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
add rsp, 0x30
pop rbx
ret
mov r8d, 0xac
mov rcx, rbx
call fcn.1400e7f50
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x1400eccb0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor r8d, r8d
mov rbx, rdx
mov rdx, rcx
cmp byte [rcx + 0xae], r8b
je 0x1400ecce8
mov eax, r8d
nop dword [rax + rax]
lea ecx, [rax - 0x65]
xor byte [rdx + rax], cl
inc rax
cmp rax, 0xad
jb 0x1400eccd0
mov byte [rdx + 0xae], r8b
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbx], xmm0
lea rax, [rdx + 0xad]
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], r8
cmp rdx, rax
jne 0x1400ecd1c
mov qword [rbx + 0x10], r8
mov rax, rbx
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
add rsp, 0x30
pop rbx
ret
mov r8d, 0xad
mov rcx, rbx
call fcn.1400e7f50
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x1400ecd40
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor r8d, r8d
mov rbx, rdx
mov rdx, rcx
cmp byte [rcx + 0xb3], r8b
je 0x1400ecd78
mov eax, r8d
nop dword [rax + rax]
lea ecx, [rax - 0x65]
xor byte [rdx + rax], cl
inc rax
cmp rax, 0xb2
jb 0x1400ecd60
mov byte [rdx + 0xb3], r8b
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbx], xmm0
lea rax, [rdx + 0xb2]
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], r8
cmp rdx, rax
jne 0x1400ecdac
mov qword [rbx + 0x10], r8
mov rax, rbx
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
add rsp, 0x30
pop rbx
ret
mov r8d, 0xb2
mov rcx, rbx
call fcn.1400e7f50
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x1400ecdd0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor r8d, r8d
mov rbx, rdx
mov rdx, rcx
cmp byte [rcx + 0xb4], r8b
je 0x1400ece08
mov eax, r8d
nop dword [rax + rax]
lea ecx, [rax - 0x65]
xor byte [rdx + rax], cl
inc rax
cmp rax, 0xb3
jb 0x1400ecdf0
mov byte [rdx + 0xb4], r8b
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbx], xmm0
lea rax, [rdx + 0xb3]
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], r8
cmp rdx, rax
jne 0x1400ece3c
mov qword [rbx + 0x10], r8
mov rax, rbx
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
add rsp, 0x30
pop rbx
ret
mov r8d, 0xb3
mov rcx, rbx
call fcn.1400e7f50
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x1400ece60
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor r8d, r8d
mov rbx, rdx
mov rdx, rcx
cmp byte [rcx + 0xb6], r8b
je 0x1400ece98
mov eax, r8d
nop dword [rax + rax]
lea ecx, [rax - 0x65]
xor byte [rdx + rax], cl
inc rax
cmp rax, 0xb5
jb 0x1400ece80
mov byte [rdx + 0xb6], r8b
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbx], xmm0
lea rax, [rdx + 0xb5]
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], r8
cmp rdx, rax
jne 0x1400ececc
mov qword [rbx + 0x10], r8
mov rax, rbx
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
add rsp, 0x30
pop rbx
ret
mov r8d, 0xb5
mov rcx, rbx
call fcn.1400e7f50
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x1400ecef0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor r8d, r8d
mov rbx, rdx
mov rdx, rcx
cmp byte [rcx + 0xb8], r8b
je 0x1400ecf28
mov eax, r8d
nop dword [rax + rax]
lea ecx, [rax - 0x65]
xor byte [rdx + rax], cl
inc rax
cmp rax, 0xb7
jb 0x1400ecf10
mov byte [rdx + 0xb8], r8b
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbx], xmm0
lea rax, [rdx + 0xb7]
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], r8
cmp rdx, rax
jne 0x1400ecf5c
mov qword [rbx + 0x10], r8
mov rax, rbx
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
add rsp, 0x30
pop rbx
ret
mov r8d, 0xb7
mov rcx, rbx
call fcn.1400e7f50
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x1400ecf80
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor r8d, r8d
mov rbx, rdx
mov rdx, rcx
cmp byte [rcx + 0xbb], r8b
je 0x1400ecfb8
mov eax, r8d
nop dword [rax + rax]
lea ecx, [rax - 0x65]
xor byte [rdx + rax], cl
inc rax
cmp rax, 0xba
jb 0x1400ecfa0
mov byte [rdx + 0xbb], r8b
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbx], xmm0
lea rax, [rdx + 0xba]
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], r8
cmp rdx, rax
jne 0x1400ecfec
mov qword [rbx + 0x10], r8
mov rax, rbx
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
add rsp, 0x30
pop rbx
ret
mov r8d, 0xba
mov rcx, rbx
call fcn.1400e7f50
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x1400ed010
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor r8d, r8d
mov rbx, rdx
mov rdx, rcx
cmp byte [rcx + 0xbc], r8b
je 0x1400ed048
mov eax, r8d
nop dword [rax + rax]
lea ecx, [rax - 0x65]
xor byte [rdx + rax], cl
inc rax
cmp rax, 0xbb
jb 0x1400ed030
mov byte [rdx + 0xbc], r8b
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbx], xmm0
lea rax, [rdx + 0xbb]
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], r8
cmp rdx, rax
jne 0x1400ed07c
mov qword [rbx + 0x10], r8
mov rax, rbx
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
add rsp, 0x30
pop rbx
ret
mov r8d, 0xbb
mov rcx, rbx
call fcn.1400e7f50
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x1400ed0a0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor r8d, r8d
mov rbx, rdx
mov rdx, rcx
cmp byte [rcx + 0xbd], r8b
je 0x1400ed0d8
mov eax, r8d
nop dword [rax + rax]
lea ecx, [rax - 0x65]
xor byte [rdx + rax], cl
inc rax
cmp rax, 0xbc
jb 0x1400ed0c0
mov byte [rdx + 0xbd], r8b
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbx], xmm0
lea rax, [rdx + 0xbc]
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], r8
cmp rdx, rax
jne 0x1400ed10c
mov qword [rbx + 0x10], r8
mov rax, rbx
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
add rsp, 0x30
pop rbx
ret
mov r8d, 0xbc
mov rcx, rbx
call fcn.1400e7f50
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x1400ed130
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor r8d, r8d
mov rbx, rdx
mov rdx, rcx
cmp byte [rcx + 0xc6], r8b
je 0x1400ed168
mov eax, r8d
nop dword [rax + rax]
lea ecx, [rax - 0x65]
xor byte [rdx + rax], cl
inc rax
cmp rax, 0xc5
jb 0x1400ed150
mov byte [rdx + 0xc6], r8b
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbx], xmm0
lea rax, [rdx + 0xc5]
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], r8
cmp rdx, rax
jne 0x1400ed19c
mov qword [rbx + 0x10], r8
mov rax, rbx
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
add rsp, 0x30
pop rbx
ret
mov r8d, Ordinal_200
mov rcx, rbx
call fcn.1400e7f50
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x1400ed1c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor r8d, r8d
mov rbx, rdx
mov rdx, rcx
cmp byte [rcx + 0xcf], r8b
je 0x1400ed1f8
mov eax, r8d
nop dword [rax + rax]
lea ecx, [rax - 0x65]
xor byte [rdx + rax], cl
inc rax
cmp rax, 0xce
jb 0x1400ed1e0
mov byte [rdx + 0xcf], r8b
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbx], xmm0
lea rax, [rdx + 0xce]
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], r8
cmp rdx, rax
jne 0x1400ed22c
mov qword [rbx + 0x10], r8
mov rax, rbx
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
add rsp, 0x30
pop rbx
ret
mov r8d, Ordinal_211
mov rcx, rbx
call fcn.1400e7f50
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x1400ed250
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor r8d, r8d
mov rbx, rdx
mov rdx, rcx
cmp byte [rcx + 0xd3], r8b
je 0x1400ed288
mov eax, r8d
nop dword [rax + rax]
lea ecx, [rax - 0x65]
xor byte [rdx + rax], cl
inc rax
cmp rax, 0xd2
jb 0x1400ed270
mov byte [rdx + 0xd3], r8b
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbx], xmm0
lea rax, [rdx + 0xd2]
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], r8
cmp rdx, rax
jne 0x1400ed2bc
mov qword [rbx + 0x10], r8
mov rax, rbx
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
add rsp, 0x30
pop rbx
ret
mov r8d, Ordinal_211
mov rcx, rbx
call fcn.1400e7f50
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x1400fcb30
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov rsi, rdx
mov rdi, rcx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
mov r8d, dword [0x14031a0e8]
mov rax, qword gs:[0x58]
mov r14, qword [rax + r8*8]
mov r15d, 0x9cf8
mov eax, dword [r15 + r14]
mov r12d, 0x8970
test al, 1
jne 0x1400fcbd8
or eax, 1
mov dword [r15 + r14], eax
mov ebx, r12d
add rbx, r14
call sub.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_
mov dword [rbx + 0x1384], 0xffffffff
mov dword [rbx + 4], eax
lea edx, [rbp + 1]
lea r8, [rbx + 8]
nop word [rax + rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [r8], eax
inc rdx
lea r8, [r8 + 4]
cmp rdx, 0x270
jb 0x1400fcbb0
mov dword [rbx], 0x270
mov eax, dword [r15 + r14]
mov ebx, 0x9d00
test al, 2
jne 0x1400fcbf9
or eax, 2
mov dword [r15 + r14], eax
mov qword [r14 + rbx], rbp
mov qword [r14 + rbx + 8], reloc.WS2_32.dll_ntohs
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rbp
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
mov dword [rsp + 0x20], 1
cmp rsi, 0xf
jbe 0x1400fcc35
movzx r8d, byte [rsp + 0x60]
mov rdx, rsi
mov rcx, rdi
call fcn.1400e8e70
mov qword [rdi + 0x10], rbp
jmp 0x1400fcc3e
test rsi, rsi
je 0x1400fccca
lea r15, [r14 + rbx]
mov eax, r12d
add rax, r14
mov qword [rsp + 0x68], rax
movzx ebx, byte [rsp + 0x60]
dec rsi
mov r14, qword [0x1402c3200]
mov rbp, qword [r15]
mov rdx, qword [r15 + 8]
sub rdx, rbp
lea rcx, [rsp + 0x68]
cmp rdx, 0xffffffffffffffff
jne 0x1400fcc78
call fcn.140102430
jmp 0x1400fcc80
inc rdx
call fcn.1400ed9f0
add rax, r14
movzx r9d, byte [rax + rbp]
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x1400fccb4
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0xf
jbe 0x1400fcca9
mov rax, qword [rdi]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x1400fccc5
movzx r8d, bl
mov edx, 1
mov rcx, rdi
call fcn.14009e320
test rsi, rsi
jne 0x1400fcc52
mov rax, rdi
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140100c80
Capabilities:
Delete file
Encode data using xor
Execute command

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
xor ebx, ebx
mov dword [rbp - 0x40], 0xfabdffe8
mov ecx, ebx
mov dword [rbp - 0x3c], 0xd6c4ccfa
mov dword [rbp - 0x38], 0xc1d384c6
mov word [rbp - 0x34], Ordinal_200
mov byte [rbp - 0x32], 1
lea eax, [rcx - 0x65]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xd
jb 0x140100cb0
lea rcx, [rbp - 0x40]
mov byte [rbp - 0x32], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, rbx
mov dword [rbp - 0x40], 0xfabdffe8
mov dword [rbp - 0x3c], 0xd6c4ccfa
mov dword [rbp - 0x38], 0xc1d384c6
mov word [rbp - 0x34], 0xcc
mov byte [rbp - 0x32], 1
nop
lea eax, [rcx - 0x65]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xd
jb 0x140100cf0
lea rcx, [rbp - 0x40]
mov byte [rbp - 0x32], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
vmovdqu ymm0, ymmword [0x1401ee520]
vmovdqu ymmword [rbp - 0x31], ymm0
mov dword [rbp - 0x11], 0xdfc8dbd5
mov rcx, rbx
mov dword [rbp - 0xd], 0x100a4cd
nop dword [rax + rax]
lea eax, [rcx - 0x65]
xor byte [rbp + rcx - 0x31], al
inc rcx
cmp rcx, 0x26
jb 0x140100d30
mov byte [rbp - 0xa], bl
lea rcx, [rbp - 0x31]
vzeroupper
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
vmovdqu ymm0, ymmword [0x1401ee780]
vmovdqu ymmword [rbp - 0x31], ymm0
mov dword [rbp - 0x11], 0xcbdad2da
mov dword [rbp - 0xd], 0xa5b2de
mov byte [rbp - 9], 1
nop
lea eax, [rbx - 0x65]
xor byte [rbp + rbx - 0x31], al
inc rbx
cmp rbx, 0x27
jb 0x140100d70
mov byte [rbp - 9], 0
lea rcx, [rbp - 0x31]
vzeroupper
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x140102430
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
call fcn.1401027c0
mov r9, qword [rbx]
mov rdi, rax
shl rdi, 0x20
mov r10d, 0x270
mov ecx, dword [r9]
cmp ecx, r10d
jne 0x1401024a1
lea r8, [r9 + 8]
nop
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x140102460
mov ecx, dword [r9]
jmp 0x140102587
cmp ecx, 0x4e0
jb 0x140102587
lea r10, [r9 + 0x9c4]
mov ebx, 0xe3
mov r11d, dword [r10]
nop dword [rax]
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x1401024c0
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x140102510
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov rbx, qword [rsp + 0x30]
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
mov ecx, edx
xor rcx, rax
mov rax, rcx
shr rax, 0x12
xor rax, rcx
or rax, rdi
add rsp, 0x20
pop rdi
ret
Function at 0x1401025e0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, qword [rcx]
mov r9d, 0x138
mov ecx, dword [r10]
cmp ecx, r9d
jne 0x140102648
lea r8, [r10 + 0x10]
movabs r11, 0xb5026f5aa96619e9
mov rdx, qword [r8]
xor rdx, qword [r8 - 8]
lea r8, [r8 + 8]
and rdx, 0xffffffff80000000
xor rdx, qword [r8 - 8]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r8 + 0x4d0]
xor rcx, rdx
mov qword [r8 + 0x9b0], rcx
sub r9, 1
jne 0x140102603
mov ecx, dword [r10]
jmp 0x14010275a
cmp ecx, 0x270
jb 0x14010275a
mov qword [rsp + 0x10], rbx
movabs r11, 0xb5026f5aa96619e9
lea rbx, [r10 + 0x9c8]
mov qword [rsp], rdi
mov r9, qword [rbx]
mov edi, 0x9c
nop word [rax + rax]
mov r8, qword [rbx + 8]
mov rdx, rbx
xor r9, r8
add rbx, 8
and r9, 0xffffffff80000000
xor r9, r8
movzx eax, r9b
and al, 1
neg al
sbb rcx, rcx
shr r9, 1
and rcx, r11
xor rcx, qword [rdx + 0x4e0]
xor rcx, r9
mov r9, r8
mov qword [rdx - 0x9c0], rcx
sub rdi, 1
jne 0x140102680
lea rbx, [r10 + 0xea8]
mov edi, 0x9b
mov r9, qword [rbx]
mov r8, qword [rbx + 8]
mov rdx, rbx
xor r9, r8
add rbx, 8
and r9, 0xffffffff80000000
xor r9, r8
movzx eax, r9b
and al, 1
neg al
sbb rcx, rcx
shr r9, 1
and rcx, r11
xor rcx, qword [rdx - 0xea0]
xor rcx, r9
mov r9, r8
mov qword [rdx - 0x9c0], rcx
sub rdi, 1
jne 0x1401026d2
mov rdx, qword [r10 + 8]
xor rdx, qword [r10 + 0x1380]
mov rdi, qword [rsp]
and rdx, 0xffffffff80000000
xor rdx, qword [r10 + 8]
mov rbx, qword [rsp + 0x10]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r10 + 0x4e0]
xor rcx, rdx
mov qword [r10 + 0x9c0], rcx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov rdx, qword [r10 + rax*8 + 8]
lea eax, [rcx + 1]
mov dword [r10], eax
mov rcx, rdx
mov rax, qword [r10 + 0x1388]
shr rcx, 0x1d
and rax, rcx
movabs rcx, 0x38eb3ffff6d3
xor rdx, rax
mov rax, rdx
and rax, rcx
shl rax, 0x11
xor rdx, rax
mov rax, rdx
and rax, 0xffffffffffffbf77
shl rax, 0x25
xor rdx, rax
mov rax, rdx
shr rax, 0x2b
xor rax, rdx
add rsp, 8
ret
Function at 0x1401027c0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, qword [rcx]
mov r10d, 0x270
mov ecx, dword [r9]
cmp ecx, r10d
jne 0x140102821
lea r8, [r9 + 8]
nop dword [rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x1401027e0
mov ecx, dword [r9]
jmp 0x14010290b
cmp ecx, 0x4e0
jb 0x14010290b
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x140102840
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x140102890
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
mov ecx, edx
xor rcx, rax
mov rax, rcx
shr rax, 0x12
xor rax, rcx
add rsp, 8
ret