joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003cd0
Capabilities:
Get user security identifier

Disassembly:
push rbp
push rsi
sub rsp, 0x48
xor ebp, ebp
lea rax, [rsp + 0x68]
mov rsi, rcx
mov rdx, rcx
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x70]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x68], ebp
mov dword [rsp + 0x70], ebp
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x534
je 0x140003d93
mov ecx, dword [rsp + 0x70]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x40], rdi
call fcn.14000ac7c
mov ecx, dword [rsp + 0x68]
add rcx, rcx
mov rbx, rax
call fcn.14000ac7c
lea r9, [rsp + 0x70]
mov r8, rbx
mov rdi, rax
lea rax, [rsp + 0x78]
mov rdx, rsi
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x68]
xor ecx, ecx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x140003d77
mov rcx, rbx
call fcn.14000ac3c
mov ebx, ebp
mov rcx, rdi
call fcn.14000ac3c
mov rdi, qword [rsp + 0x40]
mov rax, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x48
pop rsi
pop rbp
ret
mov rax, rbp
add rsp, 0x48
pop rsi
pop rbp
ret
Function at 0x140004070
Capabilities:
Acquire debug privileges
Enumerate processes

Disassembly:
sub rsp, 0x298
mov rax, qword [0x140056fb0]
xor rax, rsp
mov qword [rsp + 0x280], rax
lea rcx, str.SeDebugPrivilege
call fcn.140002aa0
test eax, eax
je 0x140004221
xor edx, edx
mov qword [rsp + 0x290], rdi
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
test rax, rax
je 0x140004219
lea rdx, [rsp + 0x40]
mov rcx, rax
mov dword [rsp + 0x40], 0x238
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x140004210
mov qword [rsp + 0x2a0], rbx
lea rcx, [rsp + 0x6c]
mov edx, 0x5c
lea rbx, [rsp + 0x6c]
call fcn.14000c9bc
test rax, rax
je 0x140004111
lea rcx, [rsp + 0x6c]
mov edx, 0x5c
call fcn.14000c9bc
mov rbx, rax
add rbx, 2
je 0x140004124
lea rdx, str.winlogon.exe
mov rcx, rbx
call fcn.14000a6dc
test eax, eax
je 0x14000413a
lea rdx, [rsp + 0x40]
mov rcx, rdi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1400040e0
jmp 0x140004208
mov r8d, dword [rsp + 0x48]
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140004208
lea r8, [rsp + 0x30]
mov edx, 0xa
mov rcx, rax
mov qword [rsp + 0x30], 0
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400041ff
mov rcx, qword [rsp + 0x30]
lea rax, [0x140058b18]
mov r9d, 2
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov edx, 0xf01ff
mov dword [rsp + 0x20], 2
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x1400041f4
lea rcx, str.SeImpersonatePrivilege
call fcn.140002aa0
mov rcx, qword [0x140058b18]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x1400041f4
lea rcx, str.SeSecurityPrivilege
call fcn.140002aa0
lea rcx, str.SeDebugPrivilege
call fcn.140002aa0
lea rcx, str.SeBackupPrivilege
call fcn.140002aa0
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x2a0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x290]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.14000b260
add rsp, 0x298
ret
Function at 0x140005200
Capabilities:
Compare security identifiers

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 8], rcx
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x40
xor ebp, ebp
mov rbx, r9
mov r15, r8
cmp byte [0x140058b28], bpl
mov r13, rdx
mov qword [rax - 0x38], rbp
jne 0x14000527c
mov rdi, qword [rsp + 0x90]
lea r8, [rax + 0x20]
lea rdx, [rax - 0x30]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorOwner]
test eax, eax
je 0x14000527c
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x14000527c
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x14000527c
lea rdx, [rsp + 0xa0]
mov rcx, rdi
call fcn.1400025b0
mov ecx, dword [rbx]
mov edi, dword [rsp + 0xa0]
test ecx, ecx
je 0x1400052b1
mov r8, rbp
mov eax, ecx
mov rdx, rbx
test edi, eax
je 0x14000529e
test byte [rdx + 0x204], 2
jne 0x14000531d
inc r8
imul rdx, r8, 0x208
add rdx, rbx
mov eax, dword [rdx]
test eax, eax
jne 0x140005291
xor r14b, r14b
test ecx, ecx
je 0x1400052e0
mov rdx, rbp
mov rax, rbx
nop
test edi, ecx
je 0x1400052cd
test byte [rax + 0x204], 1
jne 0x140005322
inc rdx
imul rax, rdx, 0x208
add rax, rbx
mov ecx, dword [rax]
test ecx, ecx
jne 0x1400052c0
xor sil, sil
movzx r8d, byte [0x140035190]
test r8b, r8b
je 0x1400052f5
test sil, sil
jne 0x14000534a
movzx edx, byte [0x140035191]
test dl, dl
je 0x140005305
test r14b, r14b
jne 0x14000534a
test r8b, r8b
je 0x140005327
test dl, dl
je 0x140005327
test r14b, r14b
jne 0x140005327
test sil, sil
je 0x14000534a
jmp 0x140005436
mov r14b, 1
jmp 0x1400052b4
mov sil, 1
jmp 0x1400052e3
test sil, sil
jne 0x140005436
test r14b, r14b
jne 0x140005436
test r8b, r8b
jne 0x140005436
test dl, dl
jne 0x140005436
cmp qword [0x140058b30], rbp
je 0x1400053b5
mov eax, 0x20
mov r8d, eax
lea ecx, [rax + 0x37]
test r15, r15
je 0x140005390
test r14b, r14b
mov r9, r15
mov qword [rsp + 0x20], r13
cmovne r8d, ecx
mov ecx, 0x52
test sil, sil
cmovne eax, ecx
lea rcx, str._C_C___s__t_s_n
mov edx, eax
call fcn.14000adf8
jmp 0x140005410
test r14b, r14b
mov r9, r13
cmovne r8d, ecx
mov ecx, 0x52
test sil, sil
cmovne eax, ecx
lea rcx, str._C_C__s_n
mov edx, eax
call fcn.14000adf8
jmp 0x140005410
cmp byte [0x140058b29], bpl
jne 0x140005410
mov rcx, qword [rsp + 0x98]
lea rdx, [rsp + 0x30]
xor r8d, r8d
call fcn.140002ba0
mov rbp, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x70]
mov eax, 0x20
mov ecx, 0x57
test r14b, r14b
mov r9d, eax
mov qword [rsp + 0x20], rbp
cmovne r9d, ecx
mov ecx, 0x52
test sil, sil
cmovne eax, ecx
lea rcx, str._s_C_C__s_n
mov r8d, eax
call fcn.14000adf8
inc dword [0x140058b14]
cmp byte [0x140058b28], 0
je 0x140005429
mov edx, edi
mov rcx, rbx
call fcn.140005450
test rbp, rbp
je 0x140005436
mov rcx, rbp
call fcn.14000ac3c
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
Function at 0x140006590
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
lea rcx, str.Ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x140028ae0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.Ntdll.dll
mov qword [0x140058b68], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtOpenDirectoryObject
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.Ntdll.dll
mov qword [0x140058b80], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtQueryDirectoryObject
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.Ntdll.dll
mov qword [0x140058b78], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.RtlNtStatusToDosError
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.Ntdll.dll
mov qword [0x140058b70], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtOpenEvent
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.Ntdll.dll
mov qword [0x140058b88], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtOpenMutant
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.Ntdll.dll
mov qword [0x140058b98], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtOpenSemaphore
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.Ntdll.dll
mov qword [0x140058ba0], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtOpenSection
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.Ntdll.dll
mov qword [0x140058ba8], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtOpenTimer
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.Ntdll.dll
mov qword [0x140058bb0], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtOpenKeyedEvent
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.Ntdll.dll
mov qword [0x140058b90], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtOpenFile
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140058bb8], rax
add rsp, 0x28
ret
Function at 0x140008080
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r14
sub rsp, 0x280
mov rax, qword [0x140056fb0]
xor rax, rsp
mov qword [rsp + 0x270], rax
movzx ebp, dl
xor edx, edx
mov rbx, rcx
lea ecx, [rdx + 2]
xor r14d, r14d
mov dword [rsp + 0x20], r14d
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
test rax, rax
jne 0x1400080e0
lea rcx, str.Error_snapshoting_processes:_n
call fcn.14000adf8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140005190
jmp 0x14000821f
lea r8, [rsp + 0x20]
lea rdx, [0x140025e38]
mov rcx, rbx
mov qword [rsp + 0x2a8], rdi
call fcn.14000d990
cmp eax, 1
jne 0x14000814f
mov rdi, r14
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rbx + rax*2], di
jne 0x140008110
test rax, rax
je 0x14000814f
nop
movzx ecx, word [rbx + rdi*2]
call fcn.14000d93c
mov ecx, dword [rsp + 0x20]
test eax, eax
cmove ecx, r14d
inc rdi
or rax, 0xffffffffffffffff
mov dword [rsp + 0x20], ecx
nop
inc rax
cmp word [rbx + rax*2], r14w
jne 0x140008140
cmp rdi, rax
jb 0x140008120
lea rdx, [rsp + 0x30]
mov rcx, rsi
mov dword [rsp + 0x30], 0x238
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x14000820e
nop dword [rax]
lea rcx, [rsp + 0x5c]
mov edx, 0x5c
lea rdi, [rsp + 0x5c]
call fcn.14000c9bc
test rax, rax
je 0x14000819c
lea rcx, [rsp + 0x5c]
mov edx, 0x5c
call fcn.14000c9bc
lea rdi, [rax + 2]
mov ecx, dword [rsp + 0x38]
test ecx, ecx
je 0x1400081f9
movzx eax, word [rbx]
cmp ax, word [0x140028838]
jne 0x1400081bd
movzx eax, word [rbx + 2]
cmp ax, word [0x14002883a]
je 0x1400081eb
mov eax, dword [rsp + 0x20]
test eax, eax
je 0x1400081c9
cmp eax, ecx
je 0x1400081eb
test rdi, rdi
je 0x1400081f9
or r8, 0xffffffffffffffff
inc r8
cmp word [rbx + r8*2], r14w
jne 0x1400081d2
mov rdx, rbx
mov rcx, rdi
call fcn.14000ca6c
test eax, eax
jne 0x1400081f9
lea rcx, [rsp + 0x30]
movzx edx, bpl
call fcn.140008250
lea rdx, [rsp + 0x30]
mov rcx, rsi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x140008170
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x2a8]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14000b260
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop r14
pop rsi
pop rbp
ret
Function at 0x140008650
Capabilities:
Check os version

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x460
mov rax, qword [0x140056fb0]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rdi, rdx
mov rsi, rcx
mov dword [rsp + 0x38], r8d
mov dword [rsp + 0x30], 0x400
xor bl, bl
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jb 0x1400086ea
lea r8, [rsp + 0x40]
mov edx, 8
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400086ea
mov r9d, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
lea r8, [rsp + 0x50]
mov edx, 0x19
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x1400086df
mov rcx, qword [rsp + 0x50]
lea r8, [rsp + 0x38]
mov rdx, rdi
call fcn.140002fd0
mov bl, 1
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, bl
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.14000b260
add rsp, 0x460
pop rdi
pop rsi
pop rbx
ret
Function at 0x14000a3f0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
sub rsp, 0x40
mov eax, dword [rdx + 8]
mov rbp, rcx
shr eax, 0x1f
test al, 1
je 0x14000a524
lea rax, [rsp + 0x68]
lea rdx, str.SystemCurrentControlSetServicesLanmanserverDefaultSecurity
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x58], 0
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test eax, eax
jne 0x14000a4fa
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rdx, str.SrvsvcShareAdminConnect
xor r8d, r8d
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [rsp + 0x58]
test eax, eax
je 0x14000a4eb
mov ecx, eax
mov qword [rsp + 0x38], rsi
call fcn.14000ac7c
mov rcx, qword [rsp + 0x68]
lea r9, [rsp + 0x60]
mov rsi, rax
lea rax, [rsp + 0x58]
lea rdx, str.SrvsvcShareAdminConnect
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x14000a4de
mov rcx, rsi
call fcn.14000a550
lea rdx, [0x140045110]
xor r9d, r9d
mov r8, rsi
mov rcx, rbp
mov qword [rsp + 0x20], 0
call fcn.140004240
mov rcx, rsi
call fcn.14000ac3c
mov rsi, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x14000a519
cmp byte [0x140058b13], 0
jne 0x14000a519
lea rcx, str.__Error_getting_security_for__s:_n
mov rdx, rbp
call fcn.14000adf8
mov ecx, edi
call fcn.140005190
mov rdi, qword [rsp + 0x30]
add rsp, 0x40
pop rbp
ret
mov r8, qword [rdx + 0x40]
lea rdx, [0x140045110]
xor r9d, r9d
mov qword [rsp + 0x20], 0
call fcn.140004240
add rsp, 0x40
pop rbp
ret

Function at 0x14000ac30
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.14000aa98

Function at 0x14000dc24
Capabilities:
Encode data using xor

Disassembly:
xor rcx, rcx
sub rcx, 0xffffffffffffff62
lea rax, [entry0]
movabs rbx, 0xd919764a23debf0f
mov edi, 0x764a23de
sbb ecx, ebx
xor qword [rax + 0x27], rbx
sub rax, 0xfffffffffffffff8
loop 0x14000dc3f
neg dword [rbp - 0x39]
mov edx, 0xfd9d99e
mov edi, 0x260b729f
mov byte [r9 - 9], bl
out dx, eax
int1
invalid
Function at 0x1400aaa44
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x1b
jb 0x1400aaa51
mov word [rcx + 0x3a], r11w
ret

Function at 0x1400aaab8
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x16
jb 0x1400aaac5
mov word [rcx + 0x30], r11w
ret

Function at 0x1400aab2c
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0xc
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x1400aab39
xor edx, edx
mov word [rcx + 0x1c], dx
ret

Function at 0x1400aab70
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0xd
jb 0x1400aab7d
mov word [rcx + 0x1e], r11w
ret

Function at 0x1400aac10
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x11
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x1400aac1d
xor edx, edx
mov word [rcx + 0x26], dx
ret

Function at 0x1400aac54
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x21
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x1400aac61
xor edx, edx
mov word [rcx + 0x46], dx
ret

Function at 0x1400aac84
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x11
jb 0x1400aac91
mov word [rcx + 0x26], r11w
ret

Function at 0x1400aaccc
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x1a
jb 0x1400aacd9
mov word [rcx + 0x38], r11w
ret

Function at 0x1400aad30
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x21
jb 0x1400aad3d
mov word [rcx + 0x46], r11w
ret

Function at 0x1400aad78
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x18
jb 0x1400aad85
mov word [rcx + 0x34], r11w
ret
Function at 0x1400aadc0
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x10
jb 0x1400aadcd
mov word [rcx + 0x24], r11w
ret

Function at 0x1400aae08
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x17
jb 0x1400aae15
mov word [rcx + 0x32], r11w
ret

Function at 0x1400aae50
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x1f
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x1400aae5d
xor edx, edx
mov word [rcx + 0x42], dx
ret

Function at 0x1400aaec0
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x27
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x1400aaecd
xor edx, edx
mov word [rcx + 0x52], dx
ret

Function at 0x1400aaf5c
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x24
jb 0x1400aaf69
mov word [rcx + 0x4c], r11w
ret

Function at 0x1400aafa4
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x13
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x1400aafb1
xor edx, edx
mov word [rcx + 0x2a], dx
ret

Function at 0x1400aafe8
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x26
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x1400aaff5
xor edx, edx
mov word [rcx + 0x50], dx
ret

Function at 0x1400ab02c
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 2
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x1400ab039
xor edx, edx
mov word [rcx + 8], dx
ret

Function at 0x1400ab05c
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x10
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x1400ab069
xor edx, edx
mov word [rcx + 0x24], dx
ret

Function at 0x1400ab0a0
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x20
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x1400ab0ad
xor edx, edx
mov word [rcx + 0x44], dx
ret

Function at 0x1400ab0d0
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x1b
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x1400ab0dd
xor edx, edx
mov word [rcx + 0x3a], dx
ret
Function at 0x1400ab114
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x14
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x1400ab121
xor edx, edx
mov word [rcx + 0x2c], dx
ret

Function at 0x1400ab158
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 9
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x1400ab165
xor edx, edx
mov word [rcx + 0x16], dx
ret

Function at 0x1400ab19c
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x12
jb 0x1400ab1a9
mov word [rcx + 0x28], r11w
ret

Function at 0x1400ab1e4
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 8
jb 0x1400ab1f1
mov word [rcx + 0x14], r11w
ret

Function at 0x1400ab974
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x1c
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x1400ab981
xor edx, edx
mov word [rcx + 0x3c], dx
ret

Function at 0x1400ab9a4
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x1a
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x1400ab9b1
xor edx, edx
mov word [rcx + 0x38], dx
ret

Function at 0x1400ab9d4
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 2
jb 0x1400ab9e1
mov word [rcx + 8], r11w
ret

Function at 0x1400aba08
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x13
jb 0x1400aba15
mov word [rcx + 0x2a], r11w
ret

Function at 0x1400aba3c
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0xc
jb 0x1400aba49
mov word [rcx + 0x1c], r11w
ret

Function at 0x1400aba9c
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x12
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x1400abaa9
xor edx, edx
mov word [rcx + 0x28], dx
ret