joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14021b810
Capabilities:
Access pe header
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
movzx r14d, r8b
mov rbx, rdx
mov rsi, rcx
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov rdi, rax
mov ecx, dword [rax + 0x50]
call fcn.140219cb0
mov rbp, rax
test rbx, rbx
je 0x14021b850
mov qword [rbx], rax
movzx ecx, word [rdi + 0x14]
xor ebx, ebx
movzx edx, word [rdi + 6]
add rcx, 0x18
mov r9d, dword [rdi + 0x90]
add rcx, rdi
lea r8, [rdx + rdx*4]
lea r10, [rcx + r8*8]
cmp rcx, r10
jae 0x14021b894
mov edx, dword [rcx + 0xc]
cmp r9, rdx
jb 0x14021b88b
mov eax, dword [rcx + 8]
add eax, edx
cmp r9, rax
jb 0x14021b9a6
add rcx, 0x28
cmp rcx, r10
jb 0x14021b875
mov r8, rbx
mov rdx, rdi
mov rcx, rsi
call fcn.14021b4a0
mov r8, rdi
mov rdx, rbp
mov rcx, rsi
call fcn.14021b690
mov rdx, rdi
call fcn.14021b720
mov edx, dword [rdi + 0x54]
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.kernel32.dll_VirtualAlloc]
mov rsi, rax
mov eax, dword [rdi + 0x54]
test eax, eax
je 0x14021b90c
nop word [rax + rax]
rdtsc
shl rdx, 0x20
or rax, rdx
movzx ecx, al
mov eax, 0x80808081
mul ecx
shr edx, 7
imul eax, edx, 0xff
sub ecx, eax
mov byte [rbx + rsi], cl
inc rbx
mov eax, dword [rdi + 0x54]
cmp rbx, rax
jb 0x14021b8e0
mov r8d, eax
mov rdx, rsi
mov rcx, rbp
call fcn.140219bb0
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.kernel32.dll_VirtualFree]
mov ecx, dword [rdi + 0x28]
add rcx, rbp
call fcn.140219ed0
test r14b, r14b
je 0x14021b98b
mov ebx, dword [rdi + 0x50]
mov r9d, 4
mov edx, ebx
mov r8d, 0x3000
xor ecx, ecx
call qword [sym.imp.kernel32.dll_VirtualAlloc]
mov r8d, ebx
xor edx, edx
mov rcx, rax
mov rdi, rax
call fcn.1403ccc50
mov r8d, ebx
mov rdx, rdi
mov rcx, rbp
call fcn.140219bb0
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.kernel32.dll_VirtualFree]
mov rcx, rbp
call fcn.140219d50
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov r8d, dword [rcx + 0x14]
sub r8, rdx
add r8, r9
add r8, rsi
jmp 0x14021b897
Function at 0x14021d440
Capabilities:
Encode data using xor

Disassembly:
xor r10d, r10d
mov r9d, 0x4f0d
mov eax, r10d
nop dword [rax]
movsxd rdx, eax
lea r8, [rcx + rdx*2]
movzx edx, ax
sub dx, r9w
inc eax
xor word [r8], dx
cmp eax, 0x18
jb 0x14021d450
mov word [rcx + 0x30], r10w
mov rax, rcx
ret

Function at 0x14021d480
Capabilities:
Encode data using xor

Disassembly:
xor r10d, r10d
mov r9d, 0x4f0d
mov eax, r10d
nop dword [rax]
movsxd rdx, eax
lea r8, [rcx + rdx*2]
movzx edx, ax
sub dx, r9w
inc eax
xor word [r8], dx
cmp eax, 0x19
jb 0x14021d490
mov word [rcx + 0x32], r10w
mov rax, rcx
ret

Function at 0x14021d4c0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movsxd r8, eax
lea edx, [rax - 0xd]
inc eax
xor byte [r8 + rcx], dl
cmp eax, 0xe
jb 0x14021d4d0
mov byte [rcx + 0xe], 0
mov rax, rcx
ret

Function at 0x14021d4f0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movsxd r8, eax
lea edx, [rax - 0xd]
inc eax
xor byte [r8 + rcx], dl
cmp eax, 0x21
jb 0x14021d500
mov byte [rcx + 0x21], 0
mov rax, rcx
ret

Function at 0x14021d520
Capabilities:
Encode data using xor

Disassembly:
xor r10d, r10d
mov r9d, 0x4f0d
mov eax, r10d
nop dword [rax]
movsxd rdx, eax
lea r8, [rcx + rdx*2]
movzx edx, ax
sub dx, r9w
inc eax
xor word [r8], dx
cmp eax, 9
jb 0x14021d530
mov word [rcx + 0x12], r10w
mov rax, rcx
ret

Function at 0x14021d560
Capabilities:
Encode data using xor

Disassembly:
xor r10d, r10d
mov r9d, 0x4f0d
mov eax, r10d
nop dword [rax]
movsxd rdx, eax
lea r8, [rcx + rdx*2]
movzx edx, ax
sub dx, r9w
inc eax
xor word [r8], dx
cmp eax, 7
jb 0x14021d570
mov word [rcx + 0xe], r10w
mov rax, rcx
ret

Function at 0x14021d5a0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movsxd r8, eax
lea edx, [rax - 0xd]
inc eax
xor byte [r8 + rcx], dl
cmp eax, 0x15
jb 0x14021d5b0
mov byte [rcx + 0x15], 0
mov rax, rcx
ret

Function at 0x14021d5d0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movsxd r8, eax
lea edx, [rax - 0xd]
inc eax
xor byte [r8 + rcx], dl
cmp eax, 5
jb 0x14021d5e0
mov byte [rcx + 5], 0
mov rax, rcx
ret

Function at 0x14021d600
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movsxd r8, eax
lea edx, [rax - 0xd]
inc eax
xor byte [r8 + rcx], dl
cmp eax, 0xc
jb 0x14021d610
mov byte [rcx + 0xc], 0
mov rax, rcx
ret

Function at 0x14021d630
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movsxd r8, eax
lea edx, [rax - 0xd]
inc eax
xor byte [r8 + rcx], dl
cmp eax, 9
jb 0x14021d640
mov byte [rcx + 9], 0
mov rax, rcx
ret

Function at 0x14021d660
Capabilities:
Encode data using xor

Disassembly:
xor r10d, r10d
mov r9d, 0x4f0d
mov eax, r10d
nop dword [rax]
movsxd rdx, eax
lea r8, [rcx + rdx*2]
movzx edx, ax
sub dx, r9w
inc eax
xor word [r8], dx
cmp eax, 8
jb 0x14021d670
mov word [rcx + 0x10], r10w
mov rax, rcx
ret
Function at 0x14021d6a0
Capabilities:
Encode data using xor

Disassembly:
xor r10d, r10d
mov r9d, 0x4f0d
mov eax, r10d
nop dword [rax]
movsxd rdx, eax
lea r8, [rcx + rdx*2]
movzx edx, ax
sub dx, r9w
inc eax
xor word [r8], dx
cmp eax, 0xd
jb 0x14021d6b0
mov word [rcx + 0x1a], r10w
mov rax, rcx
ret

Function at 0x14021d6e0
Capabilities:
Encode data using xor

Disassembly:
xor r10d, r10d
mov r9d, 0x4f0d
mov eax, r10d
nop dword [rax]
movsxd rdx, eax
lea r8, [rcx + rdx*2]
movzx edx, ax
sub dx, r9w
inc eax
xor word [r8], dx
cmp eax, 0xf
jb 0x14021d6f0
mov word [rcx + 0x1e], r10w
mov rax, rcx
ret

Function at 0x14021d720
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movsxd r8, eax
lea edx, [rax - 0xd]
inc eax
xor byte [r8 + rcx], dl
cmp eax, 8
jb 0x14021d730
mov byte [rcx + 8], 0
mov rax, rcx
ret

Function at 0x14021d750
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movsxd r8, eax
lea edx, [rax - 0xd]
inc eax
xor byte [r8 + rcx], dl
cmp eax, 0xd
jb 0x14021d760
mov byte [rcx + 0xd], 0
mov rax, rcx
ret

Function at 0x14021d780
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movsxd r8, eax
lea edx, [rax - 0xd]
inc eax
xor byte [r8 + rcx], dl
cmp eax, 0xf
jb 0x14021d790
mov byte [rcx + 0xf], 0
mov rax, rcx
ret
Function at 0x14021d7c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x738]
sub rsp, 0x838
mov rbx, rdx
lea rsi, [rbp + 0x770]
mov edi, ecx
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x800
call fcn.1403ccc50
mov r8, rsi
lea rcx, [rsp + 0x30]
mov rdx, rbx
call qword [sym.imp.user32.dll_wvsprintfW]
test edi, edi
jne 0x14021d88e
mov rbx, qword [0x140549300]
xor r9d, r9d
mov r8d, r9d
mov dword [rsp + 0x20], 0xb086b0b6
mov dword [rsp + 0x24], 0xb099b087
mov edx, 0x4f0d
mov dword [rsp + 0x28], 0xb085
nop
movsxd rax, r8d
lea rcx, [rsp + 0x20]
lea rcx, [rcx + rax*2]
movzx eax, r8w
sub ax, dx
inc r8d
xor word [rcx], ax
cmp r8d, 5
jb 0x14021d840
mov word [rsp + 0x2a], r9w
call qword [sym.imp.user32.dll_GetForegroundWindow]
mov r9d, 0x10
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
mov rcx, rax
call rbx
xor eax, eax
add rsp, 0x838
pop rdi
pop rsi
pop rbx
pop rbp
ret
cmp edi, 1
jne 0x14021d8fb
mov rbx, qword [0x140549300]
xor eax, eax
xor r9d, r9d
mov dword [rsp + 0x20], 0xb09ab0ba
mov r8d, r9d
mov dword [rsp + 0x24], 0xb099b093
mov word [rsp + 0x28], ax
mov edx, 0x4f0d
nop dword [rax]
movsxd rax, r8d
lea rcx, [rsp + 0x20]
lea rcx, [rcx + rax*2]
movzx eax, r8w
sub ax, dx
inc r8d
xor word [rcx], ax
cmp r8d, 4
jb 0x14021d8c0
mov word [rsp + 0x28], r9w
call qword [sym.imp.user32.dll_GetForegroundWindow]
mov r9d, 0x40
lea r8, [rsp + 0x20]
jmp 0x14021d876
cmp edi, 2
jne 0x14021d97b
mov rbx, qword [0x140549300]
xor r9d, r9d
mov r8d, r9d
mov dword [rsp + 0x20], 0xb095b0a4
mov dword [rsp + 0x24], 0xb098b087
mov edx, 0x4f0d
mov dword [rsp + 0x28], 0xb096b09e
mov dword [rsp + 0x2c], 0xb09e
nop dword [rax]
nop word [rax + rax]
movsxd rax, r8d
lea rcx, [rsp + 0x20]
lea rcx, [rcx + rax*2]
movzx eax, r8w
sub ax, dx
inc r8d
xor word [rcx], ax
cmp r8d, 7
jb 0x14021d940
mov word [rsp + 0x2e], r9w
call qword [sym.imp.user32.dll_GetForegroundWindow]
mov r9d, 0x30
lea r8, [rsp + 0x20]
jmp 0x14021d876
cmp edi, 3
jne 0x14021d9fc
mov rbx, qword [0x140549300]
xor eax, eax
xor r9d, r9d
mov dword [rsp + 0x20], 0xb09ab0ba
mov r8d, r9d
mov dword [rsp + 0x24], 0xb099b093
mov word [rsp + 0x28], ax
mov edx, 0x4f0d
nop dword [rax]
movsxd rax, r8d
lea rcx, [rsp + 0x20]
lea rcx, [rcx + rax*2]
movzx eax, r8w
sub ax, dx
inc r8d
xor word [rcx], ax
cmp r8d, 4
jb 0x14021d9b0
mov word [rsp + 0x28], r9w
call qword [sym.imp.user32.dll_GetForegroundWindow]
mov r9d, 0x41
lea r8, [rsp + 0x20]
mov rcx, rax
lea rdx, [rsp + 0x30]
call rbx
add rsp, 0x838
pop rdi
pop rsi
pop rbx
pop rbp
ret
cmp edi, 4
jne 0x14021d880
mov rbx, qword [0x140549300]
xor eax, eax
xor r9d, r9d
mov dword [rsp + 0x20], 0xb09ab0ba
mov r8d, r9d
mov dword [rsp + 0x24], 0xb099b093
mov word [rsp + 0x28], ax
mov edx, 0x4f0d
nop
movsxd rax, r8d
lea rcx, [rsp + 0x20]
lea rcx, [rcx + rax*2]
movzx eax, r8w
sub ax, dx
inc r8d
xor word [rcx], ax
cmp r8d, 4
jb 0x14021da30
mov word [rsp + 0x28], r9w
call qword [sym.imp.user32.dll_GetForegroundWindow]
mov r9d, 0x44
lea r8, [rsp + 0x20]
mov rcx, rax
lea rdx, [rsp + 0x30]
call rbx
add rsp, 0x838
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14021db60
Capabilities:
Acquire debug privileges

Disassembly:
sub rsp, 0x48
call qword [sym.imp.kernel32.dll_GetCurrentProcess]
lea r8, [rsp + 0x50]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.advapi32.dll_OpenProcessToken]
test eax, eax
je 0x14021dba4
lea r8, [rsp + 0x34]
xor ecx, ecx
lea rdx, [0x1404cb618]
call qword [sym.imp.advapi32.dll_LookupPrivilegeValueW]
mov rcx, qword [rsp + 0x50]
test eax, eax
jne 0x14021dbab
call qword [0x1405492d8]
xor eax, eax
add rsp, 0x48
ret
xor eax, eax
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x30]
xor edx, edx
mov dword [rsp + 0x3c], 2
mov qword [rsp + 0x20], rax
lea r9d, [rax + 0x10]
call qword [sym.imp.advapi32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x50]
test eax, eax
je 0x14021db9e
call qword [0x1405492d8]
mov eax, 1
add rsp, 0x48
ret
Function at 0x140221700
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push r15
movzx eax, word [rcx + 0x14]
lea r10, [rcx + 0x18]
mov r11d, dword [rcx + 0xb0]
add r10, rax
movzx eax, word [rcx + 6]
mov rbp, rdx
sub rbp, qword [rcx + 0x30]
mov r15, r8
mov rsi, rcx
lea r9, [rax + rax*4]
lea r8, [r10 + r9*8]
cmp r10, r8
jae 0x14022175d
nop dword [rax + rax]
mov ecx, dword [r10 + 0xc]
cmp r11, rcx
jb 0x140221754
mov eax, dword [r10 + 8]
add eax, ecx
cmp r11, rax
jb 0x140221768
add r10, 0x28
cmp r10, r8
jb 0x140221740
mov al, 1
mov rbp, qword [rsp + 0x30]
pop r15
pop rsi
ret
mov eax, dword [rsi + 0xb4]
mov qword [rsp + 0x18], rbx
mov ebx, dword [r10 + 0x14]
sub rbx, rcx
mov qword [rsp + 0x28], r14
add rbx, r11
add rbx, r15
lea r14, [rbx + rax]
je 0x14022187a
test eax, eax
je 0x14022187a
cmp rbx, r14
jae 0x14022187a
mov qword [rsp + 0x20], rdi
mov eax, dword [rbx + 4]
test eax, eax
je 0x140221860
lea ecx, [rax - 8]
shr ecx, 1
je 0x140221854
lea r11, [rbx + 8]
mov edi, ecx
movzx r8d, word [r11]
movzx eax, r8w
shr ax, 0xc
and r8d, 0x80000fff
jge 0x1402217e3
dec r8d
or r8d, 0xfffff000
inc r8d
cmp ax, 3
je 0x1402217ef
cmp ax, 0xa
jne 0x140221843
movzx eax, word [rsi + 0x14]
movzx ecx, word [rsi + 6]
add rax, 0x18
mov r9d, dword [rbx]
add rax, rsi
lea rdx, [rcx + rcx*4]
lea r10, [rax + rdx*8]
cmp rax, r10
jae 0x140221843
nop
mov edx, dword [rax + 0xc]
cmp r9, rdx
jb 0x140221822
mov ecx, dword [rax + 8]
add ecx, edx
cmp r9, rcx
jb 0x14022182d
add rax, 0x28
cmp rax, r10
jb 0x140221810
jmp 0x140221843
mov ecx, dword [rax + 0x14]
sub rcx, rdx
add rcx, r9
add rcx, r15
je 0x140221843
movzx eax, r8w
add qword [rax + rcx], rbp
add r11, 2
sub rdi, 1
jne 0x1402217c1
mov eax, dword [rbx + 4]
add rbx, rax
cmp rbx, r14
jb 0x1402217a5
mov rdi, qword [rsp + 0x20]
mov al, 1
mov rbx, qword [rsp + 0x18]
mov r14, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
pop r15
pop rsi
ret
mov rbx, qword [rsp + 0x18]
mov al, 1
mov r14, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
pop r15
pop rsi
ret
Function at 0x140221890
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x230
movzx eax, word [rdx + 0x14]
lea r10, [rdx + 0x18]
mov r11d, dword [rdx + 0x90]
add r10, rax
movzx eax, word [rdx + 6]
mov r15, r8
mov rbp, rdx
mov r12, rcx
lea r9, [rax + rax*4]
lea r9, [r10 + r9*8]
cmp r10, r9
jae 0x1402218fd
nop dword [rax]
mov ecx, dword [r10 + 0xc]
cmp r11, rcx
jb 0x1402218f4
mov eax, dword [r10 + 8]
add eax, ecx
cmp r11, rax
jb 0x140221921
add r10, 0x28
cmp r10, r9
jb 0x1402218e0
mov al, 1
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
mov edx, dword [r10 + 0x14]
sub rdx, rcx
add rdx, r11
add rdx, r15
je 0x1402218fd
cmp dword [rbp + 0x94], 0
je 0x1402218fd
lea r14, [rdx + 0x10]
nop dword [rax]
movzx eax, word [rbp + 0x14]
lea rdx, [rbp + 0x18]
mov r9d, dword [r14 - 4]
add rdx, rax
movzx eax, word [rbp + 6]
mov r8, rdx
lea rcx, [rax + rax*4]
lea r10, [rdx + rcx*8]
cmp rdx, r10
jae 0x1402218fd
mov ecx, dword [r8 + 0xc]
cmp r9, rcx
jb 0x140221977
mov eax, dword [r8 + 8]
add eax, ecx
cmp r9, rax
jb 0x140221985
add r8, 0x28
cmp r8, r10
jb 0x140221963
jmp 0x1402218fd
mov esi, dword [r8 + 0x14]
sub rsi, rcx
add rsi, r9
add rsi, r15
je 0x1402218fd
mov r8d, dword [r14]
nop dword [rax + rax]
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x1402219b2
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x1402219d1
add rdx, 0x28
cmp rdx, r10
jb 0x1402219a0
xor edi, edi
mov r8, qword [rdi]
test r8, r8
je 0x140221a6d
jns 0x1402219df
movzx edx, r8w
jmp 0x140221a21
mov edi, dword [rdx + 0x14]
sub rdi, rcx
add rdi, r8
add rdi, r15
jmp 0x1402219bd
movzx eax, word [rbp + 0x14]
movzx ecx, word [rbp + 6]
add rax, 0x18
add rax, rbp
lea rdx, [rcx + rcx*4]
lea r9, [rax + rdx*8]
cmp rax, r9
jae 0x140221a1b
nop dword [rax + rax]
mov edx, dword [rax + 0xc]
cmp r8, rdx
jb 0x140221a12
mov ecx, dword [rax + 8]
add ecx, edx
cmp r8, rcx
jb 0x140221a76
add rax, 0x28
cmp rax, r9
jb 0x140221a00
xor ecx, ecx
lea rdx, [rcx + 2]
lea r8, [rsp + 0x20]
mov rcx, rsi
call fcn.140221630
mov rbx, rax
test rax, rax
je 0x140221a84
lea rdx, [rsp + 0x20]
mov rcx, r12
call fcn.140221330
test rax, rax
jne 0x140221a57
lea rcx, [rsp + 0x20]
call fcn.1402209c0
test rax, rax
je 0x140221a84
add rax, rbx
mov qword [rdi], rax
add rdi, 8
mov r8, qword [rdi]
test r8, r8
jne 0x1402219c9
add r14, 0x14
jmp 0x140221940
mov ecx, dword [rax + 0x14]
sub rcx, rdx
add rcx, r8
add rcx, r15
jmp 0x140221a1d
xor al, al
jmp 0x1402218ff
Function at 0x140222190
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movsxd r8, eax
lea edx, [rax - 0x39]
inc eax
xor byte [r8 + rcx], dl
cmp eax, 0x1e
jb 0x1402221a0
mov byte [rcx + 0x1e], 0
mov rax, rcx
ret

Function at 0x1402221c0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movsxd r8, eax
lea edx, [rax - 0x39]
inc eax
xor byte [r8 + rcx], dl
cmp eax, 0x1d
jb 0x1402221d0
mov byte [rcx + 0x1d], 0
mov rax, rcx
ret

Function at 0x1402221f0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movsxd r8, eax
lea edx, [rax - 0x39]
inc eax
xor byte [r8 + rcx], dl
cmp eax, 0x14
jb 0x140222200
mov byte [rcx + 0x14], 0
mov rax, rcx
ret

Function at 0x140222220
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movsxd r8, eax
lea edx, [rax - 0x39]
inc eax
xor byte [r8 + rcx], dl
cmp eax, 0x19
jb 0x140222230
mov byte [rcx + 0x19], 0
mov rax, rcx
ret

Function at 0x140222250
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movsxd r8, eax
lea edx, [rax - 0x39]
inc eax
xor byte [r8 + rcx], dl
cmp eax, 0xb
jb 0x140222260
mov byte [rcx + 0xb], 0
mov rax, rcx
ret

Function at 0x140222280
Capabilities:
Encode data using xor

Disassembly:
xor r10d, r10d
mov r9d, 0x45c7
mov eax, r10d
nop dword [rax]
movsxd rdx, eax
lea r8, [rcx + rdx*2]
lea edx, [r9 + rax]
inc eax
xor word [r8], dx
cmp eax, 6
jb 0x140222290
mov word [rcx + 0xc], r10w
mov rax, rcx
ret

Function at 0x1402222b0
Capabilities:
Encode data using xor

Disassembly:
xor r10d, r10d
mov r9d, 0x45c7
mov eax, r10d
nop dword [rax]
movsxd rdx, eax
lea r8, [rcx + rdx*2]
lea edx, [r9 + rax]
inc eax
xor word [r8], dx
cmp eax, 0x1b
jb 0x1402222c0
mov word [rcx + 0x36], r10w
mov rax, rcx
ret

Function at 0x1402222e0
Capabilities:
Encode data using xor

Disassembly:
xor r10d, r10d
mov r9d, 0x45c7
mov eax, r10d
nop dword [rax]
movsxd rdx, eax
lea r8, [rcx + rdx*2]
lea edx, [r9 + rax]
inc eax
xor word [r8], dx
cmp eax, 0x15
jb 0x1402222f0
mov word [rcx + 0x2a], r10w
mov rax, rcx
ret

Function at 0x140222310
Capabilities:
Encode data using xor

Disassembly:
xor r10d, r10d
mov r9d, 0x45c7
mov eax, r10d
nop dword [rax]
movsxd rdx, eax
lea r8, [rcx + rdx*2]
lea edx, [r9 + rax]
inc eax
xor word [r8], dx
cmp eax, 0x11
jb 0x140222320
mov word [rcx + 0x22], r10w
mov rax, rcx
ret

Function at 0x140222340
Capabilities:
Encode data using xor

Disassembly:
xor r10d, r10d
mov r9d, 0x45c7
mov eax, r10d
nop dword [rax]
movsxd rdx, eax
lea r8, [rcx + rdx*2]
lea edx, [r9 + rax]
inc eax
xor word [r8], dx
cmp eax, 0x1a
jb 0x140222350
mov word [rcx + 0x34], r10w
mov rax, rcx
ret

Function at 0x140222370
Capabilities:
Encode data using xor

Disassembly:
xor r10d, r10d
mov r9d, 0x45c7
mov eax, r10d
nop dword [rax]
movsxd rdx, eax
lea r8, [rcx + rdx*2]
lea edx, [r9 + rax]
inc eax
xor word [r8], dx
cmp eax, 0xe
jb 0x140222380
mov word [rcx + 0x1c], r10w
mov rax, rcx
ret
Function at 0x1402223a0
Capabilities:
Encode data using xor

Disassembly:
xor r10d, r10d
mov r9d, 0x45c7
mov eax, r10d
nop dword [rax]
movsxd rdx, eax
lea r8, [rcx + rdx*2]
lea edx, [r9 + rax]
inc eax
xor word [r8], dx
cmp eax, 0x14
jb 0x1402223b0
mov word [rcx + 0x28], r10w
mov rax, rcx
ret

Function at 0x1402223d0
Capabilities:
Encode data using xor

Disassembly:
xor r10d, r10d
mov r9d, 0x45c7
mov eax, r10d
nop dword [rax]
movsxd rdx, eax
lea r8, [rcx + rdx*2]
lea edx, [r9 + rax]
inc eax
xor word [r8], dx
cmp eax, 0x17
jb 0x1402223e0
mov word [rcx + 0x2e], r10w
mov rax, rcx
ret

Function at 0x140222400
Capabilities:
Encode data using xor

Disassembly:
xor r10d, r10d
mov r9d, 0x45c7
mov eax, r10d
nop dword [rax]
movsxd rdx, eax
lea r8, [rcx + rdx*2]
lea edx, [r9 + rax]
inc eax
xor word [r8], dx
cmp eax, 0x1d
jb 0x140222410
mov word [rcx + 0x3a], r10w
mov rax, rcx
ret

Function at 0x140222430
Capabilities:
Encode data using xor

Disassembly:
xor r10d, r10d
mov r9d, 0x45c7
mov eax, r10d
nop dword [rax]
movsxd rdx, eax
lea r8, [rcx + rdx*2]
lea edx, [r9 + rax]
inc eax
xor word [r8], dx
cmp eax, 0xa
jb 0x140222440
mov word [rcx + 0x14], r10w
mov rax, rcx
ret

Function at 0x140222460
Capabilities:
Encode data using xor

Disassembly:
xor r10d, r10d
mov r9d, 0x45c7
mov eax, r10d
nop dword [rax]
movsxd rdx, eax
lea r8, [rcx + rdx*2]
lea edx, [r9 + rax]
inc eax
xor word [r8], dx
cmp eax, 0xb
jb 0x140222470
mov word [rcx + 0x16], r10w
mov rax, rcx
ret

Function at 0x140222490
Capabilities:
Encode data using xor

Disassembly:
xor r10d, r10d
mov r9d, 0x45c7
mov eax, r10d
nop dword [rax]
movsxd rdx, eax
lea r8, [rcx + rdx*2]
lea edx, [r9 + rax]
inc eax
xor word [r8], dx
cmp eax, 0x12
jb 0x1402224a0
mov word [rcx + 0x24], r10w
mov rax, rcx
ret

Function at 0x1402224c0
Capabilities:
Encode data using xor

Disassembly:
xor r10d, r10d
mov r9d, 0x45c7
mov eax, r10d
nop dword [rax]
movsxd rdx, eax
lea r8, [rcx + rdx*2]
lea edx, [r9 + rax]
inc eax
xor word [r8], dx
cmp eax, 0x10
jb 0x1402224d0
mov word [rcx + 0x20], r10w
mov rax, rcx
ret

Function at 0x1402224f0
Capabilities:
Encode data using xor

Disassembly:
xor r10d, r10d
mov r9d, 0x45c7
mov eax, r10d
nop dword [rax]
movsxd rdx, eax
lea r8, [rcx + rdx*2]
lea edx, [r9 + rax]
inc eax
xor word [r8], dx
cmp eax, 0xc
jb 0x140222500
mov word [rcx + 0x18], r10w
mov rax, rcx
ret

Function at 0x140222520
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movsxd r8, eax
lea edx, [rax - 0x39]
inc eax
xor byte [r8 + rcx], dl
cmp eax, 0x17
jb 0x140222530
mov byte [rcx + 0x17], 0
mov rax, rcx
ret
Function at 0x14024a290
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movsxd r8, eax
lea edx, [rax - 0x39]
inc eax
xor byte [r8 + rcx], dl
cmp eax, 7
jb 0x14024a2a0
mov byte [rcx + 7], 0
mov rax, rcx
ret

Function at 0x14024a2c0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movsxd r8, eax
lea edx, [rax - 0x39]
inc eax
xor byte [r8 + rcx], dl
cmp eax, 0x1c
jb 0x14024a2d0
mov byte [rcx + 0x1c], 0
mov rax, rcx
ret

Function at 0x14024a2f0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movsxd r8, eax
lea edx, [rax - 0x39]
inc eax
xor byte [r8 + rcx], dl
cmp eax, 0x1f
jb 0x14024a300
mov byte [rcx + 0x1f], 0
mov rax, rcx
ret

Function at 0x14024a320
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movsxd r8, eax
lea edx, [rax - 0x39]
inc eax
xor byte [r8 + rcx], dl
cmp eax, 0x1a
jb 0x14024a330
mov byte [rcx + 0x1a], 0
mov rax, rcx
ret

Function at 0x14024a350
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movsxd r8, eax
lea edx, [rax - 0x39]
inc eax
xor byte [r8 + rcx], dl
cmp eax, 0x16
jb 0x14024a360
mov byte [rcx + 0x16], 0
mov rax, rcx
ret

Function at 0x14024a380
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movsxd r8, eax
lea edx, [rax - 0x39]
inc eax
xor byte [r8 + rcx], dl
cmp eax, 0x11
jb 0x14024a390
mov byte [rcx + 0x11], 0
mov rax, rcx
ret

Function at 0x14024a3b0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movsxd r8, eax
lea edx, [rax - 0x39]
inc eax
xor byte [r8 + rcx], dl
cmp eax, 0x12
jb 0x14024a3c0
mov byte [rcx + 0x12], 0
mov rax, rcx
ret

Function at 0x14024a3e0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movsxd r8, eax
lea edx, [rax - 0x39]
inc eax
xor byte [r8 + rcx], dl
cmp eax, 0x13
jb 0x14024a3f0
mov byte [rcx + 0x13], 0
mov rax, rcx
ret

Function at 0x14024a410
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movsxd r8, eax
lea edx, [rax - 0x39]
inc eax
xor byte [r8 + rcx], dl
cmp eax, 0x18
jb 0x14024a420
mov byte [rcx + 0x18], 0
mov rax, rcx
ret

Function at 0x14024a440
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movsxd r8, eax
lea edx, [rax - 0x39]
inc eax
xor byte [r8 + rcx], dl
cmp eax, 0x10
jb 0x14024a450
mov byte [rcx + 0x10], 0
mov rax, rcx
ret

Function at 0x14024a470
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movsxd r8, eax
lea edx, [rax - 0x39]
inc eax
xor byte [r8 + rcx], dl
cmp eax, 0xa
jb 0x14024a480
mov byte [rcx + 0xa], 0
mov rax, rcx
ret