joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140144f90
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x238]
sub rsp, 0x310
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x1401cb1d8]
xor rax, rsp
mov qword [rbp + 0x1f0], rax
mov rdi, rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x70], rcx
mov dword [rsp + 0x38], 1
mov rax, qword gs:[0x30]
mov r14, qword [rax + 0x60]
mov qword [rsp + 0x68], r14
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
xor r15d, r15d
mov qword [rcx + 0x10], r15
mov qword [rcx + 0x18], 0xf
mov byte [rcx], r15b
mov dword [rsp + 0x38], 1
movdqa xmm0, xmmword [str.IPCAIPCAIPCAIPCAMCFGMCFGMCFGMCFGUEFIUEFIUEFIUEFI]
movdqu xmmword [rsp + 0x58], xmm0
mov eax, dword [rsp + 0x58]
mov dword [rbp + 8], eax
mov qword [rbp + 0xc], r15
lea r9, [rsp + 0x34]
lea r8d, [r15 + 0x14]
lea rdx, [rbp + 8]
lea ecx, [r15 + 0x4c]
push rax
call 0x140264468
mov ecx, eax
movdqa xmm6, xmmword [0x140178320]
movdqu xmmword [rsp + 0x58], xmm6
mov eax, dword [rsp + 0x58]
cmp ecx, eax
je 0x140145086
movdqa xmm0, xmmword [0x1401782e0]
movdqu xmmword [rsp + 0x58], xmm0
mov eax, dword [rsp + 0x58]
cmp ecx, eax
je 0x140145086
movdqa xmm0, xmmword [0x140178310]
movdqu xmmword [rsp + 0x58], xmm0
mov eax, dword [rsp + 0x58]
cmp ecx, eax
jne 0x1401450ee
mov r8d, dword [rsp + 0x34]
xor edx, edx
mov rcx, qword [r14 + 0x30]
call 0x14033675e
int3
mov rax, rdi
jmp 0x140145da6
mov rcx, qword [rbp + 0x1f0]
xor rcx, rsp
call fcn.1401361c0
lea r11, [rsp + 0x310]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x1401f16e0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x1401f170d
xor al, al
jmp 0x1401f186f
mov rax, qword [0x1402126c0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x1402126c8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x1402126d0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x1402126d8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x1402126e0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x1402126e8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x1402126f0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x1402126f8]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x140212700]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x1401f1861
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x1401f17b9
mov r11d, 2
jmp 0x1401f17dd
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x1401f17d3
mov r11d, 1
jmp 0x1401f17dd
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x1401f1885
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x1401f1822
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x1401f183a
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x1401f184a
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x1401f1858
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x1401f17a0
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x1401f186a
Function at 0x1400014b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0x72]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, [0x140010040]
mov r10, rax
sub rbx, rax
movabs rdi, 0x22a0122a0122a013
lea r9, [rax + 1]
nop dword [rax + rax]
movsxd r8, r11d
lea r9, [r9 + 2]
mov rax, rdi
mov rcx, r8
mul r8
mov rax, r8
add r11d, 2
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 3]
mov byte [r9 - 3], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 2]
mov byte [r9 - 2], al
cmp r11d, 0x7a
jb 0x140001500
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140001590
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, [0x140010040]
mov r10, rax
sub rbx, rax
movabs rdi, 0x22a0122a0122a013
lea r9, [rax + 1]
nop dword [rax + rax]
movsxd r8, r11d
mov rax, rdi
mul r8
mov rax, r8
mov rcx, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 1]
mov byte [r9 - 1], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [rbx + r9]
mov byte [r9], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 + 1]
mov byte [r9 + 1], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 + 2]
mov byte [r9 + 2], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 + 3]
mov byte [r9 + 3], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 6]
xor al, byte [rbx + r9 + 4]
mov byte [r9 + 4], al
mov rax, rdi
mul rcx
mov rax, rcx
lea r9, [r9 + 0xb]
sub rax, rdx
add r11d, 0xb
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 7]
xor al, byte [rbx + r9 - 6]
mov byte [r9 - 6], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 8]
xor al, byte [rbx + r9 - 5]
mov byte [r9 - 5], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 9]
xor al, byte [rbx + r9 - 4]
mov byte [r9 - 4], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xa]
xor al, byte [rbx + r9 - 3]
mov byte [r9 - 3], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 2]
mov byte [r9 - 2], al
cmp r11d, 0xb
jb 0x1400015e0
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400018c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx - 6]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, [0x140010210]
mov r10, rax
sub rbx, rax
movabs rdi, 0x22a0122a0122a013
lea r9, [rax + 1]
nop dword [rax + rax]
movsxd r8, r11d
lea r9, [r9 + 2]
mov rax, rdi
mov rcx, r8
mul r8
mov rax, r8
add r11d, 2
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 3]
mov byte [r9 - 3], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 2]
mov byte [r9 - 2], al
cmp r11d, 2
jb 0x140001910
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140002000
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 6]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, [0x1400105b0]
mov r10, rax
sub rbx, rax
movabs rdi, 0x22a0122a0122a013
lea r9, [rax + 2]
nop dword [rax + rax]
movsxd r8, r11d
mov rax, rdi
mul r8
mov rax, r8
mov rcx, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [r9 + rbx - 2]
movsx eax, al
mov word [r9 - 2], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [r9 + rbx]
movsx eax, al
mov word [r9], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [r9 + rbx + 2]
movsx eax, al
mov word [r9 + 2], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [r9 + rbx + 4]
movsx eax, al
mov word [r9 + 4], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [r9 + rbx + 6]
movsx eax, al
mov word [r9 + 6], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 6]
xor al, byte [r9 + rbx + 8]
lea r9, [r9 + 0xe]
movsx eax, al
add r11d, 7
mov word [r9 - 6], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [r9 + rbx - 4]
movsx eax, al
mov word [r9 - 4], ax
cmp r11d, 7
jb 0x140002050
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400021f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 8]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, [0x1400105b0]
mov r10, rax
sub rbx, rax
movabs rdi, 0x22a0122a0122a013
lea r9, [rax + 2]
nop dword [rax + rax]
movsxd r8, r11d
mov rax, rdi
mul r8
mov rax, r8
mov rcx, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 2]
movsx eax, al
mov word [r9 - 2], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [rbx + r9]
movsx eax, al
mov word [r9], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 + 2]
movsx eax, al
mov word [r9 + 2], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 + 4]
movsx eax, al
mov word [r9 + 4], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 + 6]
movsx eax, al
mov word [r9 + 6], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 6]
xor al, byte [rbx + r9 + 8]
lea r9, [r9 + 0x10]
movsx eax, al
add r11d, 8
mov word [r9 - 8], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 7]
xor al, byte [rbx + r9 - 6]
movsx eax, al
mov word [r9 - 6], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 4]
movsx eax, al
mov word [r9 - 4], ax
cmp r11d, 8
jb 0x140002240
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140002410
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, [0x1400105b0]
mov r10, rax
sub rbx, rax
movabs rdi, 0x22a0122a0122a013
lea r9, [rax + 2]
nop dword [rax + rax]
movsxd r8, r11d
lea r9, [r9 + 0xa]
mov rax, rdi
mov rcx, r8
mul r8
mov rax, r8
add r11d, 5
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 0xc]
movsx eax, al
mov word [r9 - 0xc], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [r9 + rbx - 0xa]
movsx eax, al
mov word [r9 - 0xa], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 - 8]
movsx eax, al
mov word [r9 - 8], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 - 6]
movsx eax, al
mov word [r9 - 6], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 4]
movsx eax, al
mov word [r9 - 4], ax
cmp r11d, 5
jb 0x140002460
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140002590
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0xa]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, [0x1400105b0]
mov r9, rax
sub rbx, rax
movabs rdi, 0x22a0122a0122a013
lea r10, [rax + 2]
nop dword [rax + rax]
movsxd r8, r11d
mov rax, rdi
mul r8
mov rax, r8
mov rcx, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r10 - 2]
movsx eax, al
mov word [r10 - 2], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [rbx + r10]
movsx eax, al
mov word [r10], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r10 + 2]
movsx eax, al
mov word [r10 + 2], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r10 + 4]
movsx eax, al
mov word [r10 + 4], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r10 + 6]
movsx eax, al
mov word [r10 + 6], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 6]
xor al, byte [rbx + r10 + 8]
lea r10, [r10 + 0x12]
movsx eax, al
add r11d, 9
mov word [r10 - 0xa], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 7]
xor al, byte [rbx + r10 - 8]
movsx eax, al
mov word [r10 - 8], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 8]
xor al, byte [rbx + r10 - 6]
movsx eax, al
mov word [r10 - 6], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r10 - 4]
movsx eax, al
mov word [r10 - 4], ax
cmp r11d, 9
jb 0x1400025e0
mov rbx, qword [rsp + 0x30]
mov rax, r9
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400027f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx - 4]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, [0x1400105b0]
mov r10, rax
sub rbx, rax
movabs rdi, 0x22a0122a0122a013
lea r9, [rax + 2]
nop dword [rax + rax]
movsxd r8, r11d
lea r9, [r9 + 4]
mov rax, rdi
mov rcx, r8
mul r8
mov rax, r8
add r11d, 2
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 6]
movsx eax, al
mov word [r9 - 6], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 4]
movsx eax, al
mov word [r9 - 4], ax
cmp r11d, 2
jb 0x140002840
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1400028d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx - 2]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, [0x1400105b0]
mov r10, rax
sub rbx, rax
movabs rdi, 0x22a0122a0122a013
lea r9, [rax + 2]
nop dword [rax + rax]
movsxd r8, r11d
lea r9, [r9 + 6]
mov rax, rdi
mov rcx, r8
mul r8
mov rax, r8
add r11d, 3
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 8]
movsx eax, al
mov word [r9 - 8], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [r9 + rbx - 6]
movsx eax, al
mov word [r9 - 6], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 4]
movsx eax, al
mov word [r9 - 4], ax
cmp r11d, 3
jb 0x140002920
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140004cc0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx - 2]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, str.Hl_toperaciones_tyomama_tproducts_tebiz_tbannerad_tuploadsuser_tanime_tphotoalbum_tpub_tstile_ttestsearch_tlinkman_tkristi_tclipper_tkgb_ttrebor_ttier_tdwg_tangerine_tcompanysearch_txtcommerce_tkindeditor_tavia_tconvergelocal_tfaith_trose_tski_tguestbook_tempresa_ttemplatefiles_tlanguage_tscriptlibrary_tmonica_tiecssfix_tscuba_tdns_thotcock_tcams_tuserads_toverlib_tinterim_twebstorecpanel_tphoenix_thotelclient_tcatinfo_tfonds_tcpm_tmn_tadimg_tintroductions_twireframe_tomniture_tskinacp_tResearch_tmce
mov r10, rax
sub rbx, rax
movabs rdi, 0x22a0122a0122a013
lea r9, [rax + 1]
nop dword [rax + rax]
movsxd r8, r11d
lea r9, [r9 + 6]
mov rax, rdi
mov rcx, r8
mul r8
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 7]
mov byte [r9 - 7], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [r9 + rbx - 6]
mov byte [r9 - 6], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 - 5]
mov byte [r9 - 5], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 - 4]
mov byte [r9 - 4], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 - 3]
mov byte [r9 - 3], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1c3
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 2]
mov byte [r9 - 2], al
add r11d, 6
cmp r11d, 6
jb 0x140004d10
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret