joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400026e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r10d, r10d
lea r11, str.Aaa_tsympoll_tecommerce_tgathere_tcustomerror_ttrazi_tdfnet_tproduct_tmycgi_trategame_tevil_tkpn_tspeedtest_tlogowanie_texhibitors_tforumbackup_tbelgium_topinions_tepisodes_ttransportation_tchef_tphpsdk_tblogspot_tanimal_tadmentor_tzaehler_tsbd_tbasket_tsnatch_toradata_tmsft_tviewimage
mov r9, rax
sub rbx, rax
lea r8, [rax + 1]
nop word [rax + rax]
movsxd rdx, r10d
movzx eax, dl
movzx eax, byte [rax + r11]
xor al, byte [rbx + r8 - 1]
mov byte [r8 - 1], al
lea rax, [rdx + 1]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8]
mov byte [r8], al
lea rax, [rdx + 2]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 + 1]
mov byte [r8 + 1], al
lea rax, [rdx + 3]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 + 2]
mov byte [r8 + 2], al
lea rax, [rdx + 4]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 + 3]
mov byte [r8 + 3], al
lea rax, [rdx + 5]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 + 4]
mov byte [r8 + 4], al
lea rax, [rdx + 6]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 + 5]
mov byte [r8 + 5], al
lea rax, [rdx + 7]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 + 6]
mov byte [r8 + 6], al
lea rax, [rdx + 8]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 + 7]
mov byte [r8 + 7], al
lea rax, [rdx + 9]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 + 8]
mov byte [r8 + 8], al
lea rax, [rdx + 0xa]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 + 9]
mov byte [r8 + 9], al
lea rax, [rdx + 0xb]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 + 0xa]
mov byte [r8 + 0xa], al
lea rax, [rdx + 0xc]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 + 0xb]
mov byte [r8 + 0xb], al
lea rax, [rdx + 0xd]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 + 0xc]
mov byte [r8 + 0xc], al
lea rax, [rdx + 0xe]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 + 0xd]
mov byte [r8 + 0xd], al
lea rax, [rdx + 0xf]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 + 0xe]
mov byte [r8 + 0xe], al
lea rax, [rdx + 0x10]
movzx ecx, al
lea r8, [r8 + 0x15]
add r10d, 0x15
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 6]
mov byte [r8 - 6], al
lea rax, [rdx + 0x11]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 5]
mov byte [r8 - 5], al
lea rax, [rdx + 0x12]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 4]
mov byte [r8 - 4], al
lea rax, [rdx + 0x13]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 3]
mov byte [r8 - 3], al
lea rax, [rdx + 0x14]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 2]
mov byte [r8 - 2], al
cmp r10d, 0x15
jb 0x140002720
mov rax, r9
add rsp, 0x20
pop rbx
ret
Function at 0x140002900
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 8]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r10d, r10d
lea r11, str.Aaa_tsympoll_tecommerce_tgathere_tcustomerror_ttrazi_tdfnet_tproduct_tmycgi_trategame_tevil_tkpn_tspeedtest_tlogowanie_texhibitors_tforumbackup_tbelgium_topinions_tepisodes_ttransportation_tchef_tphpsdk_tblogspot_tanimal_tadmentor_tzaehler_tsbd_tbasket_tsnatch_toradata_tmsft_tviewimage
mov r9, rax
sub rbx, rax
lea r8, [rax + 1]
nop word [rax + rax]
movsxd rdx, r10d
movzx eax, dl
movzx eax, byte [rax + r11]
xor al, byte [r8 + rbx - 1]
mov byte [r8 - 1], al
lea rax, [rdx + 1]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [r8 + rbx]
mov byte [r8], al
lea rax, [rdx + 2]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 + 1]
mov byte [r8 + 1], al
lea rax, [rdx + 3]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 + 2]
mov byte [r8 + 2], al
lea rax, [rdx + 4]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 + 3]
mov byte [r8 + 3], al
lea rax, [rdx + 5]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 + 4]
mov byte [r8 + 4], al
lea rax, [rdx + 6]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 + 5]
mov byte [r8 + 5], al
lea rax, [rdx + 7]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 + 6]
mov byte [r8 + 6], al
lea rax, [rdx + 8]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 + 7]
mov byte [r8 + 7], al
lea rax, [rdx + 9]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [r8 + rbx + 8]
mov byte [r8 + 8], al
lea rax, [rdx + 0xa]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [r8 + rbx + 9]
mov byte [r8 + 9], al
lea rax, [rdx + 0xb]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [r8 + rbx + 0xa]
mov byte [r8 + 0xa], al
lea rax, [rdx + 0xc]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [r8 + rbx + 0xb]
mov byte [r8 + 0xb], al
lea rax, [rdx + 0xd]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [r8 + rbx + 0xc]
mov byte [r8 + 0xc], al
lea rax, [rdx + 0xe]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [r8 + rbx + 0xd]
mov byte [r8 + 0xd], al
lea rax, [rdx + 0xf]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [r8 + rbx + 0xe]
mov byte [r8 + 0xe], al
add r10d, 0x10
lea r8, [r8 + 0x10]
cmp r10d, 0x10
jb 0x140002940
mov rax, r9
add rsp, 0x20
pop rbx
ret
Function at 0x140002f70
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r10d, r10d
lea r11, str.Aaa_tsympoll_tecommerce_tgathere_tcustomerror_ttrazi_tdfnet_tproduct_tmycgi_trategame_tevil_tkpn_tspeedtest_tlogowanie_texhibitors_tforumbackup_tbelgium_topinions_tepisodes_ttransportation_tchef_tphpsdk_tblogspot_tanimal_tadmentor_tzaehler_tsbd_tbasket_tsnatch_toradata_tmsft_tviewimage
mov r9, rax
sub rbx, rax
lea r8, [rax + 1]
nop word [rax + rax]
movsxd rdx, r10d
lea r8, [r8 + 0xc]
movzx eax, dl
add r10d, 0xc
movzx eax, byte [rax + r11]
xor al, byte [rbx + r8 - 0xd]
mov byte [r8 - 0xd], al
lea rax, [rdx + 1]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 0xc]
mov byte [r8 - 0xc], al
lea rax, [rdx + 2]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 0xb]
mov byte [r8 - 0xb], al
lea rax, [rdx + 3]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 0xa]
mov byte [r8 - 0xa], al
lea rax, [rdx + 4]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 9]
mov byte [r8 - 9], al
lea rax, [rdx + 5]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 8]
mov byte [r8 - 8], al
lea rax, [rdx + 6]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 7]
mov byte [r8 - 7], al
lea rax, [rdx + 7]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 6]
mov byte [r8 - 6], al
lea rax, [rdx + 8]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 5]
mov byte [r8 - 5], al
lea rax, [rdx + 9]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 4]
mov byte [r8 - 4], al
lea rax, [rdx + 0xa]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 3]
mov byte [r8 - 3], al
lea rax, [rdx + 0xb]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 2]
mov byte [r8 - 2], al
cmp r10d, 0xc
jb 0x140002fb0
mov rax, r9
add rsp, 0x20
pop rbx
ret
Function at 0x1400030d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx - 2]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r10d, r10d
lea r11, str.Aaa_tsympoll_tecommerce_tgathere_tcustomerror_ttrazi_tdfnet_tproduct_tmycgi_trategame_tevil_tkpn_tspeedtest_tlogowanie_texhibitors_tforumbackup_tbelgium_topinions_tepisodes_ttransportation_tchef_tphpsdk_tblogspot_tanimal_tadmentor_tzaehler_tsbd_tbasket_tsnatch_toradata_tmsft_tviewimage
mov r9, rax
sub rbx, rax
lea rdx, [rax + 1]
nop word [rax + rax]
movsxd r8, r10d
lea rdx, [rdx + 6]
movzx eax, r8b
add r10d, 6
movzx eax, byte [rax + r11]
xor al, byte [rbx + rdx - 7]
mov byte [rdx - 7], al
lea rax, [r8 + 1]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rdx + rbx - 6]
mov byte [rdx - 6], al
lea rax, [r8 + 2]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + rdx - 5]
mov byte [rdx - 5], al
lea rax, [r8 + 3]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + rdx - 4]
mov byte [rdx - 4], al
lea rax, [r8 + 4]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + rdx - 3]
mov byte [rdx - 3], al
lea rax, [r8 + 5]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + rdx - 2]
mov byte [rdx - 2], al
cmp r10d, 6
jb 0x140003110
mov rax, r9
add rsp, 0x20
pop rbx
ret
Function at 0x1400031a0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 9]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r10d, r10d
lea r11, str.Aaa_tsympoll_tecommerce_tgathere_tcustomerror_ttrazi_tdfnet_tproduct_tmycgi_trategame_tevil_tkpn_tspeedtest_tlogowanie_texhibitors_tforumbackup_tbelgium_topinions_tepisodes_ttransportation_tchef_tphpsdk_tblogspot_tanimal_tadmentor_tzaehler_tsbd_tbasket_tsnatch_toradata_tmsft_tviewimage
mov r9, rax
sub rbx, rax
lea r8, [rax + 1]
nop word [rax + rax]
movsxd rdx, r10d
movzx eax, dl
movzx eax, byte [rax + r11]
xor al, byte [r8 + rbx - 1]
mov byte [r8 - 1], al
lea rax, [rdx + 1]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [r8 + rbx]
mov byte [r8], al
lea rax, [rdx + 2]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [r8 + rbx + 1]
mov byte [r8 + 1], al
lea rax, [rdx + 3]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [r8 + rbx + 2]
mov byte [r8 + 2], al
lea rax, [rdx + 4]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [r8 + rbx + 3]
mov byte [r8 + 3], al
lea rax, [rdx + 5]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [r8 + rbx + 4]
mov byte [r8 + 4], al
lea rax, [rdx + 6]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [r8 + rbx + 5]
mov byte [r8 + 5], al
lea rax, [rdx + 7]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [r8 + rbx + 6]
mov byte [r8 + 6], al
lea rax, [rdx + 8]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [r8 + rbx + 7]
mov byte [r8 + 7], al
lea rax, [rdx + 9]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [r8 + rbx + 8]
mov byte [r8 + 8], al
lea rax, [rdx + 0xa]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [r8 + rbx + 9]
mov byte [r8 + 9], al
lea rax, [rdx + 0xb]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [r8 + rbx + 0xa]
mov byte [r8 + 0xa], al
lea rax, [rdx + 0xc]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [r8 + rbx + 0xb]
mov byte [r8 + 0xb], al
lea rax, [rdx + 0xd]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [r8 + rbx + 0xc]
mov byte [r8 + 0xc], al
lea rax, [rdx + 0xe]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [r8 + rbx + 0xd]
mov byte [r8 + 0xd], al
lea rax, [rdx + 0xf]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [r8 + rbx + 0xe]
mov byte [r8 + 0xe], al
lea rax, [rdx + 0x10]
movzx ecx, al
lea r8, [r8 + 0x11]
add r10d, 0x11
movzx eax, byte [rcx + r11]
xor al, byte [r8 + rbx - 2]
mov byte [r8 - 2], al
cmp r10d, 0x11
jb 0x1400031e0
mov rax, r9
add rsp, 0x20
pop rbx
ret
Function at 0x140003360
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0xb]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r10d, r10d
lea r11, str.Aaa_tsympoll_tecommerce_tgathere_tcustomerror_ttrazi_tdfnet_tproduct_tmycgi_trategame_tevil_tkpn_tspeedtest_tlogowanie_texhibitors_tforumbackup_tbelgium_topinions_tepisodes_ttransportation_tchef_tphpsdk_tblogspot_tanimal_tadmentor_tzaehler_tsbd_tbasket_tsnatch_toradata_tmsft_tviewimage
mov r9, rax
sub rbx, rax
lea r8, [rax + 1]
nop word [rax + rax]
movsxd rdx, r10d
movzx eax, dl
movzx eax, byte [rax + r11]
xor al, byte [rbx + r8 - 1]
mov byte [r8 - 1], al
lea rax, [rdx + 1]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8]
mov byte [r8], al
lea rax, [rdx + 2]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 + 1]
mov byte [r8 + 1], al
lea rax, [rdx + 3]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 + 2]
mov byte [r8 + 2], al
lea rax, [rdx + 4]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 + 3]
mov byte [r8 + 3], al
lea rax, [rdx + 5]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 + 4]
mov byte [r8 + 4], al
lea rax, [rdx + 6]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 + 5]
mov byte [r8 + 5], al
lea rax, [rdx + 7]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 + 6]
mov byte [r8 + 6], al
lea rax, [rdx + 8]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 + 7]
mov byte [r8 + 7], al
lea rax, [rdx + 9]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 + 8]
mov byte [r8 + 8], al
lea rax, [rdx + 0xa]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 + 9]
mov byte [r8 + 9], al
lea rax, [rdx + 0xb]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 + 0xa]
mov byte [r8 + 0xa], al
lea rax, [rdx + 0xc]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 + 0xb]
mov byte [r8 + 0xb], al
lea rax, [rdx + 0xd]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 + 0xc]
mov byte [r8 + 0xc], al
lea rax, [rdx + 0xe]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 + 0xd]
mov byte [r8 + 0xd], al
lea rax, [rdx + 0xf]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 + 0xe]
mov byte [r8 + 0xe], al
lea rax, [rdx + 0x10]
movzx ecx, al
lea r8, [r8 + 0x13]
add r10d, 0x13
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 4]
mov byte [r8 - 4], al
lea rax, [rdx + 0x11]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 3]
mov byte [r8 - 3], al
lea rax, [rdx + 0x12]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 2]
mov byte [r8 - 2], al
cmp r10d, 0x13
jb 0x1400033a0
mov rax, r9
add rsp, 0x20
pop rbx
ret
Function at 0x140003550
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 5]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r10d, r10d
lea r11, str.Aaa_tsympoll_tecommerce_tgathere_tcustomerror_ttrazi_tdfnet_tproduct_tmycgi_trategame_tevil_tkpn_tspeedtest_tlogowanie_texhibitors_tforumbackup_tbelgium_topinions_tepisodes_ttransportation_tchef_tphpsdk_tblogspot_tanimal_tadmentor_tzaehler_tsbd_tbasket_tsnatch_toradata_tmsft_tviewimage
mov r9, rax
sub rbx, rax
lea r8, [rax + 1]
nop word [rax + rax]
movsxd rdx, r10d
lea r8, [r8 + 0xd]
movzx eax, dl
add r10d, 0xd
movzx eax, byte [rax + r11]
xor al, byte [rbx + r8 - 0xe]
mov byte [r8 - 0xe], al
lea rax, [rdx + 1]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 0xd]
mov byte [r8 - 0xd], al
lea rax, [rdx + 2]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 0xc]
mov byte [r8 - 0xc], al
lea rax, [rdx + 3]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 0xb]
mov byte [r8 - 0xb], al
lea rax, [rdx + 4]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 0xa]
mov byte [r8 - 0xa], al
lea rax, [rdx + 5]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 9]
mov byte [r8 - 9], al
lea rax, [rdx + 6]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 8]
mov byte [r8 - 8], al
lea rax, [rdx + 7]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 7]
mov byte [r8 - 7], al
lea rax, [rdx + 8]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 6]
mov byte [r8 - 6], al
lea rax, [rdx + 9]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 5]
mov byte [r8 - 5], al
lea rax, [rdx + 0xa]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 4]
mov byte [r8 - 4], al
lea rax, [rdx + 0xb]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 3]
mov byte [r8 - 3], al
lea rax, [rdx + 0xc]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 2]
mov byte [r8 - 2], al
cmp r10d, 0xd
jb 0x140003590
mov rax, r9
add rsp, 0x20
pop rbx
ret
Function at 0x1400036c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 7]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r10d, r10d
lea r11, str.Aaa_tsympoll_tecommerce_tgathere_tcustomerror_ttrazi_tdfnet_tproduct_tmycgi_trategame_tevil_tkpn_tspeedtest_tlogowanie_texhibitors_tforumbackup_tbelgium_topinions_tepisodes_ttransportation_tchef_tphpsdk_tblogspot_tanimal_tadmentor_tzaehler_tsbd_tbasket_tsnatch_toradata_tmsft_tviewimage
mov r9, rax
sub rbx, rax
lea r8, [rax + 1]
nop word [rax + rax]
movsxd rdx, r10d
lea r8, [r8 + 0xf]
movzx eax, dl
add r10d, 0xf
movzx eax, byte [rax + r11]
xor al, byte [r8 + rbx - 0x10]
mov byte [r8 - 0x10], al
lea rax, [rdx + 1]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 0xf]
mov byte [r8 - 0xf], al
lea rax, [rdx + 2]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 0xe]
mov byte [r8 - 0xe], al
lea rax, [rdx + 3]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 0xd]
mov byte [r8 - 0xd], al
lea rax, [rdx + 4]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 0xc]
mov byte [r8 - 0xc], al
lea rax, [rdx + 5]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 0xb]
mov byte [r8 - 0xb], al
lea rax, [rdx + 6]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 0xa]
mov byte [r8 - 0xa], al
lea rax, [rdx + 7]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 9]
mov byte [r8 - 9], al
lea rax, [rdx + 8]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 8]
mov byte [r8 - 8], al
lea rax, [rdx + 9]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 7]
mov byte [r8 - 7], al
lea rax, [rdx + 0xa]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 6]
mov byte [r8 - 6], al
lea rax, [rdx + 0xb]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 5]
mov byte [r8 - 5], al
lea rax, [rdx + 0xc]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 4]
mov byte [r8 - 4], al
lea rax, [rdx + 0xd]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 3]
mov byte [r8 - 3], al
lea rax, [rdx + 0xe]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [r8 + rbx - 2]
mov byte [r8 - 2], al
cmp r10d, 0xf
jb 0x140003700
mov rax, r9
add rsp, 0x20
pop rbx
ret
Function at 0x140003860
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r10d, r10d
lea r11, str.Aaa_tsympoll_tecommerce_tgathere_tcustomerror_ttrazi_tdfnet_tproduct_tmycgi_trategame_tevil_tkpn_tspeedtest_tlogowanie_texhibitors_tforumbackup_tbelgium_topinions_tepisodes_ttransportation_tchef_tphpsdk_tblogspot_tanimal_tadmentor_tzaehler_tsbd_tbasket_tsnatch_toradata_tmsft_tviewimage
mov r9, rax
sub rbx, rax
lea r8, [rax + 2]
nop word [rax + rax]
movsxd rdx, r10d
lea r8, [r8 + 0xc]
movzx eax, dl
add r10d, 6
movzx eax, byte [rax + r11]
xor al, byte [r8 + rbx - 0xe]
movsx eax, al
mov word [r8 - 0xe], ax
lea rax, [rdx + 1]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [r8 + rbx - 0xc]
movsx eax, al
mov word [r8 - 0xc], ax
lea rax, [rdx + 2]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 0xa]
movsx eax, al
mov word [r8 - 0xa], ax
lea rax, [rdx + 3]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 8]
movsx eax, al
mov word [r8 - 8], ax
lea rax, [rdx + 4]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 6]
movsx eax, al
mov word [r8 - 6], ax
lea rax, [rdx + 5]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 4]
movsx eax, al
mov word [r8 - 4], ax
cmp r10d, 6
jb 0x1400038a0
mov rax, r9
add rsp, 0x20
pop rbx
ret
Function at 0x140003950
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0xe]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r10d, r10d
lea r11, str.Aaa_tsympoll_tecommerce_tgathere_tcustomerror_ttrazi_tdfnet_tproduct_tmycgi_trategame_tevil_tkpn_tspeedtest_tlogowanie_texhibitors_tforumbackup_tbelgium_topinions_tepisodes_ttransportation_tchef_tphpsdk_tblogspot_tanimal_tadmentor_tzaehler_tsbd_tbasket_tsnatch_toradata_tmsft_tviewimage
mov r9, rax
sub rbx, rax
lea r8, [rax + 2]
nop word [rax + rax]
movsxd rdx, r10d
lea r8, [r8 + 0x16]
movzx eax, dl
add r10d, 0xb
movzx eax, byte [rax + r11]
xor al, byte [rbx + r8 - 0x18]
movsx eax, al
mov word [r8 - 0x18], ax
lea rax, [rdx + 1]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 0x16]
movsx eax, al
mov word [r8 - 0x16], ax
lea rax, [rdx + 2]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 0x14]
movsx eax, al
mov word [r8 - 0x14], ax
lea rax, [rdx + 3]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 0x12]
movsx eax, al
mov word [r8 - 0x12], ax
lea rax, [rdx + 4]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 0x10]
movsx eax, al
mov word [r8 - 0x10], ax
lea rax, [rdx + 5]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 0xe]
movsx eax, al
mov word [r8 - 0xe], ax
lea rax, [rdx + 6]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 0xc]
movsx eax, al
mov word [r8 - 0xc], ax
lea rax, [rdx + 7]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 0xa]
movsx eax, al
mov word [r8 - 0xa], ax
lea rax, [rdx + 8]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 8]
movsx eax, al
mov word [r8 - 8], ax
lea rax, [rdx + 9]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 6]
movsx eax, al
mov word [r8 - 6], ax
lea rax, [rdx + 0xa]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 4]
movsx eax, al
mov word [r8 - 4], ax
cmp r10d, 0xb
jb 0x140003990
mov rax, r9
add rsp, 0x20
pop rbx
ret