joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400070c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xa0
mov rax, qword [0x14011c028]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov r14, rdx
mov r15, rcx
mov qword [rbp - 0x11], rcx
mov qword [rbp - 9], rdx
xor edi, edi
cmp qword [rdx + 0x18], 0x10
jb 0x140007110
mov rsi, qword [rdx]
mov r12, rsi
add r12, qword [rdx + 0x10]
mov rbx, rsi
jmp 0x14000711d
mov r12, qword [rdx + 0x10]
add r12, r14
mov rbx, r14
mov rsi, r14
cmp rbx, r12
je 0x140007139
sub rsi, rbx
movzx ecx, byte [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov byte [rsi + rbx], al
inc rbx
cmp rbx, r12
jne 0x140007125
mov rdx, r15
lea rcx, [rbp - 1]
call fcn.1400265a0
nop
lea rsi, [rbp - 1]
mov r8, qword [rbp - 1]
cmp qword [rbp + 0x17], 0x10
cmovae rsi, r8
lea rcx, [rbp - 1]
cmovae rcx, r8
mov r12, qword [rbp + 0xf]
add r12, rcx
lea rbx, [rbp - 1]
cmp qword [rbp + 0x17], 0x10
cmovae rbx, r8
cmp rbx, r12
je 0x140007194
sub rsi, rbx
nop dword [rax + rax]
movzx ecx, byte [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov byte [rbx + rsi], al
inc rbx
cmp rbx, r12
jne 0x140007180
mov word [rbp - 0x39], gethostbyname
mov byte [rbp - 0x37], 0
lea rax, [rbp - 0x39]
mov rsi, 0xffffffffffffffff
mov rcx, rsi
nop dword [rax]
inc rcx
cmp byte [rax + rcx], 0
jne 0x1400071b0
mov rdx, qword [r14 + 0x10]
movabs r12, 0x7fffffffffffffff
mov rax, r12
sub rax, rdx
cmp rax, rcx
jb 0x140007304
mov rax, r14
cmp qword [r14 + 0x18], 0x10
jb 0x1400071e3
mov rax, qword [r14]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, [rbp - 0x39]
lea rcx, [rbp - 0x31]
call fcn.140029850
lea r9, [rbp - 0x31]
cmp qword [rbp - 0x19], 0x10
cmovae r9, qword [rbp - 0x31]
lea rcx, [rbp - 1]
cmp qword [rbp + 0x17], 0x10
cmovae rcx, qword [rbp - 1]
mov rax, qword [rbp - 0x21]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, qword [rbp + 0xf]
call fcn.140028a90
mov rbx, rax
test rax, rax
sete r13b
lea rcx, [rbp - 0x31]
call fcn.140027180
test rbx, rbx
jne 0x1400072b8
mov dword [rbp - 0x39], 0x1008adb
nop
lea eax, [rdi - 0x45]
xor byte [rbp + rdi - 0x39], al
inc rdi
cmp rdi, 2
jb 0x140007250
mov byte [rbp - 0x36], 0
lea rax, [rbp - 0x39]
nop dword [rax + rax]
inc rsi
cmp byte [rax + rsi], 0
jne 0x140007270
mov rcx, qword [r15 + 0x10]
sub r12, rcx
cmp r12, rsi
jb 0x1400072fe
mov rax, r15
cmp qword [r15 + 0x18], 0x10
jb 0x140007292
mov rax, qword [r15]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 0x39]
lea rcx, [rbp - 0x31]
call fcn.140029850
lea rcx, [rbp - 0x31]
call fcn.1400a1af0
nop
lea rcx, [rbp - 1]
call fcn.140027180
nop
mov rcx, r15
call fcn.140027180
nop
mov rcx, r14
call fcn.140027180
movzx eax, r13b
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.1400d1560
mov rbx, qword [rsp + 0xf0]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140003100
nop
call fcn.140003100
int3
Function at 0x140009ab0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x14], 0
je 0x140009ad3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x45]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x13
jb 0x140009ac0
mov byte [rcx + 0x14], 0
mov rax, rcx
ret

Function at 0x140009ae0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x33], 0
je 0x140009b03
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x45]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x32
jb 0x140009af0
mov byte [rcx + 0x33], 0
mov rax, rcx
ret

Function at 0x140009b10
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 8], 0
je 0x140009b33
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x45]
xor byte [rax + rcx], dl
inc rax
cmp rax, 7
jb 0x140009b20
mov byte [rcx + 8], 0
mov rax, rcx
ret

Function at 0x140009b40
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xf], 0
je 0x140009b63
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x45]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xe
jb 0x140009b50
mov byte [rcx + 0xf], 0
mov rax, rcx
ret

Function at 0x140009de0
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x60
mov rbx, qword [0x140126af0]
xor eax, eax
mov qword [rsp + 0x24], rax
mov qword [rsp + 0x2c], rax
mov qword [rsp + 0x40], rax
cmp qword [rbx + 0x10], 0
movss xmm3, dword [rbx + 0x1c0]
movss xmm2, dword [rbx + 0x1c4]
movaps xmm0, xmm3
mulss xmm0, dword [0x1400f8c58]
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x54], rax
movss dword [rsp + 0x38], xmm3
cvttss2si rax, xmm0
mov word [rsp + 0x21], 0
mov byte [rsp + 0x23], 0
mov byte [rsp + 0x20], 0xa
mov dword [rsp + 0x34], 0x1c14
movaps xmm0, xmm2
movss dword [rsp + 0x3c], xmm2
mulss xmm0, dword [0x1400f8c58]
mov dword [rsp + 0x4c], eax
cvttss2si rax, xmm0
mov dword [rsp + 0x50], eax
je 0x140009ed8
cmp qword [rbx + 8], 0
je 0x140009ed8
mov edx, 0x41
xor ecx, ecx
lea r8d, [rdx - 0x40]
call fcn.140050980
movups xmm0, xmmword [rsp + 0x20]
mov edx, dword [rsp + 0x58]
xor ecx, ecx
movups xmm1, xmmword [rsp + 0x30]
mov r8, qword [rax + 0x10]
mov dword [r8], 4
movups xmmword [r8 + 4], xmm0
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [r8 + 0x14], xmm1
movsd xmm1, qword [rsp + 0x50]
movups xmmword [r8 + 0x24], xmm0
movsd qword [r8 + 0x34], xmm1
mov dword [r8 + 0x3c], edx
mov rdx, rax
mov byte [r8 + 0x40], cl
xor r8d, r8d
mov rcx, rbx
add rsp, 0x60
pop rbx
jmp fcn.1400cff10
add rsp, 0x60
pop rbx
ret
Function at 0x140009ee0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x78
mov rax, qword [0x14011c028]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x50], ecx
mov byte [rsp + 0x54], dl
mov ecx, 8
call fcn.1400d1580
mov r9, rax
mov rax, qword [rsp + 0x50]
mov qword [r9], rax
mov qword [rsp + 0x50], r9
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
lea r8, [0x14002b340]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140009f91
cmp dword [rsp + 0x38], 0
jne 0x140009f54
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x50]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
je 0x140009f76
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400d1560
add rsp, 0x78
ret
mov dword [rsp + 0x38], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x14000b590
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x19], 0
je 0x14000b5b3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x45]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x18
jb 0x14000b5a0
mov byte [rcx + 0x19], 0
mov rax, rcx
ret

Function at 0x14000b5c0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x21], 0
je 0x14000b5e3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x45]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x20
jb 0x14000b5d0
mov byte [rcx + 0x21], 0
mov rax, rcx
ret

Function at 0x14000b5f0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x18], 0
je 0x14000b613
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x45]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x17
jb 0x14000b600
mov byte [rcx + 0x18], 0
mov rax, rcx
ret

Function at 0x14000b620
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xa], 0
je 0x14000b643
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x45]
xor byte [rax + rcx], dl
inc rax
cmp rax, 9
jb 0x14000b630
mov byte [rcx + 0xa], 0
mov rax, rcx
ret

Function at 0x14000b650
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xe], 0
je 0x14000b673
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x45]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xd
jb 0x14000b660
mov byte [rcx + 0xe], 0
mov rax, rcx
ret

Function at 0x14000cea0
Capabilities:
Create thread

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x78
mov rax, qword [0x14011c028]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov ecx, 8
call fcn.1400d1580
lea rcx, [rsp + 0x80]
mov qword [rax], rcx
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x14002b4b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14000cf50
cmp dword [rsp + 0x38], 0
jne 0x14000cf13
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x50]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
je 0x14000cf35
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400d1560
add rsp, 0x78
ret
mov dword [rsp + 0x38], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x14000d600
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x10], 0
je 0x14000d623
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x45]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xf
jb 0x14000d610
mov byte [rcx + 0x10], 0
mov rax, rcx
ret

Function at 0x14000d630
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 9], 0
je 0x14000d653
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x45]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x14000d640
mov byte [rcx + 9], 0
mov rax, rcx
ret
Function at 0x140023450
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x15], 0
je 0x140023473
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x45]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x14
jb 0x140023460
mov byte [rcx + 0x15], 0
mov rax, rcx
ret

Function at 0x140023480
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x17], 0
je 0x1400234a3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x45]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x16
jb 0x140023490
mov byte [rcx + 0x17], 0
mov rax, rcx
ret

Function at 0x1400234b0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 6], 0
je 0x1400234d3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x45]
xor byte [rax + rcx], dl
inc rax
cmp rax, 5
jb 0x1400234c0
mov byte [rcx + 6], 0
mov rax, rcx
ret

Function at 0x1400234e0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x23], 0
je 0x140023503
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x45]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x22
jb 0x1400234f0
mov byte [rcx + 0x23], 0
mov rax, rcx
ret

Function at 0x140023510
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1a], 0
je 0x140023533
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x45]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x19
jb 0x140023520
mov byte [rcx + 0x1a], 0
mov rax, rcx
ret

Function at 0x140023540
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1f], 0
je 0x140023563
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x45]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1e
jb 0x140023550
mov byte [rcx + 0x1f], 0
mov rax, rcx
ret

Function at 0x140023570
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x22], 0
je 0x140023593
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x45]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x21
jb 0x140023580
mov byte [rcx + 0x22], 0
mov rax, rcx
ret

Function at 0x1400235a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1b], 0
je 0x1400235c3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x45]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1a
jb 0x1400235b0
mov byte [rcx + 0x1b], 0
mov rax, rcx
ret

Function at 0x1400235d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x20], 0
je 0x1400235f3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x45]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1f
jb 0x1400235e0
mov byte [rcx + 0x20], 0
mov rax, rcx
ret

Function at 0x140023600
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xc], 0
je 0x140023623
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x45]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xb
jb 0x140023610
mov byte [rcx + 0xc], 0
mov rax, rcx
ret

Function at 0x140023630
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xd], 0
je 0x140023653
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x45]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xc
jb 0x140023640
mov byte [rcx + 0xd], 0
mov rax, rcx
ret
Function at 0x140023660
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x24], 0
je 0x140023683
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x45]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x23
jb 0x140023670
mov byte [rcx + 0x24], 0
mov rax, rcx
ret

Function at 0x140023690
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x26], 0
je 0x1400236b3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x45]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x25
jb 0x1400236a0
mov byte [rcx + 0x26], 0
mov rax, rcx
ret

Function at 0x1400236c0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x27], 0
je 0x1400236e3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x45]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x26
jb 0x1400236d0
mov byte [rcx + 0x27], 0
mov rax, rcx
ret

Function at 0x1400236f0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xb], 0
je 0x140023713
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x45]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xa
jb 0x140023700
mov byte [rcx + 0xb], 0
mov rax, rcx
ret

Function at 0x140023720
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2a], 0
je 0x140023743
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x45]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x29
jb 0x140023730
mov byte [rcx + 0x2a], 0
mov rax, rcx
ret

Function at 0x140023750
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2c], 0
je 0x140023773
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x45]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x2b
jb 0x140023760
mov byte [rcx + 0x2c], 0
mov rax, rcx
ret

Function at 0x140023780
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1c], 0
je 0x1400237a3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x45]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1b
jb 0x140023790
mov byte [rcx + 0x1c], 0
mov rax, rcx
ret

Function at 0x1400237b0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x13], 0
je 0x1400237d3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x45]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x12
jb 0x1400237c0
mov byte [rcx + 0x13], 0
mov rax, rcx
ret

Function at 0x1400237e0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x12], 0
je 0x140023803
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x45]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x11
jb 0x1400237f0
mov byte [rcx + 0x12], 0
mov rax, rcx
ret

Function at 0x140023810
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x25], 0
je 0x140023833
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x45]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x24
jb 0x140023820
mov byte [rcx + 0x25], 0
mov rax, rcx
ret

Function at 0x140023840
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x43], 0
je 0x140023863
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x45]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x42
jb 0x140023850
mov byte [rcx + 0x43], 0
mov rax, rcx
ret
Function at 0x140023870
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1e], 0
je 0x140023893
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x45]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1d
jb 0x140023880
mov byte [rcx + 0x1e], 0
mov rax, rcx
ret

Function at 0x1400238a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x29], 0
je 0x1400238c3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x45]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x28
jb 0x1400238b0
mov byte [rcx + 0x29], 0
mov rax, rcx
ret

Function at 0x1400238d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x3c], 0
je 0x1400238f3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x45]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x3b
jb 0x1400238e0
mov byte [rcx + 0x3c], 0
mov rax, rcx
ret

Function at 0x140023900
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x32], 0
je 0x140023923
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x45]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x31
jb 0x140023910
mov byte [rcx + 0x32], 0
mov rax, rcx
ret

Function at 0x140023930
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2d], 0
je 0x140023953
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x45]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x2c
jb 0x140023940
mov byte [rcx + 0x2d], 0
mov rax, rcx
ret

Function at 0x140023960
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x3f], 0
je 0x140023983
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x45]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x3e
jb 0x140023970
mov byte [rcx + 0x3f], 0
mov rax, rcx
ret

Function at 0x140023990
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x46], 0
je 0x1400239b3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x45]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x45
jb 0x1400239a0
mov byte [rcx + 0x46], 0
mov rax, rcx
ret

Function at 0x1400239c0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1d], 0
je 0x1400239e3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x45]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1c
jb 0x1400239d0
mov byte [rcx + 0x1d], 0
mov rax, rcx
ret
Function at 0x1400242f0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x14011c028]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rax, qword [rcx]
mov rbx, qword [rax]
mov rbx, qword [rbx + 8]
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
jne 0x1400243a6
mov edi, 0x18c0
mov esi, 0x25a8
nop
movzx eax, word [rbx + 0x20]
cmp eax, 0x12
je 0x140024359
cmp eax, 0x20
je 0x140024359
cmp ax, di
je 0x140024359
cmp ax, si
je 0x140024359
movzx ecx, byte [rbx + 0x22]
test cl, cl
je 0x140024359
mov edx, ecx
mov ecx, eax
call fcn.140004ac0
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x140024388
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x140024383
nop dword [rax]
cmp rbx, qword [rax + 0x10]
jne 0x140024383
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x140024370
mov rbx, rax
jmp 0x1400243a0
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1400243a0
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x140024394
cmp byte [rbx + 0x19], 0
je 0x140024330
mov ecx, 1
call fcn.1400d1580
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x14002b120]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140024438
cmp dword [rsp + 0x38], 0
jne 0x1400243f8
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
je 0x14002441b
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
nop
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400d1560
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov dword [rsp + 0x38], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x140024500
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x3f], 0
je 0x140024523
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x45]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x3e
jb 0x140024510
mov byte [rcx + 0x3f], 0
ret

Function at 0x140024530
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x25], 0
je 0x140024553
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x45]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x24
jb 0x140024540
mov byte [rcx + 0x25], 0
ret

Function at 0x140024560
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xd], 0
je 0x140024583
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x45]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xc
jb 0x140024570
mov byte [rcx + 0xd], 0
ret

Function at 0x1400245a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x15], 0
je 0x1400245c3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x45]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x14
jb 0x1400245b0
mov byte [rcx + 0x15], 0
ret
Function at 0x1400245d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x10], 0
je 0x1400245f3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x45]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xf
jb 0x1400245e0
mov byte [rcx + 0x10], 0
ret

Function at 0x140024c00
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x140024c28
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x140024c4e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140024c50
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140024ca9
test ecx, ecx
jle 0x140024c89
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140024ca9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140024ca9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret