joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401eb188
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1402d0d30]
mov rbx, rdx
test rax, rax
jne 0x1401eb283
mov dword [rbp - 0x50], 0x18
mov eax, dword [rbp - 0x50]
xor al, 0x56
mov byte [rbp - 0x4c], al
mov eax, dword [rbp - 0x50]
inc al
xor al, 0x69
mov byte [rbp - 0x4b], al
mov eax, dword [rbp - 0x50]
add al, 2
xor al, 0x72
mov byte [rbp - 0x4a], al
mov eax, dword [rbp - 0x50]
add al, 3
xor al, 0x74
mov byte [rbp - 0x49], al
mov eax, dword [rbp - 0x50]
add al, 4
xor al, 0x75
mov byte [rbp - 0x48], al
mov eax, dword [rbp - 0x50]
add al, 5
xor al, 0x61
mov byte [rbp - 0x47], al
mov eax, dword [rbp - 0x50]
add al, 6
xor al, 0x6c
mov byte [rbp - 0x46], al
mov eax, dword [rbp - 0x50]
add al, 7
xor al, 0x51
mov byte [rbp - 0x45], al
mov eax, dword [rbp - 0x50]
add al, 8
xor al, 0x75
mov byte [rbp - 0x44], al
mov eax, dword [rbp - 0x50]
add al, 9
xor al, 0x65
mov byte [rbp - 0x43], al
mov eax, dword [rbp - 0x50]
add al, 0xa
xor al, 0x72
mov byte [rbp - 0x42], al
mov eax, dword [rbp - 0x50]
add al, 0xb
xor al, 0x79
mov byte [rbp - 0x41], al
xor eax, eax
mov byte [rbp - 0x40], al
xor edx, edx
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
add cl, dl
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x1401eb22f
lea rcx, [0x140290e10]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x1402d0d30], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1402d0d30]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x1401eb2ac
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x1401eb2d5
cmp dword [rbp - 0x18], 0x10000
je 0x1401eb2d5
cmp qword [rbp - 0x20], 0x1000
jb 0x1401eb2d5
cmp dword [rbp - 0x10], 0x1000000
je 0x1401eb2d1
cmp dword [rbp - 0x10], 0x40000
jne 0x1401eb2d5
mov al, 1
jmp 0x1401eb2d7
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x1401ece44
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1402d0f68]
mov rbx, rdx
test rax, rax
jne 0x1401ecf3f
mov dword [rbp - 0x50], 0x18
mov eax, dword [rbp - 0x50]
xor al, 0x56
mov byte [rbp - 0x4c], al
mov eax, dword [rbp - 0x50]
inc al
xor al, 0x69
mov byte [rbp - 0x4b], al
mov eax, dword [rbp - 0x50]
add al, 2
xor al, 0x72
mov byte [rbp - 0x4a], al
mov eax, dword [rbp - 0x50]
add al, 3
xor al, 0x74
mov byte [rbp - 0x49], al
mov eax, dword [rbp - 0x50]
add al, 4
xor al, 0x75
mov byte [rbp - 0x48], al
mov eax, dword [rbp - 0x50]
add al, 5
xor al, 0x61
mov byte [rbp - 0x47], al
mov eax, dword [rbp - 0x50]
add al, 6
xor al, 0x6c
mov byte [rbp - 0x46], al
mov eax, dword [rbp - 0x50]
add al, 7
xor al, 0x51
mov byte [rbp - 0x45], al
mov eax, dword [rbp - 0x50]
add al, 8
xor al, 0x75
mov byte [rbp - 0x44], al
mov eax, dword [rbp - 0x50]
add al, 9
xor al, 0x65
mov byte [rbp - 0x43], al
mov eax, dword [rbp - 0x50]
add al, 0xa
xor al, 0x72
mov byte [rbp - 0x42], al
mov eax, dword [rbp - 0x50]
add al, 0xb
xor al, 0x79
mov byte [rbp - 0x41], al
xor eax, eax
mov byte [rbp - 0x40], al
xor edx, edx
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
add cl, dl
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x1401eceeb
lea rcx, [0x140290e10]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x1402d0f68], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1402d0f68]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x1401ecf68
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x1401ecf91
cmp dword [rbp - 0x18], 0x10000
je 0x1401ecf91
cmp qword [rbp - 0x20], 0x1000
jb 0x1401ecf91
cmp dword [rbp - 0x10], 0x1000000
je 0x1401ecf8d
cmp dword [rbp - 0x10], 0x40000
jne 0x1401ecf91
mov al, 1
jmp 0x1401ecf93
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x1401eeb00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1402d0fa8]
mov rbx, rdx
test rax, rax
jne 0x1401eebfb
mov dword [rbp - 0x50], 0x18
mov eax, dword [rbp - 0x50]
xor al, 0x56
mov byte [rbp - 0x4c], al
mov eax, dword [rbp - 0x50]
inc al
xor al, 0x69
mov byte [rbp - 0x4b], al
mov eax, dword [rbp - 0x50]
add al, 2
xor al, 0x72
mov byte [rbp - 0x4a], al
mov eax, dword [rbp - 0x50]
add al, 3
xor al, 0x74
mov byte [rbp - 0x49], al
mov eax, dword [rbp - 0x50]
add al, 4
xor al, 0x75
mov byte [rbp - 0x48], al
mov eax, dword [rbp - 0x50]
add al, 5
xor al, 0x61
mov byte [rbp - 0x47], al
mov eax, dword [rbp - 0x50]
add al, 6
xor al, 0x6c
mov byte [rbp - 0x46], al
mov eax, dword [rbp - 0x50]
add al, 7
xor al, 0x51
mov byte [rbp - 0x45], al
mov eax, dword [rbp - 0x50]
add al, 8
xor al, 0x75
mov byte [rbp - 0x44], al
mov eax, dword [rbp - 0x50]
add al, 9
xor al, 0x65
mov byte [rbp - 0x43], al
mov eax, dword [rbp - 0x50]
add al, 0xa
xor al, 0x72
mov byte [rbp - 0x42], al
mov eax, dword [rbp - 0x50]
add al, 0xb
xor al, 0x79
mov byte [rbp - 0x41], al
xor eax, eax
mov byte [rbp - 0x40], al
xor edx, edx
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
add cl, dl
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x1401eeba7
lea rcx, [0x140290e10]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x1402d0fa8], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1402d0fa8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x1401eec24
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x1401eec4d
cmp dword [rbp - 0x18], 0x10000
je 0x1401eec4d
cmp qword [rbp - 0x20], 0x1000
jb 0x1401eec4d
cmp dword [rbp - 0x10], 0x1000000
je 0x1401eec49
cmp dword [rbp - 0x10], 0x40000
jne 0x1401eec4d
mov al, 1
jmp 0x1401eec4f
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x1401f07bc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1402d10a8]
mov rbx, rdx
test rax, rax
jne 0x1401f08b7
mov dword [rbp - 0x50], 0x18
mov eax, dword [rbp - 0x50]
xor al, 0x56
mov byte [rbp - 0x4c], al
mov eax, dword [rbp - 0x50]
inc al
xor al, 0x69
mov byte [rbp - 0x4b], al
mov eax, dword [rbp - 0x50]
add al, 2
xor al, 0x72
mov byte [rbp - 0x4a], al
mov eax, dword [rbp - 0x50]
add al, 3
xor al, 0x74
mov byte [rbp - 0x49], al
mov eax, dword [rbp - 0x50]
add al, 4
xor al, 0x75
mov byte [rbp - 0x48], al
mov eax, dword [rbp - 0x50]
add al, 5
xor al, 0x61
mov byte [rbp - 0x47], al
mov eax, dword [rbp - 0x50]
add al, 6
xor al, 0x6c
mov byte [rbp - 0x46], al
mov eax, dword [rbp - 0x50]
add al, 7
xor al, 0x51
mov byte [rbp - 0x45], al
mov eax, dword [rbp - 0x50]
add al, 8
xor al, 0x75
mov byte [rbp - 0x44], al
mov eax, dword [rbp - 0x50]
add al, 9
xor al, 0x65
mov byte [rbp - 0x43], al
mov eax, dword [rbp - 0x50]
add al, 0xa
xor al, 0x72
mov byte [rbp - 0x42], al
mov eax, dword [rbp - 0x50]
add al, 0xb
xor al, 0x79
mov byte [rbp - 0x41], al
xor eax, eax
mov byte [rbp - 0x40], al
xor edx, edx
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
add cl, dl
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x1401f0863
lea rcx, [0x140290e10]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x1402d10a8], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1402d10a8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x1401f08e0
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x1401f0909
cmp dword [rbp - 0x18], 0x10000
je 0x1401f0909
cmp qword [rbp - 0x20], 0x1000
jb 0x1401f0909
cmp dword [rbp - 0x10], 0x1000000
je 0x1401f0905
cmp dword [rbp - 0x10], 0x40000
jne 0x1401f0909
mov al, 1
jmp 0x1401f090b
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x1401f0d48
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1402d1050]
mov rbx, rdx
test rax, rax
jne 0x1401f0e43
mov dword [rbp - 0x50], 0x18
mov eax, dword [rbp - 0x50]
xor al, 0x56
mov byte [rbp - 0x4c], al
mov eax, dword [rbp - 0x50]
inc al
xor al, 0x69
mov byte [rbp - 0x4b], al
mov eax, dword [rbp - 0x50]
add al, 2
xor al, 0x72
mov byte [rbp - 0x4a], al
mov eax, dword [rbp - 0x50]
add al, 3
xor al, 0x74
mov byte [rbp - 0x49], al
mov eax, dword [rbp - 0x50]
add al, 4
xor al, 0x75
mov byte [rbp - 0x48], al
mov eax, dword [rbp - 0x50]
add al, 5
xor al, 0x61
mov byte [rbp - 0x47], al
mov eax, dword [rbp - 0x50]
add al, 6
xor al, 0x6c
mov byte [rbp - 0x46], al
mov eax, dword [rbp - 0x50]
add al, 7
xor al, 0x51
mov byte [rbp - 0x45], al
mov eax, dword [rbp - 0x50]
add al, 8
xor al, 0x75
mov byte [rbp - 0x44], al
mov eax, dword [rbp - 0x50]
add al, 9
xor al, 0x65
mov byte [rbp - 0x43], al
mov eax, dword [rbp - 0x50]
add al, 0xa
xor al, 0x72
mov byte [rbp - 0x42], al
mov eax, dword [rbp - 0x50]
add al, 0xb
xor al, 0x79
mov byte [rbp - 0x41], al
xor eax, eax
mov byte [rbp - 0x40], al
xor edx, edx
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
add cl, dl
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x1401f0def
lea rcx, [0x140290e10]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x1402d1050], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1402d1050]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x1401f0e6c
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x1401f0e95
cmp dword [rbp - 0x18], 0x10000
je 0x1401f0e95
cmp qword [rbp - 0x20], 0x1000
jb 0x1401f0e95
cmp dword [rbp - 0x10], 0x1000000
je 0x1401f0e91
cmp dword [rbp - 0x10], 0x40000
jne 0x1401f0e95
mov al, 1
jmp 0x1401f0e97
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x1401f2a04
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1402d0f80]
mov rbx, rdx
test rax, rax
jne 0x1401f2aff
mov dword [rbp - 0x50], 0x18
mov eax, dword [rbp - 0x50]
xor al, 0x56
mov byte [rbp - 0x4c], al
mov eax, dword [rbp - 0x50]
inc al
xor al, 0x69
mov byte [rbp - 0x4b], al
mov eax, dword [rbp - 0x50]
add al, 2
xor al, 0x72
mov byte [rbp - 0x4a], al
mov eax, dword [rbp - 0x50]
add al, 3
xor al, 0x74
mov byte [rbp - 0x49], al
mov eax, dword [rbp - 0x50]
add al, 4
xor al, 0x75
mov byte [rbp - 0x48], al
mov eax, dword [rbp - 0x50]
add al, 5
xor al, 0x61
mov byte [rbp - 0x47], al
mov eax, dword [rbp - 0x50]
add al, 6
xor al, 0x6c
mov byte [rbp - 0x46], al
mov eax, dword [rbp - 0x50]
add al, 7
xor al, 0x51
mov byte [rbp - 0x45], al
mov eax, dword [rbp - 0x50]
add al, 8
xor al, 0x75
mov byte [rbp - 0x44], al
mov eax, dword [rbp - 0x50]
add al, 9
xor al, 0x65
mov byte [rbp - 0x43], al
mov eax, dword [rbp - 0x50]
add al, 0xa
xor al, 0x72
mov byte [rbp - 0x42], al
mov eax, dword [rbp - 0x50]
add al, 0xb
xor al, 0x79
mov byte [rbp - 0x41], al
xor eax, eax
mov byte [rbp - 0x40], al
xor edx, edx
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
add cl, dl
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x1401f2aab
lea rcx, [0x140290e10]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x1402d0f80], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1402d0f80]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x1401f2b28
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x1401f2b51
cmp dword [rbp - 0x18], 0x10000
je 0x1401f2b51
cmp qword [rbp - 0x20], 0x1000
jb 0x1401f2b51
cmp dword [rbp - 0x10], 0x1000000
je 0x1401f2b4d
cmp dword [rbp - 0x10], 0x40000
jne 0x1401f2b51
mov al, 1
jmp 0x1401f2b53
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x1401f46c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1402d09e0]
mov rbx, rdx
test rax, rax
jne 0x1401f47bb
mov dword [rbp - 0x50], 0x18
mov eax, dword [rbp - 0x50]
xor al, 0x56
mov byte [rbp - 0x4c], al
mov eax, dword [rbp - 0x50]
inc al
xor al, 0x69
mov byte [rbp - 0x4b], al
mov eax, dword [rbp - 0x50]
add al, 2
xor al, 0x72
mov byte [rbp - 0x4a], al
mov eax, dword [rbp - 0x50]
add al, 3
xor al, 0x74
mov byte [rbp - 0x49], al
mov eax, dword [rbp - 0x50]
add al, 4
xor al, 0x75
mov byte [rbp - 0x48], al
mov eax, dword [rbp - 0x50]
add al, 5
xor al, 0x61
mov byte [rbp - 0x47], al
mov eax, dword [rbp - 0x50]
add al, 6
xor al, 0x6c
mov byte [rbp - 0x46], al
mov eax, dword [rbp - 0x50]
add al, 7
xor al, 0x51
mov byte [rbp - 0x45], al
mov eax, dword [rbp - 0x50]
add al, 8
xor al, 0x75
mov byte [rbp - 0x44], al
mov eax, dword [rbp - 0x50]
add al, 9
xor al, 0x65
mov byte [rbp - 0x43], al
mov eax, dword [rbp - 0x50]
add al, 0xa
xor al, 0x72
mov byte [rbp - 0x42], al
mov eax, dword [rbp - 0x50]
add al, 0xb
xor al, 0x79
mov byte [rbp - 0x41], al
xor eax, eax
mov byte [rbp - 0x40], al
xor edx, edx
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
add cl, dl
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x1401f4767
lea rcx, [0x140290e10]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x1402d09e0], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1402d09e0]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x1401f47e4
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x1401f480d
cmp dword [rbp - 0x18], 0x10000
je 0x1401f480d
cmp qword [rbp - 0x20], 0x1000
jb 0x1401f480d
cmp dword [rbp - 0x10], 0x1000000
je 0x1401f4809
cmp dword [rbp - 0x10], 0x40000
jne 0x1401f480d
mov al, 1
jmp 0x1401f480f
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x1401f637c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1402d0f40]
mov rbx, rdx
test rax, rax
jne 0x1401f6477
mov dword [rbp - 0x50], 0x18
mov eax, dword [rbp - 0x50]
xor al, 0x56
mov byte [rbp - 0x4c], al
mov eax, dword [rbp - 0x50]
inc al
xor al, 0x69
mov byte [rbp - 0x4b], al
mov eax, dword [rbp - 0x50]
add al, 2
xor al, 0x72
mov byte [rbp - 0x4a], al
mov eax, dword [rbp - 0x50]
add al, 3
xor al, 0x74
mov byte [rbp - 0x49], al
mov eax, dword [rbp - 0x50]
add al, 4
xor al, 0x75
mov byte [rbp - 0x48], al
mov eax, dword [rbp - 0x50]
add al, 5
xor al, 0x61
mov byte [rbp - 0x47], al
mov eax, dword [rbp - 0x50]
add al, 6
xor al, 0x6c
mov byte [rbp - 0x46], al
mov eax, dword [rbp - 0x50]
add al, 7
xor al, 0x51
mov byte [rbp - 0x45], al
mov eax, dword [rbp - 0x50]
add al, 8
xor al, 0x75
mov byte [rbp - 0x44], al
mov eax, dword [rbp - 0x50]
add al, 9
xor al, 0x65
mov byte [rbp - 0x43], al
mov eax, dword [rbp - 0x50]
add al, 0xa
xor al, 0x72
mov byte [rbp - 0x42], al
mov eax, dword [rbp - 0x50]
add al, 0xb
xor al, 0x79
mov byte [rbp - 0x41], al
xor eax, eax
mov byte [rbp - 0x40], al
xor edx, edx
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
add cl, dl
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x1401f6423
lea rcx, [0x140290e10]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x1402d0f40], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1402d0f40]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x1401f64a0
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x1401f64c9
cmp dword [rbp - 0x18], 0x10000
je 0x1401f64c9
cmp qword [rbp - 0x20], 0x1000
jb 0x1401f64c9
cmp dword [rbp - 0x10], 0x1000000
je 0x1401f64c5
cmp dword [rbp - 0x10], 0x40000
jne 0x1401f64c9
mov al, 1
jmp 0x1401f64cb
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x1401f8038
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1402d0df0]
mov rbx, rdx
test rax, rax
jne 0x1401f8133
mov dword [rbp - 0x50], 0x18
mov eax, dword [rbp - 0x50]
xor al, 0x56
mov byte [rbp - 0x4c], al
mov eax, dword [rbp - 0x50]
inc al
xor al, 0x69
mov byte [rbp - 0x4b], al
mov eax, dword [rbp - 0x50]
add al, 2
xor al, 0x72
mov byte [rbp - 0x4a], al
mov eax, dword [rbp - 0x50]
add al, 3
xor al, 0x74
mov byte [rbp - 0x49], al
mov eax, dword [rbp - 0x50]
add al, 4
xor al, 0x75
mov byte [rbp - 0x48], al
mov eax, dword [rbp - 0x50]
add al, 5
xor al, 0x61
mov byte [rbp - 0x47], al
mov eax, dword [rbp - 0x50]
add al, 6
xor al, 0x6c
mov byte [rbp - 0x46], al
mov eax, dword [rbp - 0x50]
add al, 7
xor al, 0x51
mov byte [rbp - 0x45], al
mov eax, dword [rbp - 0x50]
add al, 8
xor al, 0x75
mov byte [rbp - 0x44], al
mov eax, dword [rbp - 0x50]
add al, 9
xor al, 0x65
mov byte [rbp - 0x43], al
mov eax, dword [rbp - 0x50]
add al, 0xa
xor al, 0x72
mov byte [rbp - 0x42], al
mov eax, dword [rbp - 0x50]
add al, 0xb
xor al, 0x79
mov byte [rbp - 0x41], al
xor eax, eax
mov byte [rbp - 0x40], al
xor edx, edx
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
add cl, dl
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x1401f80df
lea rcx, [0x140290e10]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x1402d0df0], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1402d0df0]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x1401f815c
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x1401f8185
cmp dword [rbp - 0x18], 0x10000
je 0x1401f8185
cmp qword [rbp - 0x20], 0x1000
jb 0x1401f8185
cmp dword [rbp - 0x10], 0x1000000
je 0x1401f8181
cmp dword [rbp - 0x10], 0x40000
jne 0x1401f8185
mov al, 1
jmp 0x1401f8187
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x1401f9cf4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1402d0a70]
mov rbx, rdx
test rax, rax
jne 0x1401f9def
mov dword [rbp - 0x50], 0x18
mov eax, dword [rbp - 0x50]
xor al, 0x56
mov byte [rbp - 0x4c], al
mov eax, dword [rbp - 0x50]
inc al
xor al, 0x69
mov byte [rbp - 0x4b], al
mov eax, dword [rbp - 0x50]
add al, 2
xor al, 0x72
mov byte [rbp - 0x4a], al
mov eax, dword [rbp - 0x50]
add al, 3
xor al, 0x74
mov byte [rbp - 0x49], al
mov eax, dword [rbp - 0x50]
add al, 4
xor al, 0x75
mov byte [rbp - 0x48], al
mov eax, dword [rbp - 0x50]
add al, 5
xor al, 0x61
mov byte [rbp - 0x47], al
mov eax, dword [rbp - 0x50]
add al, 6
xor al, 0x6c
mov byte [rbp - 0x46], al
mov eax, dword [rbp - 0x50]
add al, 7
xor al, 0x51
mov byte [rbp - 0x45], al
mov eax, dword [rbp - 0x50]
add al, 8
xor al, 0x75
mov byte [rbp - 0x44], al
mov eax, dword [rbp - 0x50]
add al, 9
xor al, 0x65
mov byte [rbp - 0x43], al
mov eax, dword [rbp - 0x50]
add al, 0xa
xor al, 0x72
mov byte [rbp - 0x42], al
mov eax, dword [rbp - 0x50]
add al, 0xb
xor al, 0x79
mov byte [rbp - 0x41], al
xor eax, eax
mov byte [rbp - 0x40], al
xor edx, edx
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
add cl, dl
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x1401f9d9b
lea rcx, [0x140290e10]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x1402d0a70], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1402d0a70]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x1401f9e18
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x1401f9e41
cmp dword [rbp - 0x18], 0x10000
je 0x1401f9e41
cmp qword [rbp - 0x20], 0x1000
jb 0x1401f9e41
cmp dword [rbp - 0x10], 0x1000000
je 0x1401f9e3d
cmp dword [rbp - 0x10], 0x40000
jne 0x1401f9e41
mov al, 1
jmp 0x1401f9e43
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret