joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14015c700
Capabilities:
Encode data using xor

Disassembly:
test rdx, rdx
je 0x14015c90f
push rdi
sub rsp, 0x20
mov rcx, qword [rdx + 0x50]
xchg rdx, rdi
mov rdx, rdi
xchg rdx, rdi
xchg rbx, rbp
mov qword [rsp + 0x30], rbp
xchg rbx, rbp
xor ebx, ebx
test rcx, rcx
je 0x14015c793
mov rdx, qword [rdx + 0x60]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x14015c77c
xchg r8, r12
mov r12, qword [rcx - 8]
xchg r8, r12
nop
add rdx, 0x558a1b8b
sub rdx, 0x558a1b64
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14015c918
xchg rcx, r14
mov r14, r8
xchg rcx, r14
call fcn.1401fcccc
xchg rbx, r15
mov qword [rdi + 0x50], r15
xchg rbx, r15
mov qword [rdi + 0x58], rbx
mov qword [rdi + 0x60], rbx
mov rcx, qword [rdi + 0x40]
mov rax, qword [rcx + 8]
mov qword [rax], rbx
mov rcx, qword [rcx]
test rcx, rcx
je 0x14015c80a
nop word [rax + rax]
xchg r14, rbx
mov r14, qword [rcx]
xchg rbx, r14
mov edx, 0x39933f5a
sub edx, 0xbb4fc9c
sub edx, 0x11e033dc
sub edx, 0x10032296
xor edx, 0x328703a
xor edx, 0x47c76709
sub edx, 0x13b011d3
xor edx, 0x1d6af9ce
sub edx, 0x260f104a
call fcn.1401fcccc
xchg r10, rcx
mov r10, rbx
xchg r10, rcx
test rbx, rbx
jne 0x14015c7b5
mov rcx, qword [rdi + 0x40]
mov edx, 0x493292ba
add edx, 0x25b54c97
xor edx, 0x3ea633e7
sub edx, 0xa1896f3
xor edx, 0x7191cced
sub edx, 0x2eb6098
xor edx, 0x34cd388e
call fcn.1401fcccc
xchg r12, rbx
mov r12, qword [rdi + 0x28]
xchg rbx, r12
test rbx, rbx
je 0x14015c8bb
xchg rsi, rcx
mov qword [rsp + 0x38], rcx
xchg rsi, rcx
mov esi, 0x578faa3d
xor esi, 0x46941839
add esi, 0x56fef018
sub esi, 0x3013c3b5
xor esi, 0x20f51b32
xor esi, 0xe70c3aaa
mov eax, esi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x14015c8b6
mov rax, qword [rbx]
xchg rcx, r9
mov r9, rbx
xchg r9, rcx
call qword [rax]
lock xadd dword [rbx + 0xc], esi
cmp esi, 1
jne 0x14015c8b6
xchg r8, rax
mov r8, qword [rbx]
xchg r8, rax
mov rcx, rbx
call qword [rax + 8]
mov rsi, qword [rsp + 0x38]
mov edx, 0x385d5133
add edx, 0x36ea66fd
xor edx, 0x414032f1
xor edx, 0x73cba78c
add edx, 0xa5b1d4c
sub edx, 0x5a04d33d
sub edx, 0xe2275b4
xchg r14, rcx
mov r14, rdi
xchg r14, rcx
call fcn.1401fcccc
xchg rcx, rbx
mov rcx, qword [rsp + 0x30]
xchg rbx, rcx
add rsp, 0x20
push rcx
push rax
push rbx
push rbx
push rax
xchg qword [rsp + 0x28], rdi
add rsp, 0x30
nop
add rsp, 8
jmp qword [rsp - 8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x1401748d0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x50
cmp qword [rcx + 0x68], 0
xchg r9, rbx
mov r9, rcx
xchg rbx, r9
je 0x140174a93
cmp byte [rcx + 0x72], 0
je 0x140174a93
xchg r12, rax
mov r12, qword [rcx]
xchg r12, rax
mov qword [rsp + 0x68], rdi
mov edi, 0x54b01a8e
add edi, 0x21fd2f93
sub edi, 0x31987517
add edi, 0x345d8bee
add edi, 0x1785f7
sub edi, 0x2c799c7e
add edi, 0x7d43583
sub edi, 0x3fefd8be
xor edi, 0x14f458c9
mov edx, edi
call qword [rax + 0x18]
cmp di, ax
je 0x140174a6f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x60]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1401749c2
sub eax, 1
je 0x1401749da
cmp eax, 2
jne 0x140174a6f
mov rdi, qword [rsp + 0x68]
mov al, 0x3b
xor al, 0x55
sub al, 0x47
add al, 8
add al, 0x47
sub al, 0x75
mov byte [rbx + 0x72], 0x1e
add byte [rbx + 0x72], 0x4e
sub byte [rbx + 0x72], 0x35
add byte [rbx + 0x72], 0xe
add byte [rbx + 0x72], 0x29
sub byte [rbx + 0x72], 0xa
xor byte [rbx + 0x72], 0x64
add rsp, 0x50
nop
mov rbx, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
mov byte [rbx + 0x72], 0x65
xor byte [rbx + 0x72], 0x14
sub byte [rbx + 0x72], 0x37
sub byte [rbx + 0x72], 0x13
xor byte [rbx + 0x72], 0x34
sub byte [rbx + 0x72], 0x13
mov rdi, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
sub rdi, rax
je 0x140174a40
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x30]
xchg r15, r8
mov r15, rdi
xchg r15, r8
mov edx, 0x6c8f2bf6
add edx, 0xf4a3bdc
xor edx, 0x53075593
add edx, 0x1a45e96
xor edx, 0x186aa3b6
xor edx, 0x24ae0b20
add edx, 0x4f73ef7c
xor edx, 0x65ba27bc
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140174a6f
cmp byte [rbx + 0x72], 0
xchg rbx, rdi
mov rbx, qword [rsp + 0x68]
xchg rdi, rbx
sete al
add rsp, 0x50
push rdx
push rdx
push rax
push rcx
push rcx
push rax
push rax
xchg qword [rsp + 0x38], rbx
add rsp, 0x40
nop
add rsp, 8
jmp qword [rsp - 8]
mov rdi, qword [rsp + 0x68]
xor al, al
add rsp, 0x50
push rdx
push rdx
push rax
push rcx
push rdx
push rax
push rcx
xchg qword [rsp + 0x38], rbx
add rsp, 0x40
nop
add rsp, 8
jmp qword [rsp - 8]
mov al, 0x3b
xor al, 0x39
add al, 0x7a
sub al, 0x5f
xor al, 0x57
sub al, 0x49
add rsp, 0x50
push rax
push rdx
push rcx
push rdx
push rax
xchg qword [rsp + 0x28], rbx
pop rax
pop rdx
pop rcx
pop rdx
pop rax
add rsp, 8
ret
Function at 0x140179850
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x60
mov r8d, edx
lea r9, [rsp + 0x52]
xchg rcx, rdx
mov rbx, rdx
xchg rcx, rdx
xor r10d, r10d
nop dword [rax]
nop dword [rax + rax]
sub r9, 2
mov eax, 0xbf99fad
add eax, 0x176c51a7
add eax, 0x4d37c333
xor eax, 0x15319767
sub eax, 0x58100955
add eax, 0xa054313
add eax, 0x10f7a37
add eax, 0x5a46a7ca
add eax, 0x59d54d2e
mul r8d
shr edx, 2
shr edx, 1
movzx eax, dx
shl ax, 2
lea ecx, [rax + rdx]
add cx, cx
sub r8w, cx
nop
sub r8w, 0x55b3
add r8w, 0x55e3
mov word [r9], r8w
mov r8d, edx
test edx, edx
jne 0x140179876
xorps xmm0, xmm0
lea rax, [rsp + 0x52]
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r10
xchg r8, r10
mov qword [rbx + 0x18], r8
xchg r10, r8
cmp r9, rax
jne 0x14017996b
xchg r12, r10
mov qword [rbx + 0x10], r12
xchg r10, r12
xchg rsi, rbx
mov rax, rsi
xchg rbx, rsi
mov qword [rbx + 0x18], 0x62e8bd52
xor qword [rbx + 0x18], 0x22a06b86
xor qword [rbx + 0x18], 0x74a2423f
xor qword [rbx + 0x18], 0x1c36ccf1
xor qword [rbx + 0x18], 0x3b65e5cd
add qword [rbx + 0x18], 0x6bd839d8
sub qword [rbx + 0x18], 0x1b6a1853
sub qword [rbx + 0x18], 0x6427df55
mov word [rbx], r10w
add rsp, 0x60
nop
xchg qword [rsp], rbx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
lea r8, [rsp + 0x52]
xchg r9, rdx
mov r9, rdx
xchg rdx, r9
sub r8, r9
mov rcx, rbx
sar r8, 1
call fcn.14007ed20
xchg r12, rbx
mov rax, r12
xchg rbx, r12
add rsp, 0x60
nop
add rsp, 8
mov rbx, qword [rsp - 8]
ret
Function at 0x1401940b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
xchg rdx, r8
mov r10, r8
xchg r8, rdx
mov r11, rcx
mov word [rsp + 0x30], 0x429
xor word [rsp + 0x30], 0x65ba
xor word [rsp + 0x30], 0x1731
add word [rsp + 0x30], 0x635
sub word [rsp + 0x30], 0x5cd0
xor word [rsp + 0x30], 0xea1
sub word [rsp + 0x30], 0x117
add word [rsp + 0x30], 0xc967
mov dword [rsp + 0x34], 0x1e444fc0
xor dword [rsp + 0x34], 0x7ae40678
add dword [rsp + 0x34], 0x6727257
sub dword [rsp + 0x34], 0x428dc62c
add dword [rsp + 0x34], 0x1cffe02e
sub dword [rsp + 0x34], 0x4103be55
add dword [rsp + 0x34], 0xfacee795
mov byte [rsp + 0x32], 0x2b
xor byte [rsp + 0x32], 0x64
add byte [rsp + 0x32], 0x1c
sub byte [rsp + 0x32], 0x2f
xor byte [rsp + 0x32], 0x6e
sub byte [rsp + 0x32], 0x37
add byte [rsp + 0x32], 0x5c
sub byte [rsp + 0x32], 0x13
xor byte [rsp + 0x32], 0x92
mov dword [rsp + 0x38], 0x64b800cf
sub dword [rsp + 0x38], 0x44025cfa
xor dword [rsp + 0x38], 0x14069187
xor dword [rsp + 0x38], 0x20a82b87
add dword [rsp + 0x38], 0x368deb9e
xor dword [rsp + 0x38], 0x62467234
xor dword [rsp + 0x38], 0x4dc63c95
sub dword [rsp + 0x38], 0x4d309567
xor dword [rsp + 0x38], 0x17f84935
xor ebx, ebx
mov edx, ebx
nop dword [rax]
movzx eax, word [rsp + rdx*2 + 0x34]
movzx ecx, byte [rsp + rdx + 0x30]
add cx, ax
mov word [rsp + rdx*2 + 0x34], cx
mov byte [rsp + rdx + 0x30], bl
inc rdx
cmp rdx, 3
jb 0x1401941af
xchg r13, r8
mov qword [rsp + 0x28], r13
xchg r8, r13
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, [rsp + 0x34]
mov rdx, r10
xchg rcx, r11
mov r11, rcx
xchg r11, rcx
call fcn.1401945b0
nop
nop dword [rax]
mov byte [rsp + rbx + 0x34], 0x7b
sub byte [rsp + rbx + 0x34], 0x67
add byte [rsp + rbx + 0x34], 0x30
add byte [rsp + rbx + 0x34], 0x21
add byte [rsp + rbx + 0x34], 0x10
xor byte [rsp + rbx + 0x34], 0x52
xor byte [rsp + rbx + 0x34], 0x27
inc rbx
cmp rbx, 6
jb 0x1401941ff
add rsp, 0x40
nop
add rsp, 8
xchg qword [rsp - 8], rbx
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140198950
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xchg r9, r8
mov qword [rsp + 0x20], r8
xchg r9, r8
mov qword [rsp + 0x18], r8
xchg r12, rcx
mov qword [rsp + 8], r12
xchg rcx, r12
nop
sub rsp, 8
mov qword [rsp], rbx
nop
sub rsp, 8
mov qword [rsp], rbp
nop
sub rsp, 8
mov qword [rsp], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x58
xchg r9, r10
mov rbx, r10
xchg r9, r10
xchg rbx, rsi
mov rbx, rdx
xchg rbx, rsi
mov r9, rcx
xor ebp, ebp
test rdx, rdx
jne 0x1401989ba
mov eax, ebp
jmp 0x140198a00
mov eax, 0x3b999211
sub eax, 0x21932c78
add eax, 0x58b3429f
sub eax, 0x26711223
sub eax, 0x1ba80f6d
xor eax, 0x30a0dce5
cmp word [rdx], ax
je 0x1401989ef
xchg rdi, rbp
mov rax, rdi
xchg rbp, rdi
jmp 0x140198a00
movsxd rax, dword [rdx + 0x3c]
add rax, rsi
cmp dword [rax], 0x4550
cmovne rax, rbp
mov ecx, 0x59ae0a0a
sub ecx, 0x416f1f8f
add ecx, 0x155b8885
xor ecx, 0x4ac8a771
add ecx, 0x180b2663
xor ecx, 0x7f5df8df
cmp word [rax + 0x18], cx
jne 0x140198b42
mov r14d, dword [rax + 0x88]
add r14, rsi
je 0x140198b42
mov r15d, dword [r14 + 0x1c]
add r15, rsi
mov r12d, dword [r14 + 0x24]
add r12, rsi
mov r13d, dword [r14 + 0x20]
add r13, rsi
mov edi, ebp
cmp dword [r14 + 0x18], 0
jbe 0x140198b0e
nop dword [rax]
nop dword [rax + rax]
mov eax, edi
mov ecx, dword [r13 + rax*4]
add rcx, rsi
movzx eax, word [r12 + rax*2]
mov edx, dword [r15 + rax*4]
add rdx, rsi
cmp rcx, 0xffff
jbe 0x140198b02
mov qword [rsp + 0xa8], rdx
xchg rcx, rdx
mov qword [rsp + 0x30], rdx
xchg rcx, rdx
xchg r10, r8
mov qword [rsp + 0x38], r10
xchg r8, r10
mov qword [rsp + 0x40], r9
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x140198bd2
xchg rbx, rax
mov rbx, qword [rcx]
xchg rbx, rax
lea rdx, [rsp + 0xa8]
xchg r8, rdx
mov qword [rsp + 0x20], r8
xchg rdx, r8
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x40]
call qword [rax + 0x10]
test al, al
je 0x140198b0e
mov r8, qword [rsp + 0xb0]
mov r9, qword [rsp + 0xa0]
inc edi
cmp edi, dword [r14 + 0x18]
jb 0x140198a6b
xchg rcx, r12
mov r12, qword [rbx + 0x38]
xchg r12, rcx
test rcx, rcx
je 0x140198b31
cmp rcx, rbx
mov rax, qword [rcx]
setne dl
call qword [rax + 0x20]
mov qword [rbx + 0x38], rbp
mov al, 0x17
sub al, 2
add al, 0x3f
sub al, 0x28
sub al, 0x28
xor al, 5
jmp 0x140198b71
xchg rcx, rdi
mov rdi, qword [rbx + 0x38]
xchg rdi, rcx
test rcx, rcx
je 0x140198b6f
xchg rsi, rax
mov rsi, qword [rcx]
xchg rsi, rax
cmp rcx, rbx
setne dl
call qword [rax + 0x20]
xchg r14, rbp
mov qword [rbx + 0x38], r14
xchg r14, rbp
xor al, al
add rsp, 0x58
push rdx
push rcx
xchg qword [rsp + 0x10], r15
add rsp, 0x18
nop
xchg qword [rsp], r14
add rsp, 8
push rcx
push rcx
push rcx
push rdx
push rdx
push rcx
push rcx
xchg qword [rsp + 0x38], r13
pop rcx
pop rcx
pop rdx
pop rdx
pop rcx
pop rcx
pop rcx
add rsp, 8
nop
xchg qword [rsp], r12
add rsp, 8
nop
add rsp, 8
mov rdi, qword [rsp - 8]
push rcx
xchg qword [rsp + 8], rsi
pop rcx
add rsp, 8
nop
mov rbp, qword [rsp]
add rsp, 8
nop
add rsp, 8
xchg qword [rsp - 8], rbx
ret
call sub.MSVCP140.dll_void___cdecl_std::_Xbad_function_call_void_
nop
int3
Function at 0x1401aafc0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xchg r11, rdx
mov rdx, r11
xchg r11, rdx
xchg rcx, r15
mov r10, r15
xchg r15, rcx
test rdx, rdx
je 0x1401ab04a
xchg rdi, rbx
mov qword [rsp], rdi
xchg rdi, rbx
movzx ebx, byte [rsp + 0x30]
test r9, r9
je 0x1401ab037
movzx eax, byte [r10]
test bl, bl
je 0x1401ab019
lea rcx, [r9 - 1]
xchg r9, rdx
mov r9, rdx
xchg rdx, r9
add rcx, r8
nop
xor al, byte [rcx]
lea rcx, [rcx - 1]
mov byte [r10], al
sub rdx, 1
jne 0x1401ab008
jmp 0x1401ab037
xor ecx, ecx
nop dword [rax]
nop word [rax + rax]
xor al, byte [rcx + r8]
inc rcx
mov byte [r10], al
cmp rcx, r9
jb 0x1401ab028
inc r10
sub r11, 1
jne 0x1401aafea
xchg rbx, r10
mov r10, qword [rsp]
xchg r10, rbx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1401affc0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
xchg rcx, rbp
mov qword [rsp + 0x10], rcx
xchg rbp, rcx
xchg rdx, rsi
mov qword [rsp + 0x20], rdx
xchg rdx, rsi
nop
sub rsp, 8
mov qword [rsp], rdi
mov eax, 0x2b0e70b4
add eax, 0x193d8233
add eax, 0x3228cc5b
sub eax, 0x6b690173
xor eax, 0x19486eb4
add eax, 0x1ce4b2ca
add eax, 0x1d0b3df9
add eax, 0x58e42b6
sub eax, 0x51c1f344
call fcn.1401fd040
sub rsp, rax
mov ebx, edx
mov edi, ecx
call sub.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_
mov dword [rsp + 0x24], eax
mov r9d, 0x6c1941dc
xor r9d, 0x6add813
xor r9d, 0x79f40b3f
sub r9d, 0x4db48ef
add r9d, 0x579fe21b
sub r9d, 0x52c868f7
xor r9d, 0x133cc324
mov dword [rsp + 0x13a4], 0x56e39eef
sub dword [rsp + 0x13a4], 0x457d35e8
xor dword [rsp + 0x13a4], 0x794f2e9f
sub dword [rsp + 0x13a4], 0x3b8ada9e
add dword [rsp + 0x13a4], 0x48612617
sub dword [rsp + 0x13a4], 0x3708081d
add dword [rsp + 0x13a4], 0x3f9e4f1c
add dword [rsp + 0x13a4], 0x826a25ef
nop dword [rax + rax]
mov r8d, eax
shr r8d, 3
shr r8d, 0x16
shr r8d, 1
shr r8d, 2
shr r8d, 1
shr r8d, 1
xor r8d, eax
imul eax, r8d, 0x6c078965
add eax, r9d
mov dword [rsp + r9*4 + 0x24], eax
inc r9
cmp r9, 0x270
jb 0x1401b00b3
mov ebp, 0x1cdd7c0
add ebp, 0x1c6f7fc2
xor ebp, 0x71e1fff2
sub ebp, 0x3419d20c
xor ebp, 0x5592f440
xor ebp, 0x5d82cb2
sub ebp, 0x30e8404
xor ebp, 0x52cc6cdc
add ebp, 0x454a19b2
mov dword [rsp + 0x20], 0x2ac09db0
sub dword [rsp + 0x20], 0x219aad43
xor dword [rsp + 0x20], 0x6dbdeb1c
add dword [rsp + 0x20], 0xbb0becb
sub dword [rsp + 0x20], 0x41163cf9
xor dword [rsp + 0x20], 0x11e7a219
xor dword [rsp + 0x20], 0x7a78bfdc
sub dword [rsp + 0x20], 0x44ad7e16
cmp edi, ebp
lea rax, [rsp + 0x20]
xchg r9, rax
mov qword [rsp + 0x13d0], r9
xchg r9, rax
lea rcx, [rsp + 0x13d0]
lea eax, [rdi - 0x80000000]
lea esi, [rdi + rbp]
cmovae esi, eax
lea edi, [rbx + rbp]
cmp ebx, ebp
lea eax, [rbx - 0x80000000]
cmovae edi, eax
sub edi, esi
cmp edi, 0xffffffff
jne 0x1401b01ae
call fcn.1401b0470
mov ecx, eax
jmp 0x1401b020d
inc edi
mov ebx, edi
call fcn.1401b0470
mov ecx, eax
imul rcx, rbx
cmp ecx, edi
jae 0x1401b01fe
mov eax, edi
xor edx, edx
neg eax
div edi
mov edi, edx
cmp ecx, edx
jae 0x1401b01fe
nop dword [rax]
nop dword [rax + rax]
lea rcx, [rsp + 0x13d0]
call fcn.1401b0470
mov ecx, eax
imul rcx, rbx
cmp ecx, edi
jb 0x1401b01e3
shr rcx, 0x10
shr rcx, 0xc
shr rcx, 3
shr rcx, 1
lea edx, [rsi + rcx]
lea r11, [rsp + 0x13b0]
cmp edx, ebp
xchg rdx, rbx
mov rdx, qword [r11 + 0x10]
xchg rdx, rbx
lea eax, [rdx + rbp]
mov rbp, qword [r11 + 0x18]
lea ecx, [rdx - 0x80000000]
xchg rsi, r13
mov r13, qword [r11 + 0x28]
xchg rsi, r13
cmovae eax, ecx
mov rsp, r11
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1401b0470
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, qword [rcx]
mov r9d, 0x73f0e5c
xor r9d, 0x3c07daeb
xor r9d, 0xe5def87
xor r9d, 0x6ef3afab
xor r9d, 0x2b771cac
xor r9d, 0x28c7524c
sub r9d, 0x15537c2
sub r9d, 0x540ee94b
xor r9d, 0x2c2bb1e
mov ecx, dword [r10]
cmp ecx, r9d
jne 0x1401b0511
lea r8, [r10 + 8]
nop dword [rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x1401b04cc
mov ecx, dword [r10]
jmp 0x1401b0656
cmp ecx, 0x4e0
jb 0x1401b0656
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0x1e1b59e7
add ebx, 0x54e88a9f
sub ebx, 0x4f5dde2c
sub ebx, 0x559c594
sub ebx, 0x1adf6796
xor ebx, 0x74d21d6b
xor ebx, 0x4d8733cb
xor ebx, 0x6bca672d
sub ebx, 0x51f38fda
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1401b0560
lea r11, [r10 + 0xd50]
mov ebx, 0x21825e41
add ebx, 0x50dd8762
sub ebx, 0x17176f1
sub ebx, 0x63d7827c
xor ebx, 0x6228cb68
xor ebx, 0x6f3e26d2
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1401b05d2
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
xchg rbx, rdi
mov rdi, qword [rsp]
xchg rdi, rbx
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 4
shr ecx, 3
shr ecx, 1
shr ecx, 2
shr ecx, 1
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 2
shl eax, 4
shl eax, 1
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 6
shl eax, 3
shl eax, 6
xor edx, eax
mov eax, edx
shr eax, 8
shr eax, 6
shr eax, 3
shr eax, 1
xor eax, edx
add rsp, 8
ret
Function at 0x1401ba270
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x1401b986f
mov rdx, qword [rbx + 0x28]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x1401b9854
xchg rbp, r8
mov rbp, qword [rcx - 8]
xchg r8, rbp
sub rdx, 0xffffffffffffffd9
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1401b9886
mov rcx, r8
call fcn.1401fcccc
xor eax, eax
mov qword [rbx + 0x18], rax
xchg r8, rax
mov qword [rbx + 0x20], r8
xchg r8, rax
xchg r8, rax
mov qword [rbx + 0x28], r8
xchg r8, rax
lea rcx, [rbx + 8]
add rsp, 0x20
nop
add rsp, 8
mov rbx, qword [rsp - 8]
jmp 0x1401ba270
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
mov rbx, qword [rcx]
xchg r8, rcx
mov rsi, r8
xchg rcx, r8
xchg rdx, rax
mov rdx, qword [rbx + 8]
xchg rdx, rax
mov qword [rax], 0x43e9560a
xor qword [rax], 0x533e440c
xor qword [rax], 0x17ffc2d1
xor qword [rax], 0x7f73ddb4
sub qword [rax], 0x64f18444
xor qword [rax], 0x1369891f
mov rbx, qword [rbx]
test rbx, rbx
je 0x1401ba340
mov qword [rsp + 0x30], rdi
nop dword [rax + rax]
mov rdi, qword [rbx]
lea rdx, [rbx + 0x10]
xchg rcx, r8
mov r8, rsi
xchg rcx, r8
call fcn.1401b3440
mov edx, 0x90c59fb
xor edx, 0x2ccf00c3
sub edx, 0x1191c2ee
add edx, 0xc3604d8
add edx, 0x4cb183fa
xor edx, 0x477c3cdc
add edx, 0x39bb63d9
sub edx, 0x4c90d39a
sub edx, 0x178fb3af
xchg rbx, rcx
mov rbx, rcx
xchg rbx, rcx
call fcn.1401fcccc
xchg rdi, rbx
mov rdi, rbx
xchg rdi, rbx
test rdi, rdi
jne 0x1401ba2d1
mov rdi, qword [rsp + 0x30]
xchg r13, rcx
mov r13, qword [rsi]
xchg rcx, r13
mov edx, 0x167fa933
add edx, 0x3a0da588
sub edx, 0xc88299c
xor edx, 0x4fea6119
add edx, 0x1f4acbaa
sub edx, 0x2b3a0f60
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
nop
xchg qword [rsp], rsi
add rsp, 8
jmp fcn.1401fcccc
Function at 0x1401ba390
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp - 8], rbx
sub rsp, 8
sub rsp, 0x20
xchg rcx, rbx
mov rcx, rbx
xchg rcx, rbx
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x1401b991a
xchg rdx, r14
mov r14, qword [rbx + 0x28]
xchg r14, rdx
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x1401b98ff
xchg r13, r8
mov r13, qword [rcx - 8]
xchg r13, r8
nop
add rdx, 0x5edcd28
sub rdx, 0x5edcd01
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1401b993e
mov rcx, r8
call fcn.1401fcccc
xor eax, eax
mov qword [rbx + 0x18], rax
xchg r13, rax
mov qword [rbx + 0x20], r13
xchg r13, rax
xchg r15, rax
mov qword [rbx + 0x28], r15
xchg r15, rax
lea rcx, [rbx + 8]
add rsp, 0x20
push rdx
push rax
push rdx
push rdx
push rdx
push rdx
push rdx
xchg qword [rsp + 0x38], rbx
pop rdx
pop rdx
pop rdx
pop rdx
pop rdx
pop rax
pop rdx
add rsp, 8
jmp 0x1401ba390
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
xchg rbx, rsi
mov qword [rsp + 0x10], rsi
xchg rsi, rbx
nop
mov qword [rsp - 8], rsi
sub rsp, 8
sub rsp, 0x20
mov rbx, qword [rcx]
xchg rsi, rcx
mov rcx, rsi
xchg rsi, rcx
xchg r15, rax
mov r15, qword [rbx + 8]
xchg r15, rax
mov qword [rax], 0x12c9e80d
xor qword [rax], 0x2e59824a
xor qword [rax], 0x662d1aaf
add qword [rax], 0x1f6901a9
sub qword [rax], 0x7936e0a7
add qword [rax], 0x488532fc
sub qword [rax], 0x24232484
add qword [rax], 0x348c6c53
sub qword [rax], 0x59de0cb5
mov rbx, qword [rbx]
test rbx, rbx
je 0x1401ba481
xchg rcx, rdi
mov qword [rsp + 0x30], rcx
xchg rdi, rcx
nop dword [rax + rax]
mov rdi, qword [rbx]
lea rcx, [rbx + 0x10]
call fcn.1401ba4e0
mov edx, 0x135715
add edx, 0x755105cd
xor edx, 0x6ee685be
add edx, 0x3575cdaf
xor edx, 0x6cdaa36d
sub edx, 0x21134a4c
xor edx, 0x22ff135e
add edx, 0x2ae13eba
sub edx, 0x64d2e7be
mov rcx, rbx
call fcn.1401fcccc
xchg rbx, rdi
mov rdi, rbx
xchg rdi, rbx
test rdi, rdi
jne 0x1401ba41b
xchg r9, rdi
mov r9, qword [rsp + 0x30]
xchg r9, rdi
xchg r9, rcx
mov r9, qword [rsi]
xchg r9, rcx
mov edx, 0x75d6fbfb
add edx, 0x84fe809
sub edx, 0x668168a0
add edx, 0x4547cd6d
sub edx, 0x4b5c4f7c
add edx, 0x5f86227f
sub edx, 0x71171b94
xchg rbp, rbx
mov rbp, qword [rsp + 0x38]
xchg rbx, rbp
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rsi
jmp fcn.1401fcccc