joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007f010
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
push rbp
push rbx
push rdi
lea rbp, [r11 - 0x5f]
sub rsp, 0xa0
mov rax, qword [0x140303960]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov rax, qword [0x1406c9e88]
mov edi, r8d
dec rax
mov rbx, rcx
cmp rax, 0xfffffffffffffffd
ja 0x14007f150
mov eax, dword [0x1406c9e84]
mov qword [r11 - 0x20], rsi
xor esi, esi
mov qword [rbp + 0x1b], rsi
mov dword [rbp + 0x23], esi
mov dword [rbp - 0xd], esi
mov qword [r11 - 0x28], r14
mov dword [rbp - 1], reloc.WLDAP32.dll_Ordinal_200
mov dword [rbp + 3], eax
mov qword [rbp + 7], rdx
mov qword [rbp + 0xf], rcx
mov dword [rbp + 0x17], r8d
mov dword [rbp - 0x29], Ordinal_301
mov dword [rbp - 0x25], eax
mov qword [rbp - 0x21], rcx
mov dword [rbp - 0x15], 0x40
mov dword [rbp - 0x19], r8d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [0x1406c9e88]
lea r14, [0x1406c9ec8]
lea r9, [rbp + 0x27]
mov dword [rbp - 0x11], eax
lea r8d, [rsi + 0x29]
mov qword [rbp - 9], r14
lea rdx, [rbp - 0x29]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x1406c9e88]
lea r9, [rbp + 0x2b]
lea r8d, [rsi + 0x28]
mov qword [rsp + 0x20], rsi
lea rdx, [rbp - 1]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rax, qword [0x1406c9e88]
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x14007f140
mov eax, dword [0x1406c9e84]
mov dword [rbp - 0x25], eax
mov eax, dword [0x1406c9ec8]
mov dword [rbp - 0x15], eax
mov dword [rbp - 0xd], esi
mov dword [rbp - 0x29], Ordinal_301
mov qword [rbp - 0x21], rbx
mov dword [rbp - 0x19], edi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [0x1406c9e88]
lea r9, [rbp + 0x27]
lea r8d, [rsi + 0x29]
mov dword [rbp - 0x11], eax
lea rdx, [rbp - 0x29]
mov qword [rbp - 9], r14
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rsi, qword [rsp + 0x98]
mov r14, qword [rsp + 0x90]
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.1402376c0
add rsp, 0xa0
pop rdi
pop rbx
pop rbp
ret

Function at 0x14007f170
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x270
mov rax, qword [0x140303960]
xor rax, rsp
mov qword [rsp + 0x268], rax
mov rax, qword [0x1406c9e88]
mov rbx, rcx
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x14007f23b
xor edx, edx
mov qword [rsp + 0x30], 0
mov r8d, 0x218
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memset
mov eax, dword [0x1406c9e84]
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x40], 0x258
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x248], eax
mov r8, 0xffffffffffffffff
lea rax, [rsp + 0x30]
mov qword [rsp + 0x250], rax
inc r8
cmp byte [rbx + r8], 0
jne 0x14007f1f0
inc r8
lea rcx, [rsp + 0x48]
mov rdx, rbx
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_mbstowcs]
mov rcx, qword [0x1406c9e88]
lea r9, [rsp + 0x260]
mov r8d, 0x219
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rax, qword [rsp + 0x30]
jmp 0x14007f23d
xor eax, eax
mov rcx, qword [rsp + 0x268]
xor rcx, rsp
call fcn.1402376c0
add rsp, 0x270
pop rbx
ret
Function at 0x14007fad0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov dword [rbp - 0x50], 0xe0c8fec7
mov dword [rbp - 0x4c], 0xeafde2
mov byte [rbp - 0x48], 1
xor ebx, ebx
mov ecx, ebx
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x77]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 7
jb 0x14007fb00
mov byte [rbp - 0x48], bl
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x10], rbx
mov qword [rbp - 8], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x20], bl
lea rax, [rbp - 0x50]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], bl
jne 0x14007fb31
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.1400890f0
nop
mov dword [rbp - 0x40], 0xe2f9efe2
mov dword [rbp - 0x3c], 0xf1ede2e8
mov dword [rbp - 0x38], 0xf0bdf7e2
mov dword [rbp - 0x34], 0x100faf9
nop dword [rax]
nop dword [rax + rax]
lea eax, [rbx - 0x77]
xor byte [rbp + rbx - 0x40], al
inc rbx
cmp rbx, 0xe
jb 0x14007fb70
mov byte [rbp - 0x31], 0
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x30]
call fcn.14007f490
nop
lea r8, [rbp - 0x20]
lea rdx, [rbp - 0x50]
mov rcx, rax
call fcn.14008c400
mov rcx, qword [rax]
mov rbx, qword [rcx + 0x40]
mov r8, qword [rbp - 0x30]
mov r8, qword [r8 + 8]
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x30]
call fcn.14008d990
mov edx, 0x48
mov rcx, qword [rbp - 0x30]
call fcn.1402376e0
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x14007fc0b
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007fc06
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007fc06
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1402376e0
mov rax, rbx
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret

Function at 0x14007fc20
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xf], 0
je 0x14007fc43
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xe
jb 0x14007fc30
mov byte [rcx + 0xf], 0
mov rax, rcx
ret
Function at 0x140080010
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xa], 0
je 0x140080033
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 9
jb 0x140080020
mov byte [rcx + 0xa], 0
mov rax, rcx
ret

Function at 0x140080040
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140303960]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov rsi, r8
mov dword [rsp + 0x28], 0x80
mov rdi, rdx
mov dword [rsp + 0x40], 0
xor r8d, r8d
mov dword [rsp + 0x20], 2
lea edx, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov rcx, rax
mov r8d, esi
mov rdx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1402376c0
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x140080140
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x1410
call fcn.140238120
sub rsp, rax
mov rax, qword [0x140303960]
xor rax, rsp
mov qword [rsp + 0x1400], rax
mov esi, edx
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor ecx, ecx
mov dword [rsp + 0x20], ecx
movups xmm0, xmmword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789]
movups xmmword [rsp + 0x13c0], xmm0
movups xmm1, xmmword [0x1402e13f8]
movups xmmword [rsp + 0x13d0], xmm1
movups xmm0, xmmword [0x1402e1408]
movups xmmword [rsp + 0x13e0], xmm0
movsd xmm1, qword [0x1402e1418]
movsd qword [rsp + 0x13f0], xmm1
mov eax, dword [0x1402e1420]
mov dword [rsp + 0x13f8], eax
movzx eax, word [0x1402e1424]
mov word [rsp + 0x13fc], ax
movzx eax, byte [0x1402e1426]
mov byte [rsp + 0x13fe], al
mov qword [rbx], rcx
mov qword [rbx + 0x10], rcx
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], cl
mov edi, 1
mov dword [rsp + 0x20], edi
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov ecx, eax
mov dword [rsp + 0x13b4], 0xffffffff
mov dword [rsp + 0x34], eax
nop dword [rax]
nop word [rax + rax]
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, edi
mov dword [rsp + rdi*4 + 0x34], ecx
inc rdi
cmp rdi, 0x270
jb 0x140080220
mov dword [rsp + 0x30], 0x270
test esi, esi
jle 0x1400802d8
mov rdi, rsi
lea rcx, [rsp + 0x30]
call fcn.14008dca0
mov ecx, eax
mov eax, 0x8421085
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
cmp eax, 0x4210842
jae 0x140080252
mov eax, 0x8421085
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
imul eax, eax, 0x3e
sub ecx, eax
movsxd rax, ecx
movzx r9d, byte [rsp + rax + 0x13c0]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x1400802c6
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x1400802bb
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x1400802ce
mov rcx, rbx
call fcn.14008cc00
sub rdi, 1
jne 0x140080252
mov rax, rbx
mov rcx, qword [rsp + 0x1400]
xor rcx, rsp
call fcn.1402376c0
lea r11, [rsp + 0x1410]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140080b40
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x15], 0
je 0x140080b63
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x14
jb 0x140080b50
mov byte [rcx + 0x15], 0
mov rax, rcx
ret

Function at 0x140080b70
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x140080b93
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 4
jb 0x140080b80
mov byte [rcx + 5], 0
mov rax, rcx
ret

Function at 0x140080ba0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x61], 0
je 0x140080bc3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x60
jb 0x140080bb0
mov byte [rcx + 0x61], 0
mov rax, rcx
ret
Function at 0x1400812e0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov rax, qword [0x140303960]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor edx, edx
mov dword [rsp + 0x20], 0xbebabab0
mov eax, edx
mov word [rsp + 0x24], 0xbe
mov byte [rsp + 0x26], 1
nop dword [rax + rax]
lea ecx, [rax - 0x77]
xor byte [rsp + rax + 0x20], cl
inc rax
cmp rax, 5
jb 0x140081310
mov byte [rsp + 0x26], dl
lea rax, [rsp + 0x20]
mov qword [rsp + 0x28], rdx
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
inc r8
cmp byte [rax + r8], dl
jne 0x140081343
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x28]
call fcn.1400890f0
xor r8d, r8d
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x48]
call fcn.140094130
lea rcx, [rsp + 0x48]
call fcn.1400954f0
lea rcx, [rsp + 0x49]
call fcn.140096f90
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1402376c0
add rsp, 0x68
ret
Function at 0x1400817d0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x13c0
call fcn.140238120
sub rsp, rax
mov rax, qword [0x140303960]
xor rax, rsp
mov qword [rsp + 0x13b0], rax
mov edi, edx
mov ebx, ecx
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rsp + 0x13a4], 0xffffffff
mov r8d, 1
mov dword [rsp + 0x24], eax
nop
mov r9d, eax
shr r9d, 0x1e
xor r9d, eax
imul eax, r9d, 0x6c078965
add eax, r8d
mov dword [rsp + r8*4 + 0x24], eax
inc r8
cmp r8, 0x270
jb 0x140081820
lea eax, [rbx - 0x80000000]
mov dword [rsp + 0x20], 0x270
mov ebp, 0x80000000
cmp ebx, ebp
lea esi, [rbx + rbp]
cmovae esi, eax
lea ebx, [rdi + rbp]
cmp edi, ebp
lea eax, [rdi - 0x80000000]
cmovae ebx, eax
sub ebx, esi
cmp ebx, 0xffffffff
jne 0x140081883
lea rcx, [rsp + 0x20]
call fcn.14008dca0
mov edx, eax
jmp 0x1400818c1
lea edi, [rbx + 1]
xor r8d, r8d
xor eax, eax
test ebx, ebx
je 0x1400818a1
lea rcx, [rsp + 0x20]
call fcn.14008dca0
mov r8d, eax
mov eax, 0xffffffff
xor edx, edx
div edi
mov ecx, eax
mov r9d, edx
xor edx, edx
mov eax, r8d
div edi
cmp eax, ecx
jb 0x1400818ba
cmp r9d, ebx
jne 0x140081886
xor edx, edx
mov eax, r8d
div edi
add edx, esi
cmp edx, ebp
lea ecx, [rdx - 0x80000000]
lea eax, [rdx + rbp]
cmovae eax, ecx
mov rcx, qword [rsp + 0x13b0]
xor rcx, rsp
call fcn.1402376c0
lea r11, [rsp + 0x13c0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140081900
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
mov rax, qword gs:[0x58]
mov rsi, qword [rax]
mov r14d, reloc.WS2_32.dll_sendto
mov eax, dword [r14 + rsi]
mov r12d, reloc.WLDAP32.dll_Ordinal_32
test al, 1
jne 0x1400819ad
or eax, 1
mov dword [r14 + rsi], eax
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov edx, eax
mov r9d, r12d
add r9, rsi
mov dword [r9 + 0x1384], 0xffffffff
mov dword [r9 + 4], eax
lea ecx, [rbp + 1]
lea r8, [r9 + 8]
nop dword [rax]
nop word [rax + rax]
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [r8], edx
inc rcx
lea r8, [r8 + 4]
cmp rcx, 0x270
jb 0x140081980
mov dword [r9], 0x270
mov eax, dword [r14 + rsi]
mov r15d, 0x13a8
test al, 2
jne 0x1400819cb
or eax, 2
mov dword [r14 + rsi], eax
mov qword [r15 + rsi], rbp
mov qword [r15 + rsi + 8], Ordinal_32
mov qword [rbx], rbp
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov dword [rsp + 0x20], 1
cmp rdi, 0xf
je 0x140081a03
jbe 0x1400819fe
mov rdx, rdi
mov rcx, rbx
call fcn.14008c860
mov qword [rbx + 0x10], rbp
jmp 0x140081a03
test rdi, rdi
je 0x140081a6c
mov ebp, r12d
add rbp, rsi
mov eax, r15d
add rsi, rax
lea r14, [0x1402e1450]
nop word [rax + rax]
dec rdi
mov rdx, rbp
mov rcx, rsi
call fcn.14008baa0
movzx r9d, byte [rax + r14]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x140081a5f
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x140081a54
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140081a67
mov rcx, rbx
call fcn.14008cc00
test rdi, rdi
jne 0x140081a20
mov rax, rbx
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret

Function at 0x140081a90
Capabilities:
Create process on windows

Disassembly:
mov r11, rsp
sub rsp, 0xf8
mov rax, qword [0x140303960]
xor rax, rsp
mov qword [rsp + 0xe0], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x74], xmm0
mov dword [r11 - 0x24], eax
mov rdx, rcx
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea rax, [rsp + 0x70]
xor ecx, ecx
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
movups xmmword [r11 - 0x74], xmm0
mov dword [rsp + 0x28], 0x8000000
movups xmmword [r11 - 0x64], xmm0
mov dword [rsp + 0x20], eax
movups xmmword [r11 - 0x54], xmm0
movups xmmword [r11 - 0x44], xmm0
movups xmmword [r11 - 0x34], xmm0
mov dword [rsp + 0x70], WSAGetLastError
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rcx, qword [rsp + 0x50]
mov edx, 0x3e8
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.1402376c0
add rsp, 0xf8
ret
Function at 0x140081b60
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 3], 0
je 0x140081b83
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 2
jb 0x140081b70
mov byte [rcx + 3], 0
mov rax, rcx
ret

Function at 0x140081b90
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x140303960]
xor rax, rsp
mov qword [rsp + 0x68], rax
movdqa xmm0, xmmword [0x1402e2550]
xor edx, edx
movdqa xmm1, xmmword [0x1402e23f0]
mov eax, edx
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x40], 0xd6d2d2de
movdqu xmmword [rsp + 0x30], xmm1
mov word [rsp + 0x44], 0x100
nop dword [rax]
nop dword [rax + rax]
lea ecx, [rax - 0x77]
xor byte [rsp + rax + 0x20], cl
inc rax
cmp rax, 0x24
jb 0x140081be0
mov byte [rsp + 0x45], dl
lea rax, [rsp + 0x20]
mov qword [rsp + 0x48], rdx
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
inc r8
cmp byte [rax + r8], dl
jne 0x140081c13
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x48]
call fcn.1400890f0
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
movabs rax, 0x842108421084211
and r8d, 0x1f
mul r8
mov ecx, r8d
lea rax, [rsp + 0x48]
sub rcx, rdx
shr rcx, 1
add rcx, rdx
mov rdx, qword [rsp + 0x60]
shr rcx, 4
imul rcx, rcx, 0x1f
sub r8, rcx
mov rcx, qword [rsp + 0x48]
cmp rdx, 0x10
cmovae rax, rcx
movzx ebx, byte [rax + r8 + 1]
jb 0x140081cab
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140081ca6
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140081ca6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1402376e0
movzx eax, bl
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1402376c0
add rsp, 0x70
pop rbx
ret

Function at 0x140081cd0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xc], 0
je 0x140081cf3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xb
jb 0x140081ce0
mov byte [rcx + 0xc], 0
mov rax, rcx
ret
Function at 0x140082b70
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xb], 0
je 0x140082b93
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xa
jb 0x140082b80
mov byte [rcx + 0xb], 0
mov rax, rcx
ret

Function at 0x140082ba0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x81], 0
je 0x140082bc8
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x80
jb 0x140082bb0
mov byte [rcx + 0x81], 0
mov rax, rcx
ret

Function at 0x140082bd0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xe], 0
je 0x140082bf3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xd
jb 0x140082be0
mov byte [rcx + 0xe], 0
mov rax, rcx
ret

Function at 0x140082c20
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x11], 0
je 0x140082c43
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x10
jb 0x140082c30
mov byte [rcx + 0x11], 0
mov rax, rcx
ret

Function at 0x140082c50
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 9], 0
je 0x140082c73
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x140082c60
mov byte [rcx + 9], 0
mov rax, rcx
ret
Function at 0x140084f50
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1c], 0
je 0x140084f73
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1b
jb 0x140084f60
mov byte [rcx + 0x1c], 0
mov rax, rcx
ret

Function at 0x140084f80
Capabilities:
Create thread
Encode data using xor
Terminate process

Disassembly:
push rbp
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov dword [rsp + 0x30], 0xfcf8efdb
xor ecx, ecx
mov dword [rsp + 0x34], 0xa0e1f9ec
mov dword [rsp + 0x38], 0x100a3a1
nop dword [rax + rax]
lea eax, [rcx - 0x77]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0xa
jb 0x140084fb0
xor edx, edx
mov byte [rsp + 0x3b], 0
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x1400850d0
mov qword [rsp + 0x28], rax
lea r8, [0x140081b40]
xor r9d, r9d
mov dword [rsp + 0x20], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
movdqa xmm0, xmmword [0x1402e1f80]
lea rcx, [0x1406c71a0]
movdqa xmm1, xmmword [0x1402e2000]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm0, xmmword [str.aBa_n]
movdqa xmmword [rsp + 0x50], xmm1
movdqa xmm1, xmmword [0x1402e2450]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm0, xmmword [0x1402e24f0]
movdqa xmmword [rsp + 0x70], xmm1
movdqa xmm1, xmmword [0x1402e1e60]
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmm0, xmmword [0x1402e2110]
movdqa xmmword [rbp - 0x70], xmm1
movdqa xmm1, xmmword [0x1402e1f30]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm0, xmmword [0x1402e20e0]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm1, xmmword [0x1402e2430]
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmm0, xmmword [0x1402e2460]
movdqa xmmword [rbp - 0x30], xmm1
movdqa xmm1, xmmword [0x1402e2140]
movdqa xmmword [rbp - 0x20], xmm0
movdqa xmmword [rbp - 0x10], xmm1
mov dword [rbp], 0x100f098
call fcn.1400883a0
lea rcx, [rsp + 0x40]
mov r8, rax
call fcn.140085160
xor ecx, ecx
mov rdx, rax
lea r9d, [rcx + 0x10]
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
cmp byte [reloc.WS2_32.dll_accept], 0
je 0x14008513d
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
mov dword [rsp + 0x30], 0xfcf8efdb
mov dword [rsp + 0x34], 0xa0e1f9ec
mov dword [rsp + 0x38], 0x100a3a1
nop
lea ecx, [rax - 0x77]
xor byte [rsp + rax + 0x30], cl
inc rax
cmp rax, 0xa
jb 0x140085100
xor edx, edx
mov byte [rsp + 0x3b], 0
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_FindWindowA]
mov rcx, rax
lea rdx, [0x1406c9dfc]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x1400850d0
mov byte [reloc.WS2_32.dll_accept], 0
cmp byte [0x1406c9dfb], 0
jne 0x14008514f
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.140084ae0
int3

Function at 0x140085160
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xc3], 0
je 0x140085188
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xc2
jb 0x140085170
mov byte [rcx + 0xc3], 0
mov rax, rcx
ret
Function at 0x140085710
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x18], 0
je 0x140085733
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x17
jb 0x140085720
mov byte [rcx + 0x18], 0
mov rax, rcx
ret

Function at 0x140085740
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x4a], 0
je 0x140085763
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x49
jb 0x140085750
mov byte [rcx + 0x4a], 0
mov rax, rcx
ret

Function at 0x140085770
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x6f], 0
je 0x140085793
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x6e
jb 0x140085780
mov byte [rcx + 0x6f], 0
mov rax, rcx
ret
Function at 0x140086960
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x40], 0
je 0x140086983
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x3f
jb 0x140086970
mov byte [rcx + 0x40], 0
mov rax, rcx
ret

Function at 0x140086990
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x5d], 0
je 0x1400869b3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x5c
jb 0x1400869a0
mov byte [rcx + 0x5d], 0
mov rax, rcx
ret

Function at 0x1400869c0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x58], 0
je 0x1400869e3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x57
jb 0x1400869d0
mov byte [rcx + 0x58], 0
mov rax, rcx
ret

Function at 0x1400869f0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xaf], 0
je 0x140086a18
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xae
jb 0x140086a00
mov byte [rcx + 0xaf], 0
mov rax, rcx
ret

Function at 0x140086a20
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x76], 0
je 0x140086a43
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x75
jb 0x140086a30
mov byte [rcx + 0x76], 0
mov rax, rcx
ret

Function at 0x140086a50
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x60], 0
je 0x140086a73
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x5f
jb 0x140086a60
mov byte [rcx + 0x60], 0
mov rax, rcx
ret