joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400191d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14002b010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x1400191fd
xor eax, eax
jmp 0x140019352
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x140019228
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x140019228
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x140019352
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140019345
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x14001926b
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140019296
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14001934a
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140019305
sub eax, 1
je 0x140019305
cmp eax, 2
jne 0x140019345
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14001934a
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140019333
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140019345
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x14001934a
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140020bd0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x14001a0c0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
sub rsp, 8
cmp byte [rcx + 0x5d], 0
je 0x14001a1c4
mov qword [rsp + 0x10], rbx
lea r9, [rcx + 2]
mov ebx, 1
mov qword [rsp], rdi
sub rbx, rcx
lea rdi, [0x14002bc20]
mov r11, rcx
mov r10, 0xfffffffffffffffe
sub r10, rcx
not r11
nop word [rax + rax]
cmp qword [0x14002bc38], 0x10
lea rax, [r10 + r9]
mov r8, rdi
cmovae r8, qword [0x14002bc20]
xor edx, edx
div qword [0x14002bc30]
movzx eax, byte [rdx + r8]
mov r8, rdi
xor byte [r9 - 2], al
lea rax, [r11 + r9]
cmp qword [0x14002bc38], 0x10
cmovae r8, qword [0x14002bc20]
xor edx, edx
div qword [0x14002bc30]
movzx eax, byte [rdx + r8]
mov r8, rdi
xor byte [r9 - 1], al
mov rax, r9
cmp qword [0x14002bc38], 0x10
cmovae r8, qword [0x14002bc20]
sub rax, rcx
xor edx, edx
div qword [0x14002bc30]
movzx eax, byte [rdx + r8]
mov r8, rdi
xor byte [r9], al
lea rax, [rbx + r9]
cmp qword [0x14002bc38], 0x10
cmovae r8, qword [0x14002bc20]
xor edx, edx
div qword [0x14002bc30]
movzx eax, byte [rdx + r8]
xor byte [r9 + 1], al
add r9, 4
lea rax, [r10 + r9]
cmp rax, 0x5c
jb 0x14001a100
mov rdi, qword [rsp]
mov rbx, qword [rsp + 0x10]
mov byte [rcx + 0x5d], 0
add rsp, 8
ret

Function at 0x14001a2c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
mov r9, rcx
mov qword [rsp + 0x20], rdx
cmp byte [rcx + 0x34], 0
je 0x14001a3d6
mov r10d, 2
lea r8, [rcx + 4]
lea r11, [0x14002bf40]
nop dword [rax]
mov rcx, r11
cmp qword [0x14002bf58], 0x10
cmovae rcx, qword [0x14002bf40]
lea rax, [r10 - 2]
xor edx, edx
div qword [0x14002bf50]
movsx eax, byte [rdx + rcx]
xor word [r8 - 4], ax
mov rcx, r11
cmp qword [0x14002bf58], 0x10
cmovae rcx, qword [0x14002bf40]
lea rax, [r10 - 1]
xor edx, edx
div qword [0x14002bf50]
movsx eax, byte [rdx + rcx]
xor word [r8 - 2], ax
mov rcx, r11
cmp qword [0x14002bf58], 0x10
cmovae rcx, qword [0x14002bf40]
xor edx, edx
mov rax, r10
div qword [0x14002bf50]
movsx eax, byte [rdx + rcx]
xor word [r8], ax
mov rcx, r11
cmp qword [0x14002bf58], 0x10
cmovae rcx, qword [0x14002bf40]
lea rax, [r10 + 1]
xor edx, edx
div qword [0x14002bf50]
movsx eax, byte [rdx + rcx]
xor word [r8 + 2], ax
mov rcx, r11
cmp qword [0x14002bf58], 0x10
cmovae rcx, qword [0x14002bf40]
lea rax, [r10 + 2]
xor edx, edx
div qword [0x14002bf50]
movsx eax, byte [rdx + rcx]
xor word [r8 + 4], ax
lea r8, [r8 + 0xa]
add r10, 5
lea rax, [r10 - 2]
cmp rax, 0x19
jb 0x14001a2f0
mov byte [r9 + 0x34], 0
lea rax, [r9 + 0x32]
xor ecx, ecx
mov qword [rbx], rcx
mov qword [rbx + 0x10], rcx
mov qword [rbx + 0x18], 7
mov word [rbx], cx
cmp r9, rax
je 0x14001a402
lea r8d, [rcx + 0x19]
mov rdx, r9
mov rcx, rbx
call fcn.14001dba0
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x14001bfb0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14002b010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14001c083
cmp byte [rcx + 0x71], 0
je 0x14001c083
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14001c07f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14001c044
sub eax, 1
je 0x14001c048
cmp eax, 2
jne 0x14001c07f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140020bd0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14001c076
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14001c07f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14001c02c
xor al, al
jmp 0x14001c02c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140020bd0
add rsp, 0x60
pop rbx
ret

Function at 0x14001c380
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
cmp byte [rcx + 0x2c], 0
mov r10, rcx
je 0x14001c4ee
mov qword [rsp], rbx
lea r8, [rcx + 4]
lea rbx, [0x14002bba0]
mov r11d, 2
nop word [rax + rax]
cmp qword [0x14002bbb8], 0x10
lea rax, [r11 - 2]
mov r9, rbx
lea r8, [r8 + 0xe]
cmovae r9, qword [0x14002bba0]
mov rcx, rbx
xor edx, edx
div qword [0x14002bbb0]
movsx eax, byte [rdx + r9]
xor word [r8 - 0x12], ax
lea rax, [r11 - 1]
cmp qword [0x14002bbb8], 0x10
cmovae rcx, qword [0x14002bba0]
xor edx, edx
div qword [0x14002bbb0]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 - 0x10], ax
mov rax, r11
cmp qword [0x14002bbb8], 0x10
cmovae rcx, qword [0x14002bba0]
xor edx, edx
div qword [0x14002bbb0]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 - 0xe], ax
lea rax, [r11 + 1]
cmp qword [0x14002bbb8], 0x10
cmovae rcx, qword [0x14002bba0]
xor edx, edx
div qword [0x14002bbb0]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 - 0xc], ax
lea rax, [r11 + 2]
cmp qword [0x14002bbb8], 0x10
cmovae rcx, qword [0x14002bba0]
xor edx, edx
div qword [0x14002bbb0]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 - 0xa], ax
lea rax, [r11 + 3]
cmp qword [0x14002bbb8], 0x10
cmovae rcx, qword [0x14002bba0]
xor edx, edx
div qword [0x14002bbb0]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 - 8], ax
lea rax, [r11 + 4]
cmp qword [0x14002bbb8], 0x10
cmovae rcx, qword [0x14002bba0]
xor edx, edx
div qword [0x14002bbb0]
add r11, 7
movsx eax, byte [rdx + rcx]
xor word [r8 - 6], ax
lea rax, [r11 - 2]
cmp rax, 0x15
jb 0x14001c3b0
mov rbx, qword [rsp]
mov byte [r10 + 0x2c], 0
add rsp, 8
ret
Function at 0x14001ce60
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
cmp byte [rcx + 0x32], 0
mov r10, rcx
je 0x14001d09a
mov qword [rsp], rbx
lea r8, [rcx + 4]
lea rbx, [0x14002bbc0]
mov r11d, 2
nop word [rax + rax]
cmp qword [0x14002bbd8], 0x10
lea rax, [r11 - 2]
mov r9, rbx
mov rcx, rbx
cmovae r9, qword [0x14002bbc0]
xor edx, edx
div qword [0x14002bbd0]
movsx eax, byte [rdx + r9]
xor word [r8 - 4], ax
lea rax, [r11 - 1]
cmp qword [0x14002bbd8], 0x10
cmovae rcx, qword [0x14002bbc0]
xor edx, edx
div qword [0x14002bbd0]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 - 2], ax
mov rax, r11
cmp qword [0x14002bbd8], 0x10
cmovae rcx, qword [0x14002bbc0]
xor edx, edx
div qword [0x14002bbd0]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8], ax
lea rax, [r11 + 1]
cmp qword [0x14002bbd8], 0x10
cmovae rcx, qword [0x14002bbc0]
xor edx, edx
div qword [0x14002bbd0]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 + 2], ax
lea rax, [r11 + 2]
cmp qword [0x14002bbd8], 0x10
cmovae rcx, qword [0x14002bbc0]
xor edx, edx
div qword [0x14002bbd0]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 + 4], ax
lea rax, [r11 + 3]
cmp qword [0x14002bbd8], 0x10
cmovae rcx, qword [0x14002bbc0]
xor edx, edx
div qword [0x14002bbd0]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 + 6], ax
lea rax, [r11 + 4]
cmp qword [0x14002bbd8], 0x10
cmovae rcx, qword [0x14002bbc0]
xor edx, edx
div qword [0x14002bbd0]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 + 8], ax
lea rax, [r11 + 5]
cmp qword [0x14002bbd8], 0x10
cmovae rcx, qword [0x14002bbc0]
xor edx, edx
div qword [0x14002bbd0]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 + 0xa], ax
lea rax, [r11 + 6]
cmp qword [0x14002bbd8], 0x10
cmovae rcx, qword [0x14002bbc0]
xor edx, edx
div qword [0x14002bbd0]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 + 0xc], ax
lea rax, [r11 + 7]
cmp qword [0x14002bbd8], 0x10
cmovae rcx, qword [0x14002bbc0]
xor edx, edx
div qword [0x14002bbd0]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 + 0xe], ax
cmp qword [0x14002bbd8], 0x10
lea rax, [r11 + 8]
lea r8, [r8 + 0x18]
cmovae rcx, qword [0x14002bbc0]
xor edx, edx
div qword [0x14002bbd0]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 - 8], ax
lea rax, [r11 + 9]
cmp qword [0x14002bbd8], 0x10
cmovae rcx, qword [0x14002bbc0]
xor edx, edx
div qword [0x14002bbd0]
add r11, 0xc
movsx eax, byte [rdx + rcx]
xor word [r8 - 6], ax
lea rax, [r11 - 2]
cmp rax, 0x18
jb 0x14001ce90
mov rbx, qword [rsp]
mov byte [r10 + 0x32], 0
add rsp, 8
ret
Function at 0x14001d0a0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
cmp byte [rcx + 0x34], 0
mov r10, rcx
je 0x14001d1bc
mov qword [rsp], rbx
lea r8, [rcx + 4]
lea rbx, [0x14002bf40]
mov r11d, 2
nop word [rax + rax]
cmp qword [0x14002bf58], 0x10
lea rax, [r11 - 2]
mov r9, rbx
lea r8, [r8 + 0xa]
cmovae r9, qword [0x14002bf40]
mov rcx, rbx
xor edx, edx
div qword [0x14002bf50]
movsx eax, byte [rdx + r9]
xor word [r8 - 0xe], ax
lea rax, [r11 - 1]
cmp qword [0x14002bf58], 0x10
cmovae rcx, qword [0x14002bf40]
xor edx, edx
div qword [0x14002bf50]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 - 0xc], ax
mov rax, r11
cmp qword [0x14002bf58], 0x10
cmovae rcx, qword [0x14002bf40]
xor edx, edx
div qword [0x14002bf50]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 - 0xa], ax
lea rax, [r11 + 1]
cmp qword [0x14002bf58], 0x10
cmovae rcx, qword [0x14002bf40]
xor edx, edx
div qword [0x14002bf50]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 - 8], ax
lea rax, [r11 + 2]
cmp qword [0x14002bf58], 0x10
cmovae rcx, qword [0x14002bf40]
xor edx, edx
div qword [0x14002bf50]
add r11, 5
movsx eax, byte [rdx + rcx]
xor word [r8 - 6], ax
lea rax, [r11 - 2]
cmp rax, 0x19
jb 0x14001d0d0
mov rbx, qword [rsp]
mov byte [r10 + 0x34], 0
add rsp, 8
ret
Function at 0x14001d1d0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
cmp byte [rcx + 0x3e], 0
mov r10, rcx
je 0x14001d485
mov qword [rsp], rbx
lea r8, [rcx + 4]
lea rbx, [0x14002bca8]
mov r11d, 2
nop word [rax + rax]
cmp qword [0x14002bcc0], 0x10
lea rax, [r11 - 2]
mov r9, rbx
mov rcx, rbx
cmovae r9, qword [0x14002bca8]
xor edx, edx
div qword [0x14002bcb8]
movsx eax, byte [rdx + r9]
xor word [r8 - 4], ax
lea rax, [r11 - 1]
cmp qword [0x14002bcc0], 0x10
cmovae rcx, qword [0x14002bca8]
xor edx, edx
div qword [0x14002bcb8]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 - 2], ax
mov rax, r11
cmp qword [0x14002bcc0], 0x10
cmovae rcx, qword [0x14002bca8]
xor edx, edx
div qword [0x14002bcb8]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8], ax
lea rax, [r11 + 1]
cmp qword [0x14002bcc0], 0x10
cmovae rcx, qword [0x14002bca8]
xor edx, edx
div qword [0x14002bcb8]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 + 2], ax
lea rax, [r11 + 2]
cmp qword [0x14002bcc0], 0x10
cmovae rcx, qword [0x14002bca8]
xor edx, edx
div qword [0x14002bcb8]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 + 4], ax
lea rax, [r11 + 3]
cmp qword [0x14002bcc0], 0x10
cmovae rcx, qword [0x14002bca8]
xor edx, edx
div qword [0x14002bcb8]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 + 6], ax
lea rax, [r11 + 4]
cmp qword [0x14002bcc0], 0x10
cmovae rcx, qword [0x14002bca8]
xor edx, edx
div qword [0x14002bcb8]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 + 8], ax
lea rax, [r11 + 5]
cmp qword [0x14002bcc0], 0x10
cmovae rcx, qword [0x14002bca8]
xor edx, edx
div qword [0x14002bcb8]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 + 0xa], ax
lea rax, [r11 + 6]
cmp qword [0x14002bcc0], 0x10
cmovae rcx, qword [0x14002bca8]
xor edx, edx
div qword [0x14002bcb8]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 + 0xc], ax
lea rax, [r11 + 7]
cmp qword [0x14002bcc0], 0x10
cmovae rcx, qword [0x14002bca8]
xor edx, edx
div qword [0x14002bcb8]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 + 0xe], ax
cmp qword [0x14002bcc0], 0x10
lea rax, [r11 + 8]
lea r8, [r8 + 0x1e]
cmovae rcx, qword [0x14002bca8]
xor edx, edx
div qword [0x14002bcb8]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 - 0xe], ax
lea rax, [r11 + 9]
cmp qword [0x14002bcc0], 0x10
cmovae rcx, qword [0x14002bca8]
xor edx, edx
div qword [0x14002bcb8]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 - 0xc], ax
lea rax, [r11 + 0xa]
cmp qword [0x14002bcc0], 0x10
cmovae rcx, qword [0x14002bca8]
xor edx, edx
div qword [0x14002bcb8]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 - 0xa], ax
lea rax, [r11 + 0xb]
cmp qword [0x14002bcc0], 0x10
cmovae rcx, qword [0x14002bca8]
xor edx, edx
div qword [0x14002bcb8]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 - 8], ax
lea rax, [r11 + 0xc]
cmp qword [0x14002bcc0], 0x10
cmovae rcx, qword [0x14002bca8]
xor edx, edx
div qword [0x14002bcb8]
add r11, 0xf
movsx eax, byte [rdx + rcx]
xor word [r8 - 6], ax
lea rax, [r11 - 2]
cmp rax, 0x1e
jb 0x14001d200
mov rbx, qword [rsp]
mov byte [r10 + 0x3e], 0
add rsp, 8
ret
Function at 0x14001eda0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x14002b010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rdx
mov rdi, rcx
mov ecx, 8
call fcn.140020bf0
mov qword [rax], rbx
mov qword [rsp + 0x30], rax
lea rbx, [rdi + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140005730]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rdi], rax
test rax, rax
je 0x14001ee19
mov rax, rdi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140020bd0
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov dword [rbx], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x14001ff30
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x14002b010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rdi, r9
mov r13, r8
mov r12, rdx
mov rbp, rcx
mov ecx, 0x48
call fcn.140020bf0
mov r15, rax
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rax]
mov qword [r15], rcx
lea r14, [r15 + 8]
xor eax, eax
mov qword [r14], rax
mov qword [r14 + 8], rax
mov qword [r14 + 0x10], rax
mov rbx, qword [rdi]
mov rsi, qword [rdi + 8]
cmp rbx, rsi
je 0x14001fffc
mov rdx, rsi
sub rdx, rbx
sar rdx, 5
mov rcx, r14
call fcn.14001fea0
mov qword [rsp + 0x38], r14
mov rdi, qword [r14]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], r14
nop dword [rax]
mov rdx, rbx
mov rcx, rdi
call fcn.14001b550
add rdi, 0x20
mov qword [rsp + 0x48], rdi
add rbx, 0x20
cmp rbx, rsi
jne 0x14001ffd0
mov rdx, rdi
mov rcx, rdi
call fcn.14001f9c0
mov qword [r14 + 8], rdi
lea rcx, [r15 + 0x20]
mov rdx, r13
call fcn.14001b550
nop
mov qword [r15 + 0x40], r12
mov qword [rsp + 0x38], r15
lea rbx, [rbp + 8]
mov qword [rsp + 0x28], rbx
xor edi, edi
mov dword [rsp + 0x20], edi
mov r9, r15
lea r8, [0x140020ae0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp], rax
test rax, rax
je 0x140020066
mov rax, rbp
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140020bd0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov dword [rbx], edi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x1400207c0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x270
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x140020821
lea r8, [r10 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x1400207e0
mov ecx, dword [r10]
jmp 0x14002090a
cmp ecx, 0x4e0
jb 0x14002090a
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0xe3
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140020840
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140020890
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret

Function at 0x140021200
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x140034575
Capabilities:
Check for software breakpoints

Disassembly:
push rbx
bswap dx
sar bh, cl
sub rsp, 0x20
mov rdx, qword [0x14002bd08]
or bh, 0xd2
sub rbx, r9
mov rbx, r8
cmp rdx, qword [0x14002bd10]
je 0x14003473f
mov rdx, qword [rdx]
shr cx, cl
mov rcx, rdx
movzx eax, byte [rcx]
cmp dil, al
cmp al, 0xc3
jmp 0x1400345b3
je 0x1400345e0
cmp al, 0xcc
je 0x140034682
inc rcx
sbb ah, 0xaa
movsx eax, sp
mov rax, rcx
sub rax, rdx
test ch, 0xae
cmp r15b, 0xad
cmp rax, rdx
jbe 0x1400345a6
mov rcx, qword [r8]
clc
test rcx, rcx
jmp 0x1400345ec
je 0x14003466d
mov rdx, qword [r8 + 0x10]
sub rdx, rcx
cmp rbx, 0x576d2aee
and rdx, 0xfffffffffffffff8
cmp bpl, dil
cmp rdx, 0x1000
jmp 0x140034613
jb 0x14003464c
mov r8, qword [rcx - 8]
or al, r12b
btc ax, r15w
add rdx, 0x27
rcr ah, 0x32
adc al, ch
test di, 0x61d1
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400347dd
mov rcx, r8
jmp 0x14003464c
call fcn.140020c34
xor eax, eax
mov qword [rbx], rax
cmc
mov qword [rbx + 8], rax
test rcx, 0x2f8068d4
clc
mov qword [rbx + 0x10], rax
or rbx, r11
or bl, 0xd
xor al, al
adc bl, 0x8d
cmp sil, 0x7d
xor ebx, 0x715d5fa1
add rsp, 0x20
pop rbx
ret
mov rcx, qword [r8]
clc
test r13b, 0xec
test rcx, rcx
jmp 0x140034692
je 0x140034722
mov rdx, qword [r8 + 0x10]
stc
test ch, 0x13
sub rdx, rcx
cmp dx, r9w
and rdx, 0xfffffffffffffff8
jmp 0x1400346b1
cmp rdx, 0x1000
jmp 0x1400346bd
jb 0x1400346f9
mov r8, qword [rcx - 8]
rcr ah, cl
shr ax, cl
cwde
add rdx, 0x27
sub rcx, r8
cmovg ax, r14w
movsx rax, ax
lea rax, [rcx - 8]
jmp 0x1400346e7
cmp rax, 0x1f
jmp 0x1400346f0
ja 0x1400347dd
mov rcx, r8
call fcn.140020c34
xor eax, eax
mov qword [rbx], rax
test r13w, 0x4656
cmc
mov qword [rbx + 8], rax
cmp r9d, 0x6a63ca
jmp 0x14003471a
mov qword [rbx + 0x10], rax
cmovs rbx, rcx
mov al, 1
not bh
ror bx, 0x11
btr ebx, r12d
add rsp, 0x20
cmova ebx, r11d
bswap ebx
pop rbx
jmp 0x14003473e
ret
mov rcx, qword [r8]
test rcx, rcx
jmp 0x14003474a
je 0x1400347ce
mov rdx, qword [r8 + 0x10]
stc
clc
sub rdx, rcx
jmp 0x140034761
and rdx, 0xfffffffffffffff8
clc
cmp rdx, 0x1000
jb 0x1400347a9
mov r8, qword [rcx - 8]
test r14w, 0x4383
xor eax, 0x7aac2b6b
btc eax, r9d
add rdx, 0x27
sal ah, 0x23
sub rcx, r8
movsxd rax, edi
lea rax, [rcx - 8]
cmp rax, 0x1f
jmp 0x1400347a0
ja 0x1400347dd
mov rcx, r8
call fcn.140020c34
sub eax, eax
clc
test r8w, r10w
mov qword [rbx], rax
stc
clc
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
bt bx, di
add bx, 0x36f3
shl rbx, cl
add rsp, 0x20
movsx bx, r8b
movzx rbx, r12w
pop rbx
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3