joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14013f55c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x140160b50]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x14013f5b3
cmp word [rdx], r13w
jne 0x14013f5b3
or byte [rax + rdi*8 + 0x38], cl
jmp 0x14013f5b8
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x14013f6dd
mov r11d, 0xd
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x14013f6fe
lea r9, [rdx + 2]
cmp cx, r11w
je 0x14013f5f1
mov rdx, r9
mov word [rbx], cx
jmp 0x14013f618
cmp r9, r8
jae 0x14013f628
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x14013f5d2
jmp 0x14013f6dd
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14013f6d2
cmp dword [rsp + 0x80], esi
je 0x14013f6d2
lea r8, [0x140160b50]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x14013f6aa
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x14013f67a
mov word [rbx], r13w
jmp 0x14013f6da
mov ecx, 0xd
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x14013f687
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x14013f6da
cmp word [rsp + 0x70], r13w
jne 0x14013f6b7
cmp rbx, r14
je 0x14013f674
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.14013c110
cmp word [rsp + 0x70], r13w
je 0x14013f6dd
mov ecx, 0xd
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x140160b50]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x14013f6d7
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x14013f6dd
Function at 0x140145748
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.140122758
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x1401457d2
cmp byte [rbp - 0x21], r15b
je 0x1401457cd
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x140145808
call fcn.1401345a4
test eax, eax
jne 0x1401457f4
cmp byte [rbp - 0x21], r15b
je 0x1401457ec
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x140145808
cmp byte [rbp - 0x21], r15b
je 0x140145805
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.1401227f4
test eax, eax
jne 0x1401458a8
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.140122758
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x140145847
cmp byte [rbp - 0x21], r15b
je 0x14014587c
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x14014587c
call fcn.1401345a4
test eax, eax
jne 0x140145868
cmp byte [rbp - 0x21], r15b
je 0x140145861
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x14014587c
cmp byte [rbp - 0x21], r15b
je 0x140145879
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.1401227f4
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x1401458a8
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x1401458ab
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x1401458b9
mov rcx, rdi
call fcn.14013395c
cmp byte [rbp + 0x3f], r15b
je 0x1401458c8
mov rcx, qword [rbp + 0x27]
call fcn.14013395c
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140002ec8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002f12
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002f12
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002f12
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002f12
cmp dword [rcx + 0x84], 0xe
jbe 0x140002f12
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002f14
xor al, al
add rsp, 0x28
ret
Function at 0x14001f860
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x14003c040]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov qword [rsp + 0x28], rcx
lea r8, [rsp + 0x28]
xor edi, edi
mov rbx, rcx
xor ecx, ecx
mov qword [rsp + 0x28], rdi
lea edx, [rdi + 0x1c]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov word [rsp + 0x30], di
test eax, eax
jne 0x14001f8ec
mov rcx, qword [rsp + 0x28]
lea rdx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
xorps xmm0, xmm0
lea rax, [rsp + 0x30]
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov r8, 0xffffffffffffffff
mov qword [rbx + 0x18], rdi
nop dword [rax]
inc r8
cmp word [rax + r8*2], di
jne 0x14001f8e0
jmp 0x14001f910
xorps xmm0, xmm0
lea rax, [rsp + 0x30]
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov r8, 0xffffffffffffffff
mov qword [rbx + 0x18], rdi
inc r8
cmp word [rax + r8*2], di
jne 0x14001f906
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14002e280
mov rax, rbx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14002fac0
mov rbx, qword [rsp + 0x268]
add rsp, 0x250
pop rdi
ret
Function at 0x14001fe70
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xe], 0
je 0x14001fe98
xor eax, eax
mov r8d, 0xbbb
nop
movzx edx, ax
sub dx, r8w
xor word [rcx + rax*2], dx
inc rax
cmp rax, 6
jb 0x14001fe80
mov byte [rcx + 0xe], 0
mov rax, rcx
ret

Function at 0x14001fea0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
mov rdi, rcx
mov qword [rbp + 0x4f], rcx
xor ebx, ebx
mov rdx, qword [0x14003e788]
xorps xmm0, xmm0
movups xmmword [rbp + 0x2f], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x3f], xmm1
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rdx + r8*2], bx
jne 0x14001fee0
lea rcx, [rbp + 0x2f]
call fcn.14002e280
nop
mov dword [rbp - 0x39], 0xf432f42d
mov dword [rbp - 0x35], 0xf438f433
mov dword [rbp - 0x31], 0xf470f43a
mov dword [rbp - 0x2d], 0xf463f464
mov dword [rbp - 0x29], 0xf421f43f
mov dword [rbp - 0x25], 0xf425f428
mov dword [rbp - 0x21], 0xf431f434
mov dword [rbp - 0x1d], 0xf431f43b
mov dword [rbp - 0x19], 0xf422f434
mov dword [rbp - 0x15], 0xf476f424
mov dword [rbp - 0x11], 0xf423f421
mov dword [rbp - 0xd], 0xf473f421
mov dword [rbp - 9], 0xf431f431
mov dword [rbp - 5], 0xf404f43e
mov dword [rbp - 1], 0xf410f404
mov dword [rbp + 3], 0xf417f44c
mov dword [rbp + 7], 0xf404f410
mov dword [rbp + 0xb], 0xf446f414
mov dword [rbp + 0xf], 0xf402f419
mov dword [rbp + 0x13], 0xf453f41b
mov dword [rbp + 0x17], 0xf41df418
mov dword [rbp + 0x1b], 0xf402f40a
mov dword [rbp + 0x1f], 0xf44c
mov byte [rbp + 0x23], 1
mov ecx, 0xbbb
nop
movzx eax, bx
sub ax, cx
xor word [rbp + rbx*2 - 0x39], ax
inc rbx
cmp rbx, 0x2d
jb 0x14001ffa0
mov byte [rbp + 0x23], 0
lea r8, [rbp + 0x2f]
lea rdx, [rbp - 0x39]
mov rcx, rdi
call fcn.14002d110
nop
mov rdx, qword [rbp + 0x47]
cmp rdx, 7
jbe 0x14002000c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2f]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140020007
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140020007
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002ffa8
mov rax, rdi
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140020390
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x64], 0
je 0x1400203b8
xor eax, eax
mov r8d, 0xbbb
nop
movzx edx, ax
sub dx, r8w
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x31
jb 0x1400203a0
mov byte [rcx + 0x64], 0
mov rax, rcx
ret

Function at 0x1400203c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
mov rdi, rcx
mov qword [rbp + 0x2f], rcx
xor ebx, ebx
lea rdx, [0x14003c148]
lea rcx, [rbp + 0x37]
call fcn.14002c240
mov r8, rax
mov dword [rbp - 0x39], 0xf432f42d
mov dword [rbp - 0x35], 0xf438f433
mov dword [rbp - 0x31], 0xf470f43a
mov dword [rbp - 0x2d], 0xf463f464
mov dword [rbp - 0x29], 0xf421f43f
mov dword [rbp - 0x25], 0xf425f428
mov dword [rbp - 0x21], 0xf431f434
mov dword [rbp - 0x1d], 0xf431f43b
mov dword [rbp - 0x19], 0xf422f434
mov dword [rbp - 0x15], 0xf476f424
mov dword [rbp - 0x11], 0xf423f421
mov dword [rbp - 0xd], 0xf473f421
mov dword [rbp - 9], 0xf431f431
mov dword [rbp - 5], 0xf404f43e
mov dword [rbp - 1], 0xf410f404
mov dword [rbp + 3], 0xf410f44c
mov dword [rbp + 7], 0xf40df40a
mov dword [rbp + 0xb], 0xf406f402
mov dword [rbp + 0xf], 0xf41af447
mov dword [rbp + 0x13], 0xf41cf403
mov dword [rbp + 0x17], 0xf406f452
mov dword [rbp + 0x1b], 0xf419f418
mov dword [rbp + 0x1f], 0xf44ff415
mov word [rbp + 0x23], bx
mov byte [rbp + 0x25], 1
mov ecx, 0xbbb
movzx eax, bx
sub ax, cx
xor word [rbp + rbx*2 - 0x39], ax
inc rbx
cmp rbx, 0x2e
jb 0x1400204a1
mov byte [rbp + 0x25], 0
lea rdx, [rbp - 0x39]
mov rcx, rdi
call fcn.14002d110
nop
mov rdx, qword [rbp + 0x4f]
cmp rdx, 7
jbe 0x140020509
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x37]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140020504
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140020504
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002ffa8
mov rax, rdi
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140020530
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
xor r9d, r9d
mov dword [rbp - 9], 0xf432f42d
mov word [rbp + 0x47], r9w
mov eax, r9d
mov rbx, rcx
mov dword [rbp - 5], 0xf438f433
mov dword [rbp - 1], 0xf470f43a
mov edx, 0xbbb
mov dword [rbp + 3], 0xf463f464
mov dword [rbp + 7], 0xf421f43f
mov dword [rbp + 0xb], 0xf425f428
mov dword [rbp + 0xf], 0xf431f434
mov dword [rbp + 0x13], 0xf431f43b
mov dword [rbp + 0x17], 0xf422f434
mov dword [rbp + 0x1b], 0xf476f424
mov dword [rbp + 0x1f], 0xf423f421
mov dword [rbp + 0x23], 0xf473f421
mov dword [rbp + 0x27], 0xf431f431
mov dword [rbp + 0x2b], 0xf404f43e
mov dword [rbp + 0x2f], 0xf410f404
mov dword [rbp + 0x33], 0xf410f44c
mov dword [rbp + 0x37], 0xf40df40a
mov dword [rbp + 0x3b], 0xf406f402
mov dword [rbp + 0x3f], 0xf41af447
mov dword [rbp + 0x43], 0xf41cf403
mov byte [rbp + 0x49], 1
nop word [rax + rax]
movzx ecx, ax
sub cx, dx
xor word [rbp + rax*2 - 9], cx
inc rax
cmp rax, 0x28
jb 0x1400205f0
xorps xmm0, xmm0
mov byte [rbp + 0x49], r9b
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r9
lea rax, [rbp - 9]
mov qword [rbx + 0x18], r9
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], r9w
jne 0x140020621
lea rdx, [rbp - 9]
mov rcx, rbx
call fcn.14002e280
mov rax, rbx
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rbp
ret

Function at 0x140020650
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x52], 0
je 0x140020678
xor eax, eax
mov r8d, 0xbbb
nop
movzx edx, ax
sub dx, r8w
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x28
jb 0x140020660
mov byte [rcx + 0x52], 0
mov rax, rcx
ret

Function at 0x140020680
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
xor r9d, r9d
mov dword [rbp - 9], 0xf432f42d
mov word [rbp + 0x4b], r9w
mov eax, r9d
mov rbx, rcx
mov dword [rbp - 5], 0xf438f433
mov dword [rbp - 1], 0xf470f43a
mov edx, 0xbbb
mov dword [rbp + 3], 0xf463f464
mov dword [rbp + 7], 0xf421f43f
mov dword [rbp + 0xb], 0xf425f428
mov dword [rbp + 0xf], 0xf431f434
mov dword [rbp + 0x13], 0xf431f43b
mov dword [rbp + 0x17], 0xf422f434
mov dword [rbp + 0x1b], 0xf476f424
mov dword [rbp + 0x1f], 0xf423f421
mov dword [rbp + 0x23], 0xf473f421
mov dword [rbp + 0x27], 0xf431f431
mov dword [rbp + 0x2b], 0xf404f43e
mov dword [rbp + 0x2f], 0xf410f404
mov dword [rbp + 0x33], 0xf412f44c
mov dword [rbp + 0x37], 0xf414f400
mov dword [rbp + 0x3b], 0xf401f414
mov dword [rbp + 0x3f], 0xf404f406
mov dword [rbp + 0x43], 0xf41cf445
mov dword [rbp + 0x47], 0xf41ef405
mov byte [rbp + 0x4d], 1
nop dword [rax]
movzx ecx, ax
sub cx, dx
xor word [rbp + rax*2 - 9], cx
inc rax
cmp rax, 0x2a
jb 0x140020740
xorps xmm0, xmm0
mov byte [rbp + 0x4d], r9b
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r9
lea rax, [rbp - 9]
mov qword [rbx + 0x18], r9
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], r9w
jne 0x140020771
lea rdx, [rbp - 9]
mov rcx, rbx
call fcn.14002e280
mov rax, rbx
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rbp
ret
Function at 0x1400207a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x56], 0
je 0x1400207c8
xor eax, eax
mov r8d, 0xbbb
nop
movzx edx, ax
sub dx, r8w
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x2a
jb 0x1400207b0
mov byte [rcx + 0x56], 0
mov rax, rcx
ret
Function at 0x140021070
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x26], 0
je 0x140021098
xor eax, eax
mov r8d, 0xbbb
nop
movzx edx, ax
sub dx, r8w
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x12
jb 0x140021080
mov byte [rcx + 0x26], 0
mov rax, rcx
ret

Function at 0x1400210a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x10], 0
je 0x1400210c8
xor eax, eax
mov r8d, 0xbbb
nop
movzx edx, ax
sub dx, r8w
xor word [rcx + rax*2], dx
inc rax
cmp rax, 7
jb 0x1400210b0
mov byte [rcx + 0x10], 0
mov rax, rcx
ret
Function at 0x140021730
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x30], 0
je 0x140021758
xor eax, eax
mov r8d, 0xbbb
nop
movzx edx, ax
sub dx, r8w
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x17
jb 0x140021740
mov byte [rcx + 0x30], 0
mov rax, rcx
ret
Function at 0x140021dd0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x34], 0
je 0x140021df8
xor eax, eax
mov r8d, 0xbbb
nop
movzx edx, ax
sub dx, r8w
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x19
jb 0x140021de0
mov byte [rcx + 0x34], 0
mov rax, rcx
ret
Function at 0x140022490
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2a], 0
je 0x1400224b8
xor eax, eax
mov r8d, 0xbbb
nop
movzx edx, ax
sub dx, r8w
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x14
jb 0x1400224a0
mov byte [rcx + 0x2a], 0
mov rax, rcx
ret
Function at 0x140023250
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x4c], 0
je 0x140023278
xor eax, eax
mov r8d, 0xbbb
nop
movzx edx, ax
sub dx, r8w
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x25
jb 0x140023260
mov byte [rcx + 0x4c], 0
mov rax, rcx
ret
Function at 0x140024190
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x22], 0
je 0x1400241b8
xor eax, eax
mov r8d, 0xbbb
nop
movzx edx, ax
sub dx, r8w
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x10
jb 0x1400241a0
mov byte [rcx + 0x22], 0
mov rax, rcx
ret

Function at 0x1400241c0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1c], 0
je 0x1400241e8
xor eax, eax
mov r8d, 0xbbb
nop
movzx edx, ax
sub dx, r8w
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0xd
jb 0x1400241d0
mov byte [rcx + 0x1c], 0
mov rax, rcx
ret

Function at 0x1400241f0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1e], 0
je 0x140024218
xor eax, eax
mov r8d, 0xbbb
nop
movzx edx, ax
sub dx, r8w
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0xe
jb 0x140024200
mov byte [rcx + 0x1e], 0
mov rax, rcx
ret

Function at 0x140024220
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x3e], 0
je 0x140024248
xor eax, eax
mov r8d, 0xbbb
nop
movzx edx, ax
sub dx, r8w
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x1e
jb 0x140024230
mov byte [rcx + 0x3e], 0
mov rax, rcx
ret

Function at 0x140024250
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x14], 0
je 0x140024278
xor eax, eax
mov r8d, 0xbbb
nop
movzx edx, ax
sub dx, r8w
xor word [rcx + rax*2], dx
inc rax
cmp rax, 9
jb 0x140024260
mov byte [rcx + 0x14], 0
mov rax, rcx
ret

Function at 0x140024280
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x42], 0
je 0x1400242a8
xor eax, eax
mov r8d, 0xbbb
nop
movzx edx, ax
sub dx, r8w
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x20
jb 0x140024290
mov byte [rcx + 0x42], 0
mov rax, rcx
ret

Function at 0x1400242b0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2e], 0
je 0x1400242d8
xor eax, eax
mov r8d, 0xbbb
nop
movzx edx, ax
sub dx, r8w
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x16
jb 0x1400242c0
mov byte [rcx + 0x2e], 0
mov rax, rcx
ret

Function at 0x1400242e0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x40], 0
je 0x140024308
xor eax, eax
mov r8d, 0xbbb
nop
movzx edx, ax
sub dx, r8w
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x1f
jb 0x1400242f0
mov byte [rcx + 0x40], 0
mov rax, rcx
ret

Function at 0x140024310
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x36], 0
je 0x140024338
xor eax, eax
mov r8d, 0xbbb
nop
movzx edx, ax
sub dx, r8w
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x1a
jb 0x140024320
mov byte [rcx + 0x36], 0
mov rax, rcx
ret

Function at 0x140024340
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x38], 0
je 0x140024368
xor eax, eax
mov r8d, 0xbbb
nop
movzx edx, ax
sub dx, r8w
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x1b
jb 0x140024350
mov byte [rcx + 0x38], 0
mov rax, rcx
ret

Function at 0x140024370
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x28], 0
je 0x140024398
xor eax, eax
mov r8d, 0xbbb
nop
movzx edx, ax
sub dx, r8w
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x13
jb 0x140024380
mov byte [rcx + 0x28], 0
mov rax, rcx
ret
Function at 0x1400243a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2c], 0
je 0x1400243c8
xor eax, eax
mov r8d, 0xbbb
nop
movzx edx, ax
sub dx, r8w
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x15
jb 0x1400243b0
mov byte [rcx + 0x2c], 0
mov rax, rcx
ret

Function at 0x1400243d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x32], 0
je 0x1400243f8
xor eax, eax
mov r8d, 0xbbb
nop
movzx edx, ax
sub dx, r8w
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x18
jb 0x1400243e0
mov byte [rcx + 0x32], 0
mov rax, rcx
ret

Function at 0x140024400
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x3a], 0
je 0x140024428
xor eax, eax
mov r8d, 0xbbb
nop
movzx edx, ax
sub dx, r8w
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x1c
jb 0x140024410
mov byte [rcx + 0x3a], 0
mov rax, rcx
ret

Function at 0x140024430
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x44], 0
je 0x140024458
xor eax, eax
mov r8d, 0xbbb
nop
movzx edx, ax
sub dx, r8w
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x21
jb 0x140024440
mov byte [rcx + 0x44], 0
mov rax, rcx
ret

Function at 0x140024460
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x58], 0
je 0x140024488
xor eax, eax
mov r8d, 0xbbb
nop
movzx edx, ax
sub dx, r8w
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x2b
jb 0x140024470
mov byte [rcx + 0x58], 0
mov rax, rcx
ret

Function at 0x140024490
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x60], 0
je 0x1400244b8
xor eax, eax
mov r8d, 0xbbb
nop
movzx edx, ax
sub dx, r8w
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x2f
jb 0x1400244a0
mov byte [rcx + 0x60], 0
mov rax, rcx
ret

Function at 0x1400244c0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x50], 0
je 0x1400244e8
xor eax, eax
mov r8d, 0xbbb
nop
movzx edx, ax
sub dx, r8w
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x27
jb 0x1400244d0
mov byte [rcx + 0x50], 0
mov rax, rcx
ret
Function at 0x140025190
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov rax, qword [0x14003c040]
xor rax, rsp
mov qword [rbp + 0x60], rax
xor edx, edx
mov r8d, 0x108
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memset
lea rdx, [0x14003e790]
cmp qword [0x14003e7a8], 7
cmova rdx, qword [0x14003e790]
lea rcx, [rsp + 0x50]
call fcn.14002cc10
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x50], rax
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x4c], edx
cmp qword [rbp - 0x28], 0
je 0x14002532b
mov dword [rsp + 0x30], 0x3a223510
mov dword [rsp + 0x34], 0x29262b27
mov word [rsp + 0x38], 0x70
mov byte [rsp + 0x3a], 1
xor ebx, ebx
mov ecx, ebx
nop word [rax + rax]
lea eax, [rcx + 0x45]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 9
jb 0x140025240
mov byte [rsp + 0x3a], bl
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.14002d750
mov rdx, qword [0x14003e788]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
mov word [rsp + 0x40], 0xa
mov byte [rsp + 0x42], bl
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.14002d750
mov dword [rsp + 0x30], 0x3b342715
mov dword [rsp + 0x34], 0x2839253e
mov word [rsp + 0x38], 0x70
mov byte [rsp + 0x3a], 1
nop word [rax + rax]
lea eax, [rbx + 0x45]
xor byte [rsp + rbx + 0x30], al
inc rbx
cmp rbx, 9
jb 0x1400252b0
mov byte [rsp + 0x3a], 0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.14002d750
mov rdx, qword [0x14003e758]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
mov word [rsp + 0x40], 0xa
mov byte [rsp + 0x42], 0
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.14002d750
lea rcx, [rsp + 0x58]
call fcn.14002cb50
test rax, rax
jne 0x14002532b
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x50]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
lea rcx, [rsp + 0x50]
call fcn.1400250d0
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.14002fac0
mov rbx, qword [rsp + 0x180]
add rsp, 0x170
pop rbp
ret