joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400812a0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rdi
mov qword [rsp + 0x10], rdi
xchg rdi, rbx
mov qword [rsp + 0x18], rbp
nop
sub rsp, 8
mov qword [rsp], rsi
sub rsp, 0x20
cmp byte [r8 + 0x19], 0
mov rbx, r8
xchg rsi, rdx
mov rdx, rsi
xchg rdx, rsi
xchg rbp, rcx
mov rcx, rbp
xchg rbp, rcx
jne 0x14008136a
xchg rsi, rdi
mov qword [rsp + 0x30], rsi
xchg rsi, rdi
nop dword [rax]
nop dword [rax + rax]
mov r8, qword [rbx + 0x10]
xchg rdi, rsi
mov rdx, rdi
xchg rsi, rdi
xchg rbp, rcx
mov rbp, rcx
xchg rcx, rbp
call fcn.1400812a0
mov rdi, rbx
mov rbx, qword [rbx]
lea rcx, [rdi + 0x28]
call fcn.1400917a0
mov edx, 0x2c291f44
add edx, 0x5b988c7
xor edx, 0x6e25d75e
xor edx, 0x1d9e5b47
xor edx, 0x28847a93
sub edx, 0x1f8b9a85
add edx, 0x1f633d6e
xor edx, 0x6ab501f2
xchg r12, rcx
mov r12, rdi
xchg rcx, r12
call fcn.1401fcba8
cmp byte [rbx + 0x19], 0
je 0x1400812f4
mov rdi, qword [rsp + 0x30]
xchg rcx, rbx
mov rcx, qword [rsp + 0x38]
xchg rcx, rbx
xchg rbp, r11
mov r11, qword [rsp + 0x40]
xchg r11, rbp
add rsp, 0x20
push rax
push rbx
push rcx
xchg qword [rsp + 0x18], rsi
add rsp, 0x20
ret
Function at 0x140083e50
Capabilities:
Encode data using xor

Disassembly:
mov r8d, edx
nop dword [rax]
nop word [rax + rax]
neg rcx
sub rcx, 0xfffffffffffffffe
neg rcx
mov eax, 0x5475d40b
sub eax, 0x3268f1a0
sub eax, 0x1675d515
xor eax, 0x67493e4a
xor eax, 0x755c9ce1
add eax, 0x1f1f251
add eax, 0xb1582a7f
mul r8d
shr edx, 2
shr edx, 1
movzx eax, dx
shl ax, 1
shl ax, 1
lea r9d, [rax + rdx]
add r9w, r9w
sub r8w, r9w
neg r8w
add r8w, 0xffd0
neg r8w
mov word [rcx], r8w
mov r8d, edx
test edx, edx
jne 0x140083e60
xchg rcx, rax
mov rcx, rax
xchg rcx, rax
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x140084150
Capabilities:
Encode data using xor

Disassembly:
xchg r15, r8
mov rax, r15
xchg r8, r15
cmp rcx, rdx
je 0x14008429c
xchg r9, rax
mov rax, r9
xchg r9, rax
lea r8, [rcx + 0x38]
sub r9, rcx
xor r10d, r10d
nop dword [rax]
xorps xmm0, xmm0
lea r8, [r8 + 0x48]
xchg r9, rax
movups xmmword [r9], xmm0
xchg r9, rax
mov qword [r9 + r8 - 0x70], r10
xchg r15, r10
mov qword [r9 + r8 - 0x68], r15
xchg r10, r15
xchg r10, r8
movups xmm0, xmmword [r10 - 0x80]
xchg r10, r8
xchg rdi, rax
movups xmmword [rdi], xmm0
xchg rdi, rax
movups xmm1, xmmword [r8 - 0x70]
xorps xmm0, xmm0
xchg r11, rax
movups xmmword [r11 + 0x10], xmm1
xchg r11, rax
xchg r10, rbx
mov qword [r8 - 0x70], rbx
xchg rbx, r10
nop
add rax, 0x67c07a11
sub rax, 0x67c079c9
mov qword [r8 - 0x68], 0x339c36ee
add qword [r8 - 0x68], 0x6b287b0
add qword [r8 - 0x68], 0x4a0390b
sub qword [r8 - 0x68], 0x3cfd1aea
add qword [r8 - 0x68], 0x38bf46d5
sub qword [r8 - 0x68], 0x3ab1238d
mov word [r8 - 0x80], r10w
xchg r10, r9
movups xmmword [r10 + r8 - 0x60], xmm0
xchg r10, r9
mov qword [r9 + r8 - 0x50], r10
xchg r10, rdi
mov qword [r9 + r8 - 0x48], rdi
xchg r10, rdi
movups xmm0, xmmword [r8 - 0x60]
xchg rdx, r9
movups xmmword [rdx + r8 - 0x60], xmm0
xchg r9, rdx
xchg r8, rcx
movups xmm1, xmmword [rcx - 0x50]
xchg rcx, r8
movups xmmword [r9 + r8 - 0x50], xmm1
mov qword [r8 - 0x50], r10
mov qword [r8 - 0x48], 0x567ade84
sub qword [r8 - 0x48], 0x464144fa
xor qword [r8 - 0x48], 0x3cb0bf1
add qword [r8 - 0x48], 0x2e31357b
xor qword [r8 - 0x48], 0xed04a4e
sub qword [r8 - 0x48], 0x49cd90c7
sub qword [r8 - 0x48], 0x325fcea
mov word [r8 - 0x60], r10w
mov ecx, dword [r8 - 0x40]
mov dword [r9 + r8 - 0x40], ecx
lea rcx, [r8 - 0x38]
cmp rcx, rdx
jne 0x14008417a
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1400842b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
xchg rbx, r8
mov r8, rbx
xchg r8, rbx
cmp rcx, rdx
je 0x140084380
xchg rbx, rax
mov rbx, rax
xchg rbx, rax
lea r8, [rcx + 0x18]
sub rax, rcx
xor r10d, r10d
nop dword [rax + rax]
xorps xmm0, xmm0
lea r8, [r8 + 0x20]
xchg rbx, r13
movups xmmword [r13], xmm0
xchg r13, rbx
mov qword [rax + r8 - 0x28], r10
lea rcx, [r8 - 0x18]
mov qword [r8 + rax - 0x20], r10
xchg r8, r10
movups xmm0, xmmword [r10 - 0x38]
xchg r8, r10
xchg rbx, rcx
movups xmmword [rcx], xmm0
xchg rbx, rcx
movups xmm1, xmmword [r8 - 0x28]
xchg rbx, r13
movups xmmword [r13 + 0x10], xmm1
xchg rbx, r13
xchg r10, rsi
mov qword [r8 - 0x28], rsi
xchg r10, rsi
nop
add rbx, 0x667a1810
sub rbx, 0x667a17f0
mov qword [r8 - 0x20], 0x7e9fa063
sub qword [r8 - 0x20], 0x77a80ca
add qword [r8 - 0x20], 0x327a471
sub qword [r8 - 0x20], 0x52b356df
add qword [r8 - 0x20], 0x347aea63
sub qword [r8 - 0x20], 0x570873a7
xor qword [r8 - 0x20], 0x50be3e8
mov byte [r8 - 0x38], r10b
cmp rcx, rdx
jne 0x1400842de
mov r8, r9
xchg r9, rdx
mov r9, rbx
xchg r9, rdx
xchg r10, rbx
mov rcx, r10
xchg rbx, r10
call fcn.14007f380
xchg r10, rax
mov r10, rbx
xchg r10, rax
add rsp, 0x20
nop
xchg qword [rsp], rbx
add rsp, 8
ret

Function at 0x1400843b0
Capabilities:
Encode data using xor

Disassembly:
mov rax, r8
cmp rcx, rdx
je 0x140084475
mov r9, rax
lea r8, [rcx + 0x18]
sub r9, rcx
xor r10d, r10d
nop word [rax + rax]
xorps xmm0, xmm0
lea r8, [r8 + 0x20]
xchg r12, rax
movups xmmword [r12], xmm0
xchg r12, rax
xchg rbp, r10
mov qword [r9 + r8 - 0x28], rbp
xchg rbp, r10
lea rcx, [r8 - 0x18]
xchg r10, rsi
mov qword [r8 + r9 - 0x20], rsi
xchg rsi, r10
movups xmm0, xmmword [r8 - 0x38]
xchg r11, rax
movups xmmword [r11], xmm0
xchg r11, rax
xchg r8, rbx
movups xmm1, xmmword [rbx - 0x28]
xchg rbx, r8
movups xmmword [rax + 0x10], xmm1
xchg r10, r9
mov qword [r8 - 0x28], r9
xchg r9, r10
sub rax, 0xffffffffffffffe0
mov qword [r8 - 0x20], 0x6b555ed9
sub qword [r8 - 0x20], 0xe438fe9
add qword [r8 - 0x20], 0x14c467ca
sub qword [r8 - 0x20], 0x260d0dcb
sub qword [r8 - 0x20], 0x4b87784
sub qword [r8 - 0x20], 0x3f8a7fa
xor qword [r8 - 0x20], 0x79cdd2b6
sub qword [r8 - 0x20], 0x3ad5dbc0
mov word [r8 - 0x38], r10w
cmp rcx, rdx
jne 0x1400843d4
ret
Function at 0x14008e910
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 0x14], 0x51
add byte [rcx + rax + 0x14], 0x19
xor byte [rcx + rax + 0x14], 0x4d
xor byte [rcx + rax + 0x14], 0x13
add byte [rcx + rax + 0x14], 0xe
add byte [rcx + rax + 0x14], 0x39
sub byte [rcx + rax + 0x14], 0x7b
inc rax
cmp rax, 0x24
jb 0x14008e912
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1400f14b0
Capabilities:
Create thread

Disassembly:
xchg rsi, rbx
mov qword [rsp + 8], rsi
xchg rbx, rsi
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rbp
sub rsp, 8
push rsi
push rdi
sub rsp, 0x80
mov rdi, r9
mov esi, r8d
xchg rbx, rdx
mov rdx, rbx
xchg rdx, rbx
xor ebp, ebp
lea rcx, [rsp + 0x50]
call fcn.140049ae0
mov dword [rsp + 0x70], esi
xchg rdi, r9
mov qword [rsp + 0x78], r9
xchg r9, rdi
lea ecx, [rbp + 0x30]
call fcn.1401fcb6c
test rax, rax
je 0x1400f1542
movups xmm0, xmmword [rsp + 0x50]
xchg rsi, rax
movups xmmword [rsi], xmm0
xchg rsi, rax
movups xmm1, xmmword [rsp + 0x60]
movups xmmword [rax + 0x10], xmm1
movdqa xmm0, xmmword [0x140002c70]
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], bp
mov dword [rax + 0x20], esi
mov qword [rax + 0x28], rdi
jmp 0x1400f154b
xchg rbp, rdi
mov rax, rdi
xchg rbp, rdi
xchg r8, rax
mov qword [rsp + 0xb8], r8
xchg r8, rax
lea rcx, [rsp + 0x38]
xchg r13, rcx
mov qword [rsp + 0x28], r13
xchg r13, rcx
mov dword [rsp + 0x20], ebp
xchg r9, rax
mov rax, r9
xchg r9, rax
lea r8, [0x140082120]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
xchg rbx, rax
mov qword [rsp + 0x30], rbx
xchg rbx, rax
test rax, rax
je 0x1400f1625
cmp dword [rsp + 0x38], 0
je 0x1400f1664
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x1400f161d
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x50]
call fcn.14002f810
nop
xchg rcx, rbx
mov rbx, rcx
xchg rcx, rbx
xchg rbx, r8
mov r8, qword [rsp + 0xa0]
xchg rbx, r8
add rsp, 0x80
nop
xchg qword [rsp], rdi
add rsp, 8
push rcx
push rcx
push rax
push rbx
push rbx
push rdx
push rcx
xchg qword [rsp + 0x38], rsi
pop rcx
pop rdx
pop rbx
pop rbx
pop rax
pop rcx
pop rcx
add rsp, 8
nop
xchg qword [rsp], rbp
add rsp, 8
jmp fcn.14002f810
mov ecx, eax
call sub.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_
nop
mov dword [rsp + 0x38], ebp
mov ecx, 0x5be2028f
sub ecx, 0x57a84153
xor ecx, 0x23ef308d
add ecx, 0x23d6456b
sub ecx, 0x13a471c0
add ecx, 0x278ef7a1
xor ecx, 0x62d5e537
xor ecx, 0x6711ad27
sub ecx, 0x5a53f4e7
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov ecx, 0x4015951b
xor ecx, 0x5c39de5b
add ecx, 0x3301ce0b
sub ecx, 0x24f8aa50
add ecx, 0x3ba04cca
xor ecx, 0x1bc1d704
xor ecx, 0x7e146cc0
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x14015c930
Capabilities:
Encode data using xor

Disassembly:
test rdx, rdx
je 0x14015cb34
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rbp, rcx
mov rbp, qword [rdx + 0x50]
xchg rcx, rbp
xchg r9, rdx
mov rdi, r9
xchg r9, rdx
xchg rbx, r8
mov qword [rsp + 0x30], r8
xchg r8, rbx
xor ebx, ebx
test rcx, rcx
je 0x14015c9c5
mov rdx, qword [rdx + 0x60]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x14015c9b4
xchg rsi, r8
mov rsi, qword [rcx - 8]
xchg r8, rsi
nop
sub rdx, 0x20ac1da2
add rdx, 0x20ac1dc9
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14015cb3d
mov rcx, r8
call fcn.1401fcba8
mov qword [rdi + 0x50], rbx
mov qword [rdi + 0x58], rbx
mov qword [rdi + 0x60], rbx
mov rcx, qword [rdi + 0x40]
mov rax, qword [rcx + 8]
mov qword [rax], rbx
mov rcx, qword [rcx]
test rcx, rcx
je 0x14015ca2a
nop word [rax + rax]
mov rbx, qword [rcx]
mov edx, 0x67d0a43b
xor edx, 0x658eb35
sub edx, 0x56b182ce
add edx, 0x5c372da9
sub edx, 0x3819b117
add edx, 0x6e8b7b1
xor edx, 0x35dd009b
call fcn.1401fcba8
xchg r13, rcx
mov r13, rbx
xchg r13, rcx
test rbx, rbx
jne 0x14015c9e7
mov rcx, qword [rdi + 0x40]
mov edx, 0x71c98dbb
sub edx, 0x413e9e96
add edx, 0x191164a6
sub edx, 0x3d9f00c6
sub edx, 0x3fc9f4
add edx, 0x4169d497
sub edx, 0x3faa16b7
xor edx, 0x25af29e8
sub edx, 0x28d26f01
call fcn.1401fcba8
mov rbx, qword [rdi + 0x28]
test rbx, rbx
je 0x14015cae5
mov qword [rsp + 0x38], rsi
mov esi, 0x97551e8
add esi, 0x14799012
add esi, 0x3187b086
add esi, 0x27fd68ff
sub esi, 0x3148557
add esi, 0x8ba089d7
mov eax, esi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x14015cae0
xchg rdx, rax
mov rdx, qword [rbx]
xchg rdx, rax
xchg r10, rcx
mov r10, rbx
xchg r10, rcx
call qword [rax]
lock xadd dword [rbx + 0xc], esi
cmp esi, 1
jne 0x14015cae0
xchg r14, rax
mov r14, qword [rbx]
xchg r14, rax
xchg rbx, rcx
mov rbx, rcx
xchg rcx, rbx
call qword [rax + 8]
mov rsi, qword [rsp + 0x38]
mov edx, 0x4d248112
xor edx, 0x6266bac5
add edx, 0x4f8e0a01
sub edx, 0x6cd5d46b
add edx, 0x1cf30d9
xor edx, 0x7b45f79d
sub edx, 0x688c5433
xchg rdi, rbx
mov rcx, rbx
xchg rbx, rdi
call fcn.1401fcba8
xchg rbx, rsi
mov rsi, qword [rsp + 0x30]
xchg rsi, rbx
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140174840
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x50
cmp qword [rcx + 0x68], 0
xchg r9, rcx
mov rbx, r9
xchg rcx, r9
je 0x140174a18
cmp byte [rcx + 0x72], 0
je 0x140174a18
xchg r11, rax
mov r11, qword [rcx]
xchg r11, rax
xchg rdi, r11
mov qword [rsp + 0x68], r11
xchg rdi, r11
mov edi, 0x26ddb83d
add edi, 0x55b3e53b
sub edi, 0xb9e8a31
sub edi, 0x61a7b086
add edi, 0x5e9b8a87
add edi, 0xeb9646a
sub edi, 0x629b7361
sub edi, 0x1a03de52
mov edx, edi
call qword [rax + 0x18]
cmp di, ax
je 0x1401749f4
xchg rcx, r14
mov r14, qword [rbx + 0x68]
xchg rcx, r14
lea rax, [rsp + 0x60]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14017493c
sub eax, 1
je 0x140174960
cmp eax, 2
jne 0x1401749f4
xchg rdi, r14
mov r14, qword [rsp + 0x68]
xchg r14, rdi
mov al, 7
add al, 0x57
xor al, 0x16
sub al, 0x2c
add al, 0x33
xor al, 0x12
add al, 3
sub al, 0x5f
mov byte [rbx + 0x72], 0x2a
add byte [rbx + 0x72], 0x4e
add byte [rbx + 0x72], 6
xor byte [rbx + 0x72], 0xc
sub byte [rbx + 0x72], 0x4b
sub byte [rbx + 0x72], 0x27
add rsp, 0x50
push rdx
push rdx
push rcx
push rax
push rcx
push rdx
xchg qword [rsp + 0x30], rbx
add rsp, 0x38
ret
mov byte [rbx + 0x72], 0x1e
xor byte [rbx + 0x72], 0x13
xor byte [rbx + 0x72], 0x14
xor byte [rbx + 0x72], 0x20
add byte [rbx + 0x72], 0x3a
sub byte [rbx + 0x72], 0x28
sub byte [rbx + 0x72], 5
add byte [rbx + 0x72], 7
sub byte [rbx + 0x72], 0x4d
xchg r10, rdi
mov r10, qword [rsp + 0x60]
xchg r10, rdi
lea rax, [rsp + 0x30]
sub rdi, rax
je 0x1401749cc
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x30]
xchg rdi, r8
mov rdi, r8
xchg r8, rdi
mov edx, 0x46fffb8
add edx, 0x12d54ba4
xor edx, 0x1ea1a9bb
add edx, 0x11229682
add edx, 0x3e89352c
add edx, 0x18f46a6a
sub edx, 0x2c71d824
xor edx, 0x461340da
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1401749f4
cmp byte [rbx + 0x72], 0
xchg r12, rdi
mov r12, qword [rsp + 0x68]
xchg rdi, r12
sete al
add rsp, 0x50
nop
xchg qword [rsp], rbx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
mov rdi, qword [rsp + 0x68]
xor al, al
add rsp, 0x50
push rcx
push rdx
push rcx
push rax
push rdx
push rdx
push rcx
xchg qword [rsp + 0x38], rbx
add rsp, 0x40
nop
add rsp, 8
jmp qword [rsp - 8]
mov al, 0x48
xor al, 0xf
add al, 0x1a
sub al, 0x5e
xor al, 0x5e
xor al, 0x5c
add rsp, 0x50
nop
add rsp, 8
mov rbx, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140194470
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
xchg r14, rdx
mov r10, r14
xchg rdx, r14
xchg rcx, r11
mov rcx, r11
xchg r11, rcx
mov dword [rsp + 0x30], 0x8ede6c1
xor dword [rsp + 0x30], 0x71a53462
sub dword [rsp + 0x30], 0x78c8375c
xor dword [rsp + 0x30], 0x152ff8b1
add dword [rsp + 0x30], 0xb0566b6
add dword [rsp + 0x30], 0x43110292
xor dword [rsp + 0x30], 0x6b41f77b
add dword [rsp + 0x30], 0x62d4f1ff
add dword [rsp + 0x30], 0x8b9dcab2
mov dword [rsp + 0x36], 0x7647c53d
xor dword [rsp + 0x36], 0x511f2a67
xor dword [rsp + 0x36], 0x129e4069
sub dword [rsp + 0x36], 0x149365c7
xor dword [rsp + 0x36], 0x4cb97aff
sub dword [rsp + 0x36], 0x26dcc06f
xor dword [rsp + 0x36], 0x46be1ab
add dword [rsp + 0x36], 0xbc936ccb
mov dword [rsp + 0x3a], 0x6b871cf7
xor dword [rsp + 0x3a], 0x122353ad
sub dword [rsp + 0x3a], 0x243119d3
add dword [rsp + 0x3a], 0x10fcee6f
sub dword [rsp + 0x3a], 0x41f04a94
sub dword [rsp + 0x3a], 0x22a067e2
xor dword [rsp + 0x3a], 0xff9a636
add dword [rsp + 0x3a], 0x252bfb17
add dword [rsp + 0x3a], 0xcc0c2c90
xor eax, eax
mov word [rsp + 0x3e], ax
xor ebx, ebx
mov edx, ebx
nop
movzx eax, word [rsp + rdx*2 + 0x36]
movzx ecx, byte [rsp + rdx + 0x30]
add cx, ax
mov word [rsp + rdx*2 + 0x36], cx
mov byte [rsp + rdx + 0x30], bl
inc rdx
cmp rdx, 4
jb 0x140194564
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r9
xchg r8, rbx
mov r9, rbx
xchg r8, rbx
lea r8, [rsp + 0x36]
xchg r10, rdx
mov r10, rdx
xchg rdx, r10
xchg r11, rbx
mov rcx, rbx
xchg rbx, r11
call fcn.140194610
nop
mov byte [rsp + rbx + 0x36], 0x50
xor byte [rsp + rbx + 0x36], 0x2e
sub byte [rsp + rbx + 0x36], 0x76
add byte [rsp + rbx + 0x36], 7
xor byte [rsp + rbx + 0x36], 0x79
xor byte [rsp + rbx + 0x36], 0x76
inc rbx
cmp rbx, 8
jb 0x1401945bc
add rsp, 0x40
push rcx
push rax
push rax
push rdx
push rax
push rdx
xchg qword [rsp + 0x30], rbx
pop rdx
pop rax
pop rdx
pop rax
pop rax
pop rcx
add rsp, 8
ret
Function at 0x1401ab050
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xchg r9, r11
mov r9, rdx
xchg r9, r11
xchg rcx, r10
mov rcx, r10
xchg r10, rcx
test rdx, rdx
je 0x1401ab0c8
mov qword [rsp], rbx
movzx ebx, byte [rsp + 0x30]
test r9, r9
je 0x1401ab0bb
movzx eax, byte [r10]
test bl, bl
je 0x1401ab09d
lea rcx, [r9 - 1]
mov rdx, r9
add rcx, r8
nop
xor al, byte [rcx]
lea rcx, [rcx - 1]
mov byte [r10], al
sub rdx, 1
jne 0x1401ab08c
jmp 0x1401ab0bb
xor ecx, ecx
nop dword [rax]
nop word [rax + rax]
xor al, byte [rcx + r8]
inc rcx
mov byte [r10], al
cmp rcx, r9
jb 0x1401ab0ac
inc r10
sub r11, 1
jne 0x1401ab074
mov rbx, qword [rsp]
add rsp, 8
ret
Function at 0x1401aff80
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
nop
sub rsp, 8
mov qword [rsp], rdi
mov eax, 0x66446b70
xor eax, 0x7b3ba088
sub eax, 0x18aa7d03
xor eax, 0x1282dc5d
add eax, 0x3244baa7
sub eax, 0x105d1329
add eax, 0x2d8bad62
xor eax, 0x65caf438
call fcn.1401fcf20
sub rsp, rax
mov ebx, edx
mov edi, ecx
call sub.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_
mov dword [rsp + 0x24], eax
mov r9d, 0x5e0315aa
add r9d, 0x117a990d
sub r9d, 0xf474eb6
xor r9d, 0x297e142d
sub r9d, 0x3c768c20
sub r9d, 0xcd1e80b
mov dword [rsp + 0x13a4], 0x681b7e81
sub dword [rsp + 0x13a4], 0xf1605b7
xor dword [rsp + 0x13a4], 0x2852a2e
xor dword [rsp + 0x13a4], 0x65566c3a
sub dword [rsp + 0x13a4], 0x413a1cc
sub dword [rsp + 0x13a4], 0x2b5443fb
add dword [rsp + 0x13a4], 0x36261fb8
sub dword [rsp + 0x13a4], 0x40ae81be
xor dword [rsp + 0x13a4], 0xfb1a08ee
nop dword [rax + rax]
mov r8d, eax
shr r8d, 0x15
shr r8d, 1
shr r8d, 8
xor r8d, eax
imul eax, r8d, 0x6c078965
add eax, r9d
mov dword [rsp + r9*4 + 0x24], eax
inc r9
cmp r9, 0x270
jb 0x1401b0066
mov ebp, 0x6f9f2f2c
sub ebp, 0x2e5a8036
sub ebp, 0x5d49aef
add ebp, 0x2460f89e
xor ebp, 0x5c769719
add ebp, 0x1b7b9dee
add ebp, 0x3ddd8eb1
xor ebp, 0x727ee910
xor ebp, 0xaf7e214b
mov dword [rsp + 0x20], 0x5acd3b93
sub dword [rsp + 0x20], 0x4e05c5d7
add dword [rsp + 0x20], 0x3d61924c
sub dword [rsp + 0x20], 0x9487f17
xor dword [rsp + 0x20], 0x25832eb6
sub dword [rsp + 0x20], 0x210ae661
sub dword [rsp + 0x20], 0x8814df5
xor dword [rsp + 0x20], 0x2afbf08a
sub dword [rsp + 0x20], 0x112c7f0b
cmp edi, ebp
lea rax, [rsp + 0x20]
xchg r14, rax
mov qword [rsp + 0x13d0], r14
xchg r14, rax
lea rcx, [rsp + 0x13d0]
lea eax, [rdi - 0x80000000]
lea esi, [rdi + rbp]
cmovae esi, eax
lea edi, [rbx + rbp]
cmp ebx, ebp
lea eax, [rbx - 0x80000000]
cmovae edi, eax
sub edi, esi
cmp edi, 0xffffffff
jne 0x1401b015f
call fcn.1401b0450
mov ecx, eax
jmp 0x1401b01c1
inc edi
mov ebx, edi
call fcn.1401b0450
mov ecx, eax
imul rcx, rbx
cmp ecx, edi
jae 0x1401b01af
mov eax, edi
xor edx, edx
neg eax
div edi
mov edi, edx
cmp ecx, edx
jae 0x1401b01af
nop dword [rax]
nop dword [rax + rax]
lea rcx, [rsp + 0x13d0]
call fcn.1401b0450
mov ecx, eax
imul rcx, rbx
cmp ecx, edi
jb 0x1401b0194
shr rcx, 0x14
shr rcx, 8
shr rcx, 2
shr rcx, 1
shr rcx, 1
lea edx, [rsi + rcx]
lea r11, [rsp + 0x13b0]
cmp edx, ebp
mov rbx, qword [r11 + 0x10]
lea eax, [rdx + rbp]
xchg rbp, r14
mov r14, qword [r11 + 0x18]
xchg rbp, r14
lea ecx, [rdx - 0x80000000]
mov rsi, qword [r11 + 0x28]
cmovae eax, ecx
mov rsp, r11
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1401b0450
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
xchg rdi, r10
mov rdi, qword [rcx]
xchg rdi, r10
mov r9d, 0x62a81ff5
sub r9d, 0x3fc13092
add r9d, 0xef8bd6c
xor r9d, 0x78eaf282
add r9d, 0x1b8e4dcc
sub r9d, 0x64c3a9a9
mov ecx, dword [r10]
cmp ecx, r9d
jne 0x1401b04e2
lea r8, [r10 + 8]
nop dword [rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x1401b049d
mov ecx, dword [r10]
jmp 0x1401b061b
cmp ecx, 0x4e0
jb 0x1401b061b
lea r11, [r10 + 0x9c4]
xchg r10, rbx
mov qword [rsp], r10
xchg rbx, r10
mov eax, dword [r11]
mov ebx, 0x7eba3846
sub ebx, 0x63bb0964
add ebx, 0x4513200
xor ebx, 0x21f00669
sub ebx, 0x18febc48
sub ebx, 0x25a1a960
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1401b0525
lea r11, [r10 + 0xd50]
mov ebx, 0x2454944f
sub ebx, 0x236020c
add ebx, 0x540fbc12
xor ebx, 0x6bc71fb7
xor ebx, 0x41fd1309
add ebx, 0x2302f0cf
xor ebx, 0x7f173236
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1401b059d
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 4
shr ecx, 6
shr ecx, 1
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 5
shl eax, 1
shl eax, 1
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 3
shl eax, 1
shl eax, 0xb
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1401ba330
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov qword [rsp], rbx
sub rsp, 0x20
xchg rbx, r15
mov r15, rcx
xchg rbx, r15
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x1401b9934
xchg rdx, r15
mov r15, qword [rbx + 0x28]
xchg rdx, r15
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x1401b991d
xchg rdi, r8
mov rdi, qword [rcx - 8]
xchg r8, rdi
sub rdx, 0xffffffffffffffd9
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1401b994a
xchg r8, rcx
mov r8, rcx
xchg r8, rcx
call fcn.1401fcba8
xor eax, eax
mov qword [rbx + 0x18], rax
xchg rdi, rax
mov qword [rbx + 0x20], rdi
xchg rdi, rax
mov qword [rbx + 0x28], rax
lea rcx, [rbx + 8]
add rsp, 0x20
nop
mov rbx, qword [rsp]
add rsp, 8
jmp 0x1401ba330
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
xchg rbx, rsi
mov qword [rsp + 0x10], rsi
xchg rbx, rsi
push rsi
sub rsp, 0x20
xchg r11, rbx
mov r11, qword [rcx]
xchg rbx, r11
xchg rcx, rsi
mov rcx, rsi
xchg rsi, rcx
mov rax, qword [rbx + 8]
mov qword [rax], 0x56dec2fa
xor qword [rax], 0x26944cf7
add qword [rax], 0xede55e6
sub qword [rax], 0x190fba88
sub qword [rax], 0x2dd79e2
sub qword [rax], 0x2986fda4
xor qword [rax], 0x7e42c0a8
xor qword [rax], 0x47f6714d
mov rbx, qword [rbx]
test rbx, rbx
je 0x1401ba40a
xchg r15, rdi
mov qword [rsp + 0x30], r15
xchg rdi, r15
nop dword [rax + rax]
mov rdi, qword [rbx]
lea rdx, [rbx + 0x10]
xchg rcx, rsi
mov rsi, rcx
xchg rsi, rcx
call fcn.1401b3400
mov edx, 0x7ea8d83b
sub edx, 0x363268d6
xor edx, 0x150ef37
add edx, 0x2ebe7b03
sub edx, 0xd33ed13
sub edx, 0x6ab10df2
xchg rbx, r12
mov rcx, r12
xchg r12, rbx
call fcn.1401fcba8
xchg r15, rdi
mov rbx, r15
xchg r15, rdi
test rdi, rdi
jne 0x1401ba3ad
mov rdi, qword [rsp + 0x30]
mov rcx, qword [rsi]
mov edx, 0x5ece6344
xor edx, 0xda41140
xor edx, 0x33ce7b83
add edx, 0x13e764a7
sub edx, 0x2aea1ece
sub edx, 0x49a14f10
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
push rdx
push rax
push rax
push rdx
push rbx
push rcx
push rcx
xchg qword [rsp + 0x38], rsi
add rsp, 0x40
jmp fcn.1401fcba8