joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ff738e18bf0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 0x66], sil
je 0x7ff738e18c35
mov ecx, esi
mov edx, 0x5618
nop dword [rax]
nop word [rax + rax]
lea eax, [rdx + rcx]
xor word [r8 + rcx*2], ax
inc rcx
cmp rcx, 0x32
jb 0x7ff738e18c20
mov byte [r8 + 0x66], sil
lea rax, [r8 + 0x64]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], si
cmp r8, rax
je 0x7ff738e18c69
mov r9, r8
mov edx, 0x32
lea rcx, [rsp + 0x28]
call fcn.7ff738e1dd10
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 8
jb 0x7ff738e18c77
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x28]
call fcn.7ff738e1e550
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x7ff738e18cf1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff738e18cec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff738e18cec
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff738e21b94
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x7ff738e18d00
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 0x58], sil
je 0x7ff738e18d45
mov ecx, esi
mov edx, 0x5618
nop dword [rax]
nop word [rax + rax]
lea eax, [rdx + rcx]
xor word [r8 + rcx*2], ax
inc rcx
cmp rcx, 0x2b
jb 0x7ff738e18d30
mov byte [r8 + 0x58], sil
lea rax, [r8 + 0x56]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], si
cmp r8, rax
je 0x7ff738e18d79
mov r9, r8
mov edx, 0x2b
lea rcx, [rsp + 0x28]
call fcn.7ff738e1dd10
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 8
jb 0x7ff738e18d87
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x28]
call fcn.7ff738e1e550
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x7ff738e18e01
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff738e18dfc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff738e18dfc
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff738e21b94
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x7ff738e18e10
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 0x40], sil
je 0x7ff738e18e55
mov ecx, esi
mov edx, 0x5618
nop dword [rax]
nop word [rax + rax]
lea eax, [rdx + rcx]
xor word [r8 + rcx*2], ax
inc rcx
cmp rcx, 0x1f
jb 0x7ff738e18e40
mov byte [r8 + 0x40], sil
lea rax, [r8 + 0x3e]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], si
cmp r8, rax
je 0x7ff738e18e89
mov r9, r8
mov edx, 0x1f
lea rcx, [rsp + 0x28]
call fcn.7ff738e1dd10
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 8
jb 0x7ff738e18e97
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x28]
call fcn.7ff738e1e550
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x7ff738e18f11
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff738e18f0c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff738e18f0c
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff738e21b94
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x7ff738e18f20
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 0x2a], sil
je 0x7ff738e18f65
mov ecx, esi
mov edx, 0x5618
nop dword [rax]
nop word [rax + rax]
lea eax, [rdx + rcx]
xor word [r8 + rcx*2], ax
inc rcx
cmp rcx, 0x14
jb 0x7ff738e18f50
mov byte [r8 + 0x2a], sil
lea rax, [r8 + 0x28]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], si
cmp r8, rax
je 0x7ff738e18f99
mov r9, r8
mov edx, 0x14
lea rcx, [rsp + 0x28]
call fcn.7ff738e1dd10
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 8
jb 0x7ff738e18fa7
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x28]
call fcn.7ff738e1e550
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x7ff738e19021
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff738e1901c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff738e1901c
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff738e21b94
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x7ff738e19030
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
mov r9, rcx
mov qword [rsp + 0x28], rdx
xor edx, edx
cmp byte [rcx + 0x2a], dl
je 0x7ff738e19066
mov ecx, edx
mov r8d, 0x5618
lea eax, [r8 + rcx]
xor word [r9 + rcx*2], ax
inc rcx
cmp rcx, 0x14
jb 0x7ff738e19050
mov byte [r9 + 0x2a], dl
lea rcx, [r9 + 0x28]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 7
mov word [rbx], dx
cmp r9, rcx
je 0x7ff738e1908e
mov edx, 0x14
mov rcx, rbx
call fcn.7ff738e1dd10
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x7ff738e190a0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 0x2e], sil
je 0x7ff738e190e5
mov ecx, esi
mov edx, 0x5618
nop dword [rax]
nop word [rax + rax]
lea eax, [rdx + rcx]
xor word [r8 + rcx*2], ax
inc rcx
cmp rcx, 0x16
jb 0x7ff738e190d0
mov byte [r8 + 0x2e], sil
lea rax, [r8 + 0x2c]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], si
cmp r8, rax
je 0x7ff738e19119
mov r9, r8
mov edx, 0x16
lea rcx, [rsp + 0x28]
call fcn.7ff738e1dd10
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 8
jb 0x7ff738e19127
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x28]
call fcn.7ff738e1e550
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x7ff738e191a1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff738e1919c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff738e1919c
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff738e21b94
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x7ff738e191b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 0x26], sil
je 0x7ff738e191f5
mov ecx, esi
mov edx, 0x5618
nop dword [rax]
nop word [rax + rax]
lea eax, [rdx + rcx]
xor word [r8 + rcx*2], ax
inc rcx
cmp rcx, 0x12
jb 0x7ff738e191e0
mov byte [r8 + 0x26], sil
lea rax, [r8 + 0x24]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], si
cmp r8, rax
je 0x7ff738e19229
mov r9, r8
mov edx, 0x12
lea rcx, [rsp + 0x28]
call fcn.7ff738e1dd10
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 8
jb 0x7ff738e19237
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x28]
call fcn.7ff738e1e550
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x7ff738e192b1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff738e192ac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff738e192ac
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff738e21b94
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x7ff738e192c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
mov r9, rcx
mov qword [rsp + 0x28], rdx
xor edx, edx
cmp byte [rcx + 0x26], dl
je 0x7ff738e192f6
mov ecx, edx
mov r8d, 0x5618
lea eax, [r8 + rcx]
xor word [r9 + rcx*2], ax
inc rcx
cmp rcx, 0x12
jb 0x7ff738e192e0
mov byte [r9 + 0x26], dl
lea rcx, [r9 + 0x24]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 7
mov word [rbx], dx
cmp r9, rcx
je 0x7ff738e1931e
mov edx, 0x12
mov rcx, rbx
call fcn.7ff738e1dd10
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x7ff738e19330
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 0x2c], sil
je 0x7ff738e19375
mov ecx, esi
mov edx, 0x5618
nop dword [rax]
nop word [rax + rax]
lea eax, [rdx + rcx]
xor word [r8 + rcx*2], ax
inc rcx
cmp rcx, 0x15
jb 0x7ff738e19360
mov byte [r8 + 0x2c], sil
lea rax, [r8 + 0x2a]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], si
cmp r8, rax
je 0x7ff738e193a9
mov r9, r8
mov edx, 0x15
lea rcx, [rsp + 0x28]
call fcn.7ff738e1dd10
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 8
jb 0x7ff738e193b7
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x28]
call fcn.7ff738e1e550
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x7ff738e19431
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff738e1942c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff738e1942c
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff738e21b94
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x7ff738e19440
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
mov r9, rcx
mov qword [rsp + 0x28], rdx
xor edx, edx
cmp byte [rcx + 0x2c], dl
je 0x7ff738e19476
mov ecx, edx
mov r8d, 0x5618
lea eax, [r8 + rcx]
xor word [r9 + rcx*2], ax
inc rcx
cmp rcx, 0x15
jb 0x7ff738e19460
mov byte [r9 + 0x2c], dl
lea rcx, [r9 + 0x2a]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 7
mov word [rbx], dx
cmp r9, rcx
je 0x7ff738e1949e
mov edx, 0x15
mov rcx, rbx
call fcn.7ff738e1dd10
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x7ff738e194b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 0xc6], sil
je 0x7ff738e194f8
mov ecx, esi
mov edx, 0x5618
nop word [rax + rax]
lea eax, [rdx + rcx]
xor word [r8 + rcx*2], ax
inc rcx
cmp rcx, 0x62
jb 0x7ff738e194e0
mov byte [r8 + 0xc6], sil
lea rax, [r8 + 0xc4]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], si
cmp r8, rax
je 0x7ff738e1952f
mov r9, r8
mov edx, 0x62
lea rcx, [rsp + 0x28]
call fcn.7ff738e1dd10
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 8
jb 0x7ff738e1953d
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x28]
call fcn.7ff738e1e550
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x7ff738e195b7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff738e195b2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff738e195b2
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff738e21b94
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x7ff738e196a0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 0x1c], sil
je 0x7ff738e196e5
mov ecx, esi
mov edx, 0x5618
nop dword [rax]
nop word [rax + rax]
lea eax, [rdx + rcx]
xor word [r8 + rcx*2], ax
inc rcx
cmp rcx, 0xd
jb 0x7ff738e196d0
mov byte [r8 + 0x1c], sil
lea rax, [r8 + 0x1a]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], si
cmp r8, rax
je 0x7ff738e19719
mov r9, r8
mov edx, 0xd
lea rcx, [rsp + 0x28]
call fcn.7ff738e1dd10
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 8
jb 0x7ff738e19727
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x28]
call fcn.7ff738e1e550
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x7ff738e197a1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff738e1979c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff738e1979c
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff738e21b94
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x7ff738e1a440
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x7ff738e30008]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
mov dword [rsp + 0x28], 0x101
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x30]
call qword [sym.imp.advapi32.dll_GetUserNameW]
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], 7
mov word [rdi], si
lea rax, [rsp + 0x30]
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [rax + rdx*2], 0
jne 0x7ff738e1a4a4
mov rcx, rdi
cmp rdx, 7
ja 0x7ff738e1a4d2
mov qword [rdi + 0x10], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
lea rdx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memcpy_1
mov word [rbx + rdi], si
jmp 0x7ff738e1a4dc
lea r9, [rsp + 0x30]
call fcn.7ff738e1dd10
mov rax, rdi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.7ff738e21b30
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x7ff738e1ba60
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rdx
mov r9, rcx
mov qword [rsp + 0x30], rdx
xor edx, edx
cmp byte [rcx + 0x62], dl
je 0x7ff738e1ba96
mov ecx, edx
mov r8d, 0x5618
lea eax, [r8 + rcx]
xor word [r9 + rcx*2], ax
inc rcx
cmp rcx, 0x30
jb 0x7ff738e1ba80
mov byte [r9 + 0x62], dl
lea rcx, [r9 + 0x60]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 7
mov word [rbx], dx
cmp r9, rcx
je 0x7ff738e1babe
mov edx, 0x30
mov rcx, rbx
call fcn.7ff738e1dd10
mov rax, rbx
add rsp, 0x40
pop rbx
ret

Function at 0x7ff738e1bad0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rdx
mov r9, rcx
mov qword [rsp + 0x30], rdx
xor edx, edx
cmp byte [rcx + 0x54], dl
je 0x7ff738e1bb06
mov ecx, edx
mov r8d, 0x5618
lea eax, [r8 + rcx]
xor word [r9 + rcx*2], ax
inc rcx
cmp rcx, 0x29
jb 0x7ff738e1baf0
mov byte [r9 + 0x54], dl
lea rcx, [r9 + 0x52]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 7
mov word [rbx], dx
cmp r9, rcx
je 0x7ff738e1bb2e
mov edx, 0x29
mov rcx, rbx
call fcn.7ff738e1dd10
mov rax, rbx
add rsp, 0x40
pop rbx
ret

Function at 0x7ff738e1bb40
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rdx
mov r9, rcx
mov qword [rsp + 0x30], rdx
xor edx, edx
cmp byte [rcx + 0x64], dl
je 0x7ff738e1bb76
mov ecx, edx
mov r8d, 0x5618
lea eax, [r8 + rcx]
xor word [r9 + rcx*2], ax
inc rcx
cmp rcx, 0x31
jb 0x7ff738e1bb60
mov byte [r9 + 0x64], dl
lea rcx, [r9 + 0x62]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 7
mov word [rbx], dx
cmp r9, rcx
je 0x7ff738e1bb9e
mov edx, 0x31
mov rcx, rbx
call fcn.7ff738e1dd10
mov rax, rbx
add rsp, 0x40
pop rbx
ret

Function at 0x7ff738e1bbb0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rdx
mov r9, rcx
mov qword [rsp + 0x30], rdx
xor edx, edx
cmp byte [rcx + 0x78], dl
je 0x7ff738e1bbe6
mov ecx, edx
mov r8d, 0x5618
lea eax, [r8 + rcx]
xor word [r9 + rcx*2], ax
inc rcx
cmp rcx, 0x3b
jb 0x7ff738e1bbd0
mov byte [r9 + 0x78], dl
lea rcx, [r9 + 0x76]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 7
mov word [rbx], dx
cmp r9, rcx
je 0x7ff738e1bc0e
mov edx, 0x3b
mov rcx, rbx
call fcn.7ff738e1dd10
mov rax, rbx
add rsp, 0x40
pop rbx
ret

Function at 0x7ff738e1bc20
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rdx
mov r9, rcx
mov qword [rsp + 0x30], rdx
xor edx, edx
cmp byte [rcx + 0xc4], dl
je 0x7ff738e1bc69
mov ecx, edx
mov r8d, 0x5618
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 + rcx]
xor word [r9 + rcx*2], ax
inc rcx
cmp rcx, 0x61
jb 0x7ff738e1bc50
mov byte [r9 + 0xc4], dl
lea rcx, [r9 + 0xc2]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 7
mov word [rbx], dx
cmp r9, rcx
je 0x7ff738e1bc94
mov edx, 0x61
mov rcx, rbx
call fcn.7ff738e1dd10
mov rax, rbx
add rsp, 0x40
pop rbx
ret
Function at 0x7ff738e1bca0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rdx
mov r9, rcx
mov qword [rsp + 0x30], rdx
xor edx, edx
cmp byte [rcx + 0x94], dl
je 0x7ff738e1bce9
mov ecx, edx
mov r8d, 0x5618
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 + rcx]
xor word [r9 + rcx*2], ax
inc rcx
cmp rcx, 0x49
jb 0x7ff738e1bcd0
mov byte [r9 + 0x94], dl
lea rcx, [r9 + 0x92]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 7
mov word [rbx], dx
cmp r9, rcx
je 0x7ff738e1bd14
mov edx, 0x49
mov rcx, rbx
call fcn.7ff738e1dd10
mov rax, rbx
add rsp, 0x40
pop rbx
ret

Function at 0x7ff738e1bd20
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rdx
mov r9, rcx
mov qword [rsp + 0x30], rdx
xor edx, edx
cmp byte [rcx + 0xb0], dl
je 0x7ff738e1bd69
mov ecx, edx
mov r8d, 0x5618
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 + rcx]
xor word [r9 + rcx*2], ax
inc rcx
cmp rcx, 0x57
jb 0x7ff738e1bd50
mov byte [r9 + 0xb0], dl
lea rcx, [r9 + 0xae]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 7
mov word [rbx], dx
cmp r9, rcx
je 0x7ff738e1bd94
mov edx, 0x57
mov rcx, rbx
call fcn.7ff738e1dd10
mov rax, rbx
add rsp, 0x40
pop rbx
ret

Function at 0x7ff738e1bda0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rdx
mov r9, rcx
mov qword [rsp + 0x30], rdx
xor edx, edx
cmp byte [rcx + 0x92], dl
je 0x7ff738e1bde9
mov ecx, edx
mov r8d, 0x5618
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 + rcx]
xor word [r9 + rcx*2], ax
inc rcx
cmp rcx, 0x48
jb 0x7ff738e1bdd0
mov byte [r9 + 0x92], dl
lea rcx, [r9 + 0x90]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 7
mov word [rbx], dx
cmp r9, rcx
je 0x7ff738e1be14
mov edx, 0x48
mov rcx, rbx
call fcn.7ff738e1dd10
mov rax, rbx
add rsp, 0x40
pop rbx
ret

Function at 0x7ff738e1be20
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rdx
mov r9, rcx
mov qword [rsp + 0x30], rdx
xor edx, edx
cmp byte [rcx + 0x80], dl
je 0x7ff738e1be69
mov ecx, edx
mov r8d, 0x5618
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 + rcx]
xor word [r9 + rcx*2], ax
inc rcx
cmp rcx, 0x3f
jb 0x7ff738e1be50
mov byte [r9 + 0x80], dl
lea rcx, [r9 + 0x7e]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 7
mov word [rbx], dx
cmp r9, rcx
je 0x7ff738e1be91
mov edx, 0x3f
mov rcx, rbx
call fcn.7ff738e1dd10
mov rax, rbx
add rsp, 0x40
pop rbx
ret

Function at 0x7ff738e1bea0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rdx
mov r9, rcx
mov qword [rsp + 0x30], rdx
xor edx, edx
cmp byte [rcx + 0x58], dl
je 0x7ff738e1bed6
mov ecx, edx
mov r8d, 0x5618
lea eax, [r8 + rcx]
xor word [r9 + rcx*2], ax
inc rcx
cmp rcx, 0x2b
jb 0x7ff738e1bec0
mov byte [r9 + 0x58], dl
lea rcx, [r9 + 0x56]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 7
mov word [rbx], dx
cmp r9, rcx
je 0x7ff738e1befe
mov edx, 0x2b
mov rcx, rbx
call fcn.7ff738e1dd10
mov rax, rbx
add rsp, 0x40
pop rbx
ret