joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140083af0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, edx
nop dword [rax]
nop word [rax + rax]
sub rcx, 2
mov eax, 0x797422f6
sub eax, 0x3a4bade8
add eax, 0x391f98c6
sub eax, 0x6a51ae65
xor eax, 0x2e552de3
add eax, 0x527f1719
xor eax, 0x5dd92d80
xor eax, 0x53582dd5
add eax, 0x542942dd
mul r8d
shr edx, 3
movzx eax, dx
shl ax, 1
shl ax, 1
lea r9d, [rax + rdx]
add r9w, r9w
sub r8w, r9w
add r8w, 0x30
mov word [rcx], r8w
mov r8d, edx
test edx, edx
jne 0x140083b00
mov rax, rcx
ret

Function at 0x140083d80
Capabilities:
Encode data using xor

Disassembly:
xchg r13, rax
mov r13, r8
xchg r13, rax
cmp rcx, rdx
je 0x140083ebe
mov r9, rax
lea r8, [rcx + 0x38]
sub r9, rcx
xor r10d, r10d
nop dword [rax]
xorps xmm0, xmm0
lea r8, [r8 + 0x48]
movups xmmword [rax], xmm0
xchg rdi, r10
mov qword [r9 + r8 - 0x70], rdi
xchg r10, rdi
xchg r12, r10
mov qword [r9 + r8 - 0x68], r12
xchg r10, r12
xchg r8, r9
movups xmm0, xmmword [r9 - 0x80]
xchg r9, r8
xchg rdi, rax
movups xmmword [rdi], xmm0
xchg rdi, rax
xchg r8, rcx
movups xmm1, xmmword [rcx - 0x70]
xchg rcx, r8
xorps xmm0, xmm0
xchg r14, rax
movups xmmword [r14 + 0x10], xmm1
xchg r14, rax
mov qword [r8 - 0x70], r10
add rax, 0x48
mov qword [r8 - 0x68], 0x3000912e
add qword [r8 - 0x68], 0x20c1ac58
add qword [r8 - 0x68], 0x1f944e6f
sub qword [r8 - 0x68], 0x46c16df5
xor qword [r8 - 0x68], 0xd7ce17e
sub qword [r8 - 0x68], 0x24e9ff77
mov word [r8 - 0x80], r10w
xchg r11, r9
movups xmmword [r11 + r8 - 0x60], xmm0
xchg r9, r11
xchg r11, r10
mov qword [r9 + r8 - 0x50], r11
xchg r11, r10
mov qword [r9 + r8 - 0x48], r10
xchg r11, r8
movups xmm0, xmmword [r11 - 0x60]
xchg r11, r8
movups xmmword [r9 + r8 - 0x60], xmm0
movups xmm1, xmmword [r8 - 0x50]
xchg r9, rsi
movups xmmword [rsi + r8 - 0x50], xmm1
xchg rsi, r9
mov qword [r8 - 0x50], r10
mov qword [r8 - 0x48], 0x15fbc258
add qword [r8 - 0x48], 0xefebd0c
xor qword [r8 - 0x48], 0x6fa309e1
sub qword [r8 - 0x48], 0x1929f25d
xor qword [r8 - 0x48], 0x1a82beec
xor qword [r8 - 0x48], 0x62060a97
sub qword [r8 - 0x48], 0x4aab304c
mov word [r8 - 0x60], r10w
mov ecx, dword [r8 - 0x40]
mov dword [r9 + r8 - 0x40], ecx
lea rcx, [r8 - 0x38]
cmp rcx, rdx
jne 0x140083da4
ret
Function at 0x140083fd0
Capabilities:
Encode data using xor

Disassembly:
mov rax, r8
cmp rcx, rdx
je 0x14008409f
mov r9, rax
lea r8, [rcx + 0x18]
sub r9, rcx
xor r10d, r10d
nop word [rax + rax]
xorps xmm0, xmm0
lea r8, [r8 + 0x20]
xchg rsi, rax
movups xmmword [rsi], xmm0
xchg rsi, rax
mov qword [r9 + r8 - 0x28], r10
lea rcx, [r8 - 0x18]
xchg r10, r14
mov qword [r8 + r9 - 0x20], r14
xchg r14, r10
xchg r8, rcx
movups xmm0, xmmword [rcx - 0x38]
xchg rcx, r8
xchg r8, rax
movups xmmword [r8], xmm0
xchg r8, rax
movups xmm1, xmmword [r8 - 0x28]
xchg rsi, rax
movups xmmword [rsi + 0x10], xmm1
xchg rsi, rax
xchg r12, r10
mov qword [r8 - 0x28], r12
xchg r10, r12
neg rax
add rax, 0xffffffffffffffe0
neg rax
mov qword [r8 - 0x20], 0x230ed759
sub qword [r8 - 0x20], 0xe1aa3a3
xor qword [r8 - 0x20], 0x6a145e53
sub qword [r8 - 0x20], 0x532789d
xor qword [r8 - 0x20], 0x54a1050
xor qword [r8 - 0x20], 0x4678ed62
add qword [r8 - 0x20], 0x15f2f450
sub qword [r8 - 0x20], 0x39eee1f9
xor qword [r8 - 0x20], 0x16a31ad6
mov word [r8 - 0x38], r10w
cmp rcx, rdx
jne 0x140083ff4
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14008e4b0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 0x14], 0x62
sub byte [rcx + rax + 0x14], 0x5d
xor byte [rcx + rax + 0x14], 0x52
sub byte [rcx + rax + 0x14], 9
add byte [rcx + rax + 0x14], 0x1e
add byte [rcx + rax + 0x14], 0xc
sub byte [rcx + rax + 0x14], 0x78
inc rax
cmp rax, 0x24
jb 0x14008e4b2
ret
Function at 0x1400f0dc0
Capabilities:
Create thread

Disassembly:
xchg rbx, r14
mov qword [rsp + 8], r14
xchg rbx, r14
mov qword [rsp + 0x10], rdx
push rbp
nop
push 0x565189ca
mov qword [rsp], rsi
push rdi
sub rsp, 0x80
xchg rdi, r15
mov r15, r9
xchg r15, rdi
mov esi, r8d
mov rbx, rdx
xor ebp, ebp
lea rcx, [rsp + 0x50]
call fcn.140049a50
mov dword [rsp + 0x70], esi
mov qword [rsp + 0x78], rdi
lea ecx, [rbp + 0x30]
call fcn.1401fcb4c
test rax, rax
je 0x1400f0e53
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rsp + 0x60]
xchg r11, rax
movups xmmword [r11 + 0x10], xmm1
xchg r11, rax
movdqa xmm0, xmmword [0x140002c70]
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], bp
mov dword [rax + 0x20], esi
xchg r8, rdi
mov qword [rax + 0x28], r8
xchg r8, rdi
jmp 0x1400f0e56
mov rax, rbp
xchg r14, rax
mov qword [rsp + 0xb8], r14
xchg r14, rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebp
xchg r9, rax
mov rax, r9
xchg r9, rax
lea r8, [0x140081d10]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
xchg rsi, rax
mov qword [rsp + 0x30], rsi
xchg rsi, rax
test rax, rax
je 0x1400f0f1f
cmp dword [rsp + 0x38], 0
je 0x1400f0f5e
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x1400f0f17
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x50]
call fcn.14002f780
nop
xchg r8, rcx
mov r8, rbx
xchg rcx, r8
mov rbx, qword [rsp + 0xa0]
add rsp, 0x80
push rdx
push rbx
mov ecx, eax
call sub.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_
nop
mov dword [rsp + 0x38], ebp
mov ecx, 0x51c3feb8
add ecx, 0x2d06d4fa
sub ecx, 0xa15c964
sub ecx, 0xe18a66e
xor ecx, 0x211097ad
xor ecx, 0x76d1e509
xor ecx, 0x3fecf509
add ecx, 0x115cc229
xor ecx, 0x200ea670
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov ecx, 0x39eb7da6
xor ecx, 0x24557746
xor ecx, 0x7ccf416e
sub ecx, 0x596c80a7
xor ecx, 0x5f459b87
sub ecx, 0x5741515f
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x14015bfc0
Capabilities:
Encode data using xor

Disassembly:
test rdx, rdx
je 0x14015c1ce
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rcx, rdi
mov rdi, qword [rdx + 0x50]
xchg rdi, rcx
xchg rdx, r10
mov rdi, r10
xchg rdx, r10
mov qword [rsp + 0x30], rbx
xor ebx, ebx
test rcx, rcx
je 0x14015c051
mov rdx, qword [rdx + 0x60]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x14015c03a
xchg r8, rdi
mov rdi, qword [rcx - 8]
xchg rdi, r8
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14015c1d7
xchg rcx, rdx
mov rdx, r8
xchg rcx, rdx
call fcn.1401fcb88
mov qword [rdi + 0x50], rbx
mov qword [rdi + 0x58], rbx
xchg rbx, r8
mov qword [rdi + 0x60], r8
xchg r8, rbx
mov rcx, qword [rdi + 0x40]
mov rax, qword [rcx + 8]
mov qword [rax], rbx
mov rcx, qword [rcx]
test rcx, rcx
je 0x14015c0c8
nop word [rax + rax]
xchg rbx, r8
mov r8, qword [rcx]
xchg rbx, r8
mov edx, 0x6185c848
add edx, 0xd0df849
xor edx, 0x44bf7a09
add edx, 0x1e55c6ac
add edx, 0x14df6748
xor edx, 0x2026bf33
sub edx, 0x55210e8e
xor edx, 0x67c43d0b
sub edx, 0x4fe27422
call fcn.1401fcb88
xchg rbx, rcx
mov rbx, rcx
xchg rcx, rbx
test rbx, rbx
jne 0x14015c073
mov rcx, qword [rdi + 0x40]
mov edx, 0x132d3688
xor edx, 0x2f9d4db4
xor edx, 0x78bfc01c
xor edx, 0x915ceb7
xor edx, 0x6b323667
add edx, 0x3613a723
sub edx, 0x3af49e32
sub edx, 0x21474cc9
call fcn.1401fcb88
xchg rbx, r12
mov r12, qword [rdi + 0x28]
xchg rbx, r12
test rbx, rbx
je 0x14015c17f
mov qword [rsp + 0x38], rsi
mov esi, 0x314f9e6b
xor esi, 0x1e010c7c
xor esi, 0x19b24884
xor esi, 0x665aa229
sub esi, 0x3c9db7ad
add esi, 0xebf73ef2
mov eax, esi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x14015c17a
mov rax, qword [rbx]
xchg r11, rbx
mov rcx, r11
xchg rbx, r11
call qword [rax]
lock xadd dword [rbx + 0xc], esi
cmp esi, 1
jne 0x14015c17a
xchg r9, rax
mov r9, qword [rbx]
xchg r9, rax
xchg rbx, rsi
mov rcx, rsi
xchg rbx, rsi
call qword [rax + 8]
mov rsi, qword [rsp + 0x38]
mov edx, 0x61a1c592
sub edx, 0x44d342ce
xor edx, 0x70c48045
xor edx, 0x5c0cf892
add edx, 0x1635d3ef
sub edx, 0x33dc8d92
add edx, 0x12078b5a
add edx, 0x2bcf9edf
sub edx, 0x50376901
mov rcx, rdi
call fcn.1401fcb88
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140193f90
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
xchg rdx, r10
mov rdx, r10
xchg rdx, r10
mov r11, rcx
mov dword [rsp + 0x30], 0x525f199a
sub dword [rsp + 0x30], 0x24ca52d8
add dword [rsp + 0x30], 0x15497df
add dword [rsp + 0x30], 0x348f523c
xor dword [rsp + 0x30], 0x45898bc1
sub dword [rsp + 0x30], 0x206ad50f
xor dword [rsp + 0x30], 0x71ffbc35
xor dword [rsp + 0x30], 0x4b9d8f40
xor dword [rsp + 0x30], 0xca12a38e
mov dword [rsp + 0x36], 0x230ad9fb
add dword [rsp + 0x36], 0x23579cf8
xor dword [rsp + 0x36], 0x247e03c5
sub dword [rsp + 0x36], 0x5d2f907e
xor dword [rsp + 0x36], 0x1ae1ff16
add dword [rsp + 0x36], 0x605d408a
sub dword [rsp + 0x36], 0x1028a07c
add dword [rsp + 0x36], 0x9118439e
mov dword [rsp + 0x3a], 0x7f14705a
sub dword [rsp + 0x3a], 0x597e61c9
xor dword [rsp + 0x3a], 0x4b9ecdee
add dword [rsp + 0x3a], 0x967abd4
xor dword [rsp + 0x3a], 0x50f870a7
sub dword [rsp + 0x3a], 0x84f57f6
xor dword [rsp + 0x3a], 0xe06638a3
xor eax, eax
mov word [rsp + 0x3e], ax
xor ebx, ebx
mov edx, ebx
nop
movzx eax, word [rsp + rdx*2 + 0x36]
movzx ecx, byte [rsp + rdx + 0x30]
add cx, ax
mov word [rsp + rdx*2 + 0x36], cx
mov byte [rsp + rdx + 0x30], bl
inc rdx
cmp rdx, 4
jb 0x14019406e
xchg r14, rax
mov r14, qword [rsp + 0x70]
xchg r14, rax
xchg r14, rax
mov qword [rsp + 0x28], r14
xchg r14, rax
mov qword [rsp + 0x20], r9
mov r9, r8
lea r8, [rsp + 0x36]
mov rdx, r10
xchg rcx, r14
mov r14, r11
xchg r14, rcx
call fcn.140194110
nop
mov byte [rsp + rbx + 0x36], reloc.SHLWAPI.dll_SHCreateMemStream
add byte [rsp + rbx + 0x36], 0x37
add byte [rsp + rbx + 0x36], 9
xor byte [rsp + rbx + 0x36], 0x27
sub byte [rsp + rbx + 0x36], 0x1c
xor byte [rsp + rbx + 0x36], 0x63
xor byte [rsp + rbx + 0x36], 0x2c
inc rbx
cmp rbx, 8
jb 0x1401940c2
add rsp, 0x40
nop
add rsp, 8
xchg qword [rsp - 8], rbx
ret
Function at 0x1401aae00
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xchg r11, r10
mov r10, rdx
xchg r10, r11
mov r10, rcx
test rdx, rdx
je 0x1401aae84
xchg rcx, rbx
mov qword [rsp], rcx
xchg rcx, rbx
movzx ebx, byte [rsp + 0x30]
test r9, r9
je 0x1401aae71
movzx eax, byte [r10]
test bl, bl
je 0x1401aae53
lea rcx, [r9 - 1]
xchg r13, r9
mov rdx, r13
xchg r13, r9
add rcx, r8
nop
xor al, byte [rcx]
lea rcx, [rcx - 1]
mov byte [r10], al
sub rdx, 1
jne 0x1401aae42
jmp 0x1401aae71
xor ecx, ecx
nop dword [rax]
nop word [rax + rax]
xor al, byte [rcx + r8]
inc rcx
mov byte [r10], al
cmp rcx, r9
jb 0x1401aae62
inc r10
sub r11, 1
jne 0x1401aae24
xchg rbx, rcx
mov rcx, qword [rsp]
xchg rbx, rcx
add rsp, 8
ret
Function at 0x1401afd90
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
xchg rbx, r10
mov qword [rsp + 8], r10
xchg rbx, r10
xchg rbp, rsi
mov qword [rsp + 0x10], rsi
xchg rsi, rbp
xchg rsi, r13
mov qword [rsp + 0x20], r13
xchg r13, rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
mov eax, 0x6ed53fe3
sub eax, 0x16d2d80f
add eax, 0x140c1ebc
sub eax, 0xbc73c43
sub eax, 0x55942354
add eax, 0xf461e8
sub eax, 0xba77531
call fcn.1401fcf00
sub rsp, rax
mov ebx, edx
mov edi, ecx
call sub.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_
mov dword [rsp + 0x24], eax
mov r9d, 0x74d1178c
sub r9d, 0x1f1264cb
xor r9d, 0x4f305a55
xor r9d, 0x37c619e
add r9d, 0x4b4b60b3
sub r9d, 0x653de9bc
mov dword [rsp + 0x13a4], 0x65201a79
xor dword [rsp + 0x13a4], 0x57dbed2
sub dword [rsp + 0x13a4], 0x29203846
sub dword [rsp + 0x13a4], 0x7659ef4
xor dword [rsp + 0x13a4], 0x3c7e3f93
add dword [rsp + 0x13a4], 0x2b05d075
xor dword [rsp + 0x13a4], 0x423c230d
add dword [rsp + 0x13a4], 0x836c1fa5
nop dword [rax + rax]
mov r8d, eax
shr r8d, 2
shr r8d, 0x1b
shr r8d, 1
xor r8d, eax
imul eax, r8d, 0x6c078965
add eax, r9d
mov dword [rsp + r9*4 + 0x24], eax
inc r9
cmp r9, 0x270
jb 0x1401afe79
mov ebp, 0x283362e7
sub ebp, 0xd92d3a8
add ebp, 0x9c5f5d1
xor ebp, 0xd3f0d32
xor ebp, 0x37358b38
add ebp, 0x33e9aa7a
xor ebp, 0x349f6a78
sub ebp, 0x1169b751
add ebp, 0x2a9eef65
mov dword [rsp + 0x20], 0x51d0637c
sub dword [rsp + 0x20], 0xee60bc9
sub dword [rsp + 0x20], 0x27e1322
xor dword [rsp + 0x20], 0x772db0e6
add dword [rsp + 0x20], 0x3cae3d44
sub dword [rsp + 0x20], 0x73f02f4b
cmp edi, ebp
lea rax, [rsp + 0x20]
mov qword [rsp + 0x13d0], rax
lea rcx, [rsp + 0x13d0]
lea eax, [rdi - 0x80000000]
lea esi, [rdi + rbp]
cmovae esi, eax
lea edi, [rbx + rbp]
cmp ebx, ebp
lea eax, [rbx - 0x80000000]
cmovae edi, eax
sub edi, esi
cmp edi, 0xffffffff
jne 0x1401aff56
call fcn.1401b0210
mov ecx, eax
jmp 0x1401affc3
inc edi
mov ebx, edi
call fcn.1401b0210
mov ecx, eax
imul rcx, rbx
cmp ecx, edi
jae 0x1401affa6
mov eax, edi
xor edx, edx
neg eax
div edi
mov edi, edx
cmp ecx, edx
jae 0x1401affa6
nop dword [rax]
nop dword [rax + rax]
lea rcx, [rsp + 0x13d0]
call fcn.1401b0210
mov ecx, eax
imul rcx, rbx
cmp ecx, edi
jb 0x1401aff8b
shr rcx, 0xb
shr rcx, 1
shr rcx, 0xa
shr rcx, 2
shr rcx, 2
shr rcx, 4
shr rcx, 1
shr rcx, 1
lea edx, [rsi + rcx]
lea r11, [rsp + 0x13b0]
cmp edx, ebp
xchg rbx, r12
mov r12, qword [r11 + 0x10]
xchg rbx, r12
lea eax, [rdx + rbp]
xchg r13, rbp
mov r13, qword [r11 + 0x18]
xchg r13, rbp
lea ecx, [rdx - 0x80000000]
xchg rsi, rcx
mov rcx, qword [r11 + 0x28]
xchg rcx, rsi
cmovae eax, ecx
mov rsp, r11
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x1401b0210
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
xchg r10, rsi
mov rsi, qword [rcx]
xchg r10, rsi
mov r9d, 0x3955beab
add r9d, 0x29f4effa
xor r9d, 0x68471a5a
add r9d, 0x2e40f3aa
add r9d, 0xc180f89
add r9d, 0x129b3984
add r9d, 0x732e7ef
sub r9d, 0x5f34d735
mov ecx, dword [r10]
cmp ecx, r9d
jne 0x1401b02b0
lea r8, [r10 + 8]
nop dword [rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x1401b026b
mov ecx, dword [r10]
jmp 0x1401b0401
cmp ecx, 0x4e0
jb 0x1401b0401
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0x75315026
xor ebx, 0x4b6fccde
xor ebx, 0x12ab178d
xor ebx, 0x1b54768a
sub ebx, 0x5c56930
sub ebx, 0x128c9352
add ebx, 0x12e2a90f
sub ebx, 0x3232a9a9
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1401b02f9
lea r11, [r10 + 0xd50]
mov ebx, 0x5a0bae27
add ebx, 0x1af1e414
sub ebx, 0x12d9bc9c
sub ebx, 0x43804ca5
add ebx, 0x4267ecd6
xor ebx, 0x3ae1d845
xor ebx, 0x62ffc177
xor ebx, 0xd4a95c8
sub ebx, 0x345ff79e
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1401b037d
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
xchg r12, rbx
mov r12, qword [rsp]
xchg rbx, r12
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 7
shr ecx, 1
shr ecx, 1
shr ecx, 1
shr ecx, 1
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 4
shl eax, 1
shl eax, 1
shl eax, 1
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 6
shl eax, 2
shl eax, 3
shl eax, 1
shl eax, 1
shl eax, 1
shl eax, 1
xor edx, eax
mov eax, edx
shr eax, 5
shr eax, 9
shr eax, 4
xor eax, edx
add rsp, 8
ret
Function at 0x1401b0a00
Capabilities:
Encode data using xor

Disassembly:
xchg r12, rbx
mov qword [rsp + 8], r12
xchg rbx, r12
push rdi
sub rsp, 0x20
mov eax, dword [rcx + 0x40]
xchg rdx, r13
mov rdi, r13
xchg r13, rdx
mov rbx, rcx
mov byte [rax + rcx], 0x7b
sub byte [rax + rcx], 0x64
add byte [rax + rcx], 0x49
xor byte [rax + rcx], 0x30
xor byte [rax + rcx], 0x1a
xor byte [rax + rcx], 0x46
xor byte [rax + rcx], 0x8c
lea r8d, [rax + 1]
cmp eax, 0x38
jae 0x1401b0a8d
cmp r8d, 0x38
jae 0x1401b0b02
mov ecx, r8d
mov eax, 0xcdc3dca
add eax, 0xe0a025f
add eax, 0x5e778e39
sub eax, 0x208d5430
add eax, 0x2b932f
xor eax, 0x75e47501
sub eax, 0x2d187828
sub eax, r8d
add rcx, rbx
mov r8d, eax
xor edx, edx
call sub.VCRUNTIME140.dll_memset
jmp 0x1401b0b02
cmp r8d, 0x40
jae 0x1401b0ac8
mov ecx, r8d
mov eax, 0x3ea218c0
sub eax, 0x183a7ae5
add eax, 0x4ac32624
xor eax, 0x7db193b8
add eax, 0x63b1408b
xor eax, 0x704c9092
sub eax, r8d
add rcx, rbx
mov r8d, eax
xor edx, edx
call sub.VCRUNTIME140.dll_memset
xchg rcx, rdx
mov rcx, rbx
xchg rdx, rcx
mov rcx, rbx
call fcn.1401b0e60
xorps xmm0, xmm0
xor eax, eax
xchg r12, rbx
movups xmmword [r12], xmm0
xchg r12, rbx
xchg r8, rbx
movups xmmword [r8 + 0x10], xmm0
xchg rbx, r8
xchg rbx, rcx
movups xmmword [rcx + 0x20], xmm0
xchg rbx, rcx
mov qword [rbx + 0x30], rax
mov edx, dword [rbx + 0x40]
xchg rbx, rcx
mov rbx, rcx
xchg rbx, rcx
shl edx, 3
add rdx, qword [rbx + 0x48]
mov rax, rdx
xchg r8, rdx
mov qword [rbx + 0x48], r8
xchg r8, rdx
shr rax, 4
shr rax, 3
shr rax, 1
mov byte [rbx + 0x3e], al
mov rax, rdx
shr rax, 4
shr rax, 0xa
shr rax, 1
shr rax, 1
mov byte [rbx + 0x3d], al
xchg rdx, rax
mov rdx, rax
xchg rdx, rax
shr rax, 0xc
shr rax, 1
shr rax, 1
shr rax, 1
shr rax, 1
shr rax, 5
shr rax, 1
shr rax, 1
shr rax, 1
mov byte [rbx + 0x3c], al
mov rax, rdx
shr rax, 7
shr rax, 8
shr rax, 1
shr rax, 0xd
shr rax, 2
shr rax, 1
mov byte [rbx + 0x3b], al
xchg rdx, rax
mov rdx, rax
xchg rdx, rax
shr rax, 0x1e
shr rax, 1
shr rax, 8
shr rax, 1
mov byte [rbx + 0x3a], al
xchg rdx, rbp
mov rax, rbp
xchg rbp, rdx
mov byte [rbx + 0x3f], dl
shr rdx, 0x2e
shr rdx, 5
shr rdx, 3
shr rdx, 2
mov byte [rbx + 0x38], dl
xchg rdx, rbx
mov rbx, rdx
xchg rbx, rdx
shr rax, 0x22
shr rax, 8
shr rax, 3
shr rax, 2
shr rax, 1
mov byte [rbx + 0x39], al
call fcn.1401b0e60
xor r8d, r8d
lea rdx, [rdi + 8]
nop dword [rax]
nop word [rax + rax]
mov eax, dword [rbx + 0x50]
lea rdx, [rdx + 1]
mov ecx, 0x3c2a38a7
sub ecx, 0x1660b059
sub ecx, 0x1dda7118
xor ecx, 0x1f07725e
add ecx, 0x110d27c2
sub ecx, 0x29f58d12
lea rdi, [rdi + 1]
sub ecx, r8d
neg r8d
add r8d, 0xfffffff8
neg r8d
shr eax, cl
mov byte [rdi - 1], al
mov eax, dword [rbx + 0x54]
shr eax, cl
mov byte [rdx - 5], al
mov eax, dword [rbx + 0x58]
shr eax, cl
mov byte [rdx - 1], al
mov eax, dword [rbx + 0x5c]
shr eax, cl
mov byte [rdx + 3], al
mov eax, dword [rbx + 0x60]
shr eax, cl
mov byte [rdx + 7], al
cmp r8d, 0x20
jb 0x1401b0bf6
xchg r14, rbx
mov r14, qword [rsp + 0x30]
xchg rbx, r14
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1401ba170
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x1401b97bb
mov rdx, qword [rbx + 0x28]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x1401b97a4
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1401b97d1
xchg rbp, r8
mov rcx, rbp
xchg r8, rbp
call fcn.1401fcb88
xor eax, eax
mov qword [rbx + 0x18], rax
mov qword [rbx + 0x20], rax
xchg rsi, rax
mov qword [rbx + 0x28], rsi
xchg rsi, rax
lea rcx, [rbx + 8]
add rsp, 0x20
nop
mov rbx, qword [rsp]
add rsp, 8
jmp 0x1401ba170
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
xchg rbx, r10
mov qword [rsp + 0x10], r10
xchg rbx, r10
nop
mov qword [rsp - 8], rsi
sub rsp, 8
sub rsp, 0x20
xchg r12, rbx
mov r12, qword [rcx]
xchg r12, rbx
xchg rsi, rcx
mov rcx, rsi
xchg rsi, rcx
mov rax, qword [rbx + 8]
mov qword [rax], 0x5a8d196d
sub qword [rax], 0x1ace9790
xor qword [rax], 0x2be57294
sub qword [rax], 0x11909163
add qword [rax], 0x708c017f
xor qword [rax], 0x73576365
mov rbx, qword [rbx]
test rbx, rbx
je 0x1401ba23f
mov qword [rsp + 0x30], rdi
nop dword [rax + rax]
mov rdi, qword [rbx]
lea rdx, [rbx + 0x10]
xchg rcx, r14
mov r14, rsi
xchg rcx, r14
call fcn.1401b3200
mov edx, 0x524909a2
sub edx, 0x348d58e
xor edx, 0x726d61da
xor edx, 0x5dddc64d
xor edx, 0x68a6cddb
sub edx, 0x8165e08
xchg r15, rbx
mov rcx, r15
xchg rbx, r15
call fcn.1401fcb88
mov rbx, rdi
test rdi, rdi
jne 0x1401ba1e2
xchg rdi, r9
mov r9, qword [rsp + 0x30]
xchg rdi, r9
mov rcx, qword [rsi]
mov edx, 0x7eccf956
sub edx, 0x50f66ee7
sub edx, 0x186a7ba6
xor edx, 0x6012d617
xor edx, 0x29bfe56b
xor edx, 0x11e72091
xor edx, 0x6af468a5
xor edx, 0x366e82e2
sub edx, 0x11bcf713
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
nop
mov rsi, qword [rsp]
add rsp, 8
jmp fcn.1401fcb88
Function at 0x1401ba290
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp - 8], rbx
sub rsp, 8
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x1401b984b
mov rdx, qword [rbx + 0x28]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x1401b9838
xchg r8, r11
mov r11, qword [rcx - 8]
xchg r11, r8
neg rdx
add rdx, 0xffffffffffffffd9
neg rdx
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1401b9869
xchg rsi, rcx
mov rsi, r8
xchg rcx, rsi
call fcn.1401fcb88
xor eax, eax
mov qword [rbx + 0x18], rax
mov qword [rbx + 0x20], rax
mov qword [rbx + 0x28], rax
lea rcx, [rbx + 8]
add rsp, 0x20
push rdx
push rdx
push rcx
push rcx
push rcx
push rax
push rax
push rdx
xchg qword [rsp + 0x40], rbx
add rsp, 0x48
jmp 0x1401ba290
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
xchg rbx, r14
mov qword [rsp + 0x10], r14
xchg r14, rbx
nop
sub rsp, 8
mov qword [rsp], rsi
sub rsp, 0x20
xchg rbx, r12
mov r12, qword [rcx]
xchg r12, rbx
mov rsi, rcx
mov rax, qword [rbx + 8]
mov qword [rax], 0x10c204b6
add qword [rax], 0x50b3e924
sub qword [rax], 0x45d78762
xor qword [rax], 0x315ae7fe
add qword [rax], 0x38533f0f
sub qword [rax], 0x1defc49b
add qword [rax], 0x16cb393a
sub qword [rax], 0x5bf33534
mov rbx, qword [rbx]
test rbx, rbx
je 0x1401ba37b
xchg rbx, rdi
mov qword [rsp + 0x30], rbx
xchg rdi, rbx
nop dword [rax + rax]
xchg rdi, r9
mov r9, qword [rbx]
xchg rdi, r9
lea rcx, [rbx + 0x10]
call fcn.1401ba3d0
mov edx, 0x3c559501
xor edx, 0x57fd8729
add edx, 0x11df2487
xor edx, 0x5fcd17ab
xor edx, 0x152b5362
add edx, 0x3eab6c37
sub edx, 0x682d7c1a
sub edx, 0xddf6243
xchg rbx, rcx
mov rbx, rcx
xchg rcx, rbx
call fcn.1401fcb88
xchg rbx, rdi
mov rdi, rbx
xchg rdi, rbx
test rdi, rdi
jne 0x1401ba30f
xchg rsi, rdi
mov rsi, qword [rsp + 0x30]
xchg rdi, rsi
xchg r11, rcx
mov r11, qword [rsi]
xchg rcx, r11
mov edx, 0x64bfa4e9
xor edx, 0x6f5517ad
xor edx, 0x7faf292e
xor edx, 0x81fdcc9
xor edx, 0x7f660fab
add edx, 0x437b191
sub edx, 0x773fa59
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
push rbx
push rbx
push rcx
xchg qword [rsp + 0x18], rsi
pop rcx
pop rbx
pop rbx
add rsp, 8
jmp fcn.1401fcb88