joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007d4d0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r10
mov qword [rsp + 8], r10
xchg rbx, r10
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rcx, rdx
mov rdi, rdx
xchg rdx, rcx
lea rbx, [rdx + 0x70]
mov rdx, rbx
call fcn.14007ada0
nop
xor eax, eax
mov byte [rbx + rax], 0x24
add byte [rbx + rax], 0x11
xor byte [rbx + rax], 0x40
sub byte [rbx + rax], 0x65
add byte [rbx + rax], 0x20
sub byte [rbx + rax], 0x30
inc rax
cmp rax, 0xdc
jb 0x14007d505
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rbx
push rbx
xchg qword [rsp + 0x10], rdi
pop rbx
pop rbx
add rsp, 8
ret

Function at 0x14007d550
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, rcx
mov qword [rsp + 0x10], rcx
xchg rdx, rcx
push rdi
sub rsp, 0x20
xchg rbp, rcx
mov rdi, rbp
xchg rcx, rbp
lea rbx, [rdx + 0x70]
xchg rbx, r11
mov rdx, r11
xchg r11, rbx
call fcn.14007ada0
nop
xor eax, eax
mov byte [rbx + rax], 0x68
sub byte [rbx + rax], 0x14
add byte [rbx + rax], 0x13
sub byte [rbx + rax], 0x31
xor byte [rbx + rax], 0x2e
xor byte [rbx + rax], 0x39
add byte [rbx + rax], 0x5a
sub byte [rbx + rax], 0x7b
inc rax
cmp rax, 0xde
jb 0x14007d583
xchg rbp, rdi
mov rax, rbp
xchg rdi, rbp
xchg rbx, rbp
mov rbp, qword [rsp + 0x30]
xchg rbx, rbp
add rsp, 0x20
push rdx
push rax
push rcx
push rdx
push rbx
xchg qword [rsp + 0x28], rdi
add rsp, 0x30
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d5e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rsi, rcx
mov rdi, rsi
xchg rsi, rcx
lea rbx, [rdx + 0x76]
xchg rbx, rsi
mov rdx, rsi
xchg rsi, rbx
call fcn.14007ada0
nop
xor eax, eax
mov byte [rbx + rax], 0x13
xor byte [rbx + rax], 0x1f
xor byte [rbx + rax], 6
xor byte [rbx + rax], 0x4f
add byte [rbx + rax], 0xb
sub byte [rbx + rax], 0x1b
xor byte [rbx + rax], 0x2d
add byte [rbx + rax], 0x64
sub byte [rbx + rax], 0x7c
inc rax
cmp rax, 0xea
jb 0x14007d615
xchg rbx, rax
mov rbx, rdi
xchg rbx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
ret

Function at 0x14007d660
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 0x7c]
mov rdx, rbx
call fcn.14007ada0
nop
xor eax, eax
mov byte [rbx + rax], 0x2f
sub byte [rbx + rax], 0x1e
add byte [rbx + rax], 0x56
sub byte [rbx + rax], 0x3c
sub byte [rbx + rax], 0x21
add byte [rbx + rax], 0x69
sub byte [rbx + rax], 0x23
xor byte [rbx + rax], 0x46
sub byte [rbx + rax], 0x16
inc rax
cmp rax, 0xf4
jb 0x14007d687
xchg rdi, rcx
mov rax, rcx
xchg rdi, rcx
xchg rbx, r15
mov r15, qword [rsp + 0x30]
xchg rbx, r15
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007d770
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rdi, rcx
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 0xc]
xchg rbx, r9
mov rdx, r9
xchg r9, rbx
call fcn.14007ada0
nop
xor eax, eax
mov byte [rbx + rax], 0x6b
xor byte [rbx + rax], 0xb
sub byte [rbx + rax], 0xb
sub byte [rbx + rax], 0x54
xor byte [rbx + rax], 0x77
sub byte [rbx + rax], 0x5a
add byte [rbx + rax], 0x36
xor byte [rbx + rax], 0x52
inc rax
cmp rax, 0x14
jb 0x14007d7a6
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d7f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, r12
mov qword [rsp + 0x10], r12
xchg r12, rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0xe]
xchg rbx, rsi
mov rdx, rsi
xchg rsi, rbx
call fcn.14007ada0
nop
xor eax, eax
mov byte [rbx + rax], 0x72
xor byte [rbx + rax], 0x12
add byte [rbx + rax], 0xc
sub byte [rbx + rax], 0x5e
add byte [rbx + rax], 0x66
sub byte [rbx + rax], 0x6a
xor byte [rbx + rax], 0x42
xor byte [rbx + rax], 0x48
inc rax
cmp rax, 0x18
jb 0x14007d82c
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg r13, rbx
mov r13, qword [rsp + 0x30]
xchg r13, rbx
add rsp, 0x20
push rbx
push rdx
push rcx
push rbx
xchg qword [rsp + 0x20], rdi
add rsp, 0x28
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d890
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rsi
mov qword [rsp + 8], rsi
xchg rbx, rsi
xchg r12, rdx
mov qword [rsp + 0x10], r12
xchg r12, rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rcx, r11
mov rdi, r11
xchg r11, rcx
lea rbx, [rdx + 0xe]
xchg rdx, rbx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007ada0
nop
xor eax, eax
mov byte [rbx + rax], 0x2a
add byte [rbx + rax], 0x28
sub byte [rbx + rax], 0x2a
xor byte [rbx + rax], 0x7e
add byte [rbx + rax], 0x24
sub byte [rbx + rax], 0x52
sub byte [rbx + rax], 0x25
xor byte [rbx + rax], 3
inc rax
cmp rax, 0x1a
jb 0x14007d8d2
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x1400811f0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r12
mov qword [rsp + 0x10], r12
xchg r12, rbx
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x20
cmp byte [r8 + 0x19], 0
xchg rdx, rbx
mov rdx, r8
xchg rdx, rbx
xchg rsi, rcx
mov rcx, rdx
xchg rsi, rcx
mov rbp, rcx
jne 0x1400812be
mov qword [rsp + 0x30], rdi
nop dword [rax]
nop dword [rax + rax]
xchg r8, r13
mov r13, qword [rbx + 0x10]
xchg r8, r13
xchg rsi, rdx
mov rsi, rdx
xchg rsi, rdx
xchg r12, rbp
mov rcx, r12
xchg rbp, r12
call fcn.1400811f0
mov rdi, rbx
mov rbx, qword [rbx]
lea rcx, [rdi + 0x28]
call fcn.140091880
mov edx, 0x7c5d6968
xor edx, 0x4c2a7ad2
add edx, 0x4c2e05b3
sub edx, 0x76530ad9
add edx, 0x273caaba
sub edx, 0x252e5746
add edx, 0x6a129604
sub edx, 0x4dd10d25
xor edx, 0x24a1ea7f
xchg rdx, rcx
mov rdx, rdi
xchg rdx, rcx
call fcn.1401fd468
cmp byte [rbx + 0x19], 0
je 0x140081236
xchg rbp, rdi
mov rbp, qword [rsp + 0x30]
xchg rdi, rbp
xchg rcx, rbx
mov rcx, qword [rsp + 0x38]
xchg rbx, rcx
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
push rbx
push rdx
push rax
push rbx
push rcx
push rcx
push rax
xchg qword [rsp + 0x38], rsi
pop rax
pop rcx
pop rcx
pop rbx
pop rax
pop rdx
pop rbx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140083e80
Capabilities:
Encode data using xor

Disassembly:
mov r8d, edx
nop dword [rax]
nop word [rax + rax]
sub rcx, 2
mov eax, 0x568cc9d4
sub eax, 0x137f2f15
sub eax, 0xe6101f2
add eax, 0x268d50aa
xor eax, 0x5bb74496
xor eax, 0x4e5c2da8
sub eax, 0x2964073d
add eax, 0x255c931f
add eax, 0x8201c0a2
mul r8d
shr edx, 1
shr edx, 2
movzx eax, dx
shl ax, 1
shl ax, 1
lea r9d, [rax + rdx]
add r9w, r9w
sub r8w, r9w
neg r8w
add r8w, 0xffd0
neg r8w
mov word [rcx], r8w
mov r8d, edx
test edx, edx
jne 0x140083e90
mov rax, rcx
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x140084160
Capabilities:
Encode data using xor

Disassembly:
xchg r8, r12
mov rax, r12
xchg r12, r8
cmp rcx, rdx
je 0x1400842c4
xchg r8, rax
mov r9, r8
xchg r8, rax
lea r8, [rcx + 0x38]
sub r9, rcx
xor r10d, r10d
nop dword [rax]
xorps xmm0, xmm0
lea r8, [r8 + 0x48]
xchg r9, rax
movups xmmword [r9], xmm0
xchg r9, rax
mov qword [r9 + r8 - 0x70], r10
xchg rbp, r10
mov qword [r9 + r8 - 0x68], rbp
xchg rbp, r10
xchg r8, r11
movups xmm0, xmmword [r11 - 0x80]
xchg r11, r8
xchg r12, rax
movups xmmword [r12], xmm0
xchg r12, rax
xchg r10, r8
movups xmm1, xmmword [r10 - 0x70]
xchg r10, r8
xorps xmm0, xmm0
xchg rdx, rax
movups xmmword [rdx + 0x10], xmm1
xchg rdx, rax
xchg r9, r10
mov qword [r8 - 0x70], r9
xchg r10, r9
nop
sub rax, 0x42a1eefb
add rax, 0x42a1ef43
mov qword [r8 - 0x68], 0x76c2e965
sub qword [r8 - 0x68], 0x218205aa
sub qword [r8 - 0x68], 0x134550df
sub qword [r8 - 0x68], 0x311890ca
xor qword [r8 - 0x68], 0x60231853
sub qword [r8 - 0x68], 0x16bb5957
sub qword [r8 - 0x68], 0x5a04c0e3
mov word [r8 - 0x80], r10w
movups xmmword [r9 + r8 - 0x60], xmm0
mov qword [r9 + r8 - 0x50], r10
mov qword [r9 + r8 - 0x48], r10
xchg rbp, r8
movups xmm0, xmmword [rbp - 0x60]
xchg r8, rbp
xchg r12, r9
movups xmmword [r12 + r8 - 0x60], xmm0
xchg r9, r12
xchg rdx, r8
movups xmm1, xmmword [rdx - 0x50]
xchg rdx, r8
movups xmmword [r9 + r8 - 0x50], xmm1
mov qword [r8 - 0x50], r10
mov qword [r8 - 0x48], 0x6503fa56
sub qword [r8 - 0x48], 0x5625b6b0
add qword [r8 - 0x48], 0x72b5624
add qword [r8 - 0x48], 0x39fe321b
sub qword [r8 - 0x48], 0x2eeb2db5
add qword [r8 - 0x48], 0x2269cc6b
add qword [r8 - 0x48], 0x10405e0b
sub qword [r8 - 0x48], 0x4b125980
sub qword [r8 - 0x48], 0x8b46f1f
mov word [r8 - 0x60], r10w
mov ecx, dword [r8 - 0x40]
mov dword [r9 + r8 - 0x40], ecx
lea rcx, [r8 - 0x38]
cmp rcx, rdx
jne 0x14008418a
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1400843f0
Capabilities:
Encode data using xor

Disassembly:
xchg r8, rax
mov r8, rax
xchg r8, rax
cmp rcx, rdx
je 0x1400844bc
xchg r9, r12
mov r12, rax
xchg r12, r9
lea r8, [rcx + 0x18]
sub r9, rcx
xor r10d, r10d
nop word [rax + rax]
xorps xmm0, xmm0
lea r8, [r8 + 0x20]
xchg r15, rax
movups xmmword [r15], xmm0
xchg r15, rax
xchg rcx, r10
mov qword [r9 + r8 - 0x28], rcx
xchg r10, rcx
lea rcx, [r8 - 0x18]
mov qword [r8 + r9 - 0x20], r10
xchg r8, rbx
movups xmm0, xmmword [rbx - 0x38]
xchg r8, rbx
movups xmmword [rax], xmm0
xchg r8, r13
movups xmm1, xmmword [r13 - 0x28]
xchg r8, r13
xchg r9, rax
movups xmmword [r9 + 0x10], xmm1
xchg r9, rax
xchg rdi, r10
mov qword [r8 - 0x28], rdi
xchg r10, rdi
neg rax
add rax, 0xffffffffffffffe0
neg rax
mov qword [r8 - 0x20], 0x2f2ed8a6
xor qword [r8 - 0x20], 0x57f13491
sub qword [r8 - 0x20], 0x1d52713b
sub qword [r8 - 0x20], 0x1bfe4e9e
sub qword [r8 - 0x20], 0xa4c9bd
xor qword [r8 - 0x20], 0x35da5fc0
sub qword [r8 - 0x20], 0xb303d5a
mov word [r8 - 0x38], r10w
cmp rcx, rdx
jne 0x14008441e
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14008e830
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 0xa], 0x1a
add byte [rcx + rax + 0xa], 0xf
xor byte [rcx + rax + 0xa], 0x5e
sub byte [rcx + rax + 0xa], 0x69
xor byte [rcx + rax + 0xa], 0x61
xor byte [rcx + rax + 0xa], 0x51
sub byte [rcx + rax + 0xa], 0x3e
inc rax
cmp rax, 0x10
jb 0x14008e832
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14008e940
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 0x14], 0x56
add byte [rcx + rax + 0x14], 0x14
sub byte [rcx + rax + 0x14], 7
xor byte [rcx + rax + 0x14], 0x46
sub byte [rcx + rax + 0x14], 1
xor byte [rcx + rax + 0x14], 0x24
inc rax
cmp rax, 0x24
jb 0x14008e942
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1400f1650
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rbp
sub rsp, 8
push rsi
nop
push 0x54a3efef
mov qword [rsp], rdi
sub rsp, 0x80
mov rdi, r9
mov esi, r8d
xchg rbx, rdx
mov rdx, rbx
xchg rdx, rbx
xor ebp, ebp
lea rcx, [rsp + 0x50]
call fcn.140049e50
mov dword [rsp + 0x70], esi
mov qword [rsp + 0x78], rdi
lea ecx, [rbp + 0x30]
call fcn.1401fd42c
test rax, rax
je 0x1400f16e5
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rsp + 0x60]
xchg rbx, rax
movups xmmword [rbx + 0x10], xmm1
xchg rbx, rax
movdqa xmm0, xmmword [0x140002c70]
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], bp
mov dword [rax + 0x20], esi
xchg rdi, r10
mov qword [rax + 0x28], r10
xchg r10, rdi
jmp 0x1400f16ee
xchg rbp, rbx
mov rax, rbx
xchg rbx, rbp
xchg r15, rax
mov qword [rsp + 0xb8], r15
xchg r15, rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebp
xchg r13, rax
mov r9, r13
xchg r13, rax
lea r8, [0x140082060]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
xchg r14, rax
mov qword [rsp + 0x30], r14
xchg r14, rax
test rax, rax
je 0x1400f17ae
cmp dword [rsp + 0x38], 0
je 0x1400f17ed
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x1400f17a6
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x50]
call fcn.14002f8b0
nop
mov rcx, rbx
mov rbx, qword [rsp + 0xa0]
add rsp, 0x80
nop
mov rdi, qword [rsp]
add rsp, 8
push rax
push rbx
push rcx
xchg qword [rsp + 0x18], rsi
pop rcx
pop rbx
pop rax
add rsp, 8
nop
mov rbp, qword [rsp]
add rsp, 8
jmp fcn.14002f8b0
mov ecx, eax
call sub.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_
nop
mov dword [rsp + 0x38], ebp
mov ecx, 0x4e60c02c
xor ecx, 0xb9b4c6b
xor ecx, 0x4d747363
xor ecx, 0x48da46d8
add ecx, 0xb38928f
sub ecx, 0x2ac245e4
sub ecx, 0x19cd4c55
xor ecx, 0x3fb9111a
sub ecx, 0x3947ab42
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov ecx, 0x77355675
sub ecx, 0x3541ed33
add ecx, 0xeaab0f0
xor ecx, 0x2784bb59
xor ecx, 0x19f83cfc
xor ecx, 0x5e2f52e5
sub ecx, 0x30cdcf71
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x14015c930
Capabilities:
Encode data using xor

Disassembly:
test rdx, rdx
je 0x14015cb45
nop
push r13
mov qword [rsp], rdi
sub rsp, 0x20
xchg r14, rcx
mov r14, qword [rdx + 0x50]
xchg r14, rcx
xchg rdx, rdi
mov rdx, rdi
xchg rdx, rdi
xchg rbx, r13
mov qword [rsp + 0x30], r13
xchg rbx, r13
xor ebx, ebx
test rcx, rcx
je 0x14015c9bd
mov rdx, qword [rdx + 0x60]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x14015c9ac
mov r8, qword [rcx - 8]
nop
add rdx, 0x2066dedd
sub rdx, 0x2066deb6
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14015cb46
mov rcx, r8
call fcn.1401fd468
mov qword [rdi + 0x50], rbx
mov qword [rdi + 0x58], rbx
mov qword [rdi + 0x60], rbx
xchg rcx, r13
mov r13, qword [rdi + 0x40]
xchg rcx, r13
xchg rdi, rax
mov rdi, qword [rcx + 8]
xchg rdi, rax
mov qword [rax], rbx
mov rcx, qword [rcx]
test rcx, rcx
je 0x14015ca32
nop word [rax + rax]
xchg rbx, r8
mov r8, qword [rcx]
xchg r8, rbx
mov edx, 0x6db567b7
sub edx, 0x4500c873
sub edx, 0x26b6e52c
add edx, 0x700f6461
xor edx, 0x30d6621c
add edx, 0x33b82fa2
sub edx, 0x460f19dd
xor edx, 0x30849232
call fcn.1401fd468
mov rcx, rbx
test rbx, rbx
jne 0x14015c9e9
xchg r12, rcx
mov r12, qword [rdi + 0x40]
xchg r12, rcx
mov edx, 0x63f4d9a2
add edx, 0x106a1c1b
xor edx, 0x242f51ba
add edx, 0x23208da8
sub edx, 0x63850094
add edx, 0x465a4a14
xor edx, 0x27c92786
xor edx, 0x163a59fc
xor edx, 0x6794054d
call fcn.1401fd468
mov rbx, qword [rdi + 0x28]
test rbx, rbx
je 0x14015cb01
xchg r15, rsi
mov qword [rsp + 0x38], r15
xchg rsi, r15
mov esi, 0x431f4e39
sub esi, 0x27bd0118
xor esi, 0x64eb1dd1
sub esi, 0x4741d5c5
sub esi, 0x3533566a
add esi, 0x47e64df4
sub esi, 0x31314340
xor esi, 0xe636d08a
mov eax, esi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x14015cafc
mov rax, qword [rbx]
xchg r9, rbx
mov rcx, r9
xchg rbx, r9
call qword [rax]
lock xadd dword [rbx + 0xc], esi
cmp esi, 1
jne 0x14015cafc
xchg rdx, rax
mov rdx, qword [rbx]
xchg rdx, rax
xchg rcx, r15
mov r15, rbx
xchg r15, rcx
call qword [rax + 8]
mov rsi, qword [rsp + 0x38]
mov edx, 0x25651b67
add edx, 0x3463e6d3
sub edx, 0x44f82ec4
add edx, 0x29d23e9e
sub edx, 0x3355b9fc
sub edx, 0xb4d5670
xchg rcx, r14
mov r14, rdi
xchg r14, rcx
call fcn.1401fd468
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rcx
xchg qword [rsp + 8], rdi
add rsp, 0x10
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140174c40
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x50
cmp qword [rcx + 0x68], 0
xchg r9, rbx
mov r9, rcx
xchg r9, rbx
je 0x140174e07
cmp byte [rcx + 0x72], 0
je 0x140174e07
xchg r15, rax
mov r15, qword [rcx]
xchg r15, rax
xchg rdi, rbp
mov qword [rsp + 0x68], rbp
xchg rbp, rdi
mov edi, 0x49d2ef22
add edi, 0x2ec65077
sub edi, 0x72b2d716
add edi, 0x24d95229
add edi, 0x18d782a4
xor edi, 0x1cd963e2
sub edi, 0x189bd6f
sub edi, 0x4c19dccb
sub edi, 0x11a9c479
mov edx, edi
call qword [rax + 0x18]
cmp di, ax
je 0x140174dea
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x60]
lea rdx, [rbx + 0x74]
xchg r9, rax
mov qword [rsp + 0x20], r9
xchg r9, rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140174d4c
sub eax, 1
je 0x140174d64
cmp eax, 2
jne 0x140174dea
xchg rsi, rdi
mov rsi, qword [rsp + 0x68]
xchg rdi, rsi
mov al, 0x3a
sub al, 0x38
xor al, 0x57
sub al, 0x14
add al, 4
sub al, 0x2b
sub al, 0x19
mov byte [rbx + 0x72], 0x4f
add byte [rbx + 0x72], 0x26
sub byte [rbx + 0x72], 0x5a
add byte [rbx + 0x72], 0x48
xor byte [rbx + 0x72], 0x6b
xor byte [rbx + 0x72], 0x73
sub byte [rbx + 0x72], 0x5a
xor byte [rbx + 0x72], 8
xor byte [rbx + 0x72], 0x29
add rsp, 0x50
nop
xchg qword [rsp], rbx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
mov byte [rbx + 0x72], 0x23
add byte [rbx + 0x72], 0x31
sub byte [rbx + 0x72], 0x1b
sub byte [rbx + 0x72], 7
sub byte [rbx + 0x72], 0x22
sub byte [rbx + 0x72], 0x10
xchg r9, rdi
mov r9, qword [rsp + 0x60]
xchg r9, rdi
lea rax, [rsp + 0x30]
sub rdi, rax
je 0x140174dca
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x30]
mov r8, rdi
mov edx, 0x2148a8b2
add edx, 0x30d2f3
sub edx, 0x3a2ed40
xor edx, 0x48f5cf40
xor edx, 0x5a06f8f4
add edx, 0x2ba9bd37
xor edx, 0x5cd0ce40
xor edx, 0x661fb949
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140174dea
cmp byte [rbx + 0x72], 0
mov rdi, qword [rsp + 0x68]
sete al
add rsp, 0x50
push rcx
push rax
push rdx
xchg qword [rsp + 0x18], rbx
pop rdx
pop rax
pop rcx
add rsp, 8
ret
mov rdi, qword [rsp + 0x68]
xor al, al
add rsp, 0x50
nop
xchg qword [rsp], rbx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
mov al, 0x27
xor al, 0x44
sub al, 0x5e
add al, 0x47
add al, 0x31
xor al, 0x7c
add rsp, 0x50
nop
xchg qword [rsp], rbx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140198ee0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
xchg rcx, r11
mov qword [rsp + 8], r11
xchg rcx, r11
push rbx
nop
sub rsp, 8
mov qword [rsp], rbp
nop
sub rsp, 8
mov qword [rsp], rsi
nop
push 0x42d59845
mov qword [rsp], rdi
push r12
push r13
push r14
nop
sub rsp, 8
mov qword [rsp], r15
sub rsp, 0x58
xchg rbp, rbx
mov rbp, r9
xchg rbp, rbx
mov rsi, rdx
mov r9, rcx
xor ebp, ebp
test rdx, rdx
jne 0x140198f46
mov eax, ebp
jmp 0x140198f96
mov eax, 0x732053a5
sub eax, 0xac643c4
xor eax, 0x5e6afa3e
xor eax, 0x76d8e64e
sub eax, 0x3abe5eb1
add eax, 0x89bba2f
sub eax, 0xac9e6fc
sub eax, 0x3fb2dc6
cmp word [rdx], ax
je 0x140198f85
xchg r13, rbp
mov rax, r13
xchg rbp, r13
jmp 0x140198f96
movsxd rax, dword [rdx + 0x3c]
add rax, rsi
cmp dword [rax], 0x4550
cmovne rax, rbp
mov ecx, 0x14162a7
add ecx, 0x73ae410d
sub ecx, 0x2505f195
sub ecx, 0x1126d991
sub ecx, 0x3dbed683
add ecx, 0x6e948353
xor ecx, 0x56060c88
xor ecx, 0x399e8bdd
cmp word [rax + 0x18], cx
jne 0x1401990ec
mov r14d, dword [rax + 0x88]
add r14, rsi
je 0x1401990ec
mov r15d, dword [r14 + 0x1c]
add r15, rsi
mov r12d, dword [r14 + 0x24]
add r12, rsi
mov r13d, dword [r14 + 0x20]
add r13, rsi
mov edi, ebp
cmp dword [r14 + 0x18], 0
jbe 0x1401990bc
nop dword [rax]
nop dword [rax + rax]
mov eax, edi
mov ecx, dword [r13 + rax*4]
add rcx, rsi
movzx eax, word [r12 + rax*2]
mov edx, dword [r15 + rax*4]
add rdx, rsi
cmp rcx, 0xffff
jbe 0x1401990b0
xchg rdx, rbx
mov qword [rsp + 0xa8], rbx
xchg rdx, rbx
xchg rsi, rcx
mov qword [rsp + 0x30], rsi
xchg rcx, rsi
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x40], r9
xchg rdi, rcx
mov rdi, qword [rbx + 0x38]
xchg rdi, rcx
test rcx, rcx
je 0x14019916b
xchg r13, rax
mov r13, qword [rcx]
xchg r13, rax
lea rdx, [rsp + 0xa8]
xchg rdi, rdx
mov qword [rsp + 0x20], rdi
xchg rdi, rdx
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x40]
call qword [rax + 0x10]
test al, al
je 0x1401990bc
xchg r11, r8
mov r11, qword [rsp + 0xb0]
xchg r11, r8
mov r9, qword [rsp + 0xa0]
inc edi
cmp edi, dword [r14 + 0x18]
jb 0x14019900d
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x1401990d9
cmp rcx, rbx
mov rax, qword [rcx]
setne dl
call qword [rax + 0x20]
mov qword [rbx + 0x38], rbp
mov al, 0x1f
add al, 0xe
sub al, 0x1c
add al, 0x40
xor al, 0x26
sub al, 0x6a
sub al, 0xc
jmp 0x140199111
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x14019910f
mov rax, qword [rcx]
cmp rcx, rbx
setne dl
call qword [rax + 0x20]
xchg rbp, r9
mov qword [rbx + 0x38], r9
xchg rbp, r9
xor al, al
add rsp, 0x58
nop
mov r15, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov r14, qword [rsp - 8]
nop
add rsp, 8
xchg qword [rsp - 8], r13
nop
add rsp, 8
mov r12, qword [rsp - 8]
nop
xchg qword [rsp], rdi
add rsp, 8
nop
mov rsi, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov rbp, qword [rsp - 8]
nop
add rsp, 8
mov rbx, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]
call sub.MSVCP140.dll_void___cdecl_std::_Xbad_function_call_void_
nop
int3
Function at 0x1401ab6f0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r11, rdx
xchg rcx, r10
mov rcx, r10
xchg rcx, r10
test rdx, rdx
je 0x1401ab76e
mov qword [rsp], rbx
movzx ebx, byte [rsp + 0x30]
test r9, r9
je 0x1401ab75b
movzx eax, byte [r10]
test bl, bl
je 0x1401ab73d
lea rcx, [r9 - 1]
xchg rdx, r9
mov r9, rdx
xchg rdx, r9
add rcx, r8
nop
xor al, byte [rcx]
lea rcx, [rcx - 1]
mov byte [r10], al
sub rdx, 1
jne 0x1401ab72c
jmp 0x1401ab75b
xor ecx, ecx
nop dword [rax]
nop word [rax + rax]
xor al, byte [rcx + r8]
inc rcx
mov byte [r10], al
cmp rcx, r9
jb 0x1401ab74c
inc r10
sub r11, 1
jne 0x1401ab70e
xchg rbp, rbx
mov rbp, qword [rsp]
xchg rbp, rbx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1401b0730
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
xchg rsi, r12
mov qword [rsp + 0x20], r12
xchg rsi, r12
nop
push 0x17f362ad
mov qword [rsp], rdi
mov eax, 0x39a17b19
add eax, 0x3170da0e
sub eax, 0x2b5c889c
xor eax, 0x1fc32781
xor eax, 0x3a3a7bbf
xor eax, 0x41f38d55
sub eax, 0x2a92fd49
sub eax, 0x312c0ce7
call fcn.1401fd7e0
sub rsp, rax
mov ebx, edx
mov edi, ecx
call sub.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_
mov dword [rsp + 0x24], eax
mov r9d, 0x5b1889dc
xor r9d, 0x23788eeb
sub r9d, 0x6fb6950c
xor r9d, 0x3e66ea04
sub r9d, 0x1ca999db
add r9d, 0x5f142e5
xor r9d, 0x3b1de040
sub r9d, 0xd533e87
sub r9d, 0xdb762f1
mov dword [rsp + 0x13a4], 0x4f1f336c
xor dword [rsp + 0x13a4], 0x5f957aa
add dword [rsp + 0x13a4], 0x16d50146
sub dword [rsp + 0x13a4], 0x4ccac62d
xor dword [rsp + 0x13a4], 0x5db57e3b
add dword [rsp + 0x13a4], 0xabaa6eb
xor dword [rsp + 0x13a4], 0x14b14312
add dword [rsp + 0x13a4], 0xbf4e3422
nop dword [rax + rax]
mov r8d, eax
shr r8d, 0xd
shr r8d, 1
shr r8d, 0xf
shr r8d, 1
xor r8d, eax
imul eax, r8d, 0x6c078965
add eax, r9d
mov dword [rsp + r9*4 + 0x24], eax
inc r9
cmp r9, 0x270
jb 0x1401b0827
mov ebp, 0x7603edfe
sub ebp, 0x5e9fd7db
sub ebp, 0x6816ec6
add ebp, 0x3992352a
sub ebp, 0x3dfe41d
xor ebp, 0x3636b780
sub ebp, 0x56541536
xor ebp, 0x9a4e3ab4
mov dword [rsp + 0x20], 0x6706cce3
add dword [rsp + 0x20], 0x1001b7d7
xor dword [rsp + 0x20], 0x424763cd
xor dword [rsp + 0x20], 0x3ba70d0
xor dword [rsp + 0x20], 0x6d6c5869
add dword [rsp + 0x20], 0x277ccc1
add dword [rsp + 0x20], 0x134c8f7d
sub dword [rsp + 0x20], 0x62384032
sub dword [rsp + 0x20], 0xf25e96a
cmp edi, ebp
lea rax, [rsp + 0x20]
xchg rbp, rax
mov qword [rsp + 0x13d0], rbp
xchg rbp, rax
lea rcx, [rsp + 0x13d0]
lea eax, [rdi - 0x80000000]
lea esi, [rdi + rbp]
cmovae esi, eax
lea edi, [rbx + rbp]
cmp ebx, ebp
lea eax, [rbx - 0x80000000]
cmovae edi, eax
sub edi, esi
cmp edi, 0xffffffff
jne 0x1401b091d
call fcn.1401b0bc0
mov ecx, eax
jmp 0x1401b0980
inc edi
mov ebx, edi
call fcn.1401b0bc0
mov ecx, eax
imul rcx, rbx
cmp ecx, edi
jae 0x1401b096d
mov eax, edi
xor edx, edx
neg eax
div edi
mov edi, edx
cmp ecx, edx
jae 0x1401b096d
nop dword [rax]
nop dword [rax + rax]
lea rcx, [rsp + 0x13d0]
call fcn.1401b0bc0
mov ecx, eax
imul rcx, rbx
cmp ecx, edi
jb 0x1401b0952
shr rcx, 9
shr rcx, 9
shr rcx, 9
shr rcx, 4
shr rcx, 1
lea edx, [rsi + rcx]
lea r11, [rsp + 0x13b0]
cmp edx, ebp
mov rbx, qword [r11 + 0x10]
lea eax, [rdx + rbp]
xchg r10, rbp
mov r10, qword [r11 + 0x18]
xchg rbp, r10
lea ecx, [rdx - 0x80000000]
mov rsi, qword [r11 + 0x28]
cmovae eax, ecx
mov rsp, r11
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]