joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007d7a0
Capabilities:
Encode data using xor

Disassembly:
xchg rbp, rbx
mov qword [rsp + 8], rbp
xchg rbx, rbp
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rdi, r10
mov r10, rcx
xchg rdi, r10
lea rbx, [rdx + 0x7c]
mov rdx, rbx
call fcn.14007af20
nop
xor eax, eax
mov byte [rbx + rax], 0x6b
xor byte [rbx + rax], 0x47
add byte [rbx + rax], 0x25
sub byte [rbx + rax], 0x4b
add byte [rbx + rax], 0x10
add byte [rbx + rax], 0x5a
xor byte [rbx + rax], 0x6e
sub byte [rbx + rax], 0x1e
inc rax
cmp rax, 0xf4
jb 0x14007d7d6
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d820
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, rbx
mov qword [rsp + 0x10], rbx
xchg rbx, rdx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x9a]
mov rdx, rbx
call fcn.14007af20
nop
xor eax, eax
nop dword [rax]
nop dword [rax + rax]
mov byte [rbx + rax], 0x62
add byte [rbx + rax], 0x19
xor byte [rbx + rax], 0xc
xor byte [rbx + rax], 0x34
add byte [rbx + rax], 0xf
sub byte [rbx + rax], 0x52
inc rax
cmp rax, 0x130
jb 0x14007d856
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rdx
push rdx
push rdx
push rcx
push rbx
push rbx
push rcx
xchg qword [rsp + 0x38], rdi
pop rcx
pop rbx
pop rbx
pop rcx
pop rdx
pop rdx
pop rdx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d8b0
Capabilities:
Encode data using xor

Disassembly:
xchg r8, rbx
mov qword [rsp + 8], r8
xchg r8, rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rdi, rcx
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 0xc]
mov rdx, rbx
call fcn.14007af20
nop
xor eax, eax
mov byte [rbx + rax], 0x1f
add byte [rbx + rax], 0x50
sub byte [rbx + rax], 0x69
xor byte [rbx + rax], 0x45
add byte [rbx + rax], 0x20
sub byte [rbx + rax], 0x21
add byte [rbx + rax], 0x3c
sub byte [rbx + rax], 0xb
sub byte [rbx + rax], 0x73
inc rax
cmp rax, 0x14
jb 0x14007d8dd
xchg r14, rax
mov r14, rdi
xchg r14, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d930
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
push r13
mov qword [rsp], rdi
sub rsp, 0x20
xchg r8, rcx
mov rdi, r8
xchg r8, rcx
lea rbx, [rdx + 0xe]
xchg rbx, rdi
mov rdx, rdi
xchg rdi, rbx
call fcn.14007af20
nop
xor eax, eax
mov byte [rbx + rax], 0x4b
xor byte [rbx + rax], 0x48
add byte [rbx + rax], 0x26
add byte [rbx + rax], 0x11
sub byte [rbx + rax], 0x35
add byte [rbx + rax], 0x1b
add byte [rbx + rax], 0x33
sub byte [rbx + rax], 0x53
inc rax
cmp rax, 0x18
jb 0x14007d963
xchg r14, rax
mov r14, rdi
xchg r14, rax
xchg rbx, r14
mov r14, qword [rsp + 0x30]
xchg r14, rbx
add rsp, 0x20
push rax
push rcx
push rbx
push rdx
push rbx
push rcx
push rdx
push rbx
xchg qword [rsp + 0x40], rdi
pop rbx
pop rdx
pop rcx
pop rbx
pop rdx
pop rbx
pop rcx
pop rax
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007d9d0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r8
mov qword [rsp + 8], r8
xchg r8, rbx
xchg r10, rdx
mov qword [rsp + 0x10], r10
xchg rdx, r10
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0xe]
xchg rdx, r8
mov r8, rbx
xchg r8, rdx
call fcn.14007af20
nop
xor eax, eax
mov byte [rbx + rax], 0x74
xor byte [rbx + rax], 0x63
xor byte [rbx + rax], 0x63
sub byte [rbx + rax], 0x3a
add byte [rbx + rax], 0x26
sub byte [rbx + rax], 0x60
inc rax
cmp rax, 0x1a
jb 0x14007da12
xchg rdi, r13
mov rax, r13
xchg r13, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
ret

Function at 0x1400813b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
nop
sub rsp, 8
mov qword [rsp], rsi
sub rsp, 0x20
cmp byte [r8 + 0x19], 0
xchg r11, r8
mov rbx, r11
xchg r11, r8
xchg rcx, rdx
mov rsi, rcx
xchg rdx, rcx
xchg rbp, r13
mov r13, rcx
xchg r13, rbp
jne 0x14008147a
mov qword [rsp + 0x30], rdi
nop dword [rax]
nop dword [rax + rax]
mov r8, qword [rbx + 0x10]
xchg r13, rdx
mov r13, rsi
xchg r13, rdx
mov rcx, rbp
call fcn.1400813b0
xchg rdi, rbx
mov rbx, rdi
xchg rbx, rdi
mov rbx, qword [rbx]
lea rcx, [rdi + 0x28]
call fcn.140091900
mov edx, 0x22e73c11
sub edx, 0x110e01a1
add edx, 0x1547a7d5
add edx, 0x1c4ba0b0
sub edx, 0x3ff6b136
xor edx, 0x4e99eb61
sub edx, 0x48499382
xor edx, 0x637026f1
sub edx, 0x66d28115
mov rcx, rdi
call fcn.1401fcb70
cmp byte [rbx + 0x19], 0
je 0x1400813fe
xchg rcx, rdi
mov rcx, qword [rsp + 0x30]
xchg rdi, rcx
mov rbx, qword [rsp + 0x38]
xchg rbp, r11
mov r11, qword [rsp + 0x40]
xchg rbp, r11
add rsp, 0x20
nop
add rsp, 8
mov rsi, qword [rsp - 8]
ret
Function at 0x140083f80
Capabilities:
Encode data using xor

Disassembly:
mov r8d, edx
nop dword [rax]
nop word [rax + rax]
neg rcx
sub rcx, 0xfffffffffffffffe
neg rcx
mov eax, 0x79711b9f
sub eax, 0x775617ff
xor eax, 0x7716c682
sub eax, 0x1d0f2d71
add eax, 0x7c63ee3
xor eax, 0x37d4db1e
xor eax, 0xa4dcc147
mul r8d
shr edx, 3
movzx eax, dx
shl ax, 2
lea r9d, [rax + rdx]
add r9w, r9w
sub r8w, r9w
nop
sub r8w, 0x7f8d
add r8w, 0x7fbd
mov word [rcx], r8w
mov r8d, edx
test edx, edx
jne 0x140083f90
xchg rcx, rax
mov rcx, rax
xchg rcx, rax
ret

Function at 0x140084240
Capabilities:
Encode data using xor

Disassembly:
mov rax, r8
cmp rcx, rdx
je 0x1400843a4
mov r9, rax
lea r8, [rcx + 0x38]
sub r9, rcx
xor r10d, r10d
nop dword [rax]
xorps xmm0, xmm0
lea r8, [r8 + 0x48]
xchg rbx, rax
movups xmmword [rbx], xmm0
xchg rbx, rax
mov qword [r9 + r8 - 0x70], r10
mov qword [r9 + r8 - 0x68], r10
movups xmm0, xmmword [r8 - 0x80]
xchg rsi, rax
movups xmmword [rsi], xmm0
xchg rsi, rax
xchg r12, r8
movups xmm1, xmmword [r12 - 0x70]
xchg r8, r12
xorps xmm0, xmm0
xchg rbp, rax
movups xmmword [rbp + 0x10], xmm1
xchg rbp, rax
xchg r10, r15
mov qword [r8 - 0x70], r15
xchg r10, r15
nop
sub rax, 0x7993ffda
add rax, 0x79940022
mov qword [r8 - 0x68], 0x12fdd384
add qword [r8 - 0x68], 0x69943052
sub qword [r8 - 0x68], 0x7053bdc3
add qword [r8 - 0x68], 0x231d7888
sub qword [r8 - 0x68], 0x24a167a2
xor qword [r8 - 0x68], 0x1b971f5
xor qword [r8 - 0x68], 0xb03270b
mov word [r8 - 0x80], r10w
xchg r11, r9
movups xmmword [r11 + r8 - 0x60], xmm0
xchg r9, r11
mov qword [r9 + r8 - 0x50], r10
xchg r10, r12
mov qword [r9 + r8 - 0x48], r12
xchg r10, r12
xchg rcx, r8
movups xmm0, xmmword [rcx - 0x60]
xchg r8, rcx
xchg r9, r15
movups xmmword [r15 + r8 - 0x60], xmm0
xchg r15, r9
xchg r8, rdi
movups xmm1, xmmword [rdi - 0x50]
xchg r8, rdi
xchg r13, r9
movups xmmword [r13 + r8 - 0x50], xmm1
xchg r13, r9
xchg r10, rcx
mov qword [r8 - 0x50], rcx
xchg rcx, r10
mov qword [r8 - 0x48], 0x77b0d381
sub qword [r8 - 0x48], 0x6b972819
add qword [r8 - 0x48], 0x62cffd37
add qword [r8 - 0x48], 0x76a14bc
sub qword [r8 - 0x48], 0x44dacb9d
xor qword [r8 - 0x48], 0x2e1fdc19
add qword [r8 - 0x48], 0x512d1bc8
xor qword [r8 - 0x48], 0x57988251
xor qword [r8 - 0x48], 0x270ccb39
mov word [r8 - 0x60], r10w
mov ecx, dword [r8 - 0x40]
mov dword [r9 + r8 - 0x40], ecx
lea rcx, [r8 - 0x38]
cmp rcx, rdx
jne 0x140084260
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1400843b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
xchg rbx, r10
mov r10, r8
xchg r10, rbx
cmp rcx, rdx
je 0x140084493
xchg r11, rbx
mov rax, r11
xchg r11, rbx
lea r8, [rcx + 0x18]
sub rax, rcx
xor r10d, r10d
nop dword [rax + rax]
xorps xmm0, xmm0
lea r8, [r8 + 0x20]
xchg r12, rbx
movups xmmword [r12], xmm0
xchg r12, rbx
xchg r13, r10
mov qword [rax + r8 - 0x28], r13
xchg r10, r13
lea rcx, [r8 - 0x18]
xchg r10, r12
mov qword [r8 + rax - 0x20], r12
xchg r12, r10
xchg r12, r8
movups xmm0, xmmword [r12 - 0x38]
xchg r12, r8
movups xmmword [rbx], xmm0
xchg r8, rsi
movups xmm1, xmmword [rsi - 0x28]
xchg rsi, r8
xchg rbx, r10
movups xmmword [r10 + 0x10], xmm1
xchg rbx, r10
xchg r10, rdi
mov qword [r8 - 0x28], rdi
xchg rdi, r10
sub rbx, 0xffffffffffffffe0
mov qword [r8 - 0x20], 0x73bf85d4
sub qword [r8 - 0x20], 0x5c1f031
add qword [r8 - 0x20], 0xafdb57e
xor qword [r8 - 0x20], 0x1238ecb1
sub qword [r8 - 0x20], 0x4c99b36
xor qword [r8 - 0x20], 0x64f6ae49
xor qword [r8 - 0x20], 0x698594b4
sub qword [r8 - 0x20], 0xc8d64dd
sub qword [r8 - 0x20], 0x5bfbd1bb
mov byte [r8 - 0x38], r10b
cmp rcx, rdx
jne 0x1400843e0
xchg rdx, r8
mov rdx, r9
xchg rdx, r8
xchg rcx, rdx
mov rcx, rbx
xchg rcx, rdx
xchg rcx, rbx
mov rbx, rcx
xchg rcx, rbx
call fcn.14007f4a0
mov rax, rbx
add rsp, 0x20
nop
add rsp, 8
mov rbx, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x1400844d0
Capabilities:
Encode data using xor

Disassembly:
xchg r8, rax
mov r8, rax
xchg r8, rax
cmp rcx, rdx
je 0x14008459b
xchg rcx, rax
mov r9, rcx
xchg rcx, rax
lea r8, [rcx + 0x18]
sub r9, rcx
xor r10d, r10d
nop word [rax + rax]
xorps xmm0, xmm0
lea r8, [r8 + 0x20]
xchg rbp, rax
movups xmmword [rbp], xmm0
xchg rbp, rax
mov qword [r9 + r8 - 0x28], r10
lea rcx, [r8 - 0x18]
xchg r12, r10
mov qword [r8 + r9 - 0x20], r12
xchg r10, r12
xchg r8, r14
movups xmm0, xmmword [r14 - 0x38]
xchg r14, r8
xchg rdx, rax
movups xmmword [rdx], xmm0
xchg rdx, rax
movups xmm1, xmmword [r8 - 0x28]
xchg r14, rax
movups xmmword [r14 + 0x10], xmm1
xchg r14, rax
mov qword [r8 - 0x28], r10
neg rax
add rax, 0xffffffffffffffe0
neg rax
mov qword [r8 - 0x20], 0x35c97524
sub qword [r8 - 0x20], 0x222a0b57
sub qword [r8 - 0x20], 0xaa17ea0
xor qword [r8 - 0x20], 0x645c2b40
xor qword [r8 - 0x20], 0x16ce7684
sub qword [r8 - 0x20], 0xca37e35
sub qword [r8 - 0x20], 0x43f4084a
sub qword [r8 - 0x20], 0x29d83063
mov word [r8 - 0x38], r10w
cmp rcx, rdx
jne 0x1400844fc
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14008e9f0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 0x14], 0x79
sub byte [rcx + rax + 0x14], 0x17
sub byte [rcx + rax + 0x14], 0x5a
xor byte [rcx + rax + 0x14], 0x7d
add byte [rcx + rax + 0x14], 7
sub byte [rcx + rax + 0x14], 0x7c
inc rax
cmp rax, 0x24
jb 0x14008e9f2
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1400f1170
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, r9
mov qword [rsp + 0x10], r9
xchg rdx, r9
push rbp
nop
push 0x759b5102
mov qword [rsp], rsi
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x80
xchg r9, r14
mov rdi, r14
xchg r9, r14
mov esi, r8d
xchg rdx, rdi
mov rbx, rdi
xchg rdi, rdx
xor ebp, ebp
lea rcx, [rsp + 0x50]
call fcn.140049d10
mov dword [rsp + 0x70], esi
mov qword [rsp + 0x78], rdi
lea ecx, [rbp + 0x30]
call fcn.1401fcb34
test rax, rax
je 0x1400f1211
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rsp + 0x60]
xchg r15, rax
movups xmmword [r15 + 0x10], xmm1
xchg r15, rax
movdqa xmm0, xmmword [0x140002c70]
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], bp
mov dword [rax + 0x20], esi
xchg rbp, rdi
mov qword [rax + 0x28], rbp
xchg rdi, rbp
jmp 0x1400f1218
xchg rbp, rax
mov rbp, rax
xchg rbp, rax
mov qword [rsp + 0xb8], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebp
xchg r14, r9
mov r14, rax
xchg r14, r9
lea r8, [0x1400821f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
xchg r11, rax
mov qword [rsp + 0x30], r11
xchg r11, rax
test rax, rax
je 0x1400f12df
cmp dword [rsp + 0x38], 0
je 0x1400f1318
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x1400f12d7
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x50]
call fcn.14002f760
nop
mov rcx, rbx
mov rbx, qword [rsp + 0xa0]
add rsp, 0x80
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
xchg qword [rsp], rsi
add rsp, 8
push rbx
push rbx
push rax
push rcx
push rax
push rdx
push rax
xchg qword [rsp + 0x38], rbp
pop rax
pop rdx
pop rax
pop rcx
pop rax
pop rbx
pop rbx
add rsp, 8
jmp fcn.14002f760
mov ecx, eax
call sub.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_
nop
mov dword [rsp + 0x38], ebp
mov ecx, 0x480f11b6
sub ecx, 0x29d9b1a
xor ecx, 0x4d5dde3a
xor ecx, 0x22d676a9
xor ecx, 0x3d001892
sub ecx, 0x105f316f
add ecx, 0x64030660
xor ecx, 0x6b9e9b88
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov ecx, 0x64d8dc9a
sub ecx, 0x276d0ec3
add ecx, 0x328a7596
add ecx, 0xc97f383
sub ecx, 0x4e066ad5
add ecx, 0x235dd47
xor ecx, 0x30bda963
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x140198d40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
mov qword [rsp], rbx
push rdi
nop
sub rsp, 8
mov qword [rsp], r13
sub rsp, 0x30
xor ebx, ebx
mov r13d, r8d
mov rdi, rdx
test rdx, rdx
jne 0x140198d6c
mov eax, ebx
jmp 0x140198dac
mov eax, 0x58a6dd5
add eax, 0x1348e2ce
sub eax, 0x64a7813
add eax, 0x64a01feb
sub eax, 0x6b3af0d5
xor eax, 0xbee5deb
cmp word [rdx], ax
je 0x140198d9b
mov rax, rbx
jmp 0x140198dac
movsxd rax, dword [rdx + 0x3c]
add rax, rdi
cmp dword [rax], 0x4550
cmovne rax, rbx
mov qword [rsp + 0x50], rbp
mov ecx, 0x43ae6330
sub ecx, 0x39ebf67f
add ecx, 0x4c1958b0
sub ecx, 0x4b285116
add ecx, 0x21b229e
sub ecx, 0xcce94de
xchg r11, rsi
mov qword [rsp + 0x58], r11
xchg r11, rsi
xchg r14, r12
mov qword [rsp + 0x60], r14
xchg r14, r12
xchg r12, r14
mov qword [rsp + 0x28], r12
xchg r12, r14
xchg r11, r15
mov qword [rsp + 0x20], r11
xchg r15, r11
cmp word [rax + 0x18], cx
jne 0x140198e74
mov esi, dword [rax + 0x88]
add rsi, rdi
je 0x140198e74
mov r14d, dword [rsi + 0x1c]
mov r15d, dword [rsi + 0x24]
add r14, rdi
mov r12d, dword [rsi + 0x20]
add r15, rdi
add r12, rdi
cmp dword [rsi + 0x18], 0
jbe 0x140198e74
nop dword [rax]
nop dword [rax + rax]
mov eax, ebx
xor edx, edx
mov ecx, dword [r12 + rax*4]
movzx eax, word [r15 + rax*2]
add rcx, rdi
mov ebp, dword [r14 + rax*4]
add rbp, rdi
call fcn.140076680
cmp eax, r13d
je 0x140198ec5
inc ebx
cmp ebx, dword [rsi + 0x18]
jb 0x140198e44
xor eax, eax
xchg rbx, r15
mov rbx, qword [rsp + 0x20]
xchg rbx, r15
mov r14, qword [rsp + 0x28]
mov r12, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
nop
mov r13, qword [rsp]
add rsp, 8
push rdx
xchg qword [rsp + 8], rdi
pop rdx
add rsp, 8
push rdx
push rax
push rcx
xchg qword [rsp + 0x18], rbx
pop rcx
pop rax
pop rdx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
xchg r13, rax
mov r13, rbp
xchg r13, rax
jmp 0x140198e76
Function at 0x1401aac50
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r11, rdx
xchg r10, rcx
mov rcx, r10
xchg rcx, r10
test rdx, rdx
je 0x1401aacd4
xchg rbx, rsi
mov qword [rsp], rsi
xchg rbx, rsi
movzx ebx, byte [rsp + 0x30]
test r9, r9
je 0x1401aacc1
movzx eax, byte [r10]
test bl, bl
je 0x1401aaca3
lea rcx, [r9 - 1]
xchg r12, r9
mov rdx, r12
xchg r12, r9
add rcx, r8
nop
xor al, byte [rcx]
lea rcx, [rcx - 1]
mov byte [r10], al
sub rdx, 1
jne 0x1401aac92
jmp 0x1401aacc1
xor ecx, ecx
nop dword [rax]
nop word [rax + rax]
xor al, byte [rcx + r8]
inc rcx
mov byte [r10], al
cmp rcx, r9
jb 0x1401aacb2
inc r10
sub r11, 1
jne 0x1401aac74
xchg rbx, r14
mov r14, qword [rsp]
xchg rbx, r14
add rsp, 8
ret
Function at 0x1401afc10
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
xchg rbx, r14
mov qword [rsp + 8], r14
xchg r14, rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x4198aec5
add eax, 0x2492b226
sub eax, 0x4f38b29c
xor eax, 0x3a425f4
add eax, 0x26e852fd
sub eax, 0x3c3ecb08
call fcn.1401fcee0
sub rsp, rax
mov ebx, edx
mov edi, ecx
call sub.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_
mov dword [rsp + 0x24], eax
mov r9d, 0x1d4080f6
add r9d, 0x6006e51b
xor r9d, 0x1b4b7143
sub r9d, 0x59f0a723
xor r9d, 0x3c37067d
sub r9d, 0x185e1362
add r9d, 0xdccc345
sub r9d, 0x259b2634
mov dword [rsp + 0x13a4], 0x722524e7
add dword [rsp + 0x13a4], 0x38bb4de
sub dword [rsp + 0x13a4], 0x28ec4c8a
sub dword [rsp + 0x13a4], 0x1eeb9789
sub dword [rsp + 0x13a4], 0x24d90e9b
xor dword [rsp + 0x13a4], 0x5919e610
add dword [rsp + 0x13a4], 0x29d6bcb1
add dword [rsp + 0x13a4], 0x84434247
nop dword [rax + rax]
mov r8d, eax
shr r8d, 0x15
shr r8d, 4
shr r8d, 5
xor r8d, eax
imul eax, r8d, 0x6c078965
add eax, r9d
mov dword [rsp + r9*4 + 0x24], eax
inc r9
cmp r9, 0x270
jb 0x1401afced
mov ebp, 0x1c406bc
add ebp, 0x2328fb70
sub ebp, 0x2351818c
xor ebp, 0x6bcef47c
xor ebp, 0x2fbe48fe
sub ebp, 0x17babea5
xor ebp, 0x179e3f65
sub ebp, 0x910597b
add ebp, 0x4f621763
mov dword [rsp + 0x20], 0x8e3bf69
add dword [rsp + 0x20], 0x68c378f3
sub dword [rsp + 0x20], 0x6d2d2949
add dword [rsp + 0x20], 0x2f5dd988
sub dword [rsp + 0x20], 0xb17e53a
add dword [rsp + 0x20], 0x227bb374
sub dword [rsp + 0x20], 0x2a19fd9d
xor dword [rsp + 0x20], 0x2121bb48
cmp edi, ebp
lea rax, [rsp + 0x20]
mov qword [rsp + 0x13d0], rax
lea rcx, [rsp + 0x13d0]
lea eax, [rdi - 0x80000000]
lea esi, [rdi + rbp]
cmovae esi, eax
lea edi, [rbx + rbp]
cmp ebx, ebp
lea eax, [rbx - 0x80000000]
cmovae edi, eax
sub edi, esi
cmp edi, 0xffffffff
jne 0x1401afddb
call fcn.1401b0060
mov ecx, eax
jmp 0x1401afe3f
inc edi
mov ebx, edi
call fcn.1401b0060
mov ecx, eax
imul rcx, rbx
cmp ecx, edi
jae 0x1401afe2b
mov eax, edi
xor edx, edx
neg eax
div edi
mov edi, edx
cmp ecx, edx
jae 0x1401afe2b
nop dword [rax]
nop dword [rax + rax]
lea rcx, [rsp + 0x13d0]
call fcn.1401b0060
mov ecx, eax
imul rcx, rbx
cmp ecx, edi
jb 0x1401afe10
shr rcx, 1
shr rcx, 0x13
shr rcx, 9
shr rcx, 1
shr rcx, 1
shr rcx, 1
lea edx, [rsi + rcx]
lea r11, [rsp + 0x13b0]
cmp edx, ebp
xchg rdi, rbx
mov rdi, qword [r11 + 0x10]
xchg rdi, rbx
lea eax, [rdx + rbp]
mov rbp, qword [r11 + 0x18]
lea ecx, [rdx - 0x80000000]
mov rsi, qword [r11 + 0x28]
cmovae eax, ecx
mov rsp, r11
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1401b0060
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
xchg r10, rbp
mov rbp, qword [rcx]
xchg rbp, r10
mov r9d, 0x2a05365b
sub r9d, 0x1951a6a2
sub r9d, 0xbf2895c
xor r9d, 0x726e2844
sub r9d, 0x39c72c34
sub r9d, 0x2b35c531
sub r9d, 0x11b23a44
mov ecx, dword [r10]
cmp ecx, r9d
jne 0x1401b00f9
lea r8, [r10 + 8]
nop dword [rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x1401b00b4
mov ecx, dword [r10]
jmp 0x1401b024a
cmp ecx, 0x4e0
jb 0x1401b024a
lea r11, [r10 + 0x9c4]
xchg rbx, r9
mov qword [rsp], r9
xchg rbx, r9
mov eax, dword [r11]
mov ebx, 0x427c9aaf
xor ebx, 0x583ab61a
sub ebx, 0xc7bbbb0
add ebx, 0x9718e49
add ebx, 0x5fee820b
sub ebx, 0x45c2f008
add ebx, 0x4842a8d0
xor ebx, 0x79aa3ac2
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1401b0148
lea r11, [r10 + 0xd50]
mov ebx, 0x7a8c90be
sub ebx, 0x5346ecb7
sub ebx, 0x125de52a
add ebx, 0x299bed9b
sub ebx, 0xcd1478f
add ebx, 0x34f3ea57
sub ebx, 0x37ebe14c
xor ebx, 0x6ba34da3
sub ebx, 0x45191ecb
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1401b01cc
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 8
shr ecx, 1
shr ecx, 1
shr ecx, 1
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 6
shl eax, 1
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xa
shl eax, 3
shl eax, 1
shl eax, 1
xor edx, eax
mov eax, edx
shr eax, 9
shr eax, 2
shr eax, 3
shr eax, 1
shr eax, 1
shr eax, 1
shr eax, 1
xor eax, edx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1401b0800
Capabilities:
Encode data using xor

Disassembly:
xchg rcx, rbx
mov qword [rsp + 8], rcx
xchg rcx, rbx
push rdi
sub rsp, 0x20
mov eax, dword [rcx + 0x40]
mov rdi, rdx
xchg rbx, rcx
mov rcx, rbx
xchg rbx, rcx
mov byte [rax + rcx], 0x1b
add byte [rax + rcx], 0x4e
sub byte [rax + rcx], 0xf
xor byte [rax + rcx], 0x45
add byte [rax + rcx], 0x4a
sub byte [rax + rcx], 0x50
xor byte [rax + rcx], 0x99
lea r8d, [rax + 1]
cmp eax, 0x38
jae 0x1401b0892
cmp r8d, 0x38
jae 0x1401b090c
mov ecx, r8d
mov eax, 0x31aa9e06
xor eax, 0x68652d9c
xor eax, 0xad3c06b
sub eax, 0x259f73e7
add eax, 0x1fb14cf7
sub eax, 0x490daf93
add eax, 0x21bf2859
sub eax, 0x25dfc58f
sub eax, r8d
add rcx, rbx
mov r8d, eax
xor edx, edx
call sub.VCRUNTIME140.dll_memset
jmp 0x1401b090c
cmp r8d, 0x40
jae 0x1401b08cd
mov ecx, r8d
mov eax, 0x16ae9c8b
xor eax, 0x43cb8dd
add eax, 0x4db67096
sub eax, 0xfcf721d
sub eax, 0x24e77f06
xor eax, 0x2b91a389
sub eax, r8d
add rcx, rbx
mov r8d, eax
xor edx, edx
call sub.VCRUNTIME140.dll_memset
xchg rdi, rdx
mov rdi, rbx
xchg rdi, rdx
xchg rbx, rcx
mov rbx, rcx
xchg rbx, rcx
call fcn.1401b0c80
xorps xmm0, xmm0
xor eax, eax
xchg r8, rbx
movups xmmword [r8], xmm0
xchg rbx, r8
xchg r11, rbx
movups xmmword [r11 + 0x10], xmm0
xchg rbx, r11
xchg rbx, rdi
movups xmmword [rdi + 0x20], xmm0
xchg rdi, rbx
mov qword [rbx + 0x30], rax
mov edx, dword [rbx + 0x40]
xchg rcx, rbx
mov rbx, rcx
xchg rbx, rcx
shl edx, 2
shl edx, 1
add rdx, qword [rbx + 0x48]
xchg rcx, rax
mov rcx, rdx
xchg rcx, rax
xchg r13, rdx
mov qword [rbx + 0x48], r13
xchg rdx, r13
shr rax, 5
shr rax, 1
shr rax, 2
mov byte [rbx + 0x3e], al
xchg rsi, rax
mov rsi, rdx
xchg rsi, rax
shr rax, 0xe
shr rax, 2
mov byte [rbx + 0x3d], al
xchg rcx, rax
mov rcx, rdx
xchg rcx, rax
shr rax, 0x10
shr rax, 6
shr rax, 1
shr rax, 1
mov byte [rbx + 0x3c], al
xchg rsi, rax
mov rsi, rdx
xchg rsi, rax
shr rax, 0x16
shr rax, 1
shr rax, 5
shr rax, 3
shr rax, 1
mov byte [rbx + 0x3b], al
xchg rdx, r14
mov rax, r14
xchg r14, rdx
shr rax, 2
shr rax, 3
shr rax, 0x17
shr rax, 0xa
shr rax, 1
shr rax, 1
mov byte [rbx + 0x3a], al
xchg r9, rax
mov r9, rdx
xchg r9, rax
mov byte [rbx + 0x3f], dl
shr rdx, 0x26
shr rdx, 7
shr rdx, 2
shr rdx, 6
shr rdx, 1
shr rdx, 1
shr rdx, 1
mov byte [rbx + 0x38], dl
xchg rdi, rbx
mov rdx, rdi
xchg rdi, rbx
shr rax, 0x1d
shr rax, 0x11
shr rax, 1
shr rax, 1
mov byte [rbx + 0x39], al
call fcn.1401b0c80
xor r8d, r8d
lea rdx, [rdi + 8]
nop dword [rax]
nop word [rax + rax]
mov eax, dword [rbx + 0x50]
lea rdx, [rdx + 1]
mov ecx, 0x5bf447d2
xor ecx, 0x754e10d3
xor ecx, 0x6abe0b11
sub ecx, 0x27118574
xor ecx, 0x5467b952
sub ecx, 0x48956fb6
lea rdi, [rdi + 1]
sub ecx, r8d
add r8d, 8
shr eax, cl
mov byte [rdi - 1], al
mov eax, dword [rbx + 0x54]
shr eax, cl
mov byte [rdx - 5], al
mov eax, dword [rbx + 0x58]
shr eax, cl
mov byte [rdx - 1], al
mov eax, dword [rbx + 0x5c]
shr eax, cl
mov byte [rdx + 3], al
mov eax, dword [rbx + 0x60]
shr eax, cl
mov byte [rdx + 7], al
cmp r8d, 0x20
jb 0x1401b0a01
xchg rbx, r14
mov r14, qword [rsp + 0x30]
xchg rbx, r14
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]