joyce8/EMBER2024-capa huggingface dataset:
Function at 0x141891058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1418911df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141891089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14189106f
add dl, dl
jne 0x141891096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1418910f6
xor eax, eax
add dl, dl
jne 0x1418910a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1418911ad
add dl, dl
jne 0x1418910b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1418910c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1418910d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1418910dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1418910ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14189107e
mov eax, 1
add dl, dl
jne 0x141891106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141891113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1418910fb
sub eax, ebx
mov ebx, 1
jne 0x14189114c
mov ecx, 1
add dl, dl
jne 0x14189112e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14189113b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141891123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14189107e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141891168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141891175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14189115d
cmp eax, 0x7d00
jae 0x14189119b
cmp eax, 0x500
jb 0x141891196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14189107e
cmp eax, 0x7f
ja 0x14189119e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14189107e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1418911d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14189107e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x401530
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbp
push rdi
push rsi
mov rbp, rsp
sub rsp, 0x30
call fcn.00402150
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x37f
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
mov rdx, rax
lea rax, [0x00403040]
mov ecx, 0x37f
mov r8, qword [rax]
mov qword [rdx], r8
mov r8d, ecx
add r8, rdx
lea r9, [r8 + 8]
mov r8d, ecx
add r8, rax
add r8, 8
mov r8, qword [r8 - 0x10]
mov qword [r9 - 0x10], r8
lea r8, [rdx + 8]
and r8, 0xfffffffffffffff8
sub rdx, r8
sub rax, rdx
add ecx, edx
and ecx, 0xfffffff8
shr ecx, 3
mov edx, ecx
mov edx, edx
mov rdi, r8
mov rsi, rax
mov rcx, rdx
rep movsq qword [rdi], qword [rsi]
mov rax, qword [rbp - 8]
call rax
add rsp, 0x30
pop rsi
pop rdi
pop rbp
ret

Function at 0x4017d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
movsxd rbp, dword [0x00407054]
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
test ebp, ebp
jle 0x4018ea
mov rax, qword [0x00407058]
xor r9d, r9d
add rax, 8
mov r10, qword [rax]
cmp rbx, r10
jb 0x40181e
mov rdx, qword [rax + 8]
mov r11d, dword [rdx + 8]
add r10, r11
cmp rbx, r10
jb 0x4018d0
add r9d, 1
add rax, 0x18
cmp r9d, ebp
jne 0x401802
mov rcx, rbx
call fcn.00402610
test rax, rax
mov r12, rax
je 0x401922
lea rbp, [rbp + rbp*2]
shl rbp, 3
mov r13, rbp
add r13, qword [0x00407058]
mov qword [r13 + 0x10], rax
mov dword [r13], 0
call fcn.00402730
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
lea rdx, [rsp + 0x20]
mov qword [r13 + 8], rax
mov rax, qword [0x00407058]
mov rcx, qword [rax + rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x401905
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x4018c9
sub eax, 0x40
and eax, 0xffffffbf
je 0x4018c9
mov r9, rbp
add r9, qword [0x00407058]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x4018f1
add dword [0x00407054], 1
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sub.msvcrt.dll_memcpy
xor ebp, ebp
jmp 0x40182b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.00401760
mov rax, qword [0x00407058]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbp + 8]
call fcn.00401760
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.00401760
nop
nop word cs:[rax + rax]

Function at 0x402520
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x402561
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x402558
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x402563
add rax, 0x28
cmp rax, r9
jne 0x402544
xor eax, eax
repz ret
Function at 0x402610
Capabilities:
Enumerate pe sections

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [0x004042e0]
cmp word [rbx], 0x5a4d
je 0x402630
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
mov rsi, rcx
mov rcx, rbx
call fcn.004024e0
test eax, eax
je 0x402624
sub rsi, rbx
mov rcx, rbx
mov rdx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.00402520

Function at 0x402880
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x004079c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x004079a0]
test rbx, rbx
je 0x4028d4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x4028cb
test rsi, rsi
je 0x4028cb
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x4028b0
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x004079c0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
Function at 0x14000124c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a044
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 5]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a044
mov qword [rbx], rax
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 5]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
mov dword [rax], ecx
mov byte [rax + 4], cl
add rax, 5
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x4f38f62dd4c9a845
mul r8
mov rax, r8
inc edi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x187
sub r8, rax
lea rax, [0x140042420]
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 5
jb 0x1400012a0
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140001300
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov ecx, 0x18
call fcn.14000a044
xor esi, esi
mov rdi, rax
mov qword [rax], rsi
lea ecx, [rsi + 0x7a]
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
call fcn.14000a044
mov qword [rdi], rax
lea r8d, [rsi + 0x7a]
xor edx, edx
mov rbx, rax
lea rcx, [rax + 0x7a]
mov qword [rdi + 0x10], rcx
mov rcx, rax
call fcn.14000cb00
lea rax, [rbx + 0x7a]
mov r9d, esi
mov qword [rdi + 8], rax
mov r8d, esi
mov cl, byte [r9 + rbp]
movabs rax, 0x4f38f62dd4c9a845
mul r8
mov rax, r8
inc esi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x187
sub r8, rax
lea rax, [0x140042420]
xor cl, byte [r8 + rax]
mov rax, qword [rdi]
movsxd r8, esi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0x7a
jb 0x140001363
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400013c8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a044
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0xb]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a044
mov qword [rbx], rax
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0xb]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
mov qword [rax], rcx
mov word [rax + 8], cx
mov byte [rax + 0xa], cl
add rax, 0xb
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x4f38f62dd4c9a845
mul r8
mov rax, r8
inc edi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x187
sub r8, rax
lea rax, [0x140042420]
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0xb
jb 0x140001421
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140002b08
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a044
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0xc]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a044
mov qword [rbx], rax
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0xc]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
mov qword [rax], rcx
mov dword [rax + 8], ecx
add rax, 0xc
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x4f38f62dd4c9a845
mul r8
mov rax, r8
inc edi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x187
sub r8, rax
lea rax, [0x1400425c0]
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0xc
jb 0x140002b5d
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400040f8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a044
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 2]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a044
mov qword [rbx], rax
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 2]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
mov word [rax], cx
add rax, 2
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x4f38f62dd4c9a845
mul r8
mov rax, r8
inc edi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x187
sub r8, rax
lea rax, [0x140042750]
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 2
jb 0x14000414a
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14000636c
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x18
call fcn.14000a044
mov edx, 8
mov rcx, rax
call fcn.140001f90
xor r8d, r8d
mov r9, rax
mov r10d, r8d
mov r11d, r8d
mov rcx, r10
movabs rax, 0x4f38f62dd4c9a845
mul r10
inc r8d
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 8
imul rax, rcx, 0x187
lea rcx, [0x1400428e0]
sub r10, rax
mov al, byte [r11 + rbx]
xor al, byte [r10 + rcx]
movsx ecx, al
mov rax, qword [r9]
movsxd r10, r8d
mov word [r11 + rax], cx
lea r11, [r11 + 2]
cmp r10, 8
jb 0x140006398
mov rax, r9
add rsp, 0x20
pop rbx
ret

Function at 0x1400063f4
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x18
call fcn.14000a044
mov edx, 5
mov rcx, rax
call fcn.140001f90
xor r8d, r8d
mov r9, rax
mov r10d, r8d
mov r11d, r8d
mov rcx, r10
movabs rax, 0x4f38f62dd4c9a845
mul r10
inc r8d
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 8
imul rax, rcx, 0x187
lea rcx, [0x1400428e0]
sub r10, rax
mov al, byte [r11 + rbx]
xor al, byte [r10 + rcx]
movsx ecx, al
mov rax, qword [r9]
movsxd r10, r8d
mov word [r11 + rax], cx
lea r11, [r11 + 2]
cmp r10, 5
jb 0x140006420
mov rax, r9
add rsp, 0x20
pop rbx
ret
Function at 0x14000647c
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x18
call fcn.14000a044
mov edx, 9
mov rcx, rax
call fcn.140001f90
xor r8d, r8d
mov r9, rax
mov r10d, r8d
mov r11d, r8d
mov rcx, r10
movabs rax, 0x4f38f62dd4c9a845
mul r10
inc r8d
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 8
imul rax, rcx, 0x187
lea rcx, [0x1400428e0]
sub r10, rax
mov al, byte [r11 + rbx]
xor al, byte [r10 + rcx]
movsx ecx, al
mov rax, qword [r9]
movsxd r10, r8d
mov word [r11 + rax], cx
lea r11, [r11 + 2]
cmp r10, 9
jb 0x1400064a8
mov rax, r9
add rsp, 0x20
pop rbx
ret

Function at 0x140006590
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x18
call fcn.14000a044
mov edx, 3
mov rcx, rax
call fcn.140001f90
xor r8d, r8d
mov r9, rax
mov r10d, r8d
mov r11d, r8d
mov rcx, r10
movabs rax, 0x4f38f62dd4c9a845
mul r10
inc r8d
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 8
imul rax, rcx, 0x187
lea rcx, [0x1400428e0]
sub r10, rax
mov al, byte [r11 + rbx]
xor al, byte [r10 + rcx]
movsx ecx, al
mov rax, qword [r9]
movsxd r10, r8d
mov word [r11 + rax], cx
lea r11, [r11 + 2]
cmp r10, 3
jb 0x1400065bc
mov rax, r9
add rsp, 0x20
pop rbx
ret

Function at 0x140006618
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x18
call fcn.14000a044
mov edx, 2
mov rcx, rax
call fcn.140001f90
xor r8d, r8d
mov r9, rax
mov r10d, r8d
mov r11d, r8d
mov rcx, r10
movabs rax, 0x4f38f62dd4c9a845
mul r10
inc r8d
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 8
imul rax, rcx, 0x187
lea rcx, [0x1400428e0]
sub r10, rax
mov al, byte [r11 + rbx]
xor al, byte [r10 + rcx]
movsx ecx, al
mov rax, qword [r9]
movsxd r10, r8d
mov word [r11 + rax], cx
lea r11, [r11 + 2]
cmp r10, 2
jb 0x140006644
mov rax, r9
add rsp, 0x20
pop rbx
ret

Function at 0x140007000
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a044
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0x14]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a044
mov qword [rbx], rax
xorps xmm0, xmm0
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0x14]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
movups xmmword [rax], xmm0
mov dword [rax + 0x10], ecx
add rax, 0x14
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x4f38f62dd4c9a845
mul r8
mov rax, r8
inc edi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x187
sub r8, rax
lea rax, [0x140042a70]
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0x14
jb 0x140007058
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140007204
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x18
call fcn.14000a044
mov edx, 0xc
mov rcx, rax
call fcn.140001f90
xor r8d, r8d
mov r9, rax
mov r10d, r8d
mov r11d, r8d
mov rcx, r10
movabs rax, 0x4f38f62dd4c9a845
mul r10
inc r8d
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 8
imul rax, rcx, 0x187
lea rcx, str.vJPITSFpMOCLSefDxeORvEioJzVZNULsfbpqqxAxI_tfTCMOgro_EORcp_AAiTzHYlWpVYVZocwcLDwnVrctVACXDlCgtcfLTiNRJnzEtdvKfgWabytQDWUiShYXOBDVyYgcrArtfoMekGVfdygPtnhSUPNClOnTZFzPfBdjDDVYbALZaLjObsxH_vTPJbRgtjqfQuJhQRzojTrNmgfGqccXEgczymxBXPNSFfpuEAyCYSGqVaUWXdNiCyUDzNPEUtDCWHUrGYpmtPMaEregVSRweacASnaovgTcpdIKQiPcTtRxEezWDVg_LugTIJoCojtSPOtmytXVpRhmlKEFMdcqPqZgwHOSpReMfYJCXJznsyvSznJogdXYLbheHOUiWOlWZh
sub r10, rax
mov al, byte [r11 + rbx]
xor al, byte [r10 + rcx]
movsx ecx, al
mov rax, qword [r9]
movsxd r10, r8d
mov word [r11 + rax], cx
lea r11, [r11 + 2]
cmp r10, 0xc
jb 0x140007230
mov rax, r9
add rsp, 0x20
pop rbx
ret

Function at 0x14000728c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a044
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0xa]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a044
mov qword [rbx], rax
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0xa]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
mov qword [rax], rcx
mov word [rax + 8], cx
add rax, 0xa
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x4f38f62dd4c9a845
mul r8
mov rax, r8
inc edi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x187
sub r8, rax
lea rax, str.vJPITSFpMOCLSefDxeORvEioJzVZNULsfbpqqxAxI_tfTCMOgro_EORcp_AAiTzHYlWpVYVZocwcLDwnVrctVACXDlCgtcfLTiNRJnzEtdvKfgWabytQDWUiShYXOBDVyYgcrArtfoMekGVfdygPtnhSUPNClOnTZFzPfBdjDDVYbALZaLjObsxH_vTPJbRgtjqfQuJhQRzojTrNmgfGqccXEgczymxBXPNSFfpuEAyCYSGqVaUWXdNiCyUDzNPEUtDCWHUrGYpmtPMaEregVSRweacASnaovgTcpdIKQiPcTtRxEezWDVg_LugTIJoCojtSPOtmytXVpRhmlKEFMdcqPqZgwHOSpReMfYJCXJznsyvSznJogdXYLbheHOUiWOlWZh
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0xa
jb 0x1400072e2
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140007340
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a044
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0xe]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a044
mov qword [rbx], rax
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0xe]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
mov qword [rax], rcx
mov dword [rax + 8], ecx
mov word [rax + 0xc], cx
add rax, 0xe
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x4f38f62dd4c9a845
mul r8
mov rax, r8
inc edi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x187
sub r8, rax
lea rax, str.vJPITSFpMOCLSefDxeORvEioJzVZNULsfbpqqxAxI_tfTCMOgro_EORcp_AAiTzHYlWpVYVZocwcLDwnVrctVACXDlCgtcfLTiNRJnzEtdvKfgWabytQDWUiShYXOBDVyYgcrArtfoMekGVfdygPtnhSUPNClOnTZFzPfBdjDDVYbALZaLjObsxH_vTPJbRgtjqfQuJhQRzojTrNmgfGqccXEgczymxBXPNSFfpuEAyCYSGqVaUWXdNiCyUDzNPEUtDCWHUrGYpmtPMaEregVSRweacASnaovgTcpdIKQiPcTtRxEezWDVg_LugTIJoCojtSPOtmytXVpRhmlKEFMdcqPqZgwHOSpReMfYJCXJznsyvSznJogdXYLbheHOUiWOlWZh
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0xe
jb 0x140007399
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400073f8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a044
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0x15]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a044
mov qword [rbx], rax
xorps xmm0, xmm0
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0x15]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
movups xmmword [rax], xmm0
mov dword [rax + 0x10], ecx
mov byte [rax + 0x14], cl
add rax, 0x15
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x4f38f62dd4c9a845
mul r8
mov rax, r8
inc edi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x187
sub r8, rax
lea rax, str.vJPITSFpMOCLSefDxeORvEioJzVZNULsfbpqqxAxI_tfTCMOgro_EORcp_AAiTzHYlWpVYVZocwcLDwnVrctVACXDlCgtcfLTiNRJnzEtdvKfgWabytQDWUiShYXOBDVyYgcrArtfoMekGVfdygPtnhSUPNClOnTZFzPfBdjDDVYbALZaLjObsxH_vTPJbRgtjqfQuJhQRzojTrNmgfGqccXEgczymxBXPNSFfpuEAyCYSGqVaUWXdNiCyUDzNPEUtDCWHUrGYpmtPMaEregVSRweacASnaovgTcpdIKQiPcTtRxEezWDVg_LugTIJoCojtSPOtmytXVpRhmlKEFMdcqPqZgwHOSpReMfYJCXJznsyvSznJogdXYLbheHOUiWOlWZh
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0x15
jb 0x140007453
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400074b4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a044
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0x10]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a044
mov qword [rbx], rax
xorps xmm0, xmm0
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0x10]
mov qword [rbx + 0x10], rcx
movups xmmword [rax], xmm0
add rax, 0x10
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x4f38f62dd4c9a845
mul r8
mov rax, r8
inc edi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x187
sub r8, rax
lea rax, str.vJPITSFpMOCLSefDxeORvEioJzVZNULsfbpqqxAxI_tfTCMOgro_EORcp_AAiTzHYlWpVYVZocwcLDwnVrctVACXDlCgtcfLTiNRJnzEtdvKfgWabytQDWUiShYXOBDVyYgcrArtfoMekGVfdygPtnhSUPNClOnTZFzPfBdjDDVYbALZaLjObsxH_vTPJbRgtjqfQuJhQRzojTrNmgfGqccXEgczymxBXPNSFfpuEAyCYSGqVaUWXdNiCyUDzNPEUtDCWHUrGYpmtPMaEregVSRweacASnaovgTcpdIKQiPcTtRxEezWDVg_LugTIJoCojtSPOtmytXVpRhmlKEFMdcqPqZgwHOSpReMfYJCXJznsyvSznJogdXYLbheHOUiWOlWZh
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0x10
jb 0x140007507
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140007568
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000a044
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 0x19]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000a044
mov qword [rbx], rax
xorps xmm0, xmm0
mov r9d, edi
mov r8d, edi
lea rcx, [rax + 0x19]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
movups xmmword [rax], xmm0
mov qword [rax + 0x10], rcx
mov byte [rax + 0x18], cl
add rax, 0x19
mov qword [rbx + 8], rax
mov cl, byte [r9 + rsi]
movabs rax, 0x4f38f62dd4c9a845
mul r8
mov rax, r8
inc edi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x187
sub r8, rax
lea rax, str.vJPITSFpMOCLSefDxeORvEioJzVZNULsfbpqqxAxI_tfTCMOgro_EORcp_AAiTzHYlWpVYVZocwcLDwnVrctVACXDlCgtcfLTiNRJnzEtdvKfgWabytQDWUiShYXOBDVyYgcrArtfoMekGVfdygPtnhSUPNClOnTZFzPfBdjDDVYbALZaLjObsxH_vTPJbRgtjqfQuJhQRzojTrNmgfGqccXEgczymxBXPNSFfpuEAyCYSGqVaUWXdNiCyUDzNPEUtDCWHUrGYpmtPMaEregVSRweacASnaovgTcpdIKQiPcTtRxEezWDVg_LugTIJoCojtSPOtmytXVpRhmlKEFMdcqPqZgwHOSpReMfYJCXJznsyvSznJogdXYLbheHOUiWOlWZh
xor cl, byte [r8 + rax]
mov rax, qword [rbx]
movsxd r8, edi
mov byte [r9 + rax], cl
inc r9
cmp r8, 0x19
jb 0x1400075c4
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret