joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007cf00
Capabilities:
Encode data using xor

Disassembly:
xchg r10, rbx
mov qword [rsp + 8], r10
xchg rbx, r10
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg r13, rdi
mov r13, rcx
xchg rdi, r13
lea rbx, [rdx + 0x34]
xchg rbp, rbx
mov rdx, rbp
xchg rbp, rbx
call fcn.14007aa00
nop
xor eax, eax
mov byte [rbx + rax], 0x4e
add byte [rbx + rax], 0x2a
add byte [rbx + rax], 4
sub byte [rbx + rax], 0x59
add byte [rbx + rax], 0x2d
xor byte [rbx + rax], 0x7b
xor byte [rbx + rax], 4
xor byte [rbx + rax], 0x2f
inc rax
cmp rax, 0x64
jb 0x14007cf3b
xchg rbp, rax
mov rbp, rdi
xchg rbp, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007cf90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rcx, rdx
mov qword [rsp + 0x10], rcx
xchg rdx, rcx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rdi, rcx
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 0x38]
xchg rdx, rbx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007aa00
nop
xor eax, eax
mov byte [rbx + rax], 0x73
sub byte [rbx + rax], 0x53
sub byte [rbx + rax], 0x18
add byte [rbx + rax], 0x5a
add byte [rbx + rax], 0x12
xor byte [rbx + rax], 0x28
xor byte [rbx + rax], 0x3c
xor byte [rbx + rax], 0x60
inc rax
cmp rax, 0x6e
jb 0x14007cfcc
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret

Function at 0x14007d010
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, r15
mov qword [rsp + 0x10], r15
xchg rdx, r15
push rdi
sub rsp, 0x20
xchg rdi, rcx
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0x4e]
mov rdx, rbx
call fcn.14007aa00
nop
xor eax, eax
mov byte [rbx + rax], 0x59
sub byte [rbx + rax], 0x18
sub byte [rbx + rax], 0x10
xor byte [rbx + rax], 0x71
xor byte [rbx + rax], 0x68
sub byte [rbx + rax], 0x25
sub byte [rbx + rax], 3
inc rax
cmp rax, 0x98
jb 0x14007d03d
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d090
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rdi, r13
mov r13, rcx
xchg rdi, r13
lea rbx, [rdx + 0x56]
xchg rdx, rbx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007aa00
nop
xor eax, eax
mov byte [rbx + rax], 0x7d
sub byte [rbx + rax], 0x74
add byte [rbx + rax], 0x13
xor byte [rbx + rax], 0x7c
xor byte [rbx + rax], 0x61
add byte [rbx + rax], 0x2b
add byte [rbx + rax], 0x3d
xor byte [rbx + rax], 0x69
inc rax
cmp rax, 0xa8
jb 0x14007d0bd
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg r12, rbx
mov r12, qword [rsp + 0x30]
xchg rbx, r12
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x14007d110
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, r9
mov qword [rsp + 0x10], r9
xchg rdx, r9
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x5a]
xchg r13, rdx
mov r13, rbx
xchg r13, rdx
call fcn.14007aa00
nop
xor eax, eax
mov byte [rbx + rax], 0xf
xor byte [rbx + rax], 0x45
add byte [rbx + rax], 7
sub byte [rbx + rax], 0x4b
xor byte [rbx + rax], 0x7d
sub byte [rbx + rax], 5
sub byte [rbx + rax], 0x3e
sub byte [rbx + rax], 0x38
inc rax
cmp rax, 0xb0
jb 0x14007d146
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg rbx, rbp
mov rbp, qword [rsp + 0x30]
xchg rbx, rbp
add rsp, 0x20
push rbx
push rax
push rbx
xchg qword [rsp + 0x18], rdi
add rsp, 0x20
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d1a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg r12, rdi
mov r12, rcx
xchg r12, rdi
lea rbx, [rdx + 0x70]
xchg rbx, rdx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007aa00
nop
xor eax, eax
mov byte [rbx + rax], 0x38
sub byte [rbx + rax], 0x27
add byte [rbx + rax], 0x2b
sub byte [rbx + rax], 0x18
xor byte [rbx + rax], 0x2e
xor byte [rbx + rax], 0x4a
xor byte [rbx + rax], 0x47
sub byte [rbx + rax], 7
inc rax
cmp rax, 0xdc
jb 0x14007d1cd
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d220
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rcx
mov qword [rsp + 8], rcx
xchg rbx, rcx
xchg rdx, r9
mov qword [rsp + 0x10], r9
xchg r9, rdx
nop
push 0x25afb578
mov qword [rsp], rdi
sub rsp, 0x20
xchg r11, rdi
mov r11, rcx
xchg rdi, r11
lea rbx, [rdx + 0x70]
mov rdx, rbx
call fcn.14007aa00
nop
xor eax, eax
mov byte [rbx + rax], 7
add byte [rbx + rax], 0x22
add byte [rbx + rax], 7
sub byte [rbx + rax], 4
xor byte [rbx + rax], 0x14
add byte [rbx + rax], 4
add byte [rbx + rax], 0x38
sub byte [rbx + rax], 0x74
inc rax
cmp rax, 0xde
jb 0x14007d25c
mov rax, rdi
xchg rbx, r15
mov r15, qword [rsp + 0x30]
xchg r15, rbx
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
ret

Function at 0x14007d2b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rdi, r9
mov r9, rcx
xchg rdi, r9
lea rbx, [rdx + 0x76]
xchg rdx, rdi
mov rdi, rbx
xchg rdx, rdi
call fcn.14007aa00
nop
xor eax, eax
mov byte [rbx + rax], 0x56
sub byte [rbx + rax], 0xf
sub byte [rbx + rax], 0x2c
xor byte [rbx + rax], 0x1b
add byte [rbx + rax], 0x12
add byte [rbx + rax], 0x2a
add byte [rbx + rax], 0x42
sub byte [rbx + rax], 0x7e
inc rax
cmp rax, 0xea
jb 0x14007d2e6
xchg r8, rdi
mov rax, r8
xchg rdi, r8
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rcx
push rax
push rcx
push rcx
push rdx
push rbx
push rdx
xchg qword [rsp + 0x38], rdi
pop rdx
pop rbx
pop rdx
pop rcx
pop rcx
pop rax
pop rcx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007d350
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rdx
mov qword [rsp + 8], rdx
xchg rbx, rdx
xchg rdx, rcx
mov qword [rsp + 0x10], rcx
xchg rdx, rcx
push rdi
sub rsp, 0x20
xchg rcx, r11
mov rdi, r11
xchg r11, rcx
lea rbx, [rdx + 0x7c]
xchg rbx, rdx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007aa00
nop
xor eax, eax
mov byte [rbx + rax], 0x75
sub byte [rbx + rax], 0x3a
sub byte [rbx + rax], 0xd
xor byte [rbx + rax], 0x4b
add byte [rbx + rax], 0x18
sub byte [rbx + rax], 0x17
xor byte [rbx + rax], 0x75
xor byte [rbx + rax], 0x13
inc rax
cmp rax, 0xf4
jb 0x14007d389
xchg r13, rax
mov r13, rdi
xchg r13, rax
xchg rbx, r14
mov r14, qword [rsp + 0x30]
xchg r14, rbx
add rsp, 0x20
push rbx
push rax
push rbx
push rcx
push rax
push rcx
push rcx
xchg qword [rsp + 0x38], rdi
add rsp, 0x40
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d3f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rcx, rdx
mov qword [rsp + 0x10], rcx
xchg rcx, rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg r15, rdi
mov r15, rcx
xchg rdi, r15
lea rbx, [rdx + 0x9a]
xchg rdx, rbx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007aa00
nop
xor eax, eax
nop dword [rax]
nop dword [rax + rax]
mov byte [rbx + rax], 0x14
sub byte [rbx + rax], 0xd
add byte [rbx + rax], 0x51
xor byte [rbx + rax], 0x33
sub byte [rbx + rax], 2
sub byte [rbx + rax], 0x15
xor byte [rbx + rax], 0x54
inc rax
cmp rax, 0x130
jb 0x14007d43b
xchg r10, rdi
mov rax, r10
xchg r10, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d490
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg r9, rdx
mov qword [rsp + 0x10], r9
xchg r9, rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0xc]
xchg rbx, rdx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007aa00
nop
xor eax, eax
mov byte [rbx + rax], 0x51
sub byte [rbx + rax], 0x31
sub byte [rbx + rax], 0x18
sub byte [rbx + rax], 2
add byte [rbx + rax], 0x2f
xor byte [rbx + rax], 0x35
inc rax
cmp rax, 0x14
jb 0x14007d4c6
xchg r10, rax
mov r10, rdi
xchg r10, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rax
push rbx
push rcx
push rcx
xchg qword [rsp + 0x20], rdi
add rsp, 0x28
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d510
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rbp
mov qword [rsp + 8], rbp
xchg rbp, rbx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0xe]
xchg rdx, r14
mov r14, rbx
xchg rdx, r14
call fcn.14007aa00
nop
xor eax, eax
mov byte [rbx + rax], 0x5a
sub byte [rbx + rax], 0x3d
add byte [rbx + rax], 2
xor byte [rbx + rax], 0x5d
sub byte [rbx + rax], 0x26
sub byte [rbx + rax], 0x1c
inc rax
cmp rax, 0x18
jb 0x14007d546
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg rbx, rdx
mov rdx, qword [rsp + 0x30]
xchg rbx, rdx
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
ret
Function at 0x14007d590
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0xe]
xchg rbx, r12
mov rdx, r12
xchg r12, rbx
call fcn.14007aa00
nop
xor eax, eax
mov byte [rbx + rax], 0x49
xor byte [rbx + rax], 5
sub byte [rbx + rax], 7
add byte [rbx + rax], 0x2c
sub byte [rbx + rax], 0x4e
sub byte [rbx + rax], 0x23
inc rax
cmp rax, 0x1a
jb 0x14007d5bf
xchg r11, rax
mov r11, rdi
xchg r11, rax
xchg r9, rbx
mov r9, qword [rsp + 0x30]
xchg r9, rbx
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x140080fc0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
nop
push r12
mov qword [rsp], rsi
sub rsp, 0x20
cmp byte [r8 + 0x19], 0
xchg rbx, r8
mov r8, rbx
xchg rbx, r8
xchg rsi, rdx
mov rdx, rsi
xchg rsi, rdx
xchg rbp, rcx
mov rcx, rbp
xchg rbp, rcx
jne 0x14008107c
mov qword [rsp + 0x30], rdi
nop dword [rax]
nop dword [rax + rax]
mov r8, qword [rbx + 0x10]
xchg rdx, r14
mov r14, rsi
xchg r14, rdx
mov rcx, rbp
call fcn.140080fc0
xchg rdi, rbx
mov rbx, rdi
xchg rdi, rbx
mov rbx, qword [rbx]
lea rcx, [rdi + 0x28]
call fcn.140091630
mov edx, 0x5f71506f
xor edx, 0xdab116a
xor edx, 0x5bafbd9
xor edx, 0x5d615fd
sub edx, 0x37b236e7
xor edx, 0x6046f2d0
sub edx, 0x2c96cf84
sub edx, 0x4eabbace
mov rcx, rdi
call fcn.1401fd08c
cmp byte [rbx + 0x19], 0
je 0x14008100c
mov rdi, qword [rsp + 0x30]
xchg rbx, r14
mov r14, qword [rsp + 0x38]
xchg r14, rbx
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
push rcx
push rdx
push rbx
push rbx
push rcx
push rdx
xchg qword [rsp + 0x30], rsi
pop rdx
pop rcx
pop rbx
pop rbx
pop rdx
pop rcx
add rsp, 8
ret
Function at 0x140083b70
Capabilities:
Encode data using xor

Disassembly:
mov r8d, edx
nop dword [rax]
nop word [rax + rax]
add rcx, 0xfffffffffffffffe
mov eax, 0x20a73f4a
xor eax, 0x5f3eda70
sub eax, 0x2622c011
add eax, 0x14a9c773
sub eax, 0x4f220e5
add eax, 0x639e0116
mul r8d
shr edx, 2
shr edx, 1
movzx eax, dx
shl ax, 1
shl ax, 1
lea r9d, [rax + rdx]
add r9w, r9w
sub r8w, r9w
add r8w, 0x30
mov word [rcx], r8w
mov r8d, edx
test edx, edx
jne 0x140083b80
mov rax, rcx
ret

Function at 0x140083e00
Capabilities:
Encode data using xor

Disassembly:
xchg r12, rax
mov r12, r8
xchg r12, rax
cmp rcx, rdx
je 0x140083f5f
xchg rdx, r9
mov rdx, rax
xchg rdx, r9
lea r8, [rcx + 0x38]
sub r9, rcx
xor r10d, r10d
nop dword [rax]
xorps xmm0, xmm0
lea r8, [r8 + 0x48]
xchg r12, rax
movups xmmword [r12], xmm0
xchg r12, rax
xchg r10, r12
mov qword [r9 + r8 - 0x70], r12
xchg r10, r12
mov qword [r9 + r8 - 0x68], r10
xchg r8, rdi
movups xmm0, xmmword [rdi - 0x80]
xchg rdi, r8
movups xmmword [rax], xmm0
movups xmm1, xmmword [r8 - 0x70]
xorps xmm0, xmm0
xchg rdi, rax
movups xmmword [rdi + 0x10], xmm1
xchg rdi, rax
xchg r10, rbx
mov qword [r8 - 0x70], rbx
xchg r10, rbx
nop
add rax, 0x1c26002
sub rax, 0x1c25fba
mov qword [r8 - 0x68], 0x6e6e9fa2
sub qword [r8 - 0x68], 0x5911c598
add qword [r8 - 0x68], 0x22588087
xor qword [r8 - 0x68], 0x25dbd0e
add qword [r8 - 0x68], 0x25b23138
xor qword [r8 - 0x68], 0x52f1a676
sub qword [r8 - 0x68], 0x96abe9a
mov word [r8 - 0x80], r10w
xchg r9, rbx
movups xmmword [rbx + r8 - 0x60], xmm0
xchg r9, rbx
xchg rcx, r10
mov qword [r9 + r8 - 0x50], rcx
xchg rcx, r10
mov qword [r9 + r8 - 0x48], r10
xchg r8, rdx
movups xmm0, xmmword [rdx - 0x60]
xchg rdx, r8
xchg r12, r9
movups xmmword [r12 + r8 - 0x60], xmm0
xchg r9, r12
movups xmm1, xmmword [r8 - 0x50]
movups xmmword [r9 + r8 - 0x50], xmm1
mov qword [r8 - 0x50], r10
mov qword [r8 - 0x48], 0x309603c5
sub qword [r8 - 0x48], 0x1852bcf3
add qword [r8 - 0x48], 0x60df7205
xor qword [r8 - 0x48], 0x707c608d
xor qword [r8 - 0x48], 0x8be68ed
add qword [r8 - 0x48], 0xb791c38
add qword [r8 - 0x48], 0x1315ba68
sub qword [r8 - 0x48], 0xcd3d00b
sub qword [r8 - 0x48], 0x139bb745
mov word [r8 - 0x60], r10w
mov ecx, dword [r8 - 0x40]
mov dword [r9 + r8 - 0x40], ecx
lea rcx, [r8 - 0x38]
cmp rcx, rdx
jne 0x140083e2a
ret
Function at 0x140084080
Capabilities:
Encode data using xor

Disassembly:
xchg rsi, rax
mov rsi, r8
xchg rsi, rax
cmp rcx, rdx
je 0x14008413a
xchg r8, rax
mov r9, r8
xchg r8, rax
lea r8, [rcx + 0x18]
sub r9, rcx
xor r10d, r10d
nop word [rax + rax]
xorps xmm0, xmm0
lea r8, [r8 + 0x20]
movups xmmword [rax], xmm0
mov qword [r9 + r8 - 0x28], r10
lea rcx, [r8 - 0x18]
xchg rbx, r10
mov qword [r8 + r9 - 0x20], rbx
xchg r10, rbx
movups xmm0, xmmword [r8 - 0x38]
xchg rdi, rax
movups xmmword [rdi], xmm0
xchg rdi, rax
movups xmm1, xmmword [r8 - 0x28]
xchg rcx, rax
movups xmmword [rcx + 0x10], xmm1
xchg rcx, rax
mov qword [r8 - 0x28], r10
nop
sub rax, 0x53732c6f
add rax, 0x53732c8f
mov qword [r8 - 0x20], 0x7ef8526b
xor qword [r8 - 0x20], 0x6f9c1243
add qword [r8 - 0x20], 0x1b7c10b8
add qword [r8 - 0x20], 0x257698af
sub qword [r8 - 0x20], 0x4ca80dc4
add qword [r8 - 0x20], 0x2f662913
xor qword [r8 - 0x20], 0x351504d9
mov word [r8 - 0x38], r10w
cmp rcx, rdx
jne 0x1400840ac
ret
Function at 0x14008e560
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 0xa], 0x3f
sub byte [rcx + rax + 0xa], 0x14
add byte [rcx + rax + 0xa], 0x3e
xor byte [rcx + rax + 0xa], 0x42
xor byte [rcx + rax + 0xa], 0x3c
add byte [rcx + rax + 0xa], 3
add byte [rcx + rax + 0xa], 0
xor byte [rcx + rax + 0xa], 0x18
xor byte [rcx + rax + 0xa], 2
inc rax
cmp rax, 0x10
jb 0x14008e562
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14008e680
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 0x14], 0x67
xor byte [rcx + rax + 0x14], 0x59
add byte [rcx + rax + 0x14], 5
sub byte [rcx + rax + 0x14], 0x1c
sub byte [rcx + rax + 0x14], 7
xor byte [rcx + rax + 0x14], 0x20
inc rax
cmp rax, 0x24
jb 0x14008e682
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1400f11f0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rbp
push rsi
push rdi
sub rsp, 0x80
xchg r9, rdi
mov r9, rdi
xchg rdi, r9
mov esi, r8d
xchg rbx, rdx
mov rdx, rbx
xchg rbx, rdx
xor ebp, ebp
lea rcx, [rsp + 0x50]
call fcn.140049b00
mov dword [rsp + 0x70], esi
mov qword [rsp + 0x78], rdi
lea ecx, [rbp + 0x30]
call fcn.1401fd050
test rax, rax
je 0x1400f1282
movups xmm0, xmmword [rsp + 0x50]
xchg r9, rax
movups xmmword [r9], xmm0
xchg r9, rax
movups xmm1, xmmword [rsp + 0x60]
movups xmmword [rax + 0x10], xmm1
movdqa xmm0, xmmword [0x140002c70]
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], bp
mov dword [rax + 0x20], esi
xchg rdi, r12
mov qword [rax + 0x28], r12
xchg r12, rdi
jmp 0x1400f128b
xchg rsi, rbp
mov rax, rsi
xchg rsi, rbp
xchg r11, rax
mov qword [rsp + 0xb8], r11
xchg r11, rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebp
mov r9, rax
lea r8, [0x140081e40]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
xchg r13, rax
mov qword [rsp + 0x30], r13
xchg r13, rax
test rax, rax
je 0x1400f1351
cmp dword [rsp + 0x38], 0
je 0x1400f1384
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x1400f1349
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x50]
call fcn.14002f8f0
nop
mov rcx, rbx
xchg rbx, rsi
mov rsi, qword [rsp + 0xa0]
xchg rbx, rsi
add rsp, 0x80
push rax
push rax
push rdx
push rcx
xchg qword [rsp + 0x20], rdi
pop rcx
pop rdx
pop rax
pop rax
add rsp, 8
nop
add rsp, 8
mov rsi, qword [rsp - 8]
nop
add rsp, 8
mov rbp, qword [rsp - 8]
jmp fcn.14002f8f0
mov ecx, eax
call sub.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_
nop
mov dword [rsp + 0x38], ebp
mov ecx, 0x255cce1a
sub ecx, 0x15fde63c
add ecx, 0x49f251c3
xor ecx, 0x4bad27ab
add ecx, 0x4ec49f26
sub ecx, 0x5926d857
sub ecx, 0x899e4d3
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov ecx, 0xd719f98
add ecx, 0x6b581713
xor ecx, 0xa533597
sub ecx, 0x26724a22
xor ecx, 0xbe527b5
sub ecx, 0x25c4e458
xor ecx, 0x22083a56
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x14015c570
Capabilities:
Encode data using xor

Disassembly:
test rdx, rdx
je 0x14015c781
push rdi
sub rsp, 0x20
xchg r15, rcx
mov r15, qword [rdx + 0x50]
xchg rcx, r15
mov rdi, rdx
mov qword [rsp + 0x30], rbx
xor ebx, ebx
test rcx, rcx
je 0x14015c5f7
mov rdx, qword [rdx + 0x60]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x14015c5da
mov r8, qword [rcx - 8]
nop
add rdx, 0x17536410
sub rdx, 0x175363e9
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14015c782
mov rcx, r8
call fcn.1401fd08c
xchg rbx, r8
mov qword [rdi + 0x50], r8
xchg r8, rbx
mov qword [rdi + 0x58], rbx
xchg r15, rbx
mov qword [rdi + 0x60], r15
xchg r15, rbx
mov rcx, qword [rdi + 0x40]
xchg r10, rax
mov r10, qword [rcx + 8]
xchg r10, rax
mov qword [rax], rbx
mov rcx, qword [rcx]
test rcx, rcx
je 0x14015c66c
nop word [rax + rax]
mov rbx, qword [rcx]
mov edx, 0x17e4f9a7
xor edx, 0x349f2d42
xor edx, 0x78b3038d
xor edx, 0x6b7f9a92
sub edx, 0x118fb270
xor edx, 0x1a28649d
xor edx, 0x3bcf41c8
xor edx, 0x3aa1bc3c
xor edx, 0x46102fb
call fcn.1401fd08c
xchg rcx, rdi
mov rdi, rbx
xchg rdi, rcx
test rbx, rbx
jne 0x14015c61d
mov rcx, qword [rdi + 0x40]
mov edx, 0x6ed4eaab
sub edx, 0x6dedbe48
add edx, 0x77c1a462
sub edx, 0x42a0bfed
add edx, 0x9af67eb
sub edx, 0x30742631
sub edx, 0xf43527a
call fcn.1401fd08c
xchg r9, rbx
mov r9, qword [rdi + 0x28]
xchg rbx, r9
test rbx, rbx
je 0x14015c731
xchg rcx, rsi
mov qword [rsp + 0x38], rcx
xchg rsi, rcx
mov esi, 0x1d09d9ae
add esi, 0x3a9a259a
sub esi, 0xbc6bb97
xor esi, 0x10b8174
xor esi, 0x547aea54
xor esi, 0x2a0ac2a8
xor esi, 0x78cd41de
add esi, 0xb3945418
mov eax, esi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x14015c726
mov rax, qword [rbx]
xchg rbp, rcx
mov rbp, rbx
xchg rbp, rcx
call qword [rax]
lock xadd dword [rbx + 0xc], esi
cmp esi, 1
jne 0x14015c726
mov rax, qword [rbx]
xchg rbp, rcx
mov rbp, rbx
xchg rbp, rcx
call qword [rax + 8]
xchg r10, rsi
mov r10, qword [rsp + 0x38]
xchg rsi, r10
mov edx, 0x2ccb8d14
xor edx, 0x3daacd15
add edx, 0x1c66d534
xor edx, 0xbf14421
xor edx, 0x66917390
xor edx, 0x738171bb
xor edx, 0x31e73a1b
sub edx, 0x2ce677c
xchg rcx, r13
mov r13, rdi
xchg rcx, r13
call fcn.1401fd08c
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140174670
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x50
cmp qword [rcx + 0x68], 0
xchg r14, rcx
mov rbx, r14
xchg r14, rcx
je 0x14017483c
cmp byte [rcx + 0x72], 0
je 0x14017483c
xchg rbp, rax
mov rbp, qword [rcx]
xchg rbp, rax
xchg rdi, r10
mov qword [rsp + 0x68], r10
xchg r10, rdi
mov edi, 0x3e92c355
xor edi, 0x5cc253cc
xor edi, 0x353a5f4
add edi, 0x15e056b7
xor edi, 0x431667b6
sub edi, 0x35a120dc
sub edi, 0x53cab7
mov edx, edi
call qword [rax + 0x18]
cmp di, ax
je 0x140174820
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x60]
lea rdx, [rbx + 0x74]
xchg r12, rax
mov qword [rsp + 0x20], r12
xchg r12, rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140174772
sub eax, 1
je 0x14017478a
cmp eax, 2
jne 0x140174820
xchg rdi, rdx
mov rdx, qword [rsp + 0x68]
xchg rdx, rdi
mov al, 0x4a
sub al, 0x26
add al, 0x2a
add al, 0x2b
sub al, 0x38
xor al, 0x40
mov byte [rbx + 0x72], 0x13
add byte [rbx + 0x72], 0x1c
add byte [rbx + 0x72], 0x3a
xor byte [rbx + 0x72], 0x2a
xor byte [rbx + 0x72], 0x77
add byte [rbx + 0x72], 4
add byte [rbx + 0x72], 0x1a
sub byte [rbx + 0x72], 0x4b
xor byte [rbx + 0x72], 7
add rsp, 0x50
push rcx
push rcx
xchg qword [rsp + 0x10], rbx
pop rcx
pop rcx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
mov byte [rbx + 0x72], 0x5e
sub byte [rbx + 0x72], 0x1c
xor byte [rbx + 0x72], 0x36
xor byte [rbx + 0x72], 0x25
xor byte [rbx + 0x72], 0x7a
sub byte [rbx + 0x72], 0x2b
xchg rdi, rbx
mov rbx, qword [rsp + 0x60]
xchg rbx, rdi
lea rax, [rsp + 0x30]
sub rdi, rax
je 0x1401747fc
xchg rdi, r9
mov rdi, qword [rbx + 0x80]
xchg rdi, r9
lea rcx, [rsp + 0x30]
xchg r8, r12
mov r12, rdi
xchg r8, r12
mov edx, 0xed12644
sub edx, 0x78ccafb
xor edx, 0x737d6c88
sub edx, 0x166ae073
sub edx, 0x98b8e98
xor edx, 0x22f7fd8e
sub edx, 0x156ce2fe
sub edx, 0x61485239
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140174820
cmp byte [rbx + 0x72], 0
mov rdi, qword [rsp + 0x68]
sete al
add rsp, 0x50
push rax
xchg qword [rsp + 8], rbx
pop rax
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
xchg rdi, rbx
mov rbx, qword [rsp + 0x68]
xchg rbx, rdi
xor al, al
add rsp, 0x50
nop
add rsp, 8
xchg qword [rsp - 8], rbx
ret
mov al, 0x46
xor al, 0
sub al, 0x30
add al, 0x2b
sub al, 0x26
xor al, 0x42
xor al, 2
sub al, 0x5a
add rsp, 0x50
push rdx
push rcx
push rdx
push rdx
push rax
xchg qword [rsp + 0x28], rbx
pop rax
pop rdx
pop rdx
pop rcx
pop rdx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140193fb0
Capabilities:
Encode data using xor

Disassembly:
push r8
mov qword [rsp], rbx
sub rsp, 0x40
xchg rdx, rcx
mov r10, rcx
xchg rcx, rdx
xchg r11, rcx
mov rcx, r11
xchg r11, rcx
mov word [rsp + 0x30], 0x42a1
add word [rsp + 0x30], 0x1dde
sub word [rsp + 0x30], 0x1de4
add word [rsp + 0x30], 0x360a
sub word [rsp + 0x30], 0x6eae
add word [rsp + 0x30], 0xecff
mov dword [rsp + 0x34], 0x3d45f70
add dword [rsp + 0x34], 0x4ab7f195
xor dword [rsp + 0x34], 0x28cc245f
xor dword [rsp + 0x34], 0x311989fb
sub dword [rsp + 0x34], 0x550fba93
add dword [rsp + 0x34], 0x7c0f5c20
add dword [rsp + 0x34], 0x80f66123
mov byte [rsp + 0x32], 0x37
add byte [rsp + 0x32], 0x13
add byte [rsp + 0x32], 8
sub byte [rsp + 0x32], 0x24
add byte [rsp + 0x32], 0x2d
xor byte [rsp + 0x32], 0x20
sub byte [rsp + 0x32], 0xa
sub byte [rsp + 0x32], 0x65
add byte [rsp + 0x32], 0xea
mov dword [rsp + 0x38], 0x665edf65
sub dword [rsp + 0x38], 0x3dbe4d2
sub dword [rsp + 0x38], 0xd8dbb38
xor dword [rsp + 0x38], 0x1d175bff
sub dword [rsp + 0x38], 0x2f5fde16
add dword [rsp + 0x38], 0xbac0e11
add dword [rsp + 0x38], 0x54d50c39
xor dword [rsp + 0x38], 0x7b035f86
xor ebx, ebx
mov edx, ebx
nop dword [rax]
movzx eax, word [rsp + rdx*2 + 0x34]
movzx ecx, byte [rsp + rdx + 0x30]
add cx, ax
mov word [rsp + rdx*2 + 0x34], cx
mov byte [rsp + rdx + 0x30], bl
inc rdx
cmp rdx, 3
jb 0x1401940a3
xchg rdx, r8
mov qword [rsp + 0x28], rdx
xchg r8, rdx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, [rsp + 0x34]
xchg r15, rdx
mov r15, r10
xchg rdx, r15
mov rcx, r11
call fcn.1401944a0
nop
nop dword [rax]
mov byte [rsp + rbx + 0x34], 0x38
sub byte [rsp + rbx + 0x34], 0x2e
xor byte [rsp + rbx + 0x34], 0x78
sub byte [rsp + rbx + 0x34], 0x51
sub byte [rsp + rbx + 0x34], 0x18
sub byte [rsp + rbx + 0x34], 9
inc rbx
cmp rbx, 6
jb 0x1401940f3
add rsp, 0x40
nop
xchg qword [rsp], rbx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]