joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402040
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rdi, dword [0x00408614]
mov r12, rcx
mov rsi, rdx
mov rbx, r8
test edi, edi
jle 0x4021e8
mov rax, qword [0x00408618]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp r12, rdx
jb 0x40208c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x402117
add ecx, 1
add rax, 0x28
cmp ecx, edi
jne 0x402070
mov rcx, r12
call fcn.00402da0
mov rbp, rax
test rax, rax
je 0x402222
mov rax, qword [0x00408618]
lea rdi, [rdi + rdi*4]
shl rdi, 3
add rax, rdi
mov qword [rax + 0x20], rbp
mov dword [rax], 0
call fcn.00402ed0
mov ecx, dword [rbp + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x00408618]
mov qword [rax + rdi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x402231
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x402110
sub eax, 4
and eax, 0xfffffffb
jne 0x4021a0
add dword [0x00408614], 1
cmp ebx, 8
jae 0x402148
test bl, 4
jne 0x4021f0
test ebx, ebx
je 0x402139
movzx eax, byte [rsi]
mov byte [r12], al
test bl, 2
jne 0x402210
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rsi]
lea rcx, [r12 + 8]
and rcx, 0xfffffffffffffff8
mov qword [r12], rax
mov eax, ebx
mov rdx, qword [rsi + rax - 8]
mov qword [r12 + rax - 8], rdx
sub r12, rcx
add ebx, r12d
sub rsi, r12
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x402139
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov r8, qword [rsi + rdx]
mov qword [rcx + rdx], r8
cmp eax, ebx
jb 0x40217a
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
add rdi, qword [0x00408618]
mov qword [rdi + 8], rcx
mov r9, rdi
mov qword [rdi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x402110
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.00401fd0
nop dword [rax]
xor edi, edi
jmp 0x402097
mov eax, dword [rsi]
mov ebx, ebx
mov dword [r12], eax
mov eax, dword [rsi + rbx - 4]
mov dword [r12 + rbx - 4], eax
jmp 0x402139
mov ebx, ebx
movzx eax, word [rsi + rbx - 2]
mov word [r12 + rbx - 2], ax
jmp 0x402139
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.00401fd0
mov rax, qword [0x00408618]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rdi + 0x18]
call fcn.00401fd0
nop
nop dword [rax]
Function at 0x402a10
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x00408900]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x004088e0]
test rbx, rbx
je 0x402a64
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x402a5b
test r12, r12
je 0x402a5b
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x402a40
lea rcx, [0x00408900]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x402da0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x004053f0]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x402e19
mov rcx, r10
call fcn.00402c70
test eax, eax
je 0x402e19
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x402e16
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x402e0d
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x402e19
add r8, 0x28
cmp r8, r9
jne 0x402df8
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret
Function at 0x140009e10
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov r15d, edx
lea r14d, [rdx - 1]
mov rdi, rcx
xor r12d, r12d
nop word [rax + rax]
mov esi, r12d
mov ebp, r12d
test r14d, r14d
je 0x14000a01a
mov r8, qword [rdi + 8]
nop dword [rax]
nop word [rax + rax]
lea ecx, [r8 + 0xff]
shl esi, cl
add esi, esi
nop dword [rax + rax]
mov r10, qword [rdi]
mov ecx, dword [r10]
cmp ecx, 0x270
jne 0x140009ed4
lea rax, [r10 + 8]
mov r9d, ecx
nop word [rax + rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x140009e90
mov ecx, dword [r10]
jmp 0x140009fb7
cmp ecx, 0x4e0
jb 0x140009fb7
lea r11, [r10 + 0x9c4]
mov ebx, 0xe3
mov eax, dword [r11]
nop
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140009ef0
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140009f40
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov ecx, r12d
mov dword [r10], r12d
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
mov edx, dword [rdi + 0x10]
cmp eax, edx
ja 0x140009e70
mov r8, qword [rdi + 8]
or esi, eax
lea ecx, [r8 + 0xff]
shl ebp, cl
add ebp, ebp
or ebp, edx
cmp ebp, r14d
jb 0x140009e60
xor edx, edx
mov eax, ebp
div r15d
mov ecx, eax
mov r8d, edx
xor edx, edx
mov eax, esi
div r15d
cmp eax, ecx
jb 0x14000a03a
cmp r8d, r14d
jne 0x140009e40
mov rbx, qword [rsp + 0x20]
mov eax, esi
mov rbp, qword [rsp + 0x28]
xor edx, edx
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
div r15d
mov eax, edx
pop r15
pop r14
pop r12
ret
Function at 0x14000b8d0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x270
mov rax, qword [0x140078038]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edx, edx
mov rbx, rcx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x14000b99a
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x14000b991
mov qword [rsp + 0x288], rdi
nop word [rax + rax]
cmp qword [rbx + 0x18], 8
mov rdx, rbx
jb 0x14000b93d
mov rdx, qword [rbx]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x14000b978
mov r8d, dword [rsp + 0x28]
lea ecx, [rax + 1]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x14000b978
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x14000b930
mov rdi, qword [rsp + 0x288]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140061400
mov rbx, qword [rsp + 0x290]
add rsp, 0x270
pop rsi
ret
Function at 0x140011640
Capabilities:
Stop service

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x140078038]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor edx, edx
mov rdi, rcx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
je 0x1400116b5
mov r8d, 0x24
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
je 0x1400116ac
lea r8, [rsp + 0x20]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, rdi
test eax, eax
jne 0x1400116b9
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
jmp 0x1400116ca
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140061400
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x140013830
Capabilities:
Set registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x140078038]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp qword [rdx + 0x18], 8
mov edi, r9d
mov rsi, qword [rsp + 0x80]
mov rbx, r8
jb 0x14001385f
mov rdx, qword [rdx]
lea rax, [rsp + 0x30]
mov r9d, 2
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400138b5
cmp qword [rbx + 0x18], 8
jb 0x140013886
mov rbx, qword [rbx]
mov eax, dword [rsp + 0x88]
mov r9d, edi
mov rcx, qword [rsp + 0x30]
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rdx, rbx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140061400
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x140013bf0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x19], 0
je 0x140013c13
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x16]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x18
jb 0x140013c00
mov byte [rcx + 0x19], 0
mov rax, rcx
ret

Function at 0x140013c20
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1a], 0
je 0x140013c43
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x16]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x19
jb 0x140013c30
mov byte [rcx + 0x1a], 0
mov rax, rcx
ret

Function at 0x140013c50
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1b], 0
je 0x140013c73
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x16]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1a
jb 0x140013c60
mov byte [rcx + 0x1b], 0
mov rax, rcx
ret

Function at 0x140013c80
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1c], 0
je 0x140013ca3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x16]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1b
jb 0x140013c90
mov byte [rcx + 0x1c], 0
mov rax, rcx
ret

Function at 0x140013cb0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x20], 0
je 0x140013cd3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x16]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1f
jb 0x140013cc0
mov byte [rcx + 0x20], 0
mov rax, rcx
ret

Function at 0x140013ce0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x24], 0
je 0x140013d03
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x16]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x23
jb 0x140013cf0
mov byte [rcx + 0x24], 0
mov rax, rcx
ret

Function at 0x140013d10
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x25], 0
je 0x140013d33
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x16]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x24
jb 0x140013d20
mov byte [rcx + 0x25], 0
mov rax, rcx
ret

Function at 0x140013d40
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x26], 0
je 0x140013d63
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x16]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x25
jb 0x140013d50
mov byte [rcx + 0x26], 0
mov rax, rcx
ret
Function at 0x140013d70
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x27], 0
je 0x140013d93
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x16]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x26
jb 0x140013d80
mov byte [rcx + 0x27], 0
mov rax, rcx
ret

Function at 0x140013da0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2b], 0
je 0x140013dc3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x16]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x2a
jb 0x140013db0
mov byte [rcx + 0x2b], 0
mov rax, rcx
ret

Function at 0x140013dd0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2d], 0
je 0x140013df3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x16]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x2c
jb 0x140013de0
mov byte [rcx + 0x2d], 0
mov rax, rcx
ret

Function at 0x140013e00
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x31], 0
je 0x140013e23
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x16]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x30
jb 0x140013e10
mov byte [rcx + 0x31], 0
mov rax, rcx
ret

Function at 0x140013e30
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x32], 0
je 0x140013e53
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x16]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x31
jb 0x140013e40
mov byte [rcx + 0x32], 0
mov rax, rcx
ret

Function at 0x140013e60
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x33], 0
je 0x140013e83
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x16]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x32
jb 0x140013e70
mov byte [rcx + 0x33], 0
mov rax, rcx
ret

Function at 0x140013e90
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x34], 0
je 0x140013eb3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x16]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x33
jb 0x140013ea0
mov byte [rcx + 0x34], 0
mov rax, rcx
ret

Function at 0x140013ec0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x35], 0
je 0x140013ee3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x16]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x34
jb 0x140013ed0
mov byte [rcx + 0x35], 0
mov rax, rcx
ret

Function at 0x140013ef0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x36], 0
je 0x140013f13
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x16]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x35
jb 0x140013f00
mov byte [rcx + 0x36], 0
mov rax, rcx
ret

Function at 0x140013f20
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x37], 0
je 0x140013f43
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x16]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x36
jb 0x140013f30
mov byte [rcx + 0x37], 0
mov rax, rcx
ret

Function at 0x140013f50
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x38], 0
je 0x140013f73
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x16]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x37
jb 0x140013f60
mov byte [rcx + 0x38], 0
mov rax, rcx
ret
Function at 0x140013f80
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x39], 0
je 0x140013fa3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x16]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x38
jb 0x140013f90
mov byte [rcx + 0x39], 0
mov rax, rcx
ret

Function at 0x140013fb0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x3a], 0
je 0x140013fd3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x16]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x39
jb 0x140013fc0
mov byte [rcx + 0x3a], 0
mov rax, rcx
ret

Function at 0x140013fe0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x3b], 0
je 0x140014003
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x16]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x3a
jb 0x140013ff0
mov byte [rcx + 0x3b], 0
mov rax, rcx
ret

Function at 0x140014010
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x3d], 0
je 0x140014033
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x16]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x3c
jb 0x140014020
mov byte [rcx + 0x3d], 0
mov rax, rcx
ret

Function at 0x140014040
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x3e], 0
je 0x140014063
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x16]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x3d
jb 0x140014050
mov byte [rcx + 0x3e], 0
mov rax, rcx
ret

Function at 0x140014070
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x3f], 0
je 0x140014093
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x16]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x3e
jb 0x140014080
mov byte [rcx + 0x3f], 0
mov rax, rcx
ret

Function at 0x1400140a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x40], 0
je 0x1400140c3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x16]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x3f
jb 0x1400140b0
mov byte [rcx + 0x40], 0
mov rax, rcx
ret

Function at 0x1400140d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x41], 0
je 0x1400140f3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x16]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x40
jb 0x1400140e0
mov byte [rcx + 0x41], 0
mov rax, rcx
ret

Function at 0x140014100
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x42], 0
je 0x140014123
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x16]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x41
jb 0x140014110
mov byte [rcx + 0x42], 0
mov rax, rcx
ret

Function at 0x140014130
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x43], 0
je 0x140014153
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x16]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x42
jb 0x140014140
mov byte [rcx + 0x43], 0
mov rax, rcx
ret

Function at 0x140014160
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x44], 0
je 0x140014183
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x16]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x43
jb 0x140014170
mov byte [rcx + 0x44], 0
mov rax, rcx
ret
Function at 0x140014190
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x45], 0
je 0x1400141b3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x16]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x44
jb 0x1400141a0
mov byte [rcx + 0x45], 0
mov rax, rcx
ret

Function at 0x1400141c0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x46], 0
je 0x1400141e3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x16]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x45
jb 0x1400141d0
mov byte [rcx + 0x46], 0
mov rax, rcx
ret

Function at 0x1400141f0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x140014213
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x16]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x46
jb 0x140014200
mov byte [rcx + 0x47], 0
mov rax, rcx
ret

Function at 0x140014220
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x48], 0
je 0x140014243
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x16]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x47
jb 0x140014230
mov byte [rcx + 0x48], 0
mov rax, rcx
ret

Function at 0x140014250
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x49], 0
je 0x140014273
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x16]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x48
jb 0x140014260
mov byte [rcx + 0x49], 0
mov rax, rcx
ret

Function at 0x140014280
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x4a], 0
je 0x1400142a3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x16]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x49
jb 0x140014290
mov byte [rcx + 0x4a], 0
mov rax, rcx
ret

Function at 0x1400142b0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x4b], 0
je 0x1400142d3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x16]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x4a
jb 0x1400142c0
mov byte [rcx + 0x4b], 0
mov rax, rcx
ret

Function at 0x1400142e0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x4c], 0
je 0x140014303
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x16]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x4b
jb 0x1400142f0
mov byte [rcx + 0x4c], 0
mov rax, rcx
ret

Function at 0x140014310
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x4d], 0
je 0x140014333
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x16]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x4c
jb 0x140014320
mov byte [rcx + 0x4d], 0
mov rax, rcx
ret

Function at 0x140014340
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x4e], 0
je 0x140014363
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x16]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x4d
jb 0x140014350
mov byte [rcx + 0x4e], 0
mov rax, rcx
ret

Function at 0x140014370
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x4f], 0
je 0x140014393
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x16]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x4e
jb 0x140014380
mov byte [rcx + 0x4f], 0
mov rax, rcx
ret
Function at 0x1400143a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x50], 0
je 0x1400143c3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x16]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x4f
jb 0x1400143b0
mov byte [rcx + 0x50], 0
mov rax, rcx
ret

Function at 0x1400143d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x51], 0
je 0x1400143f3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x16]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x50
jb 0x1400143e0
mov byte [rcx + 0x51], 0
mov rax, rcx
ret

Function at 0x140014400
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x52], 0
je 0x140014423
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x16]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x51
jb 0x140014410
mov byte [rcx + 0x52], 0
mov rax, rcx
ret

Function at 0x140014430
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x53], 0
je 0x140014453
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x16]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x52
jb 0x140014440
mov byte [rcx + 0x53], 0
mov rax, rcx
ret

Function at 0x140014460
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x54], 0
je 0x140014483
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x16]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x53
jb 0x140014470
mov byte [rcx + 0x54], 0
mov rax, rcx
ret

Function at 0x140014490
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x55], 0
je 0x1400144b3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x16]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x54
jb 0x1400144a0
mov byte [rcx + 0x55], 0
mov rax, rcx
ret

Function at 0x1400144c0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x56], 0
je 0x1400144e3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x16]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x55
jb 0x1400144d0
mov byte [rcx + 0x56], 0
mov rax, rcx
ret

Function at 0x1400144f0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x57], 0
je 0x140014513
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x16]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x56
jb 0x140014500
mov byte [rcx + 0x57], 0
mov rax, rcx
ret

Function at 0x140014520
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x58], 0
je 0x140014543
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x16]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x57
jb 0x140014530
mov byte [rcx + 0x58], 0
mov rax, rcx
ret

Function at 0x140014550
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x59], 0
je 0x140014573
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x16]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x58
jb 0x140014560
mov byte [rcx + 0x59], 0
mov rax, rcx
ret

Function at 0x140014580
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x5a], 0
je 0x1400145a3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x16]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x59
jb 0x140014590
mov byte [rcx + 0x5a], 0
mov rax, rcx
ret