joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407960
Capabilities:
Create directory

Disassembly:
push r15
mov eax, 0x3038
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.0040e2a0
sub rsp, rax
mov rbx, r8
mov r14, rcx
mov rcx, rdx
mov rdi, rdx
call sub.msvcrt.dll_strlen
mov rcx, rbx
mov rsi, rax
call sub.msvcrt.dll_strlen
lea rax, [rsi + rax + 1]
cmp rax, 0xfff
ja 0x407a62
lea rsi, [rsp + 0x30]
mov r9, rdi
mov edx, 0x1000
mov dword [rsp + 0x20], 0x5c
lea r8, str._s_c
mov rcx, rsi
mov ebp, 0x1000
call fcn.00407940
mov edx, 0x5c
mov rcx, rbx
movsxd rdi, eax
call sub.msvcrt.dll_strchr
sub rbp, rdi
add rdi, rsi
test rax, rax
mov r15, rax
je 0x407a70
lea r12, [0x00412c25]
lea r13, [rsp + 0x1030]
jmp 0x407a18
lea rcx, [r15 + 1]
mov edx, 0x5c
call sub.msvcrt.dll_strchr
test rax, rax
mov r15, rax
je 0x407a70
mov r9d, r15d
mov r8, r12
mov rdx, rbp
mov qword [rsp + 0x20], rbx
sub r9d, ebx
mov rcx, rdi
call fcn.00407940
mov rcx, rsi
call fcn.00404150
test eax, eax
jne 0x407a02
mov r8d, 0x1000
mov rdx, r13
mov rcx, rsi
call fcn.00408a30
mov rdx, qword [r14 + 0x3038]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x407a02
mov eax, 0xffffffff
jmp 0x407a72
xor eax, eax
add rsp, 0x3038
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x407a90
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rdi
mov eax, 0x1020
push rsi
push rbx
call fcn.0040e2a0
sub rsp, rax
mov rsi, rdx
lea rdx, [0x00412c2a]
call fcn.00404190
test rax, rax
mov rbx, rax
je 0x407b7b
lea rdx, [0x00412c2d]
mov rcx, rsi
call fcn.00404190
test rax, rax
mov rsi, rax
je 0x407b82
lea rdi, [rsp + 0x20]
jmp 0x407b1f
mov r8d, 0x1000
mov r9, rbx
mov edx, 1
mov rcx, rdi
call sub.msvcrt.dll_fread
test rax, rax
mov r8, rax
je 0x407b60
mov r9, rsi
mov edx, 1
mov rcx, rdi
call sub.msvcrt.dll_fwrite
test rax, rax
je 0x407b50
mov rcx, rsi
call sub.msvcrt.dll_ferror
test eax, eax
jne 0x407b50
mov rcx, rbx
call sub.msvcrt.dll_feof
test eax, eax
je 0x407ae0
xor edi, edi
mov rcx, rbx
call sub.msvcrt.dll_fclose
mov rcx, rsi
call sub.msvcrt.dll_fclose
mov eax, edi
add rsp, 0x1020
pop rbx
pop rsi
pop rdi
ret
mov rcx, rsi
mov edi, 0xffffffff
call sub.msvcrt.dll_clearerr
jmp 0x407b2d
mov rcx, rbx
call sub.msvcrt.dll_ferror
test eax, eax
je 0x407b2b
mov rcx, rbx
mov edi, 0xffffffff
call sub.msvcrt.dll_clearerr
jmp 0x407b2d
mov edi, 0xffffffff
jmp 0x407b3d
mov rcx, rbx
mov edi, 0xffffffff
call sub.msvcrt.dll_fclose
jmp 0x407b3d
Function at 0x407ba0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov r12, rcx
mov ecx, 0x2000
mov rbp, rdx
mov rsi, r8
call sub.msvcrt.dll_malloc
test rax, rax
mov rbx, rax
je 0x407ca2
xor edx, edx
mov r8d, 2
mov rcx, r12
call fcn.0040eb50
test eax, eax
js 0x407ca2
mov rcx, r12
call fcn.0040f040
movsxd rdi, eax
cmp rdi, rsi
jb 0x407ca2
lea rax, [rsi - 1]
mov qword [rsp + 0x28], rax
cmp rdi, 0x2000
mov r14d, 0x2000
cmovae r14, rdi
lea r13, [r14 - 0x2000]
sub rdi, r13
cmp rsi, rdi
ja 0x407ca2
xor r8d, r8d
mov edx, r13d
mov rcx, r12
call fcn.0040eb50
test eax, eax
js 0x407ca2
mov r9, r12
mov r8, rdi
mov edx, 1
mov rcx, rbx
call sub.msvcrt.dll_fread
cmp rax, rdi
jne 0x407ca2
sub rax, rsi
add rax, 1
mov rdi, rax
jne 0x407c68
jmp 0x407c90
test r15, r15
mov rdi, r15
je 0x407c90
lea r15, [rdi - 1]
mov r8, rsi
mov rdx, rbp
lea rcx, [rbx + r15]
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x407c60
lea rsi, [r14 + rdi - 0x2001]
jmp 0x407ca4
mov rax, qword [rsp + 0x28]
test r13, r13
lea rdi, [rax + r13]
jne 0x407c04
xor esi, esi
mov rcx, rbx
call sub.msvcrt.dll_free
mov rax, rsi
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x407cc0
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push r15
mov eax, 0x2288
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.0040e2a0
sub rsp, rax
lea r8, str._s
mov edx, 0x1000
mov r14, qword [sym.imp.msvcrt.dll__snwprintf]
lea r13, [rsp + 0x280]
mov r9, rcx
mov r15, rcx
mov rcx, r13
call r14
cmp eax, 0xfff
jg 0x407e28
lea rdi, [rsp + 0x30]
mov r12d, 0x1000
mov rcx, r13
lea ebx, [rax - 1]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
sub r12d, ebx
cmp rax, 0xffffffffffffffff
mov rsi, rax
je 0x407e28
movsxd rax, ebx
mov rbp, qword [sym.imp.KERNEL32.dll_FindNextFileW]
lea rax, [r13 + rax*2]
mov qword [rsp + 0x20], rax
lea rbx, [rdi + 0x2c]
movsxd rax, r12d
mov qword [rsp + 0x28], rax
lea rdx, [0x00412c4a]
mov rcx, rbx
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x407dc0
lea rdx, [0x00412c4e]
mov rcx, rbx
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x407dc0
lea r8, [0x00412c54]
mov r9, rbx
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
call r14
cmp eax, r12d
jge 0x407dc0
mov eax, dword [rsp + 0x30]
mov rcx, r13
test al, 0x10
je 0x407e00
test ah, 4
je 0x407db1
cmp dword [rsp + 0x54], 0xa000000c
je 0x407e20
call fcn.00407cc0
nop word cs:[rax + rax]
mov rdx, rdi
mov rcx, rsi
call rbp
test eax, eax
jne 0x407d55
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
cmp eax, 1
setne al
movzx eax, al
neg eax
add rsp, 0x2288
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, rdi
mov rcx, rsi
call rbp
test eax, eax
jne 0x407d55
jmp 0x407dcc
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x407dc0
mov eax, 0xffffffff
jmp 0x407de9
Function at 0x407fc0
Capabilities:
Query environment variable

Disassembly:
push rsi
mov eax, 0x4028
push rbx
call fcn.0040e2a0
sub rsp, rax
xor r8d, r8d
xor edx, edx
call fcn.00408a30
lea rbx, [rsp + 0x20]
mov r8d, 0x1000
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
sub eax, 1
cmp eax, 0xffe
ja 0x408035
lea rsi, [rsp + 0x2020]
mov r8d, 0x1000
mov rcx, rbx
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
sub eax, 1
cmp eax, 0xffe
ja 0x408035
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call fcn.00408940
add rsp, 0x4028
pop rbx
pop rsi
ret
xor eax, eax
add rsp, 0x4028
pop rbx
pop rsi
ret
Function at 0x4084d0
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended

Disassembly:
push rdi
mov eax, 0x2110
push rsi
push rbx
call fcn.0040e2a0
sub rsp, rax
mov r8d, 0x1000
lea rsi, [rsp + 0x110]
add rcx, 0x10
lea rdi, [rsp + 0xa0]
mov rdx, rsi
call fcn.00408a30
mov edx, 1
lea rcx, [0x00407e30]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
mov rcx, rdi
mov dword [rsp + 0x60], 0x18
mov qword [rsp + 0x68], 0
mov dword [rsp + 0x70], 1
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov eax, 1
xor ecx, ecx
mov rbx, qword [fcn.0040f2c0]
mov qword [rsp + 0xa8], 0
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0xb8], 0
mov dword [rsp + 0xdc], 0x101
mov word [rsp + 0xe0], ax
call rbx
mov rcx, rax
call fcn.00407e50
mov ecx, 1
mov qword [rsp + 0xf0], rax
call rbx
mov rcx, rax
call fcn.00407e50
mov ecx, 2
mov qword [rsp + 0xf8], rax
call rbx
mov rcx, rax
call fcn.00407e50
mov qword [rsp + 0x100], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor r9d, r9d
mov qword [rsp + 0x40], rdi
mov rcx, rsi
lea rdx, [rsp + 0x80]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x48], rdx
lea r8, [rsp + 0x60]
mov rdx, rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x408642
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rsp + 0x5c]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [rsp + 0x5c]
add rsp, 0x2110
pop rbx
pop rsi
pop rdi
ret
lea rdx, str.Failed_to_create_child_process__n
lea rcx, str.CreateProcessW
call fcn.00402c60
mov eax, 0xffffffff
jmp 0x408637
Function at 0x408790
Capabilities:
Enumerate process modules

Disassembly:
push r15
mov eax, 0x4048
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.0040e2a0
sub rsp, rax
mov dword [rsp + 0x3c], 0
lea rbx, [rsp + 0x3c]
mov r12, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor r8d, r8d
xor edx, edx
mov r9, rbx
mov rcx, rax
mov rsi, rax
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x4087de
mov edi, dword [rsp + 0x3c]
test edi, edi
jne 0x4087f2
add rsp, 0x4048
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, edi
mov edx, 1
call sub.msvcrt.dll_calloc
test rax, rax
mov rbp, rax
je 0x4087de
mov r9, rbx
mov r8d, edi
mov rdx, rax
mov rcx, rsi
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
jne 0x408840
mov rcx, rbp
add rsp, 0x4048
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp sub.msvcrt.dll_free
lea r14, [rsp + 0x2040]
mov r8d, 0x1000
lea rcx, [r12 + 0x2022]
mov rdx, r14
call fcn.00408a30
test rax, rax
je 0x40881b
mov rcx, r14
call sub.msvcrt.dll_wcslen
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x3c]
shr eax, 3
test eax, eax
je 0x40881b
sub eax, 1
mov rbx, rbp
mov r15, rbp
lea r12, [rbp + rax*8 + 8]
xor r13d, r13d
lea rdi, [rsp + 0x40]
mov rdx, qword [r15]
mov r9d, 0x1000
mov r8, rdi
mov rcx, rsi
call sub.KERNEL32.dll_K32GetModuleFileNameExW
test eax, eax
je 0x4088cd
mov r8, qword [rsp + 0x28]
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.msvcrt.dll__wcsnicmp]
test eax, eax
jne 0x4088cd
mov rdx, qword [r15]
movsxd rax, r13d
add r13d, 1
mov qword [rbp + rax*8], rdx
add r15, 8
cmp r15, r12
jne 0x408891
test r13d, r13d
je 0x40881b
lea eax, [r13 - 1]
mov r13, qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea r14, [rbp + rax*8 + 8]
jmp 0x4088fe
add rbx, 8
cmp rbx, r14
je 0x40881b
mov rdx, qword [rbx]
mov r9d, 0x1000
mov r8, rdi
mov rcx, rsi
call sub.KERNEL32.dll_K32GetModuleFileNameExW
test eax, eax
je 0x4088f1
xor r12d, r12d
jmp 0x408924
test eax, eax
je 0x4088f1
add r12d, 1
mov rcx, qword [rbx]
call r13
cmp r12d, 0x20
jne 0x408920
jmp 0x4088f1
Function at 0x409100
Capabilities:
Hash data with crc32

Disassembly:
push rsi
push rbx
mov eax, 0x80000000
test ecx, ecx
je 0x409175
lea rsi, [0x00413180]
mov ebx, 3
jmp 0x409127
add ebx, 1
sar ecx, 1
je 0x409175
test cl, 1
je 0x409120
mov edx, ebx
mov r8d, 0x80000000
and edx, 0x1f
mov r11d, dword [rsi + rdx*4]
mov edx, eax
xor eax, eax
jmp 0x40915e
mov r10d, edx
shr edx, 1
mov r9d, edx
and r10d, 1
shr r8d, 1
xor r9d, 0xedb88320
test r10d, r10d
cmovne edx, r9d
test r11d, r8d
je 0x409141
lea r9d, [r8 - 1]
xor eax, edx
test r9d, r11d
jne 0x409141
add ebx, 1
sar ecx, 1
jne 0x409127
pop rbx
pop rsi
ret
Function at 0x40d340
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x0041f904]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x40d4c8
mov rax, qword [0x0041f908]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x40d38c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x40d415
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x40d370
mov rcx, rbx
call fcn.0040dfe0
test rax, rax
mov r12, rax
je 0x40d4fd
mov rax, qword [0x0041f908]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call fcn.0040e110
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x0041f908]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x40d4e0
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x40d40e
sub eax, 0x40
and eax, 0xffffffbf
jne 0x40d470
add dword [0x0041f904], 1
cmp edi, 8
jae 0x40d443
test dil, 4
jne 0x40d4b4
test edi, edi
je 0x40d438
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x40d4cf
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x40d438
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x40d45c
jmp 0x40d438
add rsi, qword [0x0041f908]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x40d40e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.0040f3c0
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x40d438
xor esi, esi
jmp 0x40d397
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x40d438
mov rax, qword [0x0041f908]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call fcn.0040f3c0
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.0040f3c0
nop
nop dword [rax]

Function at 0x40dc50
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x0041fbe0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x0041fbc0]
test rbx, rbx
je 0x40dca4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x40dc9b
test rsi, rsi
je 0x40dc9b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x40dc80
lea rcx, [0x0041fbe0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x40dfe0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x00416cd0]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x40e04d
mov rcx, r8
call fcn.0040dec0
test eax, eax
je 0x40e04d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x40e04d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x40e044
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x40e04f
add rax, 0x28
cmp rax, r9
jne 0x40e030
xor eax, eax
add rsp, 0x28
ret

Function at 0x40f3c0
Capabilities:
Write file on windows

Disassembly:
lea rcx, [0x00401560]
jmp 0x401530
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.0040f2c0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.0040f2c0
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
jmp 0x401550
Function at 0x1800033c0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx]
lea r10, [rcx + 4]
xor r9d, r9d
test eax, eax
je 0x1800033ea
nop dword [rax]
movzx edx, byte [r9 + rcx + 4]
sub dl, byte [rcx + 0xd]
xor dl, byte [rcx + 0xc]
mov byte [r9 + r10], dl
inc r9d
mov eax, dword [rcx]
cmp r9d, eax
jb 0x1800033d0
mov ecx, eax
mov rax, r10
mov byte [rcx + r10], 0
ret

Function at 0x180003400
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx]
lea r10, [rcx + 4]
xor r9d, r9d
test eax, eax
je 0x18000342a
nop dword [rax]
movzx edx, byte [r9 + rcx + 4]
sub dl, byte [rcx + 0xe]
xor dl, byte [rcx + 0xd]
mov byte [r9 + r10], dl
inc r9d
mov eax, dword [rcx]
cmp r9d, eax
jb 0x180003410
mov ecx, eax
mov rax, r10
mov byte [rcx + r10], 0
ret

Function at 0x180003440
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx]
lea r10, [rcx + 4]
xor r9d, r9d
test eax, eax
je 0x18000346a
nop dword [rax]
movzx edx, byte [r9 + rcx + 4]
sub dl, byte [rcx + 0x17]
xor dl, byte [rcx + 0x16]
mov byte [r9 + r10], dl
inc r9d
mov eax, dword [rcx]
cmp r9d, eax
jb 0x180003450
mov ecx, eax
mov rax, r10
mov byte [rcx + r10], 0
ret
Function at 0x180003fa0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx]
lea r10, [rcx + 4]
xor r9d, r9d
test eax, eax
je 0x180003fca
nop dword [rax]
movzx edx, byte [r9 + rcx + 4]
sub dl, byte [rcx + 0xb]
xor dl, byte [rcx + 0xa]
mov byte [r9 + r10], dl
inc r9d
mov eax, dword [rcx]
cmp r9d, eax
jb 0x180003fb0
mov ecx, eax
mov rax, r10
mov byte [rcx + r10], 0
ret

Function at 0x180003fe0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx]
lea r10, [rcx + 4]
xor r9d, r9d
test eax, eax
je 0x18000400a
nop dword [rax]
movzx edx, byte [r9 + rcx + 4]
sub dl, byte [rcx + 0xc]
xor dl, byte [rcx + 0xb]
mov byte [r9 + r10], dl
inc r9d
mov eax, dword [rcx]
cmp r9d, eax
jb 0x180003ff0
mov ecx, eax
mov rax, r10
mov byte [rcx + r10], 0
ret
Function at 0x180005090
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx]
lea r10, [rcx + 4]
xor r9d, r9d
test eax, eax
je 0x1800050ba
nop dword [rax]
movzx edx, byte [r9 + rcx + 4]
sub dl, byte [rcx + 0x10]
xor dl, byte [rcx + 0xf]
mov byte [r9 + r10], dl
inc r9d
mov eax, dword [rcx]
cmp r9d, eax
jb 0x1800050a0
mov ecx, eax
mov rax, r10
mov byte [rcx + r10], 0
ret
Function at 0x180007590
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx]
lea r10, [rcx + 4]
xor r9d, r9d
test eax, eax
je 0x1800075ba
nop dword [rax]
movzx edx, byte [r9 + rcx + 4]
sub dl, byte [rcx + 0x11]
xor dl, byte [rcx + 0x10]
mov byte [r9 + r10], dl
inc r9d
mov eax, dword [rcx]
cmp r9d, eax
jb 0x1800075a0
mov ecx, eax
mov rax, r10
mov byte [rcx + r10], 0
ret

Function at 0x1800075d0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx]
lea r10, [rcx + 4]
xor r9d, r9d
test eax, eax
je 0x1800075fa
nop dword [rax]
movzx edx, byte [r9 + rcx + 4]
sub dl, byte [rcx + 0x14]
xor dl, byte [rcx + 0x13]
mov byte [r9 + r10], dl
inc r9d
mov eax, dword [rcx]
cmp r9d, eax
jb 0x1800075e0
mov ecx, eax
mov rax, r10
mov byte [rcx + r10], 0
ret
Function at 0x180009480
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx]
lea r10, [rcx + 4]
xor r9d, r9d
test eax, eax
je 0x1800094aa
nop dword [rax]
movzx edx, byte [r9 + rcx + 4]
sub dl, byte [rcx + 0x12]
xor dl, byte [rcx + 0x11]
mov byte [r9 + r10], dl
inc r9d
mov eax, dword [rcx]
cmp r9d, eax
jb 0x180009490
mov ecx, eax
mov rax, r10
mov byte [rcx + r10], 0
ret
Function at 0x18000a670
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx]
lea r10, [rcx + 4]
xor r9d, r9d
test eax, eax
je 0x18000a69a
nop dword [rax]
movzx edx, byte [r9 + rcx + 4]
sub dl, byte [rcx + 0x15]
xor dl, byte [rcx + 0x14]
mov byte [r9 + r10], dl
inc r9d
mov eax, dword [rcx]
cmp r9d, eax
jb 0x18000a680
mov ecx, eax
mov rax, r10
mov byte [rcx + r10], 0
ret
Function at 0x180010330
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx]
lea r10, [rcx + 4]
xor r9d, r9d
test eax, eax
je 0x18001035a
nop dword [rax]
movzx edx, byte [r9 + rcx + 4]
sub dl, byte [rcx + 0x13]
xor dl, byte [rcx + 0x12]
mov byte [r9 + r10], dl
inc r9d
mov eax, dword [rcx]
cmp r9d, eax
jb 0x180010340
mov ecx, eax
mov rax, r10
mov byte [rcx + r10], 0
ret
Function at 0x180017090
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx]
lea r10, [rcx + 4]
xor r9d, r9d
test eax, eax
je 0x1800170ba
nop dword [rax]
movzx edx, byte [r9 + rcx + 4]
sub dl, byte [rcx + 0x18]
xor dl, byte [rcx + 0x17]
mov byte [r9 + r10], dl
inc r9d
mov eax, dword [rcx]
cmp r9d, eax
jb 0x1800170a0
mov ecx, eax
mov rax, r10
mov byte [rcx + r10], 0
ret
Function at 0x18001bec0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx]
lea r10, [rcx + 4]
xor r9d, r9d
test eax, eax
je 0x18001beea
nop dword [rax]
movzx edx, byte [r9 + rcx + 4]
sub dl, byte [rcx + 0xa]
xor dl, byte [rcx + 9]
mov byte [r9 + r10], dl
inc r9d
mov eax, dword [rcx]
cmp r9d, eax
jb 0x18001bed0
mov ecx, eax
mov rax, r10
mov byte [rcx + r10], 0
ret
Function at 0x1800313b0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx]
lea r10, [rcx + 4]
xor r9d, r9d
test eax, eax
je 0x1800313da
nop dword [rax]
movzx edx, byte [r9 + rcx + 4]
sub dl, byte [rcx + 9]
xor dl, byte [rcx + 8]
mov byte [r9 + r10], dl
inc r9d
mov eax, dword [rcx]
cmp r9d, eax
jb 0x1800313c0
mov ecx, eax
mov rax, r10
mov byte [rcx + r10], 0
ret
Function at 0x18003a6d0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx]
lea r10, [rcx + 4]
xor r9d, r9d
test eax, eax
je 0x18003a6fa
nop dword [rax]
movzx edx, byte [r9 + rcx + 4]
sub dl, byte [rcx + 0x16]
xor dl, byte [rcx + 0x15]
mov byte [r9 + r10], dl
inc r9d
mov eax, dword [rcx]
cmp r9d, eax
jb 0x18003a6e0
mov ecx, eax
mov rax, r10
mov byte [rcx + r10], 0
ret
Function at 0x1800409c0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx]
lea r10, [rcx + 4]
xor r9d, r9d
test eax, eax
je 0x1800409ea
nop dword [rax]
movzx edx, byte [r9 + rcx + 4]
sub dl, byte [rcx + 0x1b]
xor dl, byte [rcx + 0x1a]
mov byte [r9 + r10], dl
inc r9d
mov eax, dword [rcx]
cmp r9d, eax
jb 0x1800409d0
mov ecx, eax
mov rax, r10
mov byte [rcx + r10], 0
ret
Function at 0x18004a3d0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx]
lea r10, [rcx + 4]
xor r9d, r9d
test eax, eax
je 0x18004a3fa
nop dword [rax]
movzx edx, byte [r9 + rcx + 4]
sub dl, byte [rcx + 0x1a]
xor dl, byte [rcx + 0x19]
mov byte [r9 + r10], dl
inc r9d
mov eax, dword [rcx]
cmp r9d, eax
jb 0x18004a3e0
mov ecx, eax
mov rax, r10
mov byte [rcx + r10], 0
ret

Function at 0x18004a410
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx]
lea r10, [rcx + 4]
xor r9d, r9d
test eax, eax
je 0x18004a43a
nop dword [rax]
movzx edx, byte [r9 + rcx + 4]
sub dl, byte [rcx + 0x19]
xor dl, byte [rcx + 0x18]
mov byte [r9 + r10], dl
inc r9d
mov eax, dword [rcx]
cmp r9d, eax
jb 0x18004a420
mov ecx, eax
mov rax, r10
mov byte [rcx + r10], 0
ret
Function at 0x18005d200
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx]
lea r10, [rcx + 4]
xor r9d, r9d
test eax, eax
je 0x18005d22a
nop dword [rax]
movzx edx, byte [r9 + rcx + 4]
sub dl, byte [rcx + 0x1c]
xor dl, byte [rcx + 0x1b]
mov byte [r9 + r10], dl
inc r9d
mov eax, dword [rcx]
cmp r9d, eax
jb 0x18005d210
mov ecx, eax
mov rax, r10
mov byte [rcx + r10], 0
ret