joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140084140
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
xchg rdx, rbx
mov rdx, r8
xchg rbx, rdx
cmp rcx, rdx
je 0x140084219
xchg r11, rbx
mov rax, r11
xchg r11, rbx
lea r8, [rcx + 0x18]
sub rax, rcx
xor r10d, r10d
nop dword [rax + rax]
xorps xmm0, xmm0
lea r8, [r8 + 0x20]
xchg rbx, r14
movups xmmword [r14], xmm0
xchg rbx, r14
mov qword [rax + r8 - 0x28], r10
lea rcx, [r8 - 0x18]
mov qword [r8 + rax - 0x20], r10
movups xmm0, xmmword [r8 - 0x38]
xchg r15, rbx
movups xmmword [r15], xmm0
xchg r15, rbx
xchg r8, rsi
movups xmm1, xmmword [rsi - 0x28]
xchg rsi, r8
xchg r14, rbx
movups xmmword [r14 + 0x10], xmm1
xchg rbx, r14
xchg r10, rdx
mov qword [r8 - 0x28], rdx
xchg rdx, r10
nop
add rbx, 0x609b3fc
sub rbx, 0x609b3dc
mov qword [r8 - 0x20], 0x6a236791
sub qword [r8 - 0x20], 0x4be71162
xor qword [r8 - 0x20], 0x13c43d3b
xor qword [r8 - 0x20], 0x397b3998
sub qword [r8 - 0x20], 0xf2a773c
add qword [r8 - 0x20], 0x2e295bf8
add qword [r8 - 0x20], 0x529ee3d
sub qword [r8 - 0x20], 0x58ac2576
mov byte [r8 - 0x38], r10b
cmp rcx, rdx
jne 0x140084170
xchg r14, r9
mov r8, r14
xchg r9, r14
xchg r8, rbx
mov rdx, r8
xchg rbx, r8
xchg r8, rcx
mov r8, rbx
xchg r8, rcx
call fcn.14007f1c0
xchg rdx, rax
mov rdx, rbx
xchg rdx, rax
add rsp, 0x20
nop
mov rbx, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x140084260
Capabilities:
Encode data using xor

Disassembly:
xchg r8, rdi
mov rax, rdi
xchg r8, rdi
cmp rcx, rdx
je 0x14008432a
xchg rdi, rax
mov r9, rdi
xchg rdi, rax
lea r8, [rcx + 0x18]
sub r9, rcx
xor r10d, r10d
nop word [rax + rax]
xorps xmm0, xmm0
lea r8, [r8 + 0x20]
xchg rcx, rax
movups xmmword [rcx], xmm0
xchg rcx, rax
mov qword [r9 + r8 - 0x28], r10
lea rcx, [r8 - 0x18]
xchg r10, r11
mov qword [r8 + r9 - 0x20], r11
xchg r11, r10
xchg r15, r8
movups xmm0, xmmword [r15 - 0x38]
xchg r8, r15
xchg rcx, rax
movups xmmword [rcx], xmm0
xchg rcx, rax
xchg r8, rbp
movups xmm1, xmmword [rbp - 0x28]
xchg r8, rbp
xchg rbx, rax
movups xmmword [rbx + 0x10], xmm1
xchg rbx, rax
mov qword [r8 - 0x28], r10
sub rax, 0xffffffffffffffe0
mov qword [r8 - 0x20], 0x714ad770
xor qword [r8 - 0x20], 0x38120873
sub qword [r8 - 0x20], 0x1b825fe3
xor qword [r8 - 0x20], 0x4d5505d8
xor qword [r8 - 0x20], 0x79549a7e
xor qword [r8 - 0x20], 0x5984441c
xor qword [r8 - 0x20], 0x34cec5d6
sub qword [r8 - 0x20], 0x749d6145
mov word [r8 - 0x38], r10w
cmp rcx, rdx
jne 0x14008428e
ret
Function at 0x14008e720
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 0xa], 0x44
xor byte [rcx + rax + 0xa], 0x58
add byte [rcx + rax + 0xa], 0x14
sub byte [rcx + rax + 0xa], 4
add byte [rcx + rax + 0xa], 0x37
sub byte [rcx + rax + 0xa], 0x58
add byte [rcx + rax + 0xa], 0x45
xor byte [rcx + rax + 0xa], 0x20
xor byte [rcx + rax + 0xa], 0x70
inc rax
cmp rax, 0x10
jb 0x14008e722
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14008e830
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 0x14], 0x24
add byte [rcx + rax + 0x14], 0xe
xor byte [rcx + rax + 0x14], 0x17
xor byte [rcx + rax + 0x14], 1
add byte [rcx + rax + 0x14], 0x10
add byte [rcx + rax + 0x14], 0x14
xor byte [rcx + rax + 0x14], 0x5f
xor byte [rcx + rax + 0x14], 0x17
inc rax
cmp rax, 0x24
jb 0x14008e832
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1400f1290
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, r12
mov qword [rsp + 0x10], r12
xchg r12, rdx
push rbp
push rsi
push rdi
sub rsp, 0x80
mov rdi, r9
mov esi, r8d
xchg rbx, rdx
mov rdx, rbx
xchg rdx, rbx
xor ebp, ebp
lea rcx, [rsp + 0x50]
call fcn.1400499e0
mov dword [rsp + 0x70], esi
mov qword [rsp + 0x78], rdi
lea ecx, [rbp + 0x30]
call fcn.1401fc7c8
test rax, rax
je 0x1400f1319
movups xmm0, xmmword [rsp + 0x50]
xchg rbp, rax
movups xmmword [rbp], xmm0
xchg rbp, rax
movups xmm1, xmmword [rsp + 0x60]
xchg r10, rax
movups xmmword [r10 + 0x10], xmm1
xchg r10, rax
movdqa xmm0, xmmword [0x140002c70]
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], bp
mov dword [rax + 0x20], esi
mov qword [rax + 0x28], rdi
jmp 0x1400f131c
mov rax, rbp
mov qword [rsp + 0xb8], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebp
xchg r9, rax
mov rax, r9
xchg r9, rax
lea r8, [0x140081ec0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
xchg rdx, rax
mov qword [rsp + 0x30], rdx
xchg rdx, rax
test rax, rax
je 0x1400f13dc
cmp dword [rsp + 0x38], 0
je 0x1400f140f
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x1400f13d4
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x50]
call fcn.14002f8d0
nop
xchg r10, rbx
mov rcx, r10
xchg r10, rbx
mov rbx, qword [rsp + 0xa0]
add rsp, 0x80
nop
add rsp, 8
xchg qword [rsp - 8], rdi
push rbx
xchg qword [rsp + 8], rsi
pop rbx
add rsp, 8
nop
add rsp, 8
xchg qword [rsp - 8], rbp
jmp fcn.14002f8d0
mov ecx, eax
call sub.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_
nop
mov dword [rsp + 0x38], ebp
mov ecx, 0x2fe49ab4
add ecx, 0x1569945
add ecx, 0x4e799c82
xor ecx, 0x114a0770
xor ecx, 0x6f8a3d1f
add ecx, 0x346a0a92
xor ecx, 0x35def4a0
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov ecx, 0x6142ecd3
sub ecx, 0x4683408c
xor ecx, 0x270d1ced
xor ecx, 0x5ce82dad
xor ecx, 0x3ba93a10
sub ecx, 0x40aec3b0
add ecx, 0x61dcfe8c
xor ecx, 0x7c21e1f2
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x14015bfa0
Capabilities:
Encode data using xor

Disassembly:
test rdx, rdx
je 0x14015c1aa
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
mov rcx, qword [rdx + 0x50]
xchg r13, rdx
mov rdi, r13
xchg rdx, r13
xchg r8, rbx
mov qword [rsp + 0x30], r8
xchg r8, rbx
xor ebx, ebx
test rcx, rcx
je 0x14015c03b
mov rdx, qword [rdx + 0x60]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x14015c024
xchg r8, rdx
mov rdx, qword [rcx - 8]
xchg r8, rdx
nop
add rdx, 0x789c86df
sub rdx, 0x789c86b8
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14015c1ab
xchg rcx, r8
mov r8, rcx
xchg r8, rcx
call fcn.1401fc804
xchg rbx, rdx
mov qword [rdi + 0x50], rdx
xchg rbx, rdx
mov qword [rdi + 0x58], rbx
mov qword [rdi + 0x60], rbx
mov rcx, qword [rdi + 0x40]
mov rax, qword [rcx + 8]
xchg rbx, rcx
mov qword [rax], rcx
xchg rcx, rbx
mov rcx, qword [rcx]
test rcx, rcx
je 0x14015c0a0
nop word [rax + rax]
mov rbx, qword [rcx]
mov edx, 0x52e78e8d
xor edx, 0x6431ddaf
xor edx, 0x55af8287
sub edx, 0x60a4f101
add edx, 0x6140488b
xor edx, 0x6d4e0d1b
xor edx, 0x95b242c
call fcn.1401fc804
mov rcx, rbx
test rbx, rbx
jne 0x14015c063
mov rcx, qword [rdi + 0x40]
mov edx, 0x64db057
add edx, 0x8c4ba9b
add edx, 0x67a1c2a7
sub edx, 0x2a072893
sub edx, 0x4bb1dec0
sub edx, 0xfb262e
call fcn.1401fc804
mov rbx, qword [rdi + 0x28]
test rbx, rbx
je 0x14015c155
xchg rsi, r13
mov qword [rsp + 0x38], r13
xchg rsi, r13
mov esi, 0x30f849c0
add esi, 0x14e1d01d
add esi, 0x30b7f064
xor esi, 0x5fad5858
sub esi, 0x1b51ec1f
add esi, 0x2c408563
add esi, 0xc5d214a2
mov eax, esi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x14015c14a
xchg r10, rax
mov r10, qword [rbx]
xchg r10, rax
xchg rcx, rdx
mov rdx, rbx
xchg rcx, rdx
call qword [rax]
lock xadd dword [rbx + 0xc], esi
cmp esi, 1
jne 0x14015c14a
xchg r9, rax
mov r9, qword [rbx]
xchg r9, rax
mov rcx, rbx
call qword [rax + 8]
xchg rsi, r15
mov r15, qword [rsp + 0x38]
xchg rsi, r15
mov edx, 0x9e92bb2
add edx, 0x5325328b
xor edx, 0x1f0404cc
xor edx, 0x34741850
sub edx, 0x3676fdbb
add edx, 0x1f27d813
sub edx, 0xa79dfcb
sub edx, 0x54b53b86
xchg rcx, rdi
mov rdi, rcx
xchg rcx, rdi
call fcn.1401fc804
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rdx
push rcx
push rcx
push rcx
push rcx
push rbx
xchg qword [rsp + 0x30], rdi
add rsp, 0x38
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140173fa0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x50
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14017415a
cmp byte [rcx + 0x72], 0
je 0x14017415a
xchg rdx, rax
mov rdx, qword [rcx]
xchg rdx, rax
mov qword [rsp + 0x68], rdi
mov edi, 0x636ebd28
xor edi, 0x468b28a1
sub edi, 0x1874ae4c
xor edi, 0x72024aa8
sub edi, 0x746c4f0b
add edi, 0x6d866c56
xor edi, 0x788c351f
mov edx, edi
call qword [rax + 0x18]
cmp di, ax
je 0x14017413e
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x60]
lea rdx, [rbx + 0x74]
xchg r13, rax
mov qword [rsp + 0x20], r13
xchg r13, rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14017409e
sub eax, 1
je 0x1401740b6
cmp eax, 2
jne 0x14017413e
xchg rdi, r9
mov r9, qword [rsp + 0x68]
xchg rdi, r9
mov al, 0x30
xor al, 0x3d
add al, 0x6d
xor al, 0x65
add al, 0xd
sub al, 0x17
add al, 0x1a
sub al, 0x2e
mov byte [rbx + 0x72], 0x26
xor byte [rbx + 0x72], 0x5b
sub byte [rbx + 0x72], 0x65
add byte [rbx + 0x72], 8
add byte [rbx + 0x72], 5
xor byte [rbx + 0x72], 0x24
add byte [rbx + 0x72], 0x12
xor byte [rbx + 0x72], 0x31
sub byte [rbx + 0x72], 0x22
add rsp, 0x50
push rax
push rcx
push rdx
push rdx
push rdx
push rax
push rcx
push rdx
xchg qword [rsp + 0x40], rbx
add rsp, 0x48
nop
add rsp, 8
jmp qword [rsp - 8]
mov byte [rbx + 0x72], 0xe
add byte [rbx + 0x72], 9
add byte [rbx + 0x72], 0x56
xor byte [rbx + 0x72], 0x64
xor byte [rbx + 0x72], 0x4f
xor byte [rbx + 0x72], 0x46
mov rdi, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
sub rdi, rax
je 0x140174116
xchg r15, r9
mov r15, qword [rbx + 0x80]
xchg r9, r15
lea rcx, [rsp + 0x30]
xchg r8, rbx
mov rbx, rdi
xchg rbx, r8
mov edx, 0x634ca115
xor edx, 0x5ac5fde
xor edx, 0x751b65eb
xor edx, 0x39e58109
xor edx, 0x235282ac
sub edx, 0x94c9884
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14017413e
cmp byte [rbx + 0x72], 0
xchg r13, rdi
mov r13, qword [rsp + 0x68]
xchg rdi, r13
sete al
add rsp, 0x50
nop
xchg qword [rsp], rbx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
xchg rdi, r10
mov r10, qword [rsp + 0x68]
xchg rdi, r10
xor al, al
add rsp, 0x50
nop
add rsp, 8
xchg qword [rsp - 8], rbx
ret
mov al, 0xf
xor al, 0x33
xor al, 0x4e
sub al, 0x34
add al, 0x32
sub al, 0x33
add al, 0x40
xor al, 0x5d
sub al, 0x1f
add rsp, 0x50
nop
add rsp, 8
xchg qword [rsp - 8], rbx
ret
Function at 0x140178d90
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x60
mov r8d, edx
lea r9, [rsp + 0x52]
xchg rbx, rcx
mov rcx, rbx
xchg rbx, rcx
xor r10d, r10d
nop dword [rax]
nop dword [rax + rax]
add r9, 0xfffffffffffffffe
mov eax, 0x5d45e9b9
sub eax, 0x34137930
xor eax, 0x5ca58824
sub eax, 0x4cc1de8f
xor eax, 0x3421dd38
xor eax, 0x7ad15a56
sub eax, 0x2890780a
xor eax, 0x2abcf6bc
add eax, 0xb5a1f8f3
mul r8d
shr edx, 2
shr edx, 1
movzx eax, dx
shl ax, 2
lea ecx, [rax + rdx]
add cx, cx
sub r8w, cx
add r8w, 0x30
mov word [r9], r8w
mov r8d, edx
test edx, edx
jne 0x140178db6
xorps xmm0, xmm0
lea rax, [rsp + 0x52]
xchg r12, rbx
movups xmmword [r12], xmm0
xchg rbx, r12
xchg r12, r10
mov qword [rbx + 0x10], r12
xchg r12, r10
mov qword [rbx + 0x18], r10
cmp r9, rax
jne 0x140178ea9
xchg rbp, r10
mov qword [rbx + 0x10], rbp
xchg rbp, r10
xchg rbp, rax
mov rbp, rbx
xchg rbp, rax
mov qword [rbx + 0x18], 0x76c87864
xor qword [rbx + 0x18], 0x3552652e
xor qword [rbx + 0x18], 0x10f28628
xor qword [rbx + 0x18], 0x243d7ac
sub qword [rbx + 0x18], 0x499a6c6a
xor qword [rbx + 0x18], 0x7c92780a
sub qword [rbx + 0x18], 0x50b75fff
xor qword [rbx + 0x18], 0xcf4da71
sub qword [rbx + 0x18], 0x26bfe217
mov word [rbx], r10w
add rsp, 0x60
nop
mov rbx, qword [rsp]
add rsp, 8
ret
lea r8, [rsp + 0x52]
xchg r9, rdx
mov r9, rdx
xchg rdx, r9
sub r8, r9
mov rcx, rbx
sar r8, 1
call fcn.14007ed10
xchg rdi, rbx
mov rax, rdi
xchg rbx, rdi
add rsp, 0x60
nop
xchg qword [rsp], rbx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140193d00
Capabilities:
Encode data using xor

Disassembly:
push r11
mov qword [rsp], rbx
sub rsp, 0x40
xchg rdx, r9
mov r10, r9
xchg r9, rdx
mov r11, rcx
mov dword [rsp + 0x30], 0x1c648b1
add dword [rsp + 0x30], 0x1e78f5e0
add dword [rsp + 0x30], 0x5acb666e
sub dword [rsp + 0x30], 0x27591cbb
sub dword [rsp + 0x30], 0x4f186795
xor dword [rsp + 0x30], 0xf26fd659
mov dword [rsp + 0x36], 0x66a34de7
sub dword [rsp + 0x36], 0x66246d40
add dword [rsp + 0x36], 0x5ff2731a
sub dword [rsp + 0x36], 0x515d6280
xor dword [rsp + 0x36], 0xdba886d
add dword [rsp + 0x36], 0x1c8cd9f2
xor dword [rsp + 0x36], 0xe06fac44
mov dword [rsp + 0x3a], 0x6a224f1e
add dword [rsp + 0x3a], 0x1302c45c
sub dword [rsp + 0x3a], 0x4db15a9c
add dword [rsp + 0x3a], 0x10feb902
add dword [rsp + 0x3a], 0xa2e3f2
sub dword [rsp + 0x3a], 0x3ef7618e
xor dword [rsp + 0x3a], 0x36564e20
add dword [rsp + 0x3a], 0xcb1344f9
xor eax, eax
mov word [rsp + 0x3e], ax
xor ebx, ebx
mov edx, ebx
nop
movzx eax, word [rsp + rdx*2 + 0x36]
movzx ecx, byte [rsp + rdx + 0x30]
add cx, ax
mov word [rsp + rdx*2 + 0x36], cx
mov byte [rsp + rdx + 0x30], bl
inc rdx
cmp rdx, 4
jb 0x140193dca
mov rax, qword [rsp + 0x70]
xchg r11, rax
mov qword [rsp + 0x28], r11
xchg r11, rax
mov qword [rsp + 0x20], r9
xchg r8, r9
mov r8, r9
xchg r8, r9
lea r8, [rsp + 0x36]
mov rdx, r10
xchg rcx, r9
mov r9, r11
xchg r9, rcx
call fcn.140193e70
nop
mov byte [rsp + rbx + 0x36], 0x73
sub byte [rsp + rbx + 0x36], 0x6e
xor byte [rsp + rbx + 0x36], 0x28
xor byte [rsp + rbx + 0x36], 0x75
sub byte [rsp + rbx + 0x36], 0x33
sub byte [rsp + rbx + 0x36], 0xc
sub byte [rsp + rbx + 0x36], 0x19
inc rbx
cmp rbx, 8
jb 0x140193e20
add rsp, 0x40
nop
xchg qword [rsp], rbx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1401981b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
xchg r14, r8
mov qword [rsp + 0x18], r14
xchg r8, r14
xchg r8, rcx
mov qword [rsp + 8], r8
xchg rcx, r8
nop
sub rsp, 8
mov qword [rsp], rbx
push rbp
push rsi
push rdi
push r12
nop
sub rsp, 8
mov qword [rsp], r13
push r14
push r15
sub rsp, 0x58
xchg r9, rbx
mov r9, rbx
xchg r9, rbx
xchg rdx, r10
mov rsi, r10
xchg r10, rdx
xchg r9, rcx
mov rcx, r9
xchg r9, rcx
xor ebp, ebp
test rdx, rdx
jne 0x140198217
mov eax, ebp
jmp 0x14019826a
mov eax, 0x3127fa24
xor eax, 0x3141c186
xor eax, 0x5a2b0037
xor eax, 0x6b59b8a0
add eax, 0x256d8b3d
add eax, 0x7b8899
add eax, 0x1ae053f1
sub eax, 0x65f6d89f
xor eax, 0xbe74810
cmp word [rdx], ax
je 0x140198259
xchg r8, rax
mov r8, rbp
xchg r8, rax
jmp 0x14019826a
movsxd rax, dword [rdx + 0x3c]
add rax, rsi
cmp dword [rax], 0x4550
cmovne rax, rbp
mov ecx, 0x13df60cb
add ecx, 0x14e53725
sub ecx, 0x12b6c804
add ecx, 0x53c4ea2d
xor ecx, 0x15cc8162
xor ecx, 0x4e600463
add ecx, 0x3613d46d
sub ecx, 0x6892117a
cmp word [rax + 0x18], cx
jne 0x1401983c2
mov r14d, dword [rax + 0x88]
add r14, rsi
je 0x1401983c2
mov r15d, dword [r14 + 0x1c]
add r15, rsi
mov r12d, dword [r14 + 0x24]
add r12, rsi
mov r13d, dword [r14 + 0x20]
add r13, rsi
mov edi, ebp
cmp dword [r14 + 0x18], 0
jbe 0x14019838a
nop dword [rax]
nop dword [rax + rax]
mov eax, edi
mov ecx, dword [r13 + rax*4]
add rcx, rsi
movzx eax, word [r12 + rax*2]
mov edx, dword [r15 + rax*4]
add rdx, rsi
cmp rcx, 0xffff
jbe 0x14019837e
mov qword [rsp + 0xa8], rdx
mov qword [rsp + 0x30], rcx
xchg r13, r8
mov qword [rsp + 0x38], r13
xchg r8, r13
xchg rsi, r9
mov qword [rsp + 0x40], rsi
xchg rsi, r9
xchg r10, rcx
mov r10, qword [rbx + 0x38]
xchg rcx, r10
test rcx, rcx
je 0x140198440
xchg r14, rax
mov r14, qword [rcx]
xchg r14, rax
lea rdx, [rsp + 0xa8]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x40]
call qword [rax + 0x10]
test al, al
je 0x14019838a
xchg r8, rdi
mov rdi, qword [rsp + 0xb0]
xchg r8, rdi
mov r9, qword [rsp + 0xa0]
inc edi
cmp edi, dword [r14 + 0x18]
jb 0x1401982e1
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x1401983ab
cmp rcx, rbx
xchg r12, rax
mov r12, qword [rcx]
xchg r12, rax
setne dl
call qword [rax + 0x20]
mov qword [rbx + 0x38], rbp
mov al, 0x21
xor al, 0x76
sub al, 0x52
xor al, 0x71
sub al, 0xd
xor al, 0x6f
xor al, 0x65
sub al, 0x5a
sub al, 0x12
jmp 0x1401983e1
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x1401983df
mov rax, qword [rcx]
cmp rcx, rbx
setne dl
call qword [rax + 0x20]
mov qword [rbx + 0x38], rbp
xor al, al
add rsp, 0x58
push rdx
push rax
push rax
push rbx
push rcx
push rcx
push rbx
xchg qword [rsp + 0x38], r15
add rsp, 0x40
nop
add rsp, 8
mov r14, qword [rsp - 8]
nop
add rsp, 8
mov r13, qword [rsp - 8]
nop
add rsp, 8
xchg qword [rsp - 8], r12
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
mov rsi, qword [rsp - 8]
nop
xchg qword [rsp], rbp
add rsp, 8
push rdx
push rax
push rdx
xchg qword [rsp + 0x18], rbx
pop rdx
pop rax
pop rdx
add rsp, 8
ret
call sub.MSVCP140.dll_void___cdecl_std::_Xbad_function_call_void_
nop
int3
Function at 0x140198ca0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rdi
nop
sub rsp, 8
mov qword [rsp], r13
sub rsp, 0x30
xor ebx, ebx
mov r13d, r8d
xchg rcx, rdx
mov rdi, rcx
xchg rdx, rcx
test rdx, rdx
jne 0x140198cce
mov eax, ebx
jmp 0x140198d17
mov eax, 0x31446fc9
sub eax, 0xa93f0c8
add eax, 0x104fb84
add eax, 0x4380c969
xor eax, 0x54cffa0e
add eax, 0x35dd82ae
xor eax, 0x75d766c3
cmp word [rdx], ax
je 0x140198d06
xchg rbx, rax
mov rbx, rax
xchg rbx, rax
jmp 0x140198d17
movsxd rax, dword [rdx + 0x3c]
add rax, rdi
cmp dword [rax], 0x4550
cmovne rax, rbx
mov qword [rsp + 0x50], rbp
mov ecx, 0x7a42f5b8
xor ecx, 0xd0e71cd
sub ecx, 0x6e733c13
add ecx, 0x6f92242f
xor ecx, 0xd893732
sub ecx, 0x63626dac
xor ecx, 0x6c7a6552
sub ecx, 0x7e05869a
xchg rsi, r14
mov qword [rsp + 0x58], r14
xchg r14, rsi
xchg r12, rsi
mov qword [rsp + 0x60], rsi
xchg r12, rsi
xchg r14, r13
mov qword [rsp + 0x28], r13
xchg r14, r13
xchg r15, r9
mov qword [rsp + 0x20], r9
xchg r15, r9
cmp word [rax + 0x18], cx
jne 0x140198deb
mov esi, dword [rax + 0x88]
add rsi, rdi
je 0x140198deb
mov r14d, dword [rsi + 0x1c]
mov r15d, dword [rsi + 0x24]
add r14, rdi
mov r12d, dword [rsi + 0x20]
add r15, rdi
add r12, rdi
cmp dword [rsi + 0x18], 0
jbe 0x140198deb
nop dword [rax]
nop dword [rax + rax]
mov eax, ebx
xor edx, edx
mov ecx, dword [r12 + rax*4]
movzx eax, word [r15 + rax*2]
add rcx, rdi
mov ebp, dword [r14 + rax*4]
add rbp, rdi
call fcn.140076340
cmp eax, r13d
je 0x140198e5b
inc ebx
cmp ebx, dword [rsi + 0x18]
jb 0x140198dbb
xor eax, eax
xchg r12, r15
mov r12, qword [rsp + 0x20]
xchg r12, r15
xchg r8, r14
mov r8, qword [rsp + 0x28]
xchg r14, r8
mov r12, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
xchg r12, rbp
mov r12, qword [rsp + 0x50]
xchg rbp, r12
add rsp, 0x30
push rcx
push rdx
push rdx
push rcx
push rcx
xchg qword [rsp + 0x28], r13
pop rcx
pop rcx
pop rdx
pop rdx
pop rcx
add rsp, 8
push rdx
push rbx
push rax
push rax
push rcx
push rcx
push rbx
push rax
xchg qword [rsp + 0x40], rdi
pop rax
pop rbx
pop rcx
pop rcx
pop rax
pop rax
pop rbx
pop rdx
add rsp, 8
nop
add rsp, 8
xchg qword [rsp - 8], rbx
nop
add rsp, 8
jmp qword [rsp - 8]
xchg rbp, rax
mov rbp, rax
xchg rbp, rax
jmp 0x140198ded
Function at 0x1401aaa30
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r11, rdx
xchg r10, rcx
mov rcx, r10
xchg r10, rcx
test rdx, rdx
je 0x1401aaaae
xchg rbx, rcx
mov qword [rsp], rcx
xchg rcx, rbx
movzx ebx, byte [rsp + 0x30]
test r9, r9
je 0x1401aaa9b
movzx eax, byte [r10]
test bl, bl
je 0x1401aaa7d
lea rcx, [r9 - 1]
mov rdx, r9
add rcx, r8
nop
xor al, byte [rcx]
lea rcx, [rcx - 1]
mov byte [r10], al
sub rdx, 1
jne 0x1401aaa6c
jmp 0x1401aaa9b
xor ecx, ecx
nop dword [rax]
nop word [rax + rax]
xor al, byte [rcx + r8]
inc rcx
mov byte [r10], al
cmp rcx, r9
jb 0x1401aaa8c
inc r10
sub r11, 1
jne 0x1401aaa54
xchg rbx, r14
mov r14, qword [rsp]
xchg r14, rbx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1401af9f0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
xchg rbp, rdx
mov qword [rsp + 0x10], rdx
xchg rdx, rbp
xchg r10, rsi
mov qword [rsp + 0x20], r10
xchg rsi, r10
push rdi
mov eax, 0x3e2f37b7
add eax, 0x287e51e
xor eax, 0x2880f826
sub eax, 0x2febc902
sub eax, 0xb9d29b2
add eax, 0x520aca8a
xor eax, 0x1b5eca2f
add eax, 0xb47360c
xor eax, 0x712ebf42
call fcn.1401fcb70
sub rsp, rax
mov ebx, edx
mov edi, ecx
call sub.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_
mov dword [rsp + 0x24], eax
mov r9d, 0x19708ab0
add r9d, 0x492c1eb2
xor r9d, 0x21d7a297
add r9d, 0xc505a9a
sub r9d, 0x1db44bbc
add r9d, 0x11c52025
add r9d, 0xe368876
xor r9d, 0x51e2c36f
mov dword [rsp + 0x13a4], 0x6293c3ba
sub dword [rsp + 0x13a4], 0x3b2716f3
add dword [rsp + 0x13a4], 0x478e2530
xor dword [rsp + 0x13a4], 0x1124b778
sub dword [rsp + 0x13a4], 0x2f00a2e4
xor dword [rsp + 0x13a4], 0x43989115
add dword [rsp + 0x13a4], 0xecbaad41
nop dword [rax + rax]
mov r8d, eax
shr r8d, 0x12
shr r8d, 7
shr r8d, 3
shr r8d, 1
shr r8d, 1
xor r8d, eax
imul eax, r8d, 0x6c078965
add eax, r9d
mov dword [rsp + r9*4 + 0x24], eax
inc r9
cmp r9, 0x270
jb 0x1401afad7
mov ebp, 0x229ccc88
add ebp, 0x23d45c8
sub ebp, 0xd288c07
sub ebp, 0xf0d1ff8
add ebp, 0x45dc6acf
xor ebp, 0x301636fc
xor ebp, 0xfe96e7dc
mov dword [rsp + 0x20], 0x45de8361
sub dword [rsp + 0x20], 0x1f67dc45
sub dword [rsp + 0x20], 0x10d99e8a
add dword [rsp + 0x20], 0x2432a235
add dword [rsp + 0x20], 0x136251f2
sub dword [rsp + 0x20], 0x4d31fa49
cmp edi, ebp
lea rax, [rsp + 0x20]
mov qword [rsp + 0x13d0], rax
lea rcx, [rsp + 0x13d0]
lea eax, [rdi - 0x80000000]
lea esi, [rdi + rbp]
cmovae esi, eax
lea edi, [rbx + rbp]
cmp ebx, ebp
lea eax, [rbx - 0x80000000]
cmovae edi, eax
sub edi, esi
cmp edi, 0xffffffff
jne 0x1401afbaf
call fcn.1401afe70
mov ecx, eax
jmp 0x1401afc15
inc edi
mov ebx, edi
call fcn.1401afe70
mov ecx, eax
imul rcx, rbx
cmp ecx, edi
jae 0x1401afbff
mov eax, edi
xor edx, edx
neg eax
div edi
mov edi, edx
cmp ecx, edx
jae 0x1401afbff
nop dword [rax]
nop dword [rax + rax]
lea rcx, [rsp + 0x13d0]
call fcn.1401afe70
mov ecx, eax
imul rcx, rbx
cmp ecx, edi
jb 0x1401afbe4
shr rcx, 0xd
shr rcx, 8
shr rcx, 5
shr rcx, 4
shr rcx, 1
shr rcx, 1
lea edx, [rsi + rcx]
lea r11, [rsp + 0x13b0]
cmp edx, ebp
xchg rcx, rbx
mov rcx, qword [r11 + 0x10]
xchg rcx, rbx
lea eax, [rdx + rbp]
mov rbp, qword [r11 + 0x18]
lea ecx, [rdx - 0x80000000]
mov rsi, qword [r11 + 0x28]
cmovae eax, ecx
mov rsp, r11
push rcx
push rdx
push rcx
push rax
push rcx
xchg qword [rsp + 0x28], rdi
add rsp, 0x30
nop
add rsp, 8
jmp qword [rsp - 8]