joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002dc30
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov rax, rsp
sub rsp, 0x28
cmp byte [rcx + 0x6f], 0
je 0x14002deed
mov qword [rax + 8], rbx
lea r9, [rcx + 2]
mov qword [rax + 0x10], rbp
mov ebx, 1
mov qword [rax + 0x18], rsi
mov ebp, 6
mov qword [rax - 8], rdi
mov esi, 3
mov qword [rax - 0x10], r12
mov edi, 2
mov qword [rax - 0x18], r13
mov r12d, 7
mov qword [rax - 0x20], r14
mov r13d, 8
mov qword [rsp], r15
mov r14d, 4
mov r15d, 5
mov r11, rcx
sub r15, rcx
sub rbx, rcx
sub rdi, rcx
sub rsi, rcx
sub r14, rcx
sub rbp, rcx
sub r12, rcx
sub r13, rcx
mov r10, 0xfffffffffffffffe
not r11
sub r10, rcx
nop dword [rax]
cmp qword [0x140041090], 0x10
lea r8, [0x140041078]
lea rax, [r9 + r10]
cmovae r8, qword [0x140041078]
xor edx, edx
div qword [0x140041088]
movzx eax, byte [rdx + r8]
lea r8, [0x140041078]
xor byte [r9 - 2], al
lea rax, [r9 + r11]
cmp qword [0x140041090], 0x10
cmovae r8, qword [0x140041078]
xor edx, edx
div qword [0x140041088]
movzx eax, byte [rdx + r8]
lea r8, [0x140041078]
xor byte [r9 - 1], al
mov rax, r9
cmp qword [0x140041090], 0x10
cmovae r8, qword [0x140041078]
sub rax, rcx
xor edx, edx
div qword [0x140041088]
movzx eax, byte [rdx + r8]
lea r8, [0x140041078]
xor byte [r9], al
lea rax, [rbx + r9]
cmp qword [0x140041090], 0x10
cmovae r8, qword [0x140041078]
xor edx, edx
div qword [0x140041088]
movzx eax, byte [rdx + r8]
lea r8, [0x140041078]
xor byte [r9 + 1], al
lea rax, [rdi + r9]
cmp qword [0x140041090], 0x10
cmovae r8, qword [0x140041078]
xor edx, edx
div qword [0x140041088]
movzx eax, byte [rdx + r8]
lea r8, [0x140041078]
xor byte [r9 + 2], al
lea rax, [rsi + r9]
cmp qword [0x140041090], 0x10
cmovae r8, qword [0x140041078]
xor edx, edx
div qword [0x140041088]
movzx eax, byte [rdx + r8]
lea r8, [0x140041078]
xor byte [r9 + 3], al
lea rax, [r14 + r9]
cmp qword [0x140041090], 0x10
cmovae r8, qword [0x140041078]
xor edx, edx
div qword [0x140041088]
movzx eax, byte [rdx + r8]
lea r8, [0x140041078]
xor byte [r9 + 4], al
lea rax, [r15 + r9]
cmp qword [0x140041090], 0x10
cmovae r8, qword [0x140041078]
xor edx, edx
div qword [0x140041088]
movzx eax, byte [rdx + r8]
lea r8, [0x140041078]
xor byte [r9 + 5], al
lea rax, [r9 + rbp]
cmp qword [0x140041090], 0x10
cmovae r8, qword [0x140041078]
xor edx, edx
div qword [0x140041088]
movzx eax, byte [rdx + r8]
lea r8, [0x140041078]
xor byte [r9 + 6], al
lea rax, [r9 + r12]
cmp qword [0x140041090], 0x10
cmovae r8, qword [0x140041078]
xor edx, edx
div qword [0x140041088]
movzx eax, byte [rdx + r8]
xor byte [r9 + 7], al
cmp qword [0x140041090], 0x10
lea rax, [r9 + r13]
lea r8, [0x140041078]
cmovae r8, qword [0x140041078]
xor edx, edx
div qword [0x140041088]
movzx eax, byte [rdx + r8]
xor byte [r9 + 8], al
add r9, 0xb
lea rax, [r9 + r10]
cmp rax, 0x6e
jb 0x14002dcc0
mov r15, qword [rsp]
mov r14, qword [rsp + 8]
mov r13, qword [rsp + 0x10]
mov r12, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov byte [rcx + 0x6f], 0
add rsp, 0x28
ret
Function at 0x14002df00
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov rax, rsp
sub rsp, 0x28
cmp byte [rcx + 0x33], 0
je 0x14002e168
mov qword [rax + 8], rbx
lea r9, [rcx + 2]
mov qword [rax + 0x10], rbp
mov ebx, 1
mov qword [rax + 0x18], rsi
mov ebp, 7
mov qword [rax - 8], rdi
mov esi, 3
mov qword [rax - 0x10], r12
mov edi, 2
mov qword [rax - 0x18], r13
mov r12d, 6
mov qword [rax - 0x20], r14
lea r13, [0x140041158]
mov qword [rsp], r15
mov r14d, 4
mov r15d, 5
mov r11, rcx
sub r15, rcx
sub rbx, rcx
sub rdi, rcx
sub rsi, rcx
sub r14, rcx
sub r12, rcx
sub rbp, rcx
mov r10, 0xfffffffffffffffe
sub r10, rcx
not r11
nop word [rax + rax]
cmp qword [0x140041170], 0x10
lea rax, [r9 + r10]
mov r8, r13
cmovae r8, qword [0x140041158]
xor edx, edx
div qword [0x140041168]
movzx eax, byte [rdx + r8]
mov r8, r13
xor byte [r9 - 2], al
lea rax, [r9 + r11]
cmp qword [0x140041170], 0x10
cmovae r8, qword [0x140041158]
xor edx, edx
div qword [0x140041168]
movzx eax, byte [rdx + r8]
mov r8, r13
xor byte [r9 - 1], al
mov rax, r9
cmp qword [0x140041170], 0x10
cmovae r8, qword [0x140041158]
sub rax, rcx
xor edx, edx
div qword [0x140041168]
movzx eax, byte [rdx + r8]
mov r8, r13
xor byte [r9], al
lea rax, [rbx + r9]
cmp qword [0x140041170], 0x10
cmovae r8, qword [0x140041158]
xor edx, edx
div qword [0x140041168]
movzx eax, byte [rdx + r8]
mov r8, r13
xor byte [r9 + 1], al
lea rax, [rdi + r9]
cmp qword [0x140041170], 0x10
cmovae r8, qword [0x140041158]
xor edx, edx
div qword [0x140041168]
movzx eax, byte [rdx + r8]
mov r8, r13
xor byte [r9 + 2], al
lea rax, [rsi + r9]
cmp qword [0x140041170], 0x10
cmovae r8, qword [0x140041158]
xor edx, edx
div qword [0x140041168]
movzx eax, byte [rdx + r8]
mov r8, r13
xor byte [r9 + 3], al
lea rax, [r14 + r9]
cmp qword [0x140041170], 0x10
cmovae r8, qword [0x140041158]
xor edx, edx
div qword [0x140041168]
movzx eax, byte [rdx + r8]
mov r8, r13
xor byte [r9 + 4], al
lea rax, [r15 + r9]
cmp qword [0x140041170], 0x10
cmovae r8, qword [0x140041158]
xor edx, edx
div qword [0x140041168]
movzx eax, byte [rdx + r8]
mov r8, r13
xor byte [r9 + 5], al
lea rax, [r12 + r9]
cmp qword [0x140041170], 0x10
cmovae r8, qword [0x140041158]
xor edx, edx
div qword [0x140041168]
movzx eax, byte [rdx + r8]
mov r8, r13
xor byte [r9 + 6], al
lea rax, [r9 + rbp]
cmp qword [0x140041170], 0x10
cmovae r8, qword [0x140041158]
xor edx, edx
div qword [0x140041168]
movzx eax, byte [rdx + r8]
xor byte [r9 + 7], al
add r9, 0xa
lea rax, [r9 + r10]
cmp rax, 0x32
jb 0x14002df90
mov r15, qword [rsp]
mov r14, qword [rsp + 8]
mov r13, qword [rsp + 0x10]
mov r12, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov byte [rcx + 0x33], 0
add rsp, 0x28
ret
Function at 0x14002e5e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rbx, rdx
mov qword [rsp + 0x20], rdx
cmp byte [rcx + 0x32], 0
je 0x14002e776
lea r9, [rcx + 2]
mov r11, rcx
not r11
mov edi, 1
sub rdi, rcx
mov esi, 2
sub rsi, rcx
mov r14d, 3
sub r14, rcx
mov r15d, 4
sub r15, rcx
mov r10, 0xfffffffffffffffe
sub r10, rcx
lea rbp, [0x140040e58]
nop
mov r8, rbp
cmp qword [0x140040e70], 0x10
cmovae r8, qword [0x140040e58]
lea rax, [r10 + r9]
xor edx, edx
div qword [0x140040e68]
movzx eax, byte [rdx + r8]
xor byte [r9 - 2], al
mov r8, rbp
cmp qword [0x140040e70], 0x10
cmovae r8, qword [0x140040e58]
lea rax, [r9 + r11]
xor edx, edx
div qword [0x140040e68]
movzx eax, byte [rdx + r8]
xor byte [r9 - 1], al
mov r8, rbp
cmp qword [0x140040e70], 0x10
cmovae r8, qword [0x140040e58]
mov rax, r9
sub rax, rcx
xor edx, edx
div qword [0x140040e68]
movzx eax, byte [rdx + r8]
xor byte [r9], al
mov r8, rbp
cmp qword [0x140040e70], 0x10
cmovae r8, qword [0x140040e58]
lea rax, [rdi + r9]
xor edx, edx
div qword [0x140040e68]
movzx eax, byte [rdx + r8]
xor byte [r9 + 1], al
mov r8, rbp
cmp qword [0x140040e70], 0x10
cmovae r8, qword [0x140040e58]
lea rax, [rsi + r9]
xor edx, edx
div qword [0x140040e68]
movzx eax, byte [rdx + r8]
xor byte [r9 + 2], al
mov r8, rbp
cmp qword [0x140040e70], 0x10
cmovae r8, qword [0x140040e58]
lea rax, [r14 + r9]
xor edx, edx
div qword [0x140040e68]
movzx eax, byte [rdx + r8]
xor byte [r9 + 3], al
mov r8, rbp
cmp qword [0x140040e70], 0x10
cmovae r8, qword [0x140040e58]
lea rax, [r15 + r9]
xor edx, edx
div qword [0x140040e68]
movzx eax, byte [rdx + r8]
xor byte [r9 + 4], al
add r9, 7
lea rax, [r10 + r9]
cmp rax, 0x31
jb 0x14002e640
mov byte [rcx + 0x32], 0
lea rdx, [rcx + 0x31]
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], 0xf
mov byte [rbx], al
cmp rcx, rdx
je 0x14002e7a1
lea r8d, [rax + 0x31]
mov rdx, rcx
mov rcx, rbx
call fcn.140006ba0
mov rax, rbx
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x14002e820
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
mov r9, rcx
mov qword [rsp + 0x20], rdx
xor r10d, r10d
cmp byte [rcx + 0x48], r10b
je 0x14002e878
mov r8d, r10d
lea r11, [0x140040c30]
mov rcx, r11
cmp qword [0x140040c48], 0x10
cmovae rcx, qword [0x140040c30]
xor edx, edx
mov rax, r8
div qword [0x140040c40]
movzx eax, byte [rdx + rcx]
xor byte [r8 + r9], al
inc r8
cmp r8, 0x47
jb 0x14002e844
mov byte [r9 + 0x48], r10b
lea rax, [r9 + 0x47]
mov qword [rbx], r10
mov qword [rbx + 0x10], r10
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
cmp r9, rax
je 0x14002e8a4
mov r8d, 0x47
mov rdx, r9
mov rcx, rbx
call fcn.140006ba0
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x14002f3a0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
mov r9, rcx
mov qword [rsp + 0x20], rdx
cmp byte [rcx + 0x34], 0
je 0x14002f4b6
mov r10d, 2
lea r8, [rcx + 4]
lea r11, [0x1400411d8]
nop dword [rax]
mov rcx, r11
cmp qword [0x1400411f0], 0x10
cmovae rcx, qword [0x1400411d8]
lea rax, [r10 - 2]
xor edx, edx
div qword [0x1400411e8]
movsx eax, byte [rdx + rcx]
xor word [r8 - 4], ax
mov rcx, r11
cmp qword [0x1400411f0], 0x10
cmovae rcx, qword [0x1400411d8]
lea rax, [r10 - 1]
xor edx, edx
div qword [0x1400411e8]
movsx eax, byte [rdx + rcx]
xor word [r8 - 2], ax
mov rcx, r11
cmp qword [0x1400411f0], 0x10
cmovae rcx, qword [0x1400411d8]
xor edx, edx
mov rax, r10
div qword [0x1400411e8]
movsx eax, byte [rdx + rcx]
xor word [r8], ax
mov rcx, r11
cmp qword [0x1400411f0], 0x10
cmovae rcx, qword [0x1400411d8]
lea rax, [r10 + 1]
xor edx, edx
div qword [0x1400411e8]
movsx eax, byte [rdx + rcx]
xor word [r8 + 2], ax
mov rcx, r11
cmp qword [0x1400411f0], 0x10
cmovae rcx, qword [0x1400411d8]
lea rax, [r10 + 2]
xor edx, edx
div qword [0x1400411e8]
movsx eax, byte [rdx + rcx]
xor word [r8 + 4], ax
lea r8, [r8 + 0xa]
add r10, 5
lea rax, [r10 - 2]
cmp rax, 0x19
jb 0x14002f3d0
mov byte [r9 + 0x34], 0
lea rax, [r9 + 0x32]
xor ecx, ecx
mov qword [rbx], rcx
mov qword [rbx + 0x10], rcx
mov qword [rbx + 0x18], 7
mov word [rbx], cx
cmp r9, rax
je 0x14002f4e2
lea r8d, [rcx + 0x19]
mov rdx, r9
mov rcx, rbx
call fcn.1400331b0
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140030d70
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140040010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140030e43
cmp byte [rcx + 0x71], 0
je 0x140030e43
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140030e3f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140030e04
sub eax, 1
je 0x140030e08
cmp eax, 2
jne 0x140030e3f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140035c80
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140030e36
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140030e3f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140030dec
xor al, al
jmp 0x140030dec
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140035c80
add rsp, 0x60
pop rbx
ret
Function at 0x1400318d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x30], 0
je 0x140031916
xor r8d, r8d
lea r10, [0x140041118]
cmp qword [0x140041130], 0x10
mov rax, r8
mov r9, r10
cmovae r9, qword [0x140041118]
xor edx, edx
div qword [0x140041128]
movsx eax, byte [rdx + r9]
xor word [rcx + r8*2], ax
inc r8
cmp r8, 0x17
jb 0x1400318e0
mov byte [rcx + 0x30], 0
ret

Function at 0x140031920
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
cmp byte [rcx + 0x2c], 0
mov r10, rcx
je 0x140031a8e
mov qword [rsp], rbx
lea r8, [rcx + 4]
lea rbx, [0x140040c50]
mov r11d, 2
nop word [rax + rax]
cmp qword [0x140040c68], 0x10
lea rax, [r11 - 2]
mov r9, rbx
lea r8, [r8 + 0xe]
cmovae r9, qword [0x140040c50]
mov rcx, rbx
xor edx, edx
div qword [0x140040c60]
movsx eax, byte [rdx + r9]
xor word [r8 - 0x12], ax
lea rax, [r11 - 1]
cmp qword [0x140040c68], 0x10
cmovae rcx, qword [0x140040c50]
xor edx, edx
div qword [0x140040c60]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 - 0x10], ax
mov rax, r11
cmp qword [0x140040c68], 0x10
cmovae rcx, qword [0x140040c50]
xor edx, edx
div qword [0x140040c60]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 - 0xe], ax
lea rax, [r11 + 1]
cmp qword [0x140040c68], 0x10
cmovae rcx, qword [0x140040c50]
xor edx, edx
div qword [0x140040c60]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 - 0xc], ax
lea rax, [r11 + 2]
cmp qword [0x140040c68], 0x10
cmovae rcx, qword [0x140040c50]
xor edx, edx
div qword [0x140040c60]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 - 0xa], ax
lea rax, [r11 + 3]
cmp qword [0x140040c68], 0x10
cmovae rcx, qword [0x140040c50]
xor edx, edx
div qword [0x140040c60]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 - 8], ax
lea rax, [r11 + 4]
cmp qword [0x140040c68], 0x10
cmovae rcx, qword [0x140040c50]
xor edx, edx
div qword [0x140040c60]
add r11, 7
movsx eax, byte [rdx + rcx]
xor word [r8 - 6], ax
lea rax, [r11 - 2]
cmp rax, 0x15
jb 0x140031950
mov rbx, qword [rsp]
mov byte [r10 + 0x2c], 0
add rsp, 8
ret
Function at 0x140032400
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
cmp byte [rcx + 0x32], 0
mov r10, rcx
je 0x14003263a
mov qword [rsp], rbx
lea r8, [rcx + 4]
lea rbx, [0x140040c70]
mov r11d, 2
nop word [rax + rax]
cmp qword [0x140040c88], 0x10
lea rax, [r11 - 2]
mov r9, rbx
mov rcx, rbx
cmovae r9, qword [0x140040c70]
xor edx, edx
div qword [0x140040c80]
movsx eax, byte [rdx + r9]
xor word [r8 - 4], ax
lea rax, [r11 - 1]
cmp qword [0x140040c88], 0x10
cmovae rcx, qword [0x140040c70]
xor edx, edx
div qword [0x140040c80]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 - 2], ax
mov rax, r11
cmp qword [0x140040c88], 0x10
cmovae rcx, qword [0x140040c70]
xor edx, edx
div qword [0x140040c80]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8], ax
lea rax, [r11 + 1]
cmp qword [0x140040c88], 0x10
cmovae rcx, qword [0x140040c70]
xor edx, edx
div qword [0x140040c80]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 + 2], ax
lea rax, [r11 + 2]
cmp qword [0x140040c88], 0x10
cmovae rcx, qword [0x140040c70]
xor edx, edx
div qword [0x140040c80]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 + 4], ax
lea rax, [r11 + 3]
cmp qword [0x140040c88], 0x10
cmovae rcx, qword [0x140040c70]
xor edx, edx
div qword [0x140040c80]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 + 6], ax
lea rax, [r11 + 4]
cmp qword [0x140040c88], 0x10
cmovae rcx, qword [0x140040c70]
xor edx, edx
div qword [0x140040c80]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 + 8], ax
lea rax, [r11 + 5]
cmp qword [0x140040c88], 0x10
cmovae rcx, qword [0x140040c70]
xor edx, edx
div qword [0x140040c80]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 + 0xa], ax
lea rax, [r11 + 6]
cmp qword [0x140040c88], 0x10
cmovae rcx, qword [0x140040c70]
xor edx, edx
div qword [0x140040c80]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 + 0xc], ax
lea rax, [r11 + 7]
cmp qword [0x140040c88], 0x10
cmovae rcx, qword [0x140040c70]
xor edx, edx
div qword [0x140040c80]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 + 0xe], ax
cmp qword [0x140040c88], 0x10
lea rax, [r11 + 8]
lea r8, [r8 + 0x18]
cmovae rcx, qword [0x140040c70]
xor edx, edx
div qword [0x140040c80]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 - 8], ax
lea rax, [r11 + 9]
cmp qword [0x140040c88], 0x10
cmovae rcx, qword [0x140040c70]
xor edx, edx
div qword [0x140040c80]
add r11, 0xc
movsx eax, byte [rdx + rcx]
xor word [r8 - 6], ax
lea rax, [r11 - 2]
cmp rax, 0x18
jb 0x140032430
mov rbx, qword [rsp]
mov byte [r10 + 0x32], 0
add rsp, 8
ret
Function at 0x140032640
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
cmp byte [rcx + 0x34], 0
mov r10, rcx
je 0x14003275c
mov qword [rsp], rbx
lea r8, [rcx + 4]
lea rbx, [0x1400411d8]
mov r11d, 2
nop word [rax + rax]
cmp qword [0x1400411f0], 0x10
lea rax, [r11 - 2]
mov r9, rbx
lea r8, [r8 + 0xa]
cmovae r9, qword [0x1400411d8]
mov rcx, rbx
xor edx, edx
div qword [0x1400411e8]
movsx eax, byte [rdx + r9]
xor word [r8 - 0xe], ax
lea rax, [r11 - 1]
cmp qword [0x1400411f0], 0x10
cmovae rcx, qword [0x1400411d8]
xor edx, edx
div qword [0x1400411e8]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 - 0xc], ax
mov rax, r11
cmp qword [0x1400411f0], 0x10
cmovae rcx, qword [0x1400411d8]
xor edx, edx
div qword [0x1400411e8]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 - 0xa], ax
lea rax, [r11 + 1]
cmp qword [0x1400411f0], 0x10
cmovae rcx, qword [0x1400411d8]
xor edx, edx
div qword [0x1400411e8]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 - 8], ax
lea rax, [r11 + 2]
cmp qword [0x1400411f0], 0x10
cmovae rcx, qword [0x1400411d8]
xor edx, edx
div qword [0x1400411e8]
add r11, 5
movsx eax, byte [rdx + rcx]
xor word [r8 - 6], ax
lea rax, [r11 - 2]
cmp rax, 0x19
jb 0x140032670
mov rbx, qword [rsp]
mov byte [r10 + 0x34], 0
add rsp, 8
ret
Function at 0x140032770
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
cmp byte [rcx + 0x3e], 0
mov r10, rcx
je 0x140032a25
mov qword [rsp], rbx
lea r8, [rcx + 4]
lea rbx, [0x140040df8]
mov r11d, 2
nop word [rax + rax]
cmp qword [0x140040e10], 0x10
lea rax, [r11 - 2]
mov r9, rbx
mov rcx, rbx
cmovae r9, qword [0x140040df8]
xor edx, edx
div qword [0x140040e08]
movsx eax, byte [rdx + r9]
xor word [r8 - 4], ax
lea rax, [r11 - 1]
cmp qword [0x140040e10], 0x10
cmovae rcx, qword [0x140040df8]
xor edx, edx
div qword [0x140040e08]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 - 2], ax
mov rax, r11
cmp qword [0x140040e10], 0x10
cmovae rcx, qword [0x140040df8]
xor edx, edx
div qword [0x140040e08]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8], ax
lea rax, [r11 + 1]
cmp qword [0x140040e10], 0x10
cmovae rcx, qword [0x140040df8]
xor edx, edx
div qword [0x140040e08]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 + 2], ax
lea rax, [r11 + 2]
cmp qword [0x140040e10], 0x10
cmovae rcx, qword [0x140040df8]
xor edx, edx
div qword [0x140040e08]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 + 4], ax
lea rax, [r11 + 3]
cmp qword [0x140040e10], 0x10
cmovae rcx, qword [0x140040df8]
xor edx, edx
div qword [0x140040e08]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 + 6], ax
lea rax, [r11 + 4]
cmp qword [0x140040e10], 0x10
cmovae rcx, qword [0x140040df8]
xor edx, edx
div qword [0x140040e08]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 + 8], ax
lea rax, [r11 + 5]
cmp qword [0x140040e10], 0x10
cmovae rcx, qword [0x140040df8]
xor edx, edx
div qword [0x140040e08]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 + 0xa], ax
lea rax, [r11 + 6]
cmp qword [0x140040e10], 0x10
cmovae rcx, qword [0x140040df8]
xor edx, edx
div qword [0x140040e08]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 + 0xc], ax
lea rax, [r11 + 7]
cmp qword [0x140040e10], 0x10
cmovae rcx, qword [0x140040df8]
xor edx, edx
div qword [0x140040e08]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 + 0xe], ax
cmp qword [0x140040e10], 0x10
lea rax, [r11 + 8]
lea r8, [r8 + 0x1e]
cmovae rcx, qword [0x140040df8]
xor edx, edx
div qword [0x140040e08]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 - 0xe], ax
lea rax, [r11 + 9]
cmp qword [0x140040e10], 0x10
cmovae rcx, qword [0x140040df8]
xor edx, edx
div qword [0x140040e08]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 - 0xc], ax
lea rax, [r11 + 0xa]
cmp qword [0x140040e10], 0x10
cmovae rcx, qword [0x140040df8]
xor edx, edx
div qword [0x140040e08]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 - 0xa], ax
lea rax, [r11 + 0xb]
cmp qword [0x140040e10], 0x10
cmovae rcx, qword [0x140040df8]
xor edx, edx
div qword [0x140040e08]
movsx eax, byte [rdx + rcx]
mov rcx, rbx
xor word [r8 - 8], ax
lea rax, [r11 + 0xc]
cmp qword [0x140040e10], 0x10
cmovae rcx, qword [0x140040df8]
xor edx, edx
div qword [0x140040e08]
add r11, 0xf
movsx eax, byte [rdx + rcx]
xor word [r8 - 6], ax
lea rax, [r11 - 2]
cmp rax, 0x1e
jb 0x1400327a0
mov rbx, qword [rsp]
mov byte [r10 + 0x3e], 0
add rsp, 8
ret
Function at 0x140035120
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x140040010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rdi, r9
mov r13, r8
mov r12, rdx
mov rbp, rcx
mov ecx, 0x48
call fcn.140035ca0
mov r15, rax
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rax]
mov qword [r15], rcx
lea r14, [r15 + 8]
xor eax, eax
mov qword [r14], rax
mov qword [r14 + 8], rax
mov qword [r14 + 0x10], rax
mov rbx, qword [rdi]
mov rsi, qword [rdi + 8]
cmp rbx, rsi
je 0x1400351ec
mov rdx, rsi
sub rdx, rbx
sar rdx, 5
mov rcx, r14
call fcn.140034ef0
mov qword [rsp + 0x38], r14
mov rdi, qword [r14]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], r14
nop dword [rax]
mov rdx, rbx
mov rcx, rdi
call fcn.1400306d0
add rdi, 0x20
mov qword [rsp + 0x48], rdi
add rbx, 0x20
cmp rbx, rsi
jne 0x1400351c0
mov rdx, rdi
mov rcx, rdi
call fcn.140034e00
mov qword [r14 + 8], rdi
lea rcx, [r15 + 0x20]
mov rdx, r13
call fcn.1400306d0
nop
mov qword [r15 + 0x40], r12
mov qword [rsp + 0x38], r15
lea rbx, [rbp + 8]
mov qword [rsp + 0x28], rbx
xor edi, edi
mov dword [rsp + 0x20], edi
mov r9, r15
lea r8, [0x140035b80]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp], rax
test rax, rax
je 0x140035256
mov rax, rbp
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140035c80
mov rbx, qword [rsp + 0xa8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov dword [rbx], edi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x140035560
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140040010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rdx
mov rdi, rcx
mov ecx, 8
call fcn.140035ca0
mov qword [rax], rbx
mov qword [rsp + 0x30], rax
lea rbx, [rdi + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140005a90]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rdi], rax
test rax, rax
je 0x1400355d6
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140035c80
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov dword [rbx], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3