joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001180
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 6]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r10d, r10d
lea r11, [0x14000e040]
mov r9, rax
sub rbx, rax
lea r8, [rax + 1]
nop word [rax + rax]
movsxd rdx, r10d
lea r8, [r8 + 0xe]
movzx eax, dl
add r10d, 0xe
movzx eax, byte [rax + r11]
xor al, byte [rbx + r8 - 0xf]
mov byte [r8 - 0xf], al
lea rax, [rdx + 1]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 0xe]
mov byte [r8 - 0xe], al
lea rax, [rdx + 2]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 0xd]
mov byte [r8 - 0xd], al
lea rax, [rdx + 3]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 0xc]
mov byte [r8 - 0xc], al
lea rax, [rdx + 4]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 0xb]
mov byte [r8 - 0xb], al
lea rax, [rdx + 5]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 0xa]
mov byte [r8 - 0xa], al
lea rax, [rdx + 6]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 9]
mov byte [r8 - 9], al
lea rax, [rdx + 7]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 8]
mov byte [r8 - 8], al
lea rax, [rdx + 8]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 7]
mov byte [r8 - 7], al
lea rax, [rdx + 9]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 6]
mov byte [r8 - 6], al
lea rax, [rdx + 0xa]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 5]
mov byte [r8 - 5], al
lea rax, [rdx + 0xb]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 4]
mov byte [r8 - 4], al
lea rax, [rdx + 0xc]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 3]
mov byte [r8 - 3], al
lea rax, [rdx + 0xd]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 2]
mov byte [r8 - 2], al
cmp r10d, 0xe
jb 0x1400011c0
mov rax, r9
add rsp, 0x20
pop rbx
ret

Function at 0x140001300
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0x72]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r9d, r9d
lea r11, [0x14000e040]
mov r10, rax
sub rbx, rax
lea rdx, [rax + 1]
nop word [rax + rax]
movsxd r8, r9d
lea rdx, [rdx + 2]
movzx ecx, r8b
add r9d, 2
movzx eax, byte [rcx + r11]
xor al, byte [rbx + rdx - 3]
mov byte [rdx - 3], al
lea rax, [r8 + 1]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + rdx - 2]
mov byte [rdx - 2], al
cmp r9d, 0x7a
jb 0x140001340
mov rax, r10
add rsp, 0x20
pop rbx
ret
Function at 0x140001380
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r10d, r10d
lea r11, [0x14000e040]
mov r9, rax
sub rbx, rax
lea r8, [rax + 1]
nop word [rax + rax]
movsxd rdx, r10d
lea r8, [r8 + 0xb]
movzx eax, dl
add r10d, 0xb
movzx eax, byte [rax + r11]
xor al, byte [rbx + r8 - 0xc]
mov byte [r8 - 0xc], al
lea rax, [rdx + 1]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 0xb]
mov byte [r8 - 0xb], al
lea rax, [rdx + 2]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 0xa]
mov byte [r8 - 0xa], al
lea rax, [rdx + 3]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 9]
mov byte [r8 - 9], al
lea rax, [rdx + 4]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 8]
mov byte [r8 - 8], al
lea rax, [rdx + 5]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 7]
mov byte [r8 - 7], al
lea rax, [rdx + 6]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 6]
mov byte [r8 - 6], al
lea rax, [rdx + 7]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 5]
mov byte [r8 - 5], al
lea rax, [rdx + 8]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 4]
mov byte [r8 - 4], al
lea rax, [rdx + 9]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 3]
mov byte [r8 - 3], al
lea rax, [rdx + 0xa]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 2]
mov byte [r8 - 2], al
cmp r10d, 0xb
jb 0x1400013c0
mov rax, r9
add rsp, 0x20
pop rbx
ret

Function at 0x140001570
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx - 6]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r9d, r9d
lea r11, [0x14000e140]
mov r10, rax
sub rbx, rax
lea rdx, [rax + 1]
nop word [rax + rax]
movsxd r8, r9d
lea rdx, [rdx + 2]
movzx ecx, r8b
add r9d, 2
movzx eax, byte [rcx + r11]
xor al, byte [rbx + rdx - 3]
mov byte [rdx - 3], al
lea rax, [r8 + 1]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + rdx - 2]
mov byte [rdx - 2], al
cmp r9d, 2
jb 0x1400015b0
mov rax, r10
add rsp, 0x20
pop rbx
ret
Function at 0x1400015f0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0x39]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r10d, r10d
lea r11, [0x14000e140]
mov r9, rax
sub rbx, rax
lea r8, [rax + 1]
nop word [rax + rax]
movsxd rdx, r10d
lea r8, [r8 + 0xd]
movzx eax, dl
add r10d, 0xd
movzx eax, byte [rax + r11]
xor al, byte [rbx + r8 - 0xe]
mov byte [r8 - 0xe], al
lea rax, [rdx + 1]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 0xd]
mov byte [r8 - 0xd], al
lea rax, [rdx + 2]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 0xc]
mov byte [r8 - 0xc], al
lea rax, [rdx + 3]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 0xb]
mov byte [r8 - 0xb], al
lea rax, [rdx + 4]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 0xa]
mov byte [r8 - 0xa], al
lea rax, [rdx + 5]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 9]
mov byte [r8 - 9], al
lea rax, [rdx + 6]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 8]
mov byte [r8 - 8], al
lea rax, [rdx + 7]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 7]
mov byte [r8 - 7], al
lea rax, [rdx + 8]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 6]
mov byte [r8 - 6], al
lea rax, [rdx + 9]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 5]
mov byte [r8 - 5], al
lea rax, [rdx + 0xa]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 4]
mov byte [r8 - 4], al
lea rax, [rdx + 0xb]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 3]
mov byte [r8 - 3], al
lea rax, [rdx + 0xc]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 2]
mov byte [r8 - 2], al
cmp r10d, 0x41
jb 0x140001630
mov rax, r9
add rsp, 0x20
pop rbx
ret
Function at 0x140001ac0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 6]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r10d, r10d
lea r11, [0x14000e340]
mov r9, rax
sub rbx, rax
lea r8, [rax + 2]
nop word [rax + rax]
movsxd rdx, r10d
lea r8, [r8 + 0xe]
movzx eax, dl
add r10d, 7
movzx eax, byte [rax + r11]
xor al, byte [r8 + rbx - 0x10]
movsx eax, al
mov word [r8 - 0x10], ax
lea rax, [rdx + 1]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [r8 + rbx - 0xe]
movsx eax, al
mov word [r8 - 0xe], ax
lea rax, [rdx + 2]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [r8 + rbx - 0xc]
movsx eax, al
mov word [r8 - 0xc], ax
lea rax, [rdx + 3]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [r8 + rbx - 0xa]
movsx eax, al
mov word [r8 - 0xa], ax
lea rax, [rdx + 4]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [r8 + rbx - 8]
movsx eax, al
mov word [r8 - 8], ax
lea rax, [rdx + 5]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [r8 + rbx - 6]
movsx eax, al
mov word [r8 - 6], ax
lea rax, [rdx + 6]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [r8 + rbx - 4]
movsx eax, al
mov word [r8 - 4], ax
cmp r10d, 7
jb 0x140001b00
mov rax, r9
add rsp, 0x20
pop rbx
ret

Function at 0x140001bd0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 8]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r10d, r10d
lea r11, [0x14000e340]
mov r9, rax
sub rbx, rax
lea r8, [rax + 2]
nop word [rax + rax]
movsxd rdx, r10d
lea r8, [r8 + 0x10]
movzx eax, dl
add r10d, 8
movzx eax, byte [rax + r11]
xor al, byte [rbx + r8 - 0x12]
movsx eax, al
mov word [r8 - 0x12], ax
lea rax, [rdx + 1]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 0x10]
movsx eax, al
mov word [r8 - 0x10], ax
lea rax, [rdx + 2]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 0xe]
movsx eax, al
mov word [r8 - 0xe], ax
lea rax, [rdx + 3]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 0xc]
movsx eax, al
mov word [r8 - 0xc], ax
lea rax, [rdx + 4]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 0xa]
movsx eax, al
mov word [r8 - 0xa], ax
lea rax, [rdx + 5]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 8]
movsx eax, al
mov word [r8 - 8], ax
lea rax, [rdx + 6]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 6]
movsx eax, al
mov word [r8 - 6], ax
lea rax, [rdx + 7]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 4]
movsx eax, al
mov word [r8 - 4], ax
cmp r10d, 8
jb 0x140001c10
mov rax, r9
add rsp, 0x20
pop rbx
ret
Function at 0x140001d00
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r10d, r10d
lea r11, [0x14000e340]
mov r9, rax
sub rbx, rax
lea rdx, [rax + 2]
nop word [rax + rax]
movsxd r8, r10d
lea rdx, [rdx + 0xa]
movzx eax, r8b
add r10d, 5
movzx eax, byte [rax + r11]
xor al, byte [rbx + rdx - 0xc]
movsx eax, al
mov word [rdx - 0xc], ax
lea rax, [r8 + 1]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rdx + rbx - 0xa]
movsx eax, al
mov word [rdx - 0xa], ax
lea rax, [r8 + 2]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + rdx - 8]
movsx eax, al
mov word [rdx - 8], ax
lea rax, [r8 + 3]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + rdx - 6]
movsx eax, al
mov word [rdx - 6], ax
lea rax, [r8 + 4]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + rdx - 4]
movsx eax, al
mov word [rdx - 4], ax
cmp r10d, 5
jb 0x140001d40
mov rax, r9
add rsp, 0x20
pop rbx
ret

Function at 0x140001dd0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0xa]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r10d, r10d
lea r11, [0x14000e340]
mov r9, rax
sub rbx, rax
lea r8, [rax + 2]
nop word [rax + rax]
movsxd rdx, r10d
lea r8, [r8 + 0x12]
movzx eax, dl
add r10d, 9
movzx eax, byte [rax + r11]
xor al, byte [rbx + r8 - 0x14]
movsx eax, al
mov word [r8 - 0x14], ax
lea rax, [rdx + 1]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 0x12]
movsx eax, al
mov word [r8 - 0x12], ax
lea rax, [rdx + 2]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 0x10]
movsx eax, al
mov word [r8 - 0x10], ax
lea rax, [rdx + 3]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 0xe]
movsx eax, al
mov word [r8 - 0xe], ax
lea rax, [rdx + 4]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 0xc]
movsx eax, al
mov word [r8 - 0xc], ax
lea rax, [rdx + 5]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 0xa]
movsx eax, al
mov word [r8 - 0xa], ax
lea rax, [rdx + 6]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 8]
movsx eax, al
mov word [r8 - 8], ax
lea rax, [rdx + 7]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 6]
movsx eax, al
mov word [r8 - 6], ax
lea rax, [rdx + 8]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 4]
movsx eax, al
mov word [r8 - 4], ax
cmp r10d, 9
jb 0x140001e10
mov rax, r9
add rsp, 0x20
pop rbx
ret
Function at 0x140001f10
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx - 4]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r9d, r9d
lea r11, [0x14000e340]
mov r10, rax
sub rbx, rax
lea rdx, [rax + 2]
nop word [rax + rax]
movsxd r8, r9d
lea rdx, [rdx + 4]
movzx ecx, r8b
add r9d, 2
movzx eax, byte [rcx + r11]
xor al, byte [rbx + rdx - 6]
movsx eax, al
mov word [rdx - 6], ax
lea rax, [r8 + 1]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + rdx - 4]
movsx eax, al
mov word [rdx - 4], ax
cmp r9d, 2
jb 0x140001f50
mov rax, r10
add rsp, 0x20
pop rbx
ret

Function at 0x140001fa0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx - 2]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r9d, r9d
lea r11, [0x14000e340]
mov r10, rax
sub rbx, rax
lea rdx, [rax + 2]
nop word [rax + rax]
movsxd r8, r9d
lea rdx, [rdx + 6]
movzx eax, r8b
add r9d, 3
movzx eax, byte [rax + r11]
xor al, byte [rbx + rdx - 8]
movsx eax, al
mov word [rdx - 8], ax
lea rax, [r8 + 1]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rdx + rbx - 6]
movsx eax, al
mov word [rdx - 6], ax
lea rax, [r8 + 2]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + rdx - 4]
movsx eax, al
mov word [rdx - 4], ax
cmp r9d, 3
jb 0x140001fe0
mov rax, r10
add rsp, 0x20
pop rbx
ret
Function at 0x140002040
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0xc]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r10d, r10d
lea r11, [0x14000e640]
mov r9, rax
sub rbx, rax
lea r8, [rax + 1]
nop word [rax + rax]
movsxd rdx, r10d
movzx eax, dl
movzx eax, byte [rax + r11]
xor al, byte [rbx + r8 - 1]
mov byte [r8 - 1], al
lea rax, [rdx + 1]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8]
mov byte [r8], al
lea rax, [rdx + 2]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 + 1]
mov byte [r8 + 1], al
lea rax, [rdx + 3]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 + 2]
mov byte [r8 + 2], al
lea rax, [rdx + 4]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 + 3]
mov byte [r8 + 3], al
lea rax, [rdx + 5]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 + 4]
mov byte [r8 + 4], al
lea rax, [rdx + 6]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 + 5]
mov byte [r8 + 5], al
lea rax, [rdx + 7]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 + 6]
mov byte [r8 + 6], al
lea rax, [rdx + 8]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 + 7]
mov byte [r8 + 7], al
lea rax, [rdx + 9]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 + 8]
mov byte [r8 + 8], al
lea rax, [rdx + 0xa]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 + 9]
mov byte [r8 + 9], al
lea rax, [rdx + 0xb]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 + 0xa]
mov byte [r8 + 0xa], al
lea rax, [rdx + 0xc]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 + 0xb]
mov byte [r8 + 0xb], al
lea rax, [rdx + 0xd]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 + 0xc]
mov byte [r8 + 0xc], al
lea rax, [rdx + 0xe]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 + 0xd]
mov byte [r8 + 0xd], al
lea rax, [rdx + 0xf]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 + 0xe]
mov byte [r8 + 0xe], al
lea rax, [rdx + 0x10]
movzx ecx, al
lea r8, [r8 + 0x14]
add r10d, 0x14
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 5]
mov byte [r8 - 5], al
lea rax, [rdx + 0x11]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 4]
mov byte [r8 - 4], al
lea rax, [rdx + 0x12]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 3]
mov byte [r8 - 3], al
lea rax, [rdx + 0x13]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 2]
mov byte [r8 - 2], al
cmp r10d, 0x14
jb 0x140002080
mov rax, r9
add rsp, 0x20
pop rbx
ret
Function at 0x140002240
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0x10]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r10d, r10d
lea r11, str.Aaa_tsympoll_tecommerce_tgathere_tcustomerror_ttrazi_tdfnet_tproduct_tmycgi_trategame_tevil_tkpn_tspeedtest_tlogowanie_texhibitors_tforumbackup_tbelgium_topinions_tepisodes_ttransportation_tchef_tphpsdk_tblogspot_tanimal_tadmentor_tzaehler_tsbd_tbasket_tsnatch_toradata_tmsft_tviewimage
mov r9, rax
sub rbx, rax
lea r8, [rax + 2]
nop word [rax + rax]
movsxd rdx, r10d
lea r8, [r8 + 0x18]
movzx eax, dl
add r10d, 0xc
movzx eax, byte [rax + r11]
xor al, byte [rbx + r8 - 0x1a]
movsx eax, al
mov word [r8 - 0x1a], ax
lea rax, [rdx + 1]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 0x18]
movsx eax, al
mov word [r8 - 0x18], ax
lea rax, [rdx + 2]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 0x16]
movsx eax, al
mov word [r8 - 0x16], ax
lea rax, [rdx + 3]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 0x14]
movsx eax, al
mov word [r8 - 0x14], ax
lea rax, [rdx + 4]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 0x12]
movsx eax, al
mov word [r8 - 0x12], ax
lea rax, [rdx + 5]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 0x10]
movsx eax, al
mov word [r8 - 0x10], ax
lea rax, [rdx + 6]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 0xe]
movsx eax, al
mov word [r8 - 0xe], ax
lea rax, [rdx + 7]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 0xc]
movsx eax, al
mov word [r8 - 0xc], ax
lea rax, [rdx + 8]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 0xa]
movsx eax, al
mov word [r8 - 0xa], ax
lea rax, [rdx + 9]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 8]
movsx eax, al
mov word [r8 - 8], ax
lea rax, [rdx + 0xa]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 6]
movsx eax, al
mov word [r8 - 6], ax
lea rax, [rdx + 0xb]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 4]
movsx eax, al
mov word [r8 - 4], ax
cmp r10d, 0xc
jb 0x140002280
mov rax, r9
add rsp, 0x20
pop rbx
ret
Function at 0x1400023d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0xa]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r10d, r10d
lea r11, str.Aaa_tsympoll_tecommerce_tgathere_tcustomerror_ttrazi_tdfnet_tproduct_tmycgi_trategame_tevil_tkpn_tspeedtest_tlogowanie_texhibitors_tforumbackup_tbelgium_topinions_tepisodes_ttransportation_tchef_tphpsdk_tblogspot_tanimal_tadmentor_tzaehler_tsbd_tbasket_tsnatch_toradata_tmsft_tviewimage
mov r9, rax
sub rbx, rax
lea r8, [rax + 1]
nop word [rax + rax]
movsxd rdx, r10d
movzx eax, dl
movzx eax, byte [rax + r11]
xor al, byte [r8 + rbx - 1]
mov byte [r8 - 1], al
lea rax, [rdx + 1]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [r8 + rbx]
mov byte [r8], al
lea rax, [rdx + 2]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [r8 + rbx + 1]
mov byte [r8 + 1], al
lea rax, [rdx + 3]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [r8 + rbx + 2]
mov byte [r8 + 2], al
lea rax, [rdx + 4]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [r8 + rbx + 3]
mov byte [r8 + 3], al
lea rax, [rdx + 5]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [r8 + rbx + 4]
mov byte [r8 + 4], al
lea rax, [rdx + 6]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [r8 + rbx + 5]
mov byte [r8 + 5], al
lea rax, [rdx + 7]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [r8 + rbx + 6]
mov byte [r8 + 6], al
lea rax, [rdx + 8]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [r8 + rbx + 7]
mov byte [r8 + 7], al
lea rax, [rdx + 9]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [r8 + rbx + 8]
mov byte [r8 + 8], al
lea rax, [rdx + 0xa]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [r8 + rbx + 9]
mov byte [r8 + 9], al
lea rax, [rdx + 0xb]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [r8 + rbx + 0xa]
mov byte [r8 + 0xa], al
lea rax, [rdx + 0xc]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [r8 + rbx + 0xb]
mov byte [r8 + 0xb], al
lea rax, [rdx + 0xd]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [r8 + rbx + 0xc]
mov byte [r8 + 0xc], al
lea rax, [rdx + 0xe]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [r8 + rbx + 0xd]
mov byte [r8 + 0xd], al
lea rax, [rdx + 0xf]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [r8 + rbx + 0xe]
mov byte [r8 + 0xe], al
lea rax, [rdx + 0x10]
movzx ecx, al
lea r8, [r8 + 0x12]
add r10d, 0x12
movzx eax, byte [rcx + r11]
xor al, byte [r8 + rbx - 3]
mov byte [r8 - 3], al
lea rax, [rdx + 0x11]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [r8 + rbx - 2]
mov byte [r8 - 2], al
cmp r10d, 0x12
jb 0x140002410
mov rax, r9
add rsp, 0x20
pop rbx
ret
Function at 0x1400025b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r10d, r10d
lea r11, str.Aaa_tsympoll_tecommerce_tgathere_tcustomerror_ttrazi_tdfnet_tproduct_tmycgi_trategame_tevil_tkpn_tspeedtest_tlogowanie_texhibitors_tforumbackup_tbelgium_topinions_tepisodes_ttransportation_tchef_tphpsdk_tblogspot_tanimal_tadmentor_tzaehler_tsbd_tbasket_tsnatch_toradata_tmsft_tviewimage
mov r9, rax
sub rbx, rax
lea r8, [rax + 1]
nop word [rax + rax]
movsxd rdx, r10d
lea r8, [r8 + 0xa]
movzx eax, dl
add r10d, 0xa
movzx eax, byte [rax + r11]
xor al, byte [rbx + r8 - 0xb]
mov byte [r8 - 0xb], al
lea rax, [rdx + 1]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 0xa]
mov byte [r8 - 0xa], al
lea rax, [rdx + 2]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 9]
mov byte [r8 - 9], al
lea rax, [rdx + 3]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 8]
mov byte [r8 - 8], al
lea rax, [rdx + 4]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 7]
mov byte [r8 - 7], al
lea rax, [rdx + 5]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 6]
mov byte [r8 - 6], al
lea rax, [rdx + 6]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 5]
mov byte [r8 - 5], al
lea rax, [rdx + 7]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 4]
mov byte [r8 - 4], al
lea rax, [rdx + 8]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 3]
mov byte [r8 - 3], al
lea rax, [rdx + 9]
movzx ecx, al
movzx eax, byte [rcx + r11]
xor al, byte [rbx + r8 - 2]
mov byte [r8 - 2], al
cmp r10d, 0xa
jb 0x1400025f0
mov rax, r9
add rsp, 0x20
pop rbx
ret