joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400f40f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov r14, qword [r9]
mov rsi, r9
mov eax, r14d
mov r15, r8
mov dword [rsp + 0x68], eax
mov rbp, rdx
cmp rax, r14
je 0x1400f4127
mov ebx, 0x80070057
jmp 0x1400f4170
mov rbx, qword [rsp + 0x70]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov r9, r15
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jle 0x1400f4156
movzx edi, ax
or edi, 0x80070000
test edi, edi
js 0x1400f41aa
test rbx, rbx
je 0x1400f418b
mov eax, dword [rsp + 0x68]
cmp rax, qword [rsi]
jbe 0x1400f418b
mov ebx, 0x800700ea
mov qword [rsi], rax
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
mov eax, dword [rsp + 0x68]
mov r9, rsi
mov qword [rsi], rax
mov rdx, r14
mov r8d, dword [r15]
mov rcx, rbp
mov qword [rsp + 0x20], rbx
call fcn.1400f4714
jmp 0x1400f4172
mov ebx, 0x80070002
cmp edi, ebx
jne 0x1400f41e6
mov rcx, qword [0x140162280]
lea rax, [0x140162280]
cmp rcx, rax
je 0x1400f4170
test byte [rcx + 0x1c], 4
je 0x1400f4170
mov rcx, qword [rcx + 0x10]
lea r8, [0x140140bb0]
mov edx, 0x16
mov r9, rbp
call fcn.140044708
jmp 0x1400f4170
mov ebx, 0x800700ea
cmp edi, ebx
je 0x1400f422b
mov rcx, qword [0x140162280]
lea rax, [0x140162280]
cmp rcx, rax
je 0x1400f4224
test byte [rcx + 0x1c], 1
je 0x1400f4224
mov rcx, qword [rcx + 0x10]
lea r8, [0x140140bb0]
mov edx, 0x17
mov dword [rsp + 0x20], edi
mov r9, rbp
call fcn.140044764
mov ebx, edi
jmp 0x1400f4170
mov eax, dword [rsp + 0x68]
cmp qword [rsi], rax
jb 0x1400f416d
mov ebx, 0x8000ffff
jmp 0x1400f4170

Function at 0x1400f47ec
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rax, qword [rsp + 0x60]
mov r9d, 4
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdi, rdx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
je 0x1400f4867
mov rcx, qword [0x140162280]
lea rax, [0x140162280]
cmp rcx, rax
je 0x1400f4852
test byte [rcx + 0x1c], 1
je 0x1400f4852
mov rcx, qword [rcx + 0x10]
lea r8, [0x140140bb0]
mov edx, 0x1a
mov dword [rsp + 0x20], ebx
mov r9, rdi
call fcn.140044764
test ebx, ebx
jle 0x1400f4861
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
jns 0x1400f4867
mov eax, ebx
jmp 0x1400f4869
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1400f5270
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
mov rsi, rcx
mov eax, dword [0x14016baf4]
xor r14d, r14d
test eax, eax
je 0x1400f52a5
lea ebx, [r14 + 1]
cmp eax, ebx
setne al
mov byte [rcx], al
jmp 0x1400f5421
mov qword [rbp + 0x28], r14
lea rdx, str.IsWow64Process2
lea rcx, [rbp + 0x28]
call fcn.1400f58a8
cmp eax, 0x8007007f
jne 0x1400f52c5
mov rdi, r14
jmp 0x1400f52d1
test eax, eax
js 0x1400f5423
mov rdi, qword [rbp + 0x28]
mov ebx, 1
test rdi, rdi
je 0x1400f5350
mov word [rbp + 0x28], r14w
mov word [rbp + 0x30], r14w
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp + 0x30]
lea rdx, [rbp + 0x28]
mov rax, rdi
call fcn.1400fece0
test eax, eax
jne 0x1400f533e
call fcn.1400f259c
mov edi, eax
lea rdx, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rdx
je 0x1400f5337
test byte [rcx + 0x1c], bl
je 0x1400f5337
lea edx, [rbx + 0x1b]
mov r9d, edi
lea r8, [0x140140c20]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov eax, edi
jmp 0x1400f5423
movzx eax, word [rbp + 0x28]
neg ax
sbb ecx, ecx
neg ecx
add ecx, ebx
jmp 0x1400f5407
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [rbp - 0x30], 0xc
je 0x1400f5418
mov qword [rbp + 0x30], r14
lea rdx, str.IsWow64Process
lea rcx, [rbp + 0x30]
call fcn.1400f58a8
cmp eax, 0x8007007f
jne 0x1400f5394
mov rdi, r14
jmp 0x1400f53a0
test eax, eax
js 0x1400f5423
mov rdi, qword [rbp + 0x30]
test rdi, rdi
je 0x1400f5418
mov dword [rbp + 0x28], r14d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rbp + 0x28]
mov rax, rdi
call fcn.1400fece0
test eax, eax
jne 0x1400f53f3
call fcn.1400f259c
mov edi, eax
lea rdx, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rdx
je 0x1400f5337
test byte [rcx + 0x1c], bl
je 0x1400f5337
mov edx, 0x1d
jmp 0x1400f5324
cmp dword [rbp + 0x28], r14d
je 0x1400f5405
mov dword [0x14016baf4], 2
jmp 0x1400f5414
mov ecx, ebx
mov dword [0x14016baf4], ecx
cmp ecx, ebx
jne 0x1400f5414
mov bl, r14b
mov byte [rsi], bl
jmp 0x1400f5421
mov dword [0x14016baf4], ebx
mov byte [rsi], r14b
xor eax, eax
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400f5a38
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, edx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, edi
mov rcx, rbp
mov ebx, eax
call fcn.1400f1e80
test al, al
je 0x1400f5a9f
lea esi, [rdi + 0x3a98]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp esi, edi
jb 0x1400f5a89
mov ecx, eax
sub ecx, ebx
cmp esi, ecx
ja 0x1400f5ab6
sub ebx, eax
cmp ebx, 0x3e8
jb 0x1400f5ab6
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, edi
mov rcx, rbp
mov ebx, eax
call fcn.1400f1e80
test al, al
jne 0x1400f5a6d
xor al, al
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov al, 1
jmp 0x1400f5aa1
Function at 0x1400f73a8
Capabilities:
Get token membership

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
sub rsp, 0x20
and dword [rsp + 0x38], 0
mov rdx, r8
mov rbx, rcx
mov byte [rcx], 0
lea r8, [rsp + 0x38]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x1400f740d
call fcn.1400f259c
mov ebx, eax
mov rcx, qword [0x140162280]
lea rax, [0x140162280]
cmp rcx, rax
je 0x1400f7409
test byte [rcx + 0x1c], 1
je 0x1400f7409
mov rcx, qword [rcx + 0x10]
lea r8, [0x140140f10]
mov edx, 0x1a
mov r9d, ebx
call fcn.140044450
mov eax, ebx
jmp 0x1400f7419
cmp dword [rsp + 0x38], 0
setne al
mov byte [rbx], al
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x1400fb000
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
and qword [rsp + 0x40], 0
mov rbx, rcx
mov ecx, dword [rcx]
mov rsi, rdx
mov r14d, 0x40
lea rdi, [rbx + 0x60]
mov byte [rcx + rbx + 0x20], 0x80
inc ecx
cmp ecx, 0x38
jbe 0x1400fb05d
mov edx, r14d
sub edx, ecx
add rcx, 0x20
add rcx, rbx
call fcn.14003f1a0
lea r9, [rsp + 0x40]
mov r8d, r14d
lea rdx, [rbx + 0x20]
mov rcx, rdi
call fcn.1400f9b44
xor ecx, ecx
mov edx, r14d
sub edx, ecx
add rcx, 0x20
add rcx, rbx
call fcn.14003f1a0
mov rax, qword [rbx + 0x10]
lea r9, [rsp + 0x40]
shl rax, 3
lea rdx, [rbx + 0x20]
bswap rax
mov r8, r14
mov qword [rbx + 0x58], rax
mov rcx, rdi
call fcn.1400f9b44
mov rcx, rdi
mov r8d, 4
mov rax, qword [rcx]
lea rcx, [rcx + 8]
rol rax, 0x20
bswap rax
mov qword [rsi], rax
lea rsi, [rsi + 8]
sub r8, 1
jne 0x1400fb09a
mov edx, 0x80
mov rcx, rbx
call fcn.14003f1a0
movups xmm0, xmmword [0x140141300]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [0x140141310]
movups xmmword [rdi + 0x10], xmm1
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x14000b770
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14000b77d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14000b78d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14000b775
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x14000b7a5
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14000b792
sub eax, 3
jb 0x14000b7bf
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14000b7f6
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x14000b7e6
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14000b7e4
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14000b7d3
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.14000b732
jmp 0x14000b77d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x2600
mov dl, 1
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14000b842
cmp rsi, rcx
jae 0x14000b84a
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14000b829
cmp al, 0x8f
ja 0x14000b829
cmp byte [rsi - 2], 0xf
je 0x14000b82f
sub al, 0xe8
cmp al, 1
ja 0x14000b813
cmp rsi, rcx
jae 0x14000b84a
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14000b819
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14000b84a
lodsb al, byte [rsi]
jmp 0x14000b829
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x9000]
mov eax, dword [rdi]
or eax, eax
je 0x14000b8a7
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xb1e4]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14000b857
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14000b8a1
mov qword [rbx], rax
add rbx, 8
jmp 0x14000b877
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14000b8e1
cmp al, 0xef
ja 0x14000b8d3
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14000b8b3
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x14000b8c2
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x21f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14000b935
sub rsp, 0xffffffffffffff80
jmp 0x140002a90
Function at 0x1409e2b3c
Capabilities:
Check http status code

Disassembly:
inc ecx
jmp 0x1409366dd
bswap ecx
jmp 0x140a1fba3
push r12
jmp 0x140a00e5b
push rcx
bswap cx
movsx r8, r15w
pushfq
sar cl, cl
test r10w, 0x7f99
push rsi
sal r11d, 0x35
movsx rcx, r13w
push r13
bsf r11d, r14d
shl r11w, cl
push r15
push r9
bt bx, si
cmp r11b, sil
push rax
rcl r8, cl
sub sil, 0xb7
push r10
push rbp
movabs rbp, 0
test r9b, 0xc8
push rbp
xchg r10b, bl
bswap r8w
shr r10, 0x13
mov rsi, qword [rsp + 0x90]
adc r11, r12
shld cx, cx, 0xde
neg esi
cmp r8b, r14b
shr r10w, 0x1a
not esi
inc ebx
xor esi, 0x3e043826
cmovae r10w, di
bswap esi
sub esi, 0x288304d2
movzx ecx, di
btc bx, r9w
xor bh, 0xb7
lea rsi, [rsi + rbp]
movsxd rcx, r14d
movabs rcx, 0x100000000
stc
ror r8b, 0xff
lea rsi, [rsi + rcx]
mov r8, rsp
sub rsp, 0x180
shr r11b, cl
and rsp, 0xfffffffffffffff0
bswap r10
rol r10w, 0xc9
bt r10w, r8w
mov rbx, rsi
xor cx, 0x2f3f
test r15b, r15b
add cl, r15b
movabs r10, 0
test dil, spl
xchg ch, ch
sub rbx, r10
btr r11w, cx
bts ecx, esp
movsxd rcx, esp
lea r11, [0x1409f5e51]
stc
sub rsi, 4
cmovno rcx, r8
mov ecx, dword [rsi]
cmc
cmp r10b, r12b
xor ecx, ebx
not ecx
neg ecx
jmp 0x14091eabf
push r11
bswap r11d
movzx r11d, r14w
mov r11b, bl
push rdx
push rbx
movsx bx, sil
mov bl, bl
movsx r11, r9w
push r8
push r14
push rdi
mov r8b, r9b
mov bh, 0x52
jmp 0x1409f5d5b
push rbx
btc ebx, r11d
xor dword [rsp], ecx
or bh, 0x91
cmc
movsxd rbx, r13d
pop rbx
movsxd rcx, ecx
test sp, r10w
test si, 0x547
add r11, rcx
jmp r11
Function at 0x140001180
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 6]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, [0x14000f040]
mov r10, rax
sub rbx, rax
movabs rdi, 0x8355ace3c897db1
lea r9, [rax + 1]
nop dword [rax + rax]
movsxd r8, r11d
mov rax, rdi
mul r8
mov rcx, r8
shr rdx, 4
imul rax, rdx, 0x1f3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 1]
mov byte [r9 - 1], al
mov rax, rdi
mul rcx
shr rdx, 4
imul rax, rdx, 0x1f3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [rbx + r9]
mov byte [r9], al
mov rax, rdi
mul rcx
shr rdx, 4
imul rax, rdx, 0x1f3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 + 1]
mov byte [r9 + 1], al
mov rax, rdi
mul rcx
shr rdx, 4
imul rax, rdx, 0x1f3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 + 2]
mov byte [r9 + 2], al
mov rax, rdi
mul rcx
shr rdx, 4
imul rax, rdx, 0x1f3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 + 3]
mov byte [r9 + 3], al
mov rax, rdi
mul rcx
shr rdx, 4
imul rax, rdx, 0x1f3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 6]
xor al, byte [rbx + r9 + 4]
mov byte [r9 + 4], al
mov rax, rdi
mul rcx
shr rdx, 4
imul rax, rdx, 0x1f3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 7]
xor al, byte [rbx + r9 + 5]
mov byte [r9 + 5], al
mov rax, rdi
mul rcx
shr rdx, 4
imul rax, rdx, 0x1f3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 8]
xor al, byte [rbx + r9 + 6]
mov byte [r9 + 6], al
mov rax, rdi
mul rcx
shr rdx, 4
imul rax, rdx, 0x1f3
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 + 7]
mov byte [r9 + 7], al
lea rcx, [r8 + 9]
mov rax, rdi
lea r9, [r9 + 0xe]
mul rcx
add r11d, 0xe
shr rdx, 4
imul rax, rdx, 0x1f3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xa]
xor al, byte [rbx + r9 - 6]
mov byte [r9 - 6], al
mov rax, rdi
mul rcx
shr rdx, 4
imul rax, rdx, 0x1f3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xb]
xor al, byte [rbx + r9 - 5]
mov byte [r9 - 5], al
mov rax, rdi
mul rcx
shr rdx, 4
imul rax, rdx, 0x1f3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xc]
xor al, byte [rbx + r9 - 4]
mov byte [r9 - 4], al
mov rax, rdi
mul rcx
shr rdx, 4
imul rax, rdx, 0x1f3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xd]
xor al, byte [rbx + r9 - 3]
mov byte [r9 - 3], al
mov rax, rdi
mul rcx
shr rdx, 4
imul rax, rdx, 0x1f3
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 2]
mov byte [r9 - 2], al
cmp r11d, 0xe
jb 0x1400011d0
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140001400
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0x72]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r10d, r10d
lea rsi, [0x14000f040]
mov r11, rax
sub rbx, rax
movabs rdi, 0x8355ace3c897db1
lea r9, [rax + 1]
nop dword [rax + rax]
movsxd r8, r10d
lea r9, [r9 + 2]
mov rax, rdi
mov rcx, r8
mul r8
add r10d, 2
shr rdx, 4
imul rax, rdx, 0x1f3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 3]
mov byte [r9 - 3], al
mov rax, rdi
mul rcx
shr rdx, 4
imul rax, rdx, 0x1f3
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 2]
mov byte [r9 - 2], al
cmp r10d, 0x7a
jb 0x140001450
mov rbx, qword [rsp + 0x30]
mov rax, r11
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400014c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, [0x14000f040]
mov r10, rax
sub rbx, rax
movabs rdi, 0x8355ace3c897db1
lea r9, [rax + 1]
nop dword [rax + rax]
movsxd r8, r11d
mov rax, rdi
mul r8
mov rcx, r8
shr rdx, 4
imul rax, rdx, 0x1f3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 1]
mov byte [r9 - 1], al
mov rax, rdi
mul rcx
shr rdx, 4
imul rax, rdx, 0x1f3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [rbx + r9]
mov byte [r9], al
mov rax, rdi
mul rcx
shr rdx, 4
imul rax, rdx, 0x1f3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 + 1]
mov byte [r9 + 1], al
mov rax, rdi
mul rcx
shr rdx, 4
imul rax, rdx, 0x1f3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 + 2]
mov byte [r9 + 2], al
mov rax, rdi
mul rcx
shr rdx, 4
imul rax, rdx, 0x1f3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 + 3]
mov byte [r9 + 3], al
mov rax, rdi
mul rcx
shr rdx, 4
imul rax, rdx, 0x1f3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 6]
xor al, byte [rbx + r9 + 4]
mov byte [r9 + 4], al
mov rax, rdi
mul rcx
shr rdx, 4
imul rax, rdx, 0x1f3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 7]
xor al, byte [rbx + r9 + 5]
mov byte [r9 + 5], al
mov rax, rdi
mul rcx
shr rdx, 4
imul rax, rdx, 0x1f3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 8]
xor al, byte [rbx + r9 + 6]
mov byte [r9 + 6], al
mov rax, rdi
mul rcx
shr rdx, 4
imul rax, rdx, 0x1f3
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 + 7]
mov byte [r9 + 7], al
lea rcx, [r8 + 9]
mov rax, rdi
lea r9, [r9 + 0xb]
mul rcx
add r11d, 0xb
shr rdx, 4
imul rax, rdx, 0x1f3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xa]
xor al, byte [rbx + r9 - 3]
mov byte [r9 - 3], al
mov rax, rdi
mul rcx
shr rdx, 4
imul rax, rdx, 0x1f3
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 2]
mov byte [r9 - 2], al
cmp r11d, 0xb
jb 0x140001510
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140001770
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx - 6]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r10d, r10d
lea rsi, [0x14000f240]
mov r11, rax
sub rbx, rax
movabs rdi, 0x8355ace3c897db1
lea r9, [rax + 1]
nop dword [rax + rax]
movsxd r8, r10d
lea r9, [r9 + 2]
mov rax, rdi
mov rcx, r8
mul r8
add r10d, 2
shr rdx, 4
imul rax, rdx, 0x1f3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 3]
mov byte [r9 - 3], al
mov rax, rdi
mul rcx
shr rdx, 4
imul rax, rdx, 0x1f3
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 2]
mov byte [r9 - 2], al
cmp r10d, 2
jb 0x1400017c0
mov rbx, qword [rsp + 0x30]
mov rax, r11
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140001830
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0x39]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, [0x14000f240]
mov r10, rax
sub rbx, rax
movabs rdi, 0x8355ace3c897db1
lea r9, [rax + 1]
nop dword [rax + rax]
movsxd r8, r11d
mov rax, rdi
mul r8
mov rcx, r8
shr rdx, 4
imul rax, rdx, 0x1f3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 1]
mov byte [r9 - 1], al
mov rax, rdi
mul rcx
shr rdx, 4
imul rax, rdx, 0x1f3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [rbx + r9]
mov byte [r9], al
mov rax, rdi
mul rcx
shr rdx, 4
imul rax, rdx, 0x1f3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 + 1]
mov byte [r9 + 1], al
mov rax, rdi
mul rcx
shr rdx, 4
imul rax, rdx, 0x1f3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 + 2]
mov byte [r9 + 2], al
mov rax, rdi
mul rcx
shr rdx, 4
imul rax, rdx, 0x1f3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 + 3]
mov byte [r9 + 3], al
mov rax, rdi
mul rcx
shr rdx, 4
imul rax, rdx, 0x1f3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 6]
xor al, byte [rbx + r9 + 4]
mov byte [r9 + 4], al
mov rax, rdi
mul rcx
shr rdx, 4
imul rax, rdx, 0x1f3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 7]
xor al, byte [rbx + r9 + 5]
mov byte [r9 + 5], al
mov rax, rdi
mul rcx
shr rdx, 4
imul rax, rdx, 0x1f3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 8]
xor al, byte [rbx + r9 + 6]
mov byte [r9 + 6], al
mov rax, rdi
mul rcx
shr rdx, 4
imul rax, rdx, 0x1f3
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 + 7]
mov byte [r9 + 7], al
lea rcx, [r8 + 9]
mov rax, rdi
lea r9, [r9 + 0xd]
mul rcx
add r11d, 0xd
shr rdx, 4
imul rax, rdx, 0x1f3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xa]
xor al, byte [rbx + r9 - 5]
mov byte [r9 - 5], al
mov rax, rdi
mul rcx
shr rdx, 4
imul rax, rdx, 0x1f3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xb]
xor al, byte [rbx + r9 - 4]
mov byte [r9 - 4], al
mov rax, rdi
mul rcx
shr rdx, 4
imul rax, rdx, 0x1f3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xc]
xor al, byte [rbx + r9 - 3]
mov byte [r9 - 3], al
mov rax, rdi
mul rcx
shr rdx, 4
imul rax, rdx, 0x1f3
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 2]
mov byte [r9 - 2], al
cmp r11d, 0x41
jb 0x140001880
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140001df0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 6]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, [0x14000f640]
mov r10, rax
sub rbx, rax
movabs rdi, 0x8355ace3c897db1
lea r9, [rax + 2]
nop dword [rax + rax]
movsxd r8, r11d
lea r9, [r9 + 0xe]
mov rax, rdi
mov rcx, r8
mul r8
add r11d, 7
shr rdx, 4
imul rax, rdx, 0x1f3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [r9 + rbx - 0x10]
movsx eax, al
mov word [r9 - 0x10], ax
mov rax, rdi
mul rcx
shr rdx, 4
imul rax, rdx, 0x1f3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [r9 + rbx - 0xe]
movsx eax, al
mov word [r9 - 0xe], ax
mov rax, rdi
mul rcx
shr rdx, 4
imul rax, rdx, 0x1f3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [r9 + rbx - 0xc]
movsx eax, al
mov word [r9 - 0xc], ax
mov rax, rdi
mul rcx
shr rdx, 4
imul rax, rdx, 0x1f3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [r9 + rbx - 0xa]
movsx eax, al
mov word [r9 - 0xa], ax
mov rax, rdi
mul rcx
shr rdx, 4
imul rax, rdx, 0x1f3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [r9 + rbx - 8]
movsx eax, al
mov word [r9 - 8], ax
mov rax, rdi
mul rcx
shr rdx, 4
imul rax, rdx, 0x1f3
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 6]
xor al, byte [r9 + rbx - 6]
movsx eax, al
mov word [r9 - 6], ax
mov rax, rdi
mul rcx
shr rdx, 4
imul rax, rdx, 0x1f3
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [r9 + rbx - 4]
movsx eax, al
mov word [r9 - 4], ax
cmp r11d, 7
jb 0x140001e40
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret