joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001e410
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov rax, rsp
sub rsp, 0x28
cmp byte [rcx + 0x6f], 0
je 0x14001e6cd
mov qword [rax + 8], rbx
lea r9, [rcx + 2]
mov qword [rax + 0x10], rbp
mov ebx, 1
mov qword [rax + 0x18], rsi
mov ebp, 6
mov qword [rax - 8], rdi
mov esi, 3
mov qword [rax - 0x10], r12
mov edi, 2
mov qword [rax - 0x18], r13
mov r12d, 7
mov qword [rax - 0x20], r14
mov r13d, 8
mov qword [rsp], r15
mov r14d, 4
mov r15d, 5
mov r11, rcx
sub r15, rcx
sub rbx, rcx
sub rdi, rcx
sub rsi, rcx
sub r14, rcx
sub rbp, rcx
sub r12, rcx
sub r13, rcx
mov r10, 0xfffffffffffffffe
not r11
sub r10, rcx
nop dword [rax]
cmp qword [0x140033048], 0x10
lea r8, [0x140033030]
lea rax, [r9 + r10]
cmovae r8, qword [0x140033030]
xor edx, edx
div qword [0x140033040]
movzx eax, byte [rdx + r8]
lea r8, [0x140033030]
xor byte [r9 - 2], al
lea rax, [r9 + r11]
cmp qword [0x140033048], 0x10
cmovae r8, qword [0x140033030]
xor edx, edx
div qword [0x140033040]
movzx eax, byte [rdx + r8]
lea r8, [0x140033030]
xor byte [r9 - 1], al
mov rax, r9
cmp qword [0x140033048], 0x10
cmovae r8, qword [0x140033030]
sub rax, rcx
xor edx, edx
div qword [0x140033040]
movzx eax, byte [rdx + r8]
lea r8, [0x140033030]
xor byte [r9], al
lea rax, [rbx + r9]
cmp qword [0x140033048], 0x10
cmovae r8, qword [0x140033030]
xor edx, edx
div qword [0x140033040]
movzx eax, byte [rdx + r8]
lea r8, [0x140033030]
xor byte [r9 + 1], al
lea rax, [rdi + r9]
cmp qword [0x140033048], 0x10
cmovae r8, qword [0x140033030]
xor edx, edx
div qword [0x140033040]
movzx eax, byte [rdx + r8]
lea r8, [0x140033030]
xor byte [r9 + 2], al
lea rax, [rsi + r9]
cmp qword [0x140033048], 0x10
cmovae r8, qword [0x140033030]
xor edx, edx
div qword [0x140033040]
movzx eax, byte [rdx + r8]
lea r8, [0x140033030]
xor byte [r9 + 3], al
lea rax, [r14 + r9]
cmp qword [0x140033048], 0x10
cmovae r8, qword [0x140033030]
xor edx, edx
div qword [0x140033040]
movzx eax, byte [rdx + r8]
lea r8, [0x140033030]
xor byte [r9 + 4], al
lea rax, [r15 + r9]
cmp qword [0x140033048], 0x10
cmovae r8, qword [0x140033030]
xor edx, edx
div qword [0x140033040]
movzx eax, byte [rdx + r8]
lea r8, [0x140033030]
xor byte [r9 + 5], al
lea rax, [r9 + rbp]
cmp qword [0x140033048], 0x10
cmovae r8, qword [0x140033030]
xor edx, edx
div qword [0x140033040]
movzx eax, byte [rdx + r8]
lea r8, [0x140033030]
xor byte [r9 + 6], al
lea rax, [r9 + r12]
cmp qword [0x140033048], 0x10
cmovae r8, qword [0x140033030]
xor edx, edx
div qword [0x140033040]
movzx eax, byte [rdx + r8]
xor byte [r9 + 7], al
cmp qword [0x140033048], 0x10
lea rax, [r9 + r13]
lea r8, [0x140033030]
cmovae r8, qword [0x140033030]
xor edx, edx
div qword [0x140033040]
movzx eax, byte [rdx + r8]
xor byte [r9 + 8], al
add r9, 0xb
lea rax, [r9 + r10]
cmp rax, 0x6e
jb 0x14001e4a0
mov r15, qword [rsp]
mov r14, qword [rsp + 8]
mov r13, qword [rsp + 0x10]
mov r12, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov byte [rcx + 0x6f], 0
add rsp, 0x28
ret
Function at 0x14001f400
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
sub rsp, 8
cmp byte [rcx + 0x24], 0
je 0x14001f5be
mov qword [rsp + 0x10], rbx
lea r9, [rcx + 2]
mov qword [rsp + 0x18], rbp
mov ebx, 1
mov qword [rsp + 0x20], rsi
lea rbp, [0x140032cb0]
mov qword [rsp + 0x28], rdi
mov esi, 3
mov qword [rsp], r14
mov edi, 2
mov r14d, 4
mov r11, rcx
sub r14, rcx
sub rbx, rcx
sub rdi, rcx
sub rsi, rcx
mov r10, 0xfffffffffffffffe
not r11
sub r10, rcx
nop dword [rax]
nop word [rax + rax]
cmp qword [0x140032cc8], 0x10
lea rax, [r10 + r9]
mov r8, rbp
cmovae r8, qword [0x140032cb0]
xor edx, edx
div qword [0x140032cc0]
movzx eax, byte [rdx + r8]
mov r8, rbp
xor byte [r9 - 2], al
lea rax, [r11 + r9]
cmp qword [0x140032cc8], 0x10
cmovae r8, qword [0x140032cb0]
xor edx, edx
div qword [0x140032cc0]
movzx eax, byte [rdx + r8]
mov r8, rbp
xor byte [r9 - 1], al
mov rax, r9
cmp qword [0x140032cc8], 0x10
cmovae r8, qword [0x140032cb0]
sub rax, rcx
xor edx, edx
div qword [0x140032cc0]
movzx eax, byte [rdx + r8]
mov r8, rbp
xor byte [r9], al
lea rax, [rbx + r9]
cmp qword [0x140032cc8], 0x10
cmovae r8, qword [0x140032cb0]
xor edx, edx
div qword [0x140032cc0]
movzx eax, byte [rdx + r8]
mov r8, rbp
xor byte [r9 + 1], al
lea rax, [rdi + r9]
cmp qword [0x140032cc8], 0x10
cmovae r8, qword [0x140032cb0]
xor edx, edx
div qword [0x140032cc0]
movzx eax, byte [rdx + r8]
mov r8, rbp
xor byte [r9 + 2], al
lea rax, [rsi + r9]
cmp qword [0x140032cc8], 0x10
cmovae r8, qword [0x140032cb0]
xor edx, edx
div qword [0x140032cc0]
movzx eax, byte [rdx + r8]
mov r8, rbp
xor byte [r9 + 3], al
lea rax, [r14 + r9]
cmp qword [0x140032cc8], 0x10
cmovae r8, qword [0x140032cb0]
xor edx, edx
div qword [0x140032cc0]
movzx eax, byte [rdx + r8]
xor byte [r9 + 4], al
add r9, 7
lea rax, [r10 + r9]
cmp rax, 0x23
jb 0x14001f470
mov r14, qword [rsp]
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x10]
mov byte [rcx + 0x24], 0
add rsp, 8
ret

Function at 0x14001f5d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x18], 0
je 0x14001f615
xor r8d, r8d
lea r10, [0x140032fb0]
cmp qword [0x140032fc8], 0x10
mov rax, r8
mov r9, r10
cmovae r9, qword [0x140032fb0]
xor edx, edx
div qword [0x140032fc0]
movzx eax, byte [rdx + r9]
xor byte [r8 + rcx], al
inc r8
cmp r8, 0x17
jb 0x14001f5e0
mov byte [rcx + 0x18], 0
ret

Function at 0x14001f620
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1e], 0
je 0x14001f665
xor r8d, r8d
lea r10, [0x140032e70]
cmp qword [0x140032e88], 0x10
mov rax, r8
mov r9, r10
cmovae r9, qword [0x140032e70]
xor edx, edx
div qword [0x140032e80]
movzx eax, byte [rdx + r9]
xor byte [r8 + rcx], al
inc r8
cmp r8, 0x1d
jb 0x14001f630
mov byte [rcx + 0x1e], 0
ret
Function at 0x14001f840
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov rax, rsp
sub rsp, 0x28
cmp byte [rcx + 0x17], 0
je 0x14001fafd
mov qword [rax + 8], rbx
lea r9, [rcx + 2]
mov qword [rax + 0x10], rbp
mov ebx, 1
mov qword [rax + 0x18], rsi
mov ebp, 6
mov qword [rax - 8], rdi
mov esi, 3
mov qword [rax - 0x10], r12
mov edi, 2
mov qword [rax - 0x18], r13
mov r12d, 7
mov qword [rax - 0x20], r14
mov r13d, 8
mov qword [rsp], r15
mov r14d, 4
mov r15d, 5
mov r11, rcx
sub r15, rcx
sub rbx, rcx
sub rdi, rcx
sub rsi, rcx
sub r14, rcx
sub rbp, rcx
sub r12, rcx
sub r13, rcx
mov r10, 0xfffffffffffffffe
not r11
sub r10, rcx
nop dword [rax]
cmp qword [0x140032bc8], 0x10
lea r8, [0x140032bb0]
lea rax, [r9 + r10]
cmovae r8, qword [0x140032bb0]
xor edx, edx
div qword [0x140032bc0]
movzx eax, byte [rdx + r8]
lea r8, [0x140032bb0]
xor byte [r9 - 2], al
lea rax, [r9 + r11]
cmp qword [0x140032bc8], 0x10
cmovae r8, qword [0x140032bb0]
xor edx, edx
div qword [0x140032bc0]
movzx eax, byte [rdx + r8]
lea r8, [0x140032bb0]
xor byte [r9 - 1], al
mov rax, r9
cmp qword [0x140032bc8], 0x10
cmovae r8, qword [0x140032bb0]
sub rax, rcx
xor edx, edx
div qword [0x140032bc0]
movzx eax, byte [rdx + r8]
lea r8, [0x140032bb0]
xor byte [r9], al
lea rax, [rbx + r9]
cmp qword [0x140032bc8], 0x10
cmovae r8, qword [0x140032bb0]
xor edx, edx
div qword [0x140032bc0]
movzx eax, byte [rdx + r8]
lea r8, [0x140032bb0]
xor byte [r9 + 1], al
lea rax, [rdi + r9]
cmp qword [0x140032bc8], 0x10
cmovae r8, qword [0x140032bb0]
xor edx, edx
div qword [0x140032bc0]
movzx eax, byte [rdx + r8]
lea r8, [0x140032bb0]
xor byte [r9 + 2], al
lea rax, [rsi + r9]
cmp qword [0x140032bc8], 0x10
cmovae r8, qword [0x140032bb0]
xor edx, edx
div qword [0x140032bc0]
movzx eax, byte [rdx + r8]
lea r8, [0x140032bb0]
xor byte [r9 + 3], al
lea rax, [r14 + r9]
cmp qword [0x140032bc8], 0x10
cmovae r8, qword [0x140032bb0]
xor edx, edx
div qword [0x140032bc0]
movzx eax, byte [rdx + r8]
lea r8, [0x140032bb0]
xor byte [r9 + 4], al
lea rax, [r15 + r9]
cmp qword [0x140032bc8], 0x10
cmovae r8, qword [0x140032bb0]
xor edx, edx
div qword [0x140032bc0]
movzx eax, byte [rdx + r8]
lea r8, [0x140032bb0]
xor byte [r9 + 5], al
lea rax, [r9 + rbp]
cmp qword [0x140032bc8], 0x10
cmovae r8, qword [0x140032bb0]
xor edx, edx
div qword [0x140032bc0]
movzx eax, byte [rdx + r8]
lea r8, [0x140032bb0]
xor byte [r9 + 6], al
lea rax, [r9 + r12]
cmp qword [0x140032bc8], 0x10
cmovae r8, qword [0x140032bb0]
xor edx, edx
div qword [0x140032bc0]
movzx eax, byte [rdx + r8]
xor byte [r9 + 7], al
cmp qword [0x140032bc8], 0x10
lea rax, [r9 + r13]
lea r8, [0x140032bb0]
cmovae r8, qword [0x140032bb0]
xor edx, edx
div qword [0x140032bc0]
movzx eax, byte [rdx + r8]
xor byte [r9 + 8], al
add r9, 0xb
lea rax, [r9 + r10]
cmp rax, 0x16
jb 0x14001f8d0
mov r15, qword [rsp]
mov r14, qword [rsp + 8]
mov r13, qword [rsp + 0x10]
mov r12, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov byte [rcx + 0x17], 0
add rsp, 0x28
ret
Function at 0x1400209f0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
mov r9, rcx
mov qword [rsp + 0x20], rdx
cmp byte [rcx + 0x34], 0
je 0x140020b06
mov r10d, 2
lea r8, [rcx + 4]
lea r11, [0x140033170]
nop dword [rax]
mov rcx, r11
cmp qword [0x140033188], 0x10
cmovae rcx, qword [0x140033170]
lea rax, [r10 - 2]
xor edx, edx
div qword [0x140033180]
movsx eax, byte [rdx + rcx]
xor word [r8 - 4], ax
mov rcx, r11
cmp qword [0x140033188], 0x10
cmovae rcx, qword [0x140033170]
lea rax, [r10 - 1]
xor edx, edx
div qword [0x140033180]
movsx eax, byte [rdx + rcx]
xor word [r8 - 2], ax
mov rcx, r11
cmp qword [0x140033188], 0x10
cmovae rcx, qword [0x140033170]
xor edx, edx
mov rax, r10
div qword [0x140033180]
movsx eax, byte [rdx + rcx]
xor word [r8], ax
mov rcx, r11
cmp qword [0x140033188], 0x10
cmovae rcx, qword [0x140033170]
lea rax, [r10 + 1]
xor edx, edx
div qword [0x140033180]
movsx eax, byte [rdx + rcx]
xor word [r8 + 2], ax
mov rcx, r11
cmp qword [0x140033188], 0x10
cmovae rcx, qword [0x140033170]
lea rax, [r10 + 2]
xor edx, edx
div qword [0x140033180]
movsx eax, byte [rdx + rcx]
xor word [r8 + 4], ax
lea r8, [r8 + 0xa]
add r10, 5
lea rax, [r10 - 2]
cmp rax, 0x19
jb 0x140020a20
mov byte [r9 + 0x34], 0
lea rax, [r9 + 0x32]
xor ecx, ecx
mov qword [rbx], rcx
mov qword [rbx + 0x10], rcx
mov qword [rbx + 0x18], 7
mov word [rbx], cx
cmp r9, rax
je 0x140020b32
lea r8d, [rcx + 0x19]
mov rdx, r9
mov rcx, rbx
call fcn.140024270
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140022330
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140032010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140022403
cmp byte [rcx + 0x71], 0
je 0x140022403
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x1400223ff
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400223c4
sub eax, 1
je 0x1400223c8
cmp eax, 2
jne 0x1400223ff
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140027490
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1400223f6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1400223ff
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400223ac
xor al, al
jmp 0x1400223ac
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140027490
add rsp, 0x60
pop rbx
ret
Function at 0x140022950
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x30], 0
je 0x140022996
xor r8d, r8d
lea r10, [0x1400330d0]
cmp qword [0x1400330e8], 0x10
mov rax, r8
mov r9, r10
cmovae r9, qword [0x1400330d0]
xor edx, edx
div qword [0x1400330e0]
movsx eax, byte [rdx + r9]
xor word [rcx + r8*2], ax
inc r8
cmp r8, 0x17
jb 0x140022960
mov byte [rcx + 0x30], 0
ret

Function at 0x1400229a0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
cmp byte [rcx + 0x2c], 0
mov r10, rcx
je 0x140022b0e
mov qword [rsp], rbx
lea r8, [rcx + 4]
lea rbx, [0x140032c70]
mov r11d, 2
nop word [rax + rax]
cmp qword [0x140032c88], 0x10
lea rax, [r11 - 2]
mov r9, rbx
lea r8, [r8 + 0xe]
cmovae r9, qword [0x140032c70]
mov rcx, rbx
xor edx, edx
div qword [0x140032c80]
movsx eax, byte [rdx + r9]
xor word [r8 - 0x12], ax
lea rax, [r11 - 1]
cmp qword [0x140032c88], 0x10
cmovae rcx, qword [0x140032c70]
xor edx, edx
div qword [0x140032c80]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 - 0x10], ax
mov rax, r11
cmp qword [0x140032c88], 0x10
cmovae rcx, qword [0x140032c70]
xor edx, edx
div qword [0x140032c80]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 - 0xe], ax
lea rax, [r11 + 1]
cmp qword [0x140032c88], 0x10
cmovae rcx, qword [0x140032c70]
xor edx, edx
div qword [0x140032c80]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 - 0xc], ax
lea rax, [r11 + 2]
cmp qword [0x140032c88], 0x10
cmovae rcx, qword [0x140032c70]
xor edx, edx
div qword [0x140032c80]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 - 0xa], ax
lea rax, [r11 + 3]
cmp qword [0x140032c88], 0x10
cmovae rcx, qword [0x140032c70]
xor edx, edx
div qword [0x140032c80]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 - 8], ax
lea rax, [r11 + 4]
cmp qword [0x140032c88], 0x10
cmovae rcx, qword [0x140032c70]
xor edx, edx
div qword [0x140032c80]
add r11, 7
movsx eax, byte [rdx + rcx]
xor word [r8 - 6], ax
lea rax, [r11 - 2]
cmp rax, 0x15
jb 0x1400229d0
mov rbx, qword [rsp]
mov byte [r10 + 0x2c], 0
add rsp, 8
ret
Function at 0x140023480
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
cmp byte [rcx + 0x32], 0
mov r10, rcx
je 0x1400236ba
mov qword [rsp], rbx
lea r8, [rcx + 4]
lea rbx, [0x140032c90]
mov r11d, 2
nop word [rax + rax]
cmp qword [0x140032ca8], 0x10
lea rax, [r11 - 2]
mov r9, rbx
mov rcx, rbx
cmovae r9, qword [0x140032c90]
xor edx, edx
div qword [0x140032ca0]
movsx eax, byte [rdx + r9]
xor word [r8 - 4], ax
lea rax, [r11 - 1]
cmp qword [0x140032ca8], 0x10
cmovae rcx, qword [0x140032c90]
xor edx, edx
div qword [0x140032ca0]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 - 2], ax
mov rax, r11
cmp qword [0x140032ca8], 0x10
cmovae rcx, qword [0x140032c90]
xor edx, edx
div qword [0x140032ca0]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8], ax
lea rax, [r11 + 1]
cmp qword [0x140032ca8], 0x10
cmovae rcx, qword [0x140032c90]
xor edx, edx
div qword [0x140032ca0]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 + 2], ax
lea rax, [r11 + 2]
cmp qword [0x140032ca8], 0x10
cmovae rcx, qword [0x140032c90]
xor edx, edx
div qword [0x140032ca0]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 + 4], ax
lea rax, [r11 + 3]
cmp qword [0x140032ca8], 0x10
cmovae rcx, qword [0x140032c90]
xor edx, edx
div qword [0x140032ca0]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 + 6], ax
lea rax, [r11 + 4]
cmp qword [0x140032ca8], 0x10
cmovae rcx, qword [0x140032c90]
xor edx, edx
div qword [0x140032ca0]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 + 8], ax
lea rax, [r11 + 5]
cmp qword [0x140032ca8], 0x10
cmovae rcx, qword [0x140032c90]
xor edx, edx
div qword [0x140032ca0]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 + 0xa], ax
lea rax, [r11 + 6]
cmp qword [0x140032ca8], 0x10
cmovae rcx, qword [0x140032c90]
xor edx, edx
div qword [0x140032ca0]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 + 0xc], ax
lea rax, [r11 + 7]
cmp qword [0x140032ca8], 0x10
cmovae rcx, qword [0x140032c90]
xor edx, edx
div qword [0x140032ca0]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 + 0xe], ax
cmp qword [0x140032ca8], 0x10
lea rax, [r11 + 8]
lea r8, [r8 + 0x18]
cmovae rcx, qword [0x140032c90]
xor edx, edx
div qword [0x140032ca0]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 - 8], ax
lea rax, [r11 + 9]
cmp qword [0x140032ca8], 0x10
cmovae rcx, qword [0x140032c90]
xor edx, edx
div qword [0x140032ca0]
add r11, 0xc
movsx eax, byte [rdx + rcx]
xor word [r8 - 6], ax
lea rax, [r11 - 2]
cmp rax, 0x18
jb 0x1400234b0
mov rbx, qword [rsp]
mov byte [r10 + 0x32], 0
add rsp, 8
ret
Function at 0x1400236c0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
cmp byte [rcx + 0x34], 0
mov r10, rcx
je 0x1400237dc
mov qword [rsp], rbx
lea r8, [rcx + 4]
lea rbx, [0x140033170]
mov r11d, 2
nop word [rax + rax]
cmp qword [0x140033188], 0x10
lea rax, [r11 - 2]
mov r9, rbx
lea r8, [r8 + 0xa]
cmovae r9, qword [0x140033170]
mov rcx, rbx
xor edx, edx
div qword [0x140033180]
movsx eax, byte [rdx + r9]
xor word [r8 - 0xe], ax
lea rax, [r11 - 1]
cmp qword [0x140033188], 0x10
cmovae rcx, qword [0x140033170]
xor edx, edx
div qword [0x140033180]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 - 0xc], ax
mov rax, r11
cmp qword [0x140033188], 0x10
cmovae rcx, qword [0x140033170]
xor edx, edx
div qword [0x140033180]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 - 0xa], ax
lea rax, [r11 + 1]
cmp qword [0x140033188], 0x10
cmovae rcx, qword [0x140033170]
xor edx, edx
div qword [0x140033180]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 - 8], ax
lea rax, [r11 + 2]
cmp qword [0x140033188], 0x10
cmovae rcx, qword [0x140033170]
xor edx, edx
div qword [0x140033180]
add r11, 5
movsx eax, byte [rdx + rcx]
xor word [r8 - 6], ax
lea rax, [r11 - 2]
cmp rax, 0x19
jb 0x1400236f0
mov rbx, qword [rsp]
mov byte [r10 + 0x34], 0
add rsp, 8
ret
Function at 0x1400237f0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
cmp byte [rcx + 0x3e], 0
mov r10, rcx
je 0x140023aa5
mov qword [rsp], rbx
lea r8, [rcx + 4]
lea rbx, [0x140032db8]
mov r11d, 2
nop word [rax + rax]
cmp qword [0x140032dd0], 0x10
lea rax, [r11 - 2]
mov r9, rbx
mov rcx, rbx
cmovae r9, qword [0x140032db8]
xor edx, edx
div qword [0x140032dc8]
movsx eax, byte [rdx + r9]
xor word [r8 - 4], ax
lea rax, [r11 - 1]
cmp qword [0x140032dd0], 0x10
cmovae rcx, qword [0x140032db8]
xor edx, edx
div qword [0x140032dc8]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 - 2], ax
mov rax, r11
cmp qword [0x140032dd0], 0x10
cmovae rcx, qword [0x140032db8]
xor edx, edx
div qword [0x140032dc8]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8], ax
lea rax, [r11 + 1]
cmp qword [0x140032dd0], 0x10
cmovae rcx, qword [0x140032db8]
xor edx, edx
div qword [0x140032dc8]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 + 2], ax
lea rax, [r11 + 2]
cmp qword [0x140032dd0], 0x10
cmovae rcx, qword [0x140032db8]
xor edx, edx
div qword [0x140032dc8]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 + 4], ax
lea rax, [r11 + 3]
cmp qword [0x140032dd0], 0x10
cmovae rcx, qword [0x140032db8]
xor edx, edx
div qword [0x140032dc8]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 + 6], ax
lea rax, [r11 + 4]
cmp qword [0x140032dd0], 0x10
cmovae rcx, qword [0x140032db8]
xor edx, edx
div qword [0x140032dc8]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 + 8], ax
lea rax, [r11 + 5]
cmp qword [0x140032dd0], 0x10
cmovae rcx, qword [0x140032db8]
xor edx, edx
div qword [0x140032dc8]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 + 0xa], ax
lea rax, [r11 + 6]
cmp qword [0x140032dd0], 0x10
cmovae rcx, qword [0x140032db8]
xor edx, edx
div qword [0x140032dc8]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 + 0xc], ax
lea rax, [r11 + 7]
cmp qword [0x140032dd0], 0x10
cmovae rcx, qword [0x140032db8]
xor edx, edx
div qword [0x140032dc8]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 + 0xe], ax
cmp qword [0x140032dd0], 0x10
lea rax, [r11 + 8]
lea r8, [r8 + 0x1e]
cmovae rcx, qword [0x140032db8]
xor edx, edx
div qword [0x140032dc8]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 - 0xe], ax
lea rax, [r11 + 9]
cmp qword [0x140032dd0], 0x10
cmovae rcx, qword [0x140032db8]
xor edx, edx
div qword [0x140032dc8]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 - 0xc], ax
lea rax, [r11 + 0xa]
cmp qword [0x140032dd0], 0x10
cmovae rcx, qword [0x140032db8]
xor edx, edx
div qword [0x140032dc8]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 - 0xa], ax
lea rax, [r11 + 0xb]
cmp qword [0x140032dd0], 0x10
cmovae rcx, qword [0x140032db8]
xor edx, edx
div qword [0x140032dc8]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 - 8], ax
lea rax, [r11 + 0xc]
cmp qword [0x140032dd0], 0x10
cmovae rcx, qword [0x140032db8]
xor edx, edx
div qword [0x140032dc8]
add r11, 0xf
movsx eax, byte [rdx + rcx]
xor word [r8 - 6], ax
lea rax, [r11 - 2]
cmp rax, 0x1e
jb 0x140023820
mov rbx, qword [rsp]
mov byte [r10 + 0x3e], 0
add rsp, 8
ret
Function at 0x140025670
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140032010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rdx
mov rdi, rcx
mov ecx, 8
call fcn.1400274b0
mov qword [rax], rbx
mov qword [rsp + 0x30], rax
lea rbx, [rdi + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140005b90]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rdi], rax
test rax, rax
je 0x1400256e9
mov rax, rdi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140027490
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov dword [rbx], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x140026690
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x140032010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rdi, r9
mov r13, r8
mov r12, rdx
mov rbp, rcx
mov ecx, 0x48
call fcn.1400274b0
mov r15, rax
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rax]
mov qword [r15], rcx
lea r14, [r15 + 8]
xor eax, eax
mov qword [r14], rax
mov qword [r14 + 8], rax
mov qword [r14 + 0x10], rax
mov rbx, qword [rdi]
mov rsi, qword [rdi + 8]
cmp rbx, rsi
je 0x14002675c
mov rdx, rsi
sub rdx, rbx
sar rdx, 5
mov rcx, r14
call fcn.140026600
mov qword [rsp + 0x38], r14
mov rdi, qword [r14]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], r14
nop dword [rax]
mov rdx, rbx
mov rcx, rdi
call fcn.140021ca0
add rdi, 0x20
mov qword [rsp + 0x48], rdi
add rbx, 0x20
cmp rbx, rsi
jne 0x140026730
mov rdx, rdi
mov rcx, rdi
call fcn.140026120
mov qword [r14 + 8], rdi
lea rcx, [r15 + 0x20]
mov rdx, r13
call fcn.140021ca0
nop
mov qword [r15 + 0x40], r12
mov qword [rsp + 0x38], r15
lea rbx, [rbp + 8]
mov qword [rsp + 0x28], rbx
xor edi, edi
mov dword [rsp + 0x20], edi
mov r9, r15
lea r8, [0x140027390]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp], rax
test rax, rax
je 0x1400267c6
mov rax, rbp
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140027490
mov rbx, qword [rsp + 0xa8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov dword [rbx], edi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3