joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140031ae0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x140050010]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edi, edi
mov rbp, rcx
xor edx, edx
mov ebx, edi
lea ecx, [rdi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x140031b82
nop word [rax + rax]
mov rdx, rbp
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
test eax, eax
jne 0x140031b70
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jle 0x140031b70
mov edi, dword [rsp + 0x28]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140031b50
mov eax, edi
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400403d0
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140031f70
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rdi
sub rsp, 0x50
mov rax, qword [0x140050010]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor eax, eax
mov dword [rsp + 0x2c], edx
mov edx, 0x1000
mov dword [rsp + 0x28], ecx
xor ecx, ecx
mov dword [rsp + 0x20], eax
mov r8d, edx
mov dword [rsp + 0x30], eax
lea r9d, [rax + 0x40]
mov qword [rsp + 0x34], 1
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
jne 0x140031fcf
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400403d0
add rsp, 0x50
pop rdi
ret
movups xmm0, xmmword [0x14021ee50]
mov r8d, 0x28
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x20]
movups xmmword [rax], xmm0
movsd xmm1, qword [0x14021ee60]
lea ecx, [r8 - 0x27]
movsd qword [rax + 0x10], xmm1
mov eax, dword [0x14021ee68]
mov dword [rdi + 0x18], eax
movzx eax, word [0x14021ee6c]
mov word [rdi + 0x1c], ax
call rdi
xor edx, edx
mov r8d, 0x1000
mov rcx, rdi
mov ebx, eax
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test ebx, ebx
mov rbx, qword [rsp + 0x70]
setg al
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400403d0
add rsp, 0x50
pop rdi
ret

Function at 0x140032050
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x13c0
call fcn.140041830
sub rsp, rax
mov rax, qword [0x140050010]
xor rax, rsp
mov qword [rsp + 0x13b0], rax
mov edi, edx
mov ebx, ecx
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rsp + 0x13a4], 0xffffffff
mov r8d, 1
mov dword [rsp + 0x24], eax
nop
mov r9d, eax
shr r9d, 0x1e
xor r9d, eax
imul eax, r9d, 0x6c078965
add eax, r8d
mov dword [rsp + r8*4 + 0x24], eax
inc r8
cmp r8, 0x270
jb 0x1400320a0
lea eax, [rbx - 0x80000000]
mov dword [rsp + 0x20], 0x270
mov ebp, 0x80000000
cmp ebx, ebp
lea esi, [rbx + rbp]
cmovae esi, eax
lea ebx, [rdi + rbp]
cmp edi, ebp
lea eax, [rdi - 0x80000000]
cmovae ebx, eax
sub ebx, esi
cmp ebx, 0xffffffff
jne 0x140032103
lea rcx, [rsp + 0x20]
call fcn.140040200
mov edx, eax
jmp 0x140032141
lea edi, [rbx + 1]
xor r8d, r8d
xor eax, eax
test ebx, ebx
je 0x140032121
lea rcx, [rsp + 0x20]
call fcn.140040200
mov r8d, eax
mov eax, 0xffffffff
xor edx, edx
div edi
mov ecx, eax
mov r9d, edx
xor edx, edx
mov eax, r8d
div edi
cmp eax, ecx
jb 0x14003213a
cmp r9d, ebx
jne 0x140032106
xor edx, edx
mov eax, r8d
div edi
add edx, esi
cmp edx, ebp
lea ecx, [rdx - 0x80000000]
lea eax, [rdx + rbp]
cmovae eax, ecx
mov rcx, qword [rsp + 0x13b0]
xor rcx, rsp
call fcn.1400403d0
lea r11, [rsp + 0x13c0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140032180
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x1340]
mov eax, 0x1440
call fcn.140041830
sub rsp, rax
mov rax, qword [0x140050010]
xor rax, rsp
mov qword [rbp + 0x1330], rax
mov r15d, edx
mov rbx, rcx
mov qword [rsp + 0x70], rcx
xor edi, edi
mov dword [rsp + 0x20], edi
movdqa xmm0, xmmword [0x140048ac0]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x140048bf0]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmm0, xmmword [0x140048b10]
movdqa xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x60], 0x9692929e
mov dword [rsp + 0x64], 0xc3dddfdd
mov dword [rsp + 0x68], 0xc3c5c7c5
mov dword [rsp + 0x6c], 0x100cfcd
mov eax, edi
nop word [rax + rax]
lea ecx, [rax - 0x47]
xor byte [rsp + rax + 0x30], cl
inc rax
cmp rax, 0x3e
jb 0x140032220
mov byte [rsp + 0x6f], dil
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x78], rdi
mov qword [rbp - 0x70], 0xf
mov byte [rsp + 0x78], dil
lea rax, [rsp + 0x30]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], dil
jne 0x140032257
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x78]
call fcn.14003c6a0
nop
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov edi, 1
mov dword [rsp + 0x20], edi
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov ecx, eax
mov dword [rbp + 0x1324], 0xffffffff
mov dword [rbp - 0x5c], eax
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, edi
mov dword [rbp + rdi*4 - 0x5c], ecx
inc rdi
cmp rdi, 0x270
jb 0x1400322a0
mov dword [rbp - 0x60], 0x270
mov r14, qword [rbp - 0x70]
mov rsi, qword [rsp + 0x78]
test r15d, r15d
jle 0x140032374
mov rdi, r15
nop dword [rax + rax]
lea rcx, [rbp - 0x60]
call fcn.140040200
mov r8d, eax
mov eax, 0x8421085
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 4
cmp eax, 0x8421084
jae 0x1400322e0
mov eax, 0x8421085
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 4
imul eax, eax, 0x1f
sub r8d, eax
lea rcx, [rsp + 0x78]
cmp r14, 0x10
cmovae rcx, rsi
movsxd rax, r8d
movzx r9d, byte [rax + rcx]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x140032362
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x140032357
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14003236a
mov rcx, rbx
call fcn.14003f570
sub rdi, 1
jne 0x1400322e0
cmp r14, 0x10
jb 0x1400323ae
lea rdx, [r14 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1400323a6
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400323a6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.140040978
mov rax, rbx
mov rcx, qword [rbp + 0x1330]
xor rcx, rsp
call fcn.1400403d0
lea r11, [rsp + 0x1440]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140033a90
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xc], 0
je 0x140033ab3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x47]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xb
jb 0x140033aa0
mov byte [rcx + 0xc], 0
mov rax, rcx
ret

Function at 0x140033b90
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140050010]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov rsi, r8
mov dword [rsp + 0x28], 0x80
mov rdi, rdx
mov dword [rsp + 0x40], 0
xor r8d, r8d
mov dword [rsp + 0x20], 2
lea edx, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov rcx, rax
mov r8d, esi
mov rdx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400403d0
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400348b0
Capabilities:
Encode data using base64 via winapi

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140050010]
xor rax, rsp
mov qword [rbp - 8], rax
mov r12, rdx
mov r14, rcx
mov qword [rbp - 0x38], rcx
xor r13d, r13d
mov dword [rbp - 0x40], r13d
mov dword [rbp - 0x30], r13d
mov qword [rcx], r13
mov qword [rcx + 0x10], r13
mov qword [rcx + 0x18], 0xf
mov byte [rcx], r13b
xor r8d, r8d
lea rdx, [0x140043b26]
call fcn.14003c6a0
mov dword [rbp - 0x40], 1
mov rsi, 0xffffffffffffffff
mov rdi, rsi
nop dword [rax]
inc rdi
cmp byte [r12 + rdi], 0
jne 0x140034920
test edi, edi
je 0x140034acb
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8d, [r9 + 1]
mov edx, edi
mov rcx, r12
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
mov eax, dword [rbp - 0x30]
test eax, eax
je 0x140034a34
xorps xmm0, xmm0
mov r15d, eax
movdqu xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x18], r13
cmp rax, 0x1000
jb 0x14003499b
lea rcx, [rax + 0x27]
cmp rcx, rax
jbe 0x140034af2
call fcn.140040c94
mov rcx, rax
test rax, rax
je 0x140034a28
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400349a3
mov rcx, r15
call fcn.140040c94
mov qword [rbp - 0x28], rax
lea rbx, [rax + r15]
mov qword [rbp - 0x18], rbx
mov r8, r15
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov qword [rbp - 0x20], rbx
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp - 0x28]
mov r8d, 1
mov edx, edi
mov rcx, r12
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
mov rdx, qword [rbp - 0x28]
inc rsi
cmp byte [rdx + rsi], 0
jne 0x1400349e2
mov r8, rsi
mov rcx, r14
call fcn.14003c6a0
nop
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x140034a34
mov rdx, qword [rbp - 0x18]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140034a2f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140034a2f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140040978
mov rcx, r14
call fcn.14003bff0
cmp rax, 0xffffffffffffffff
je 0x140034acb
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x18], r13
mov qword [rbp - 0x10], 0xf
mov byte [rbp - 0x28], 0
mov r8d, 2
lea rdx, [0x140043bec]
lea rcx, [rbp - 0x28]
call fcn.14003c6a0
nop
mov rcx, r14
call fcn.14003bff0
mov qword [rsp + 0x20], r13
mov r8, qword [rbp - 0x18]
mov rdx, rax
mov rcx, r14
call fcn.14003c4e0
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x140034a34
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140034a2f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140034a2f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, r14
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400403d0
mov rbx, qword [rsp + 0xc0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14002c1b0
int3
Function at 0x140035010
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x18], 0
je 0x140035033
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x47]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x17
jb 0x140035020
mov byte [rcx + 0x18], 0
mov rax, rcx
ret

Function at 0x140035040
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x4a], 0
je 0x140035063
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x47]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x49
jb 0x140035050
mov byte [rcx + 0x4a], 0
mov rax, rcx
ret

Function at 0x140035070
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x6f], 0
je 0x140035093
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x47]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x6e
jb 0x140035080
mov byte [rcx + 0x6f], 0
mov rax, rcx
ret

Function at 0x1400350a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 4], 0
je 0x1400350c3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x47]
xor byte [rax + rcx], dl
inc rax
cmp rax, 3
jb 0x1400350b0
mov byte [rcx + 4], 0
mov rax, rcx
ret
Function at 0x140036c20
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x140036c43
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x47]
xor byte [rax + rcx], dl
inc rax
cmp rax, 4
jb 0x140036c30
mov byte [rcx + 5], 0
mov rax, rcx
ret

Function at 0x140036c50
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x40], 0
je 0x140036c73
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x47]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x3f
jb 0x140036c60
mov byte [rcx + 0x40], 0
mov rax, rcx
ret

Function at 0x140036c80
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x5d], 0
je 0x140036ca3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x47]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x5c
jb 0x140036c90
mov byte [rcx + 0x5d], 0
mov rax, rcx
ret

Function at 0x140036cb0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x58], 0
je 0x140036cd3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x47]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x57
jb 0x140036cc0
mov byte [rcx + 0x58], 0
mov rax, rcx
ret

Function at 0x140036ce0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xaf], 0
je 0x140036d08
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x47]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xae
jb 0x140036cf0
mov byte [rcx + 0xaf], 0
mov rax, rcx
ret

Function at 0x140036d10
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x76], 0
je 0x140036d33
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x47]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x75
jb 0x140036d20
mov byte [rcx + 0x76], 0
mov rax, rcx
ret

Function at 0x140036d40
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x60], 0
je 0x140036d63
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x47]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x5f
jb 0x140036d50
mov byte [rcx + 0x60], 0
mov rax, rcx
ret

Function at 0x140036e10
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x24], 0
je 0x140036e33
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x47]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x23
jb 0x140036e20
mov byte [rcx + 0x24], 0
mov rax, rcx
ret

Function at 0x140036e40
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x7d], 0
je 0x140036e63
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x47]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x7c
jb 0x140036e50
mov byte [rcx + 0x7d], 0
mov rax, rcx
ret

Function at 0x140036ef0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x3b], 0
je 0x140036f13
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x47]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x3a
jb 0x140036f00
mov byte [rcx + 0x3b], 0
mov rax, rcx
ret
Function at 0x140037010
Capabilities:
Set console window title

Disassembly:
sub rsp, 0x58
mov rax, qword [0x140050010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov byte [rsp + 0x20], 8
mov r8b, 0x39
mov al, 0x3d
xor ecx, ecx
xor r8b, 8
mov byte [rsp + 0x21], r8b
xor al, 8
mov byte [rsp + 0x22], al
mov byte [rsp + 0x23], cl
lea r9, [rsp + 0x21]
mov ecx, 9
call fcn.14002eab0
mov r11, rax
cmp r8b, 0x30
jl 0x14003708c
nop word [rax + rax]
cmp r8b, 0x39
jg 0x14003708c
mov ecx, 0xc51
call fcn.14002eab0
imul eax, r11d
movsx r11d, r8b
add r11d, 0xffffffd0
add r11d, eax
inc r9
movzx r8d, byte [r9]
cmp r8b, 0x30
jge 0x140037060
mov byte [rsp + 0x20], 0xb
mov r8b, 0x3e
xor eax, eax
xor r8b, 0xb
mov byte [rsp + 0x21], r8b
mov byte [rsp + 0x22], al
lea r9, [rsp + 0x21]
lea ecx, [rax + 9]
call fcn.14002eab0
mov r10, rax
cmp r8b, 0x30
jl 0x1400370ec
nop dword [rax]
cmp r8b, 0x39
jg 0x1400370ec
mov ecx, 0xc51
call fcn.14002eab0
imul eax, r10d
movsx r10d, r8b
add r10d, 0xffffffd0
add r10d, eax
inc r9
movzx r8d, byte [r9]
cmp r8b, 0x30
jge 0x1400370c0
mov edx, r11d
mov ecx, r10d
call fcn.140032050
mov edx, eax
lea rcx, [rsp + 0x28]
call fcn.140032180
nop
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 0x10
cmovae rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
call fcn.1400350d0
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x140037161
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003715c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003715c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140040978
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400403d0
add rsp, 0x58
ret
Function at 0x14003a6d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x68], 0
je 0x14003a6f3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x47]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x67
jb 0x14003a6e0
mov byte [rcx + 0x68], 0
ret

Function at 0x14003a700
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xa2], 0
je 0x14003a728
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x47]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xa1
jb 0x14003a710
mov byte [rcx + 0xa2], 0
ret

Function at 0x14003a730
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xd], 0
je 0x14003a753
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x47]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xc
jb 0x14003a740
mov byte [rcx + 0xd], 0
ret

Function at 0x14003a760
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x3d], 0
je 0x14003a783
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x47]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x3c
jb 0x14003a770
mov byte [rcx + 0x3d], 0
ret

Function at 0x14003a790
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x28], 0
je 0x14003a7b3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x47]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x27
jb 0x14003a7a0
mov byte [rcx + 0x28], 0
ret

Function at 0x14003a7c0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x22], 0
je 0x14003a7e3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x47]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x21
jb 0x14003a7d0
mov byte [rcx + 0x22], 0
ret

Function at 0x14003a7f0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2c], 0
je 0x14003a813
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x47]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x2b
jb 0x14003a800
mov byte [rcx + 0x2c], 0
ret

Function at 0x14003a820
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2b], 0
je 0x14003a843
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x47]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x2a
jb 0x14003a830
mov byte [rcx + 0x2b], 0
ret

Function at 0x14003a850
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2e], 0
je 0x14003a873
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x47]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x2d
jb 0x14003a860
mov byte [rcx + 0x2e], 0
ret

Function at 0x14003a880
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x46], 0
je 0x14003a8a3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x47]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x45
jb 0x14003a890
mov byte [rcx + 0x46], 0
ret

Function at 0x14003a8b0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x34], 0
je 0x14003a8d3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x47]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x33
jb 0x14003a8c0
mov byte [rcx + 0x34], 0
ret

Function at 0x14003a8e0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x64], 0
je 0x14003a903
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x47]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x63
jb 0x14003a8f0
mov byte [rcx + 0x64], 0
ret
Function at 0x14003a910
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1f], 0
je 0x14003a933
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x47]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1e
jb 0x14003a920
mov byte [rcx + 0x1f], 0
ret

Function at 0x14003a940
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x5f], 0
je 0x14003a963
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x47]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x5e
jb 0x14003a950
mov byte [rcx + 0x5f], 0
ret

Function at 0x14003a970
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xe], 0
je 0x14003a993
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x47]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xd
jb 0x14003a980
mov byte [rcx + 0xe], 0
ret

Function at 0x14003a9a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1e], 0
je 0x14003a9c3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x47]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1d
jb 0x14003a9b0
mov byte [rcx + 0x1e], 0
ret

Function at 0x14003a9d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 9], 0
je 0x14003a9f3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x47]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x14003a9e0
mov byte [rcx + 9], 0
ret

Function at 0x14003aa00
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x40], 0
je 0x14003aa23
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x47]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x3f
jb 0x14003aa10
mov byte [rcx + 0x40], 0
ret

Function at 0x14003aa30
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x14003aa53
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x47]
xor byte [rax + rcx], dl
inc rax
cmp rax, 4
jb 0x14003aa40
mov byte [rcx + 5], 0
ret

Function at 0x14003aa70
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xf], 0
je 0x14003aa93
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x47]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xe
jb 0x14003aa80
mov byte [rcx + 0xf], 0
ret

Function at 0x14003aaa0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x68], 0
je 0x14003aac5
xor eax, eax
mov r8d, 0x21b9
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x33
jb 0x14003aab0
mov byte [rcx + 0x68], 0
ret

Function at 0x14003aad0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x22], 0
je 0x14003aaf5
xor eax, eax
mov r8d, 0x21b9
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x10
jb 0x14003aae0
mov byte [rcx + 0x22], 0
ret

Function at 0x14003ab00
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 4], 0
je 0x14003ab23
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x47]
xor byte [rax + rcx], dl
inc rax
cmp rax, 3
jb 0x14003ab10
mov byte [rcx + 4], 0
ret

Function at 0x14003ab30
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x16], 0
je 0x14003ab55
xor eax, eax
mov r8d, 0x21b9
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0xa
jb 0x14003ab40
mov byte [rcx + 0x16], 0
ret