joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140011970
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
cmp byte [rcx + 0x22], 0
mov rax, rcx
je 0x140011b90
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov rsi, 0xfffffffffffffffe
mov qword [rsp], rdi
sub rsi, rcx
lea rdi, [rcx + 2]
nop dword [rax]
lea rbx, [rsi + rdi]
mov r10d, 8
lea r8d, [rbx + 0x10]
mov r11d, ebx
xor r8b, byte [rdi - 2]
lea r9d, [rbx + 1]
movzx edx, r8b
and r9d, 7
and r11d, 7
sub r10d, r11d
mov ecx, r10d
shl dl, cl
movzx ecx, r11b
shr r8b, cl
mov ecx, 8
or dl, r8b
sub ecx, r9d
mov byte [rdi - 2], dl
lea r8d, [rbx + 0x11]
xor r8b, byte [rdi - 1]
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx + 2]
or dl, r8b
and r9d, 7
mov byte [rdi - 1], dl
lea r8d, [rbx + 0x12]
xor r8b, byte [rdi]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx + 3]
or dl, r8b
and r9d, 7
mov byte [rdi], dl
lea r8d, [rbx + 0x13]
xor r8b, byte [rdi + 1]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx - 4]
or dl, r8b
and r9d, 7
mov byte [rdi + 1], dl
lea r8d, [rbx + 0x14]
xor r8b, byte [rdi + 2]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx - 3]
or dl, r8b
and r9d, 7
mov byte [rdi + 2], dl
lea r8d, [rbx + 0x15]
xor r8b, byte [rdi + 3]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx - 2]
or dl, r8b
and r9d, 7
lea r8d, [rbx + 0x16]
mov byte [rdi + 3], dl
xor r8b, byte [rdi + 4]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
lea rdi, [rdi + 0xb]
movzx ecx, r9b
lea r9d, [rbx - 1]
shr r8b, cl
and r9d, 7
or dl, r8b
mov ecx, 8
sub ecx, r9d
mov byte [rdi - 7], dl
lea r8d, [rbx + 0x17]
xor r8b, byte [rdi - 6]
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx + 1]
or dl, r8b
mov ecx, r10d
mov byte [rdi - 6], dl
lea r8d, [rbx + 0x18]
xor r8b, byte [rdi - 5]
and r9d, 7
movzx edx, r8b
shl dl, cl
movzx ecx, r11b
shr r8b, cl
mov ecx, 8
or dl, r8b
sub ecx, r9d
mov byte [rdi - 5], dl
lea r8d, [rbx + 0x19]
xor r8b, byte [rdi - 4]
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
mov ecx, 8
or dl, r8b
lea r8d, [rbx + 2]
mov byte [rdi - 4], dl
add bl, 0x1a
xor bl, byte [rdi - 3]
and r8d, 7
sub ecx, r8d
movzx edx, bl
shl dl, cl
movzx ecx, r8b
shr bl, cl
lea rcx, [rsi + rdi]
or dl, bl
mov byte [rdi - 3], dl
cmp rcx, 0x21
jb 0x1400119a0
mov rdi, qword [rsp]
mov rsi, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x10]
mov byte [rax + 0x22], 0
add rsp, 8
ret
Function at 0x140011ba0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
cmp byte [rcx + 0x16], 0
mov rax, rcx
je 0x140011d1f
mov qword [rsp], rbx
lea r11, [rcx + 2]
mov rbx, 0xfffffffffffffffe
sub rbx, rcx
nop dword [rax]
nop word [rax + rax]
lea r10, [rbx + r11]
mov ecx, 8
lea r8d, [r10 + 0x10]
mov r9d, r10d
xor r8b, byte [r11 - 2]
and r9d, 7
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [r10 + 1]
or dl, r8b
and r9d, 7
mov byte [r11 - 2], dl
lea r8d, [r10 + 0x11]
xor r8b, byte [r11 - 1]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [r10 + 2]
or dl, r8b
and r9d, 7
mov byte [r11 - 1], dl
lea r8d, [r10 + 0x12]
xor r8b, byte [r11]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [r10 + 3]
or dl, r8b
and r9d, 7
mov byte [r11], dl
lea r8d, [r10 + 0x13]
xor r8b, byte [r11 + 1]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [r10 - 4]
or dl, r8b
and r9d, 7
mov byte [r11 + 1], dl
lea r8d, [r10 + 0x14]
xor r8b, byte [r11 + 2]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [r10 - 3]
or dl, r8b
and r9d, 7
mov byte [r11 + 2], dl
lea r8d, [r10 + 0x15]
xor r8b, byte [r11 + 3]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
mov ecx, 8
or dl, r8b
lea r8d, [r10 - 2]
add r10b, 0x16
mov byte [r11 + 3], dl
xor r10b, byte [r11 + 4]
and r8d, 7
movzx edx, r10b
sub ecx, r8d
shl dl, cl
movzx ecx, r8b
lea r11, [r11 + 7]
shr r10b, cl
lea rcx, [rbx + r11]
or dl, r10b
mov byte [r11 - 3], dl
cmp rcx, 0x15
jb 0x140011bd0
mov rbx, qword [rsp]
mov byte [rax + 0x16], 0
add rsp, 8
ret
Function at 0x140011d30
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
cmp byte [rcx + 0xf], 0
mov rax, rcx
je 0x140011eaf
mov qword [rsp], rbx
lea r11, [rcx + 2]
mov rbx, 0xfffffffffffffffe
sub rbx, rcx
nop dword [rax]
nop word [rax + rax]
lea r10, [rbx + r11]
mov ecx, 8
lea r8d, [r10 + 0x10]
mov r9d, r10d
xor r8b, byte [r11 - 2]
and r9d, 7
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [r10 + 1]
or dl, r8b
and r9d, 7
mov byte [r11 - 2], dl
lea r8d, [r10 + 0x11]
xor r8b, byte [r11 - 1]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [r10 + 2]
or dl, r8b
and r9d, 7
mov byte [r11 - 1], dl
lea r8d, [r10 + 0x12]
xor r8b, byte [r11]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [r10 + 3]
or dl, r8b
and r9d, 7
mov byte [r11], dl
lea r8d, [r10 + 0x13]
xor r8b, byte [r11 + 1]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [r10 - 4]
or dl, r8b
and r9d, 7
mov byte [r11 + 1], dl
lea r8d, [r10 + 0x14]
xor r8b, byte [r11 + 2]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [r10 - 3]
or dl, r8b
and r9d, 7
mov byte [r11 + 2], dl
lea r8d, [r10 + 0x15]
xor r8b, byte [r11 + 3]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
mov ecx, 8
or dl, r8b
lea r8d, [r10 - 2]
add r10b, 0x16
mov byte [r11 + 3], dl
xor r10b, byte [r11 + 4]
and r8d, 7
movzx edx, r10b
sub ecx, r8d
shl dl, cl
movzx ecx, r8b
lea r11, [r11 + 7]
shr r10b, cl
lea rcx, [rbx + r11]
or dl, r10b
mov byte [r11 - 3], dl
cmp rcx, 0xe
jb 0x140011d60
mov rbx, qword [rsp]
mov byte [rax + 0xf], 0
add rsp, 8
ret
Function at 0x140011ec0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
cmp byte [rcx + 0x2e], 0
mov rax, rcx
je 0x14001208a
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov rsi, 0xfffffffffffffffe
mov qword [rsp], rdi
sub rsi, rcx
lea rdi, [rcx + 2]
nop dword [rax]
lea rbx, [rsi + rdi]
mov r10d, 8
lea r8d, [rbx + 0x10]
mov r11d, ebx
xor r8b, byte [rdi - 2]
lea r9d, [rbx + 1]
movzx edx, r8b
and r9d, 7
and r11d, 7
movzx ecx, r11b
sub r10d, r11d
shr dl, cl
mov ecx, r10d
shl r8b, cl
mov ecx, 8
or dl, r8b
sub ecx, r9d
mov byte [rdi - 2], dl
lea r8d, [rbx + 0x11]
xor r8b, byte [rdi - 1]
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx + 2]
or dl, r8b
and r9d, 7
mov byte [rdi - 1], dl
lea r8d, [rbx + 0x12]
xor r8b, byte [rdi]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx + 3]
or dl, r8b
and r9d, 7
mov byte [rdi], dl
lea r8d, [rbx + 0x13]
xor r8b, byte [rdi + 1]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx - 4]
or dl, r8b
and r9d, 7
mov byte [rdi + 1], dl
lea r8d, [rbx + 0x14]
xor r8b, byte [rdi + 2]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx - 3]
or dl, r8b
and r9d, 7
mov byte [rdi + 2], dl
lea r8d, [rbx + 0x15]
xor r8b, byte [rdi + 3]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx - 2]
or dl, r8b
and r9d, 7
lea r8d, [rbx + 0x16]
mov byte [rdi + 3], dl
xor r8b, byte [rdi + 4]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
lea rdi, [rdi + 9]
movzx ecx, r9b
lea r9d, [rbx - 1]
shr r8b, cl
and r9d, 7
or dl, r8b
mov ecx, 8
mov byte [rdi - 5], dl
lea r8d, [rbx + 0x17]
xor r8b, byte [rdi - 4]
sub ecx, r9d
add bl, 0x18
movzx edx, r8b
xor bl, byte [rdi - 3]
shl dl, cl
movzx ecx, r9b
shr r8b, cl
movzx ecx, r11b
or dl, r8b
mov byte [rdi - 4], dl
movzx edx, bl
shr dl, cl
mov ecx, r10d
shl bl, cl
lea rcx, [rsi + rdi]
or dl, bl
mov byte [rdi - 3], dl
cmp rcx, 0x2d
jb 0x140011ef0
mov rdi, qword [rsp]
mov rsi, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x10]
mov byte [rax + 0x2e], 0
add rsp, 8
ret
Function at 0x140012120
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
cmp byte [rcx + 0x17], 0
mov rax, rcx
je 0x140012340
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov rsi, 0xfffffffffffffffe
mov qword [rsp], rdi
sub rsi, rcx
lea rdi, [rcx + 2]
nop dword [rax]
lea rbx, [rsi + rdi]
mov r10d, 8
lea r8d, [rbx + 0x10]
mov r11d, ebx
xor r8b, byte [rdi - 2]
lea r9d, [rbx + 1]
movzx edx, r8b
and r9d, 7
and r11d, 7
sub r10d, r11d
mov ecx, r10d
shl dl, cl
movzx ecx, r11b
shr r8b, cl
mov ecx, 8
or dl, r8b
sub ecx, r9d
mov byte [rdi - 2], dl
lea r8d, [rbx + 0x11]
xor r8b, byte [rdi - 1]
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx + 2]
or dl, r8b
and r9d, 7
mov byte [rdi - 1], dl
lea r8d, [rbx + 0x12]
xor r8b, byte [rdi]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx + 3]
or dl, r8b
and r9d, 7
mov byte [rdi], dl
lea r8d, [rbx + 0x13]
xor r8b, byte [rdi + 1]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx - 4]
or dl, r8b
and r9d, 7
mov byte [rdi + 1], dl
lea r8d, [rbx + 0x14]
xor r8b, byte [rdi + 2]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx - 3]
or dl, r8b
and r9d, 7
mov byte [rdi + 2], dl
lea r8d, [rbx + 0x15]
xor r8b, byte [rdi + 3]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx - 2]
or dl, r8b
and r9d, 7
lea r8d, [rbx + 0x16]
mov byte [rdi + 3], dl
xor r8b, byte [rdi + 4]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
lea rdi, [rdi + 0xb]
movzx ecx, r9b
lea r9d, [rbx - 1]
shr r8b, cl
and r9d, 7
or dl, r8b
mov ecx, 8
sub ecx, r9d
mov byte [rdi - 7], dl
lea r8d, [rbx + 0x17]
xor r8b, byte [rdi - 6]
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx + 1]
or dl, r8b
mov ecx, r10d
mov byte [rdi - 6], dl
lea r8d, [rbx + 0x18]
xor r8b, byte [rdi - 5]
and r9d, 7
movzx edx, r8b
shl dl, cl
movzx ecx, r11b
shr r8b, cl
mov ecx, 8
or dl, r8b
sub ecx, r9d
mov byte [rdi - 5], dl
lea r8d, [rbx + 0x19]
xor r8b, byte [rdi - 4]
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
mov ecx, 8
or dl, r8b
lea r8d, [rbx + 2]
mov byte [rdi - 4], dl
add bl, 0x1a
xor bl, byte [rdi - 3]
and r8d, 7
sub ecx, r8d
movzx edx, bl
shl dl, cl
movzx ecx, r8b
shr bl, cl
lea rcx, [rsi + rdi]
or dl, bl
mov byte [rdi - 3], dl
cmp rcx, 0x16
jb 0x140012150
mov rdi, qword [rsp]
mov rsi, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x10]
mov byte [rax + 0x17], 0
add rsp, 8
ret
Function at 0x140012350
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
cmp byte [rcx + 0x64], 0
mov rax, rcx
je 0x140012570
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov rsi, 0xfffffffffffffffe
mov qword [rsp], rdi
sub rsi, rcx
lea rdi, [rcx + 2]
nop dword [rax]
lea rbx, [rsi + rdi]
mov r10d, 8
lea r8d, [rbx + 0x10]
mov r11d, ebx
xor r8b, byte [rdi - 2]
lea r9d, [rbx + 1]
movzx edx, r8b
and r9d, 7
and r11d, 7
sub r10d, r11d
mov ecx, r10d
shl dl, cl
movzx ecx, r11b
shr r8b, cl
mov ecx, 8
or dl, r8b
sub ecx, r9d
mov byte [rdi - 2], dl
lea r8d, [rbx + 0x11]
xor r8b, byte [rdi - 1]
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx + 2]
or dl, r8b
and r9d, 7
mov byte [rdi - 1], dl
lea r8d, [rbx + 0x12]
xor r8b, byte [rdi]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx + 3]
or dl, r8b
and r9d, 7
mov byte [rdi], dl
lea r8d, [rbx + 0x13]
xor r8b, byte [rdi + 1]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx - 4]
or dl, r8b
and r9d, 7
mov byte [rdi + 1], dl
lea r8d, [rbx + 0x14]
xor r8b, byte [rdi + 2]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx - 3]
or dl, r8b
and r9d, 7
mov byte [rdi + 2], dl
lea r8d, [rbx + 0x15]
xor r8b, byte [rdi + 3]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx - 2]
or dl, r8b
and r9d, 7
lea r8d, [rbx + 0x16]
mov byte [rdi + 3], dl
xor r8b, byte [rdi + 4]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
lea rdi, [rdi + 0xb]
movzx ecx, r9b
lea r9d, [rbx - 1]
shr r8b, cl
and r9d, 7
or dl, r8b
mov ecx, 8
sub ecx, r9d
mov byte [rdi - 7], dl
lea r8d, [rbx + 0x17]
xor r8b, byte [rdi - 6]
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx + 1]
or dl, r8b
mov ecx, r10d
mov byte [rdi - 6], dl
lea r8d, [rbx + 0x18]
xor r8b, byte [rdi - 5]
and r9d, 7
movzx edx, r8b
shl dl, cl
movzx ecx, r11b
shr r8b, cl
mov ecx, 8
or dl, r8b
sub ecx, r9d
mov byte [rdi - 5], dl
lea r8d, [rbx + 0x19]
xor r8b, byte [rdi - 4]
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
mov ecx, 8
or dl, r8b
lea r8d, [rbx + 2]
mov byte [rdi - 4], dl
add bl, 0x1a
xor bl, byte [rdi - 3]
and r8d, 7
sub ecx, r8d
movzx edx, bl
shl dl, cl
movzx ecx, r8b
shr bl, cl
lea rcx, [rsi + rdi]
or dl, bl
mov byte [rdi - 3], dl
cmp rcx, 0x63
jb 0x140012380
mov rdi, qword [rsp]
mov rsi, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x10]
mov byte [rax + 0x64], 0
add rsp, 8
ret
Function at 0x140012580
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
cmp byte [rcx + 0x37], 0
mov rax, rcx
je 0x14001274a
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov rsi, 0xfffffffffffffffe
mov qword [rsp], rdi
sub rsi, rcx
lea rdi, [rcx + 2]
nop dword [rax]
lea rbx, [rsi + rdi]
mov r10d, 8
lea r8d, [rbx + 0x10]
mov r11d, ebx
xor r8b, byte [rdi - 2]
lea r9d, [rbx + 1]
movzx edx, r8b
and r9d, 7
and r11d, 7
movzx ecx, r11b
sub r10d, r11d
shr dl, cl
mov ecx, r10d
shl r8b, cl
mov ecx, 8
or dl, r8b
sub ecx, r9d
mov byte [rdi - 2], dl
lea r8d, [rbx + 0x11]
xor r8b, byte [rdi - 1]
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx + 2]
or dl, r8b
and r9d, 7
mov byte [rdi - 1], dl
lea r8d, [rbx + 0x12]
xor r8b, byte [rdi]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx + 3]
or dl, r8b
and r9d, 7
mov byte [rdi], dl
lea r8d, [rbx + 0x13]
xor r8b, byte [rdi + 1]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx - 4]
or dl, r8b
and r9d, 7
mov byte [rdi + 1], dl
lea r8d, [rbx + 0x14]
xor r8b, byte [rdi + 2]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx - 3]
or dl, r8b
and r9d, 7
mov byte [rdi + 2], dl
lea r8d, [rbx + 0x15]
xor r8b, byte [rdi + 3]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx - 2]
or dl, r8b
and r9d, 7
lea r8d, [rbx + 0x16]
mov byte [rdi + 3], dl
xor r8b, byte [rdi + 4]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
lea rdi, [rdi + 9]
movzx ecx, r9b
lea r9d, [rbx - 1]
shr r8b, cl
and r9d, 7
or dl, r8b
mov ecx, 8
mov byte [rdi - 5], dl
lea r8d, [rbx + 0x17]
xor r8b, byte [rdi - 4]
sub ecx, r9d
add bl, 0x18
movzx edx, r8b
xor bl, byte [rdi - 3]
shl dl, cl
movzx ecx, r9b
shr r8b, cl
movzx ecx, r11b
or dl, r8b
mov byte [rdi - 4], dl
movzx edx, bl
shr dl, cl
mov ecx, r10d
shl bl, cl
lea rcx, [rsi + rdi]
or dl, bl
mov byte [rdi - 3], dl
cmp rcx, 0x36
jb 0x1400125b0
mov rdi, qword [rsp]
mov rsi, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x10]
mov byte [rax + 0x37], 0
add rsp, 8
ret

Function at 0x140012750
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xe], 0
mov r10, rcx
je 0x140012799
xor eax, eax
nop dword [rax + rax]
mov r9d, eax
lea r8d, [rax + 0x10]
xor r8b, byte [r10 + rax]
and r9d, 7
movzx edx, r8b
mov ecx, 8
sub ecx, r9d
shl dl, cl
movzx ecx, r9b
shr r8b, cl
or dl, r8b
mov byte [r10 + rax], dl
inc rax
cmp rax, 0xd
jb 0x140012760
mov byte [r10 + 0xe], 0
ret
Function at 0x1400127a0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
cmp byte [rcx + 0x19], 0
mov rax, rcx
je 0x1400129eb
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov rsi, 0xfffffffffffffffe
mov qword [rsp], rdi
sub rsi, rcx
lea rdi, [rcx + 2]
nop dword [rax]
lea rbx, [rdi + rsi]
mov r10d, 8
lea r8d, [rbx + 0x10]
mov r11d, ebx
xor r8b, byte [rdi - 2]
lea r9d, [rbx + 1]
movzx edx, r8b
and r9d, 7
and r11d, 7
movzx ecx, r11b
sub r10d, r11d
shr dl, cl
mov ecx, r10d
shl r8b, cl
mov ecx, 8
or dl, r8b
sub ecx, r9d
mov byte [rdi - 2], dl
lea r8d, [rbx + 0x11]
xor r8b, byte [rdi - 1]
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx + 2]
or dl, r8b
and r9d, 7
mov byte [rdi - 1], dl
lea r8d, [rbx + 0x12]
xor r8b, byte [rdi]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx + 3]
or dl, r8b
and r9d, 7
mov byte [rdi], dl
lea r8d, [rbx + 0x13]
xor r8b, byte [rdi + 1]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx - 4]
or dl, r8b
and r9d, 7
mov byte [rdi + 1], dl
lea r8d, [rbx + 0x14]
xor r8b, byte [rdi + 2]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx - 3]
or dl, r8b
and r9d, 7
mov byte [rdi + 2], dl
lea r8d, [rbx + 0x15]
xor r8b, byte [rdi + 3]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx - 2]
or dl, r8b
and r9d, 7
lea r8d, [rbx + 0x16]
mov byte [rdi + 3], dl
xor r8b, byte [rdi + 4]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
lea rdi, [rdi + 0xc]
movzx ecx, r9b
lea r9d, [rbx - 1]
shr r8b, cl
and r9d, 7
or dl, r8b
mov ecx, 8
sub ecx, r9d
mov byte [rdi - 8], dl
lea r8d, [rbx + 0x17]
xor r8b, byte [rdi - 7]
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx + 1]
or dl, r8b
and r9d, 7
mov byte [rdi - 7], dl
lea r8d, [rbx + 0x18]
xor r8b, byte [rdi - 6]
movzx ecx, r11b
movzx edx, r8b
shr dl, cl
mov ecx, r10d
shl r8b, cl
mov ecx, 8
or dl, r8b
sub ecx, r9d
mov byte [rdi - 6], dl
lea r8d, [rbx + 0x19]
xor r8b, byte [rdi - 5]
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx + 2]
or dl, r8b
and r9d, 7
mov byte [rdi - 5], dl
lea r8d, [rbx + 0x1a]
xor r8b, byte [rdi - 4]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
mov ecx, 8
or dl, r8b
lea r8d, [rbx + 3]
mov byte [rdi - 4], dl
add bl, 0x1b
xor bl, byte [rdi - 3]
and r8d, 7
sub ecx, r8d
movzx edx, bl
shl dl, cl
movzx ecx, r8b
shr bl, cl
lea rcx, [rdi + rsi]
or dl, bl
mov byte [rdi - 3], dl
cmp rcx, 0x18
jb 0x1400127d0
mov rdi, qword [rsp]
mov rsi, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x10]
mov byte [rax + 0x19], 0
add rsp, 8
ret
Function at 0x140012a60
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
cmp byte [rcx + 0x52], 0
mov rax, rcx
je 0x140012c2a
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov rsi, 0xfffffffffffffffe
mov qword [rsp], rdi
sub rsi, rcx
lea rdi, [rcx + 2]
nop dword [rax]
lea rbx, [rsi + rdi]
mov r10d, 8
lea r8d, [rbx + 0x10]
mov r11d, ebx
xor r8b, byte [rdi - 2]
lea r9d, [rbx + 1]
movzx edx, r8b
and r9d, 7
and r11d, 7
movzx ecx, r11b
sub r10d, r11d
shr dl, cl
mov ecx, r10d
shl r8b, cl
mov ecx, 8
or dl, r8b
sub ecx, r9d
mov byte [rdi - 2], dl
lea r8d, [rbx + 0x11]
xor r8b, byte [rdi - 1]
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx + 2]
or dl, r8b
and r9d, 7
mov byte [rdi - 1], dl
lea r8d, [rbx + 0x12]
xor r8b, byte [rdi]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx + 3]
or dl, r8b
and r9d, 7
mov byte [rdi], dl
lea r8d, [rbx + 0x13]
xor r8b, byte [rdi + 1]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx - 4]
or dl, r8b
and r9d, 7
mov byte [rdi + 1], dl
lea r8d, [rbx + 0x14]
xor r8b, byte [rdi + 2]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx - 3]
or dl, r8b
and r9d, 7
mov byte [rdi + 2], dl
lea r8d, [rbx + 0x15]
xor r8b, byte [rdi + 3]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx - 2]
or dl, r8b
and r9d, 7
lea r8d, [rbx + 0x16]
mov byte [rdi + 3], dl
xor r8b, byte [rdi + 4]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
lea rdi, [rdi + 9]
movzx ecx, r9b
lea r9d, [rbx - 1]
shr r8b, cl
and r9d, 7
or dl, r8b
mov ecx, 8
mov byte [rdi - 5], dl
lea r8d, [rbx + 0x17]
xor r8b, byte [rdi - 4]
sub ecx, r9d
add bl, 0x18
movzx edx, r8b
xor bl, byte [rdi - 3]
shl dl, cl
movzx ecx, r9b
shr r8b, cl
movzx ecx, r11b
or dl, r8b
mov byte [rdi - 4], dl
movzx edx, bl
shr dl, cl
mov ecx, r10d
shl bl, cl
lea rcx, [rsi + rdi]
or dl, bl
mov byte [rdi - 3], dl
cmp rcx, 0x51
jb 0x140012a90
mov rdi, qword [rsp]
mov rsi, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x10]
mov byte [rax + 0x52], 0
add rsp, 8
ret
Function at 0x140012ca0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
cmp byte [rcx + 0x13], 0
mov rax, rcx
je 0x140012e6a
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov rsi, 0xfffffffffffffffe
mov qword [rsp], rdi
sub rsi, rcx
lea rdi, [rcx + 2]
nop dword [rax]
lea rbx, [rsi + rdi]
mov r10d, 8
lea r8d, [rbx + 0x10]
mov r11d, ebx
xor r8b, byte [rdi - 2]
lea r9d, [rbx + 1]
movzx edx, r8b
and r9d, 7
and r11d, 7
movzx ecx, r11b
sub r10d, r11d
shr dl, cl
mov ecx, r10d
shl r8b, cl
mov ecx, 8
or dl, r8b
sub ecx, r9d
mov byte [rdi - 2], dl
lea r8d, [rbx + 0x11]
xor r8b, byte [rdi - 1]
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx + 2]
or dl, r8b
and r9d, 7
mov byte [rdi - 1], dl
lea r8d, [rbx + 0x12]
xor r8b, byte [rdi]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx + 3]
or dl, r8b
and r9d, 7
mov byte [rdi], dl
lea r8d, [rbx + 0x13]
xor r8b, byte [rdi + 1]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx - 4]
or dl, r8b
and r9d, 7
mov byte [rdi + 1], dl
lea r8d, [rbx + 0x14]
xor r8b, byte [rdi + 2]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx - 3]
or dl, r8b
and r9d, 7
mov byte [rdi + 2], dl
lea r8d, [rbx + 0x15]
xor r8b, byte [rdi + 3]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx - 2]
or dl, r8b
and r9d, 7
lea r8d, [rbx + 0x16]
mov byte [rdi + 3], dl
xor r8b, byte [rdi + 4]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
lea rdi, [rdi + 9]
movzx ecx, r9b
lea r9d, [rbx - 1]
shr r8b, cl
and r9d, 7
or dl, r8b
mov ecx, 8
mov byte [rdi - 5], dl
lea r8d, [rbx + 0x17]
xor r8b, byte [rdi - 4]
sub ecx, r9d
add bl, 0x18
movzx edx, r8b
xor bl, byte [rdi - 3]
shl dl, cl
movzx ecx, r9b
shr r8b, cl
movzx ecx, r11b
or dl, r8b
mov byte [rdi - 4], dl
movzx edx, bl
shr dl, cl
mov ecx, r10d
shl bl, cl
lea rcx, [rsi + rdi]
or dl, bl
mov byte [rdi - 3], dl
cmp rcx, 0x12
jb 0x140012cd0
mov rdi, qword [rsp]
mov rsi, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x10]
mov byte [rax + 0x13], 0
add rsp, 8
ret

Function at 0x140012e70
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x87], 0
mov r10, rcx
je 0x140012ebe
xor eax, eax
nop
mov r9d, eax
lea r8d, [rax + 0x10]
xor r8b, byte [r10 + rax]
and r9d, 7
movzx edx, r8b
mov ecx, 8
sub ecx, r9d
shl dl, cl
movzx ecx, r9b
shr r8b, cl
or dl, r8b
mov byte [r10 + rax], dl
inc rax
cmp rax, 0x86
jb 0x140012e80
mov byte [r10 + 0x87], 0
ret

Function at 0x140012ec0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x12], 0
mov r10, rcx
je 0x140012f09
xor eax, eax
nop dword [rax + rax]
mov r9d, eax
lea r8d, [rax + 0x10]
xor r8b, byte [r10 + rax]
and r9d, 7
movzx edx, r8b
mov ecx, 8
sub ecx, r9d
shl dl, cl
movzx ecx, r9b
shr r8b, cl
or dl, r8b
mov byte [r10 + rax], dl
inc rax
cmp rax, 0x11
jb 0x140012ed0
mov byte [r10 + 0x12], 0
ret