joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003b290
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rdi
sub rsp, 0x50
mov rax, qword [0x1400b7060]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor eax, eax
mov dword [rsp + 0x2c], edx
mov edx, 0x1000
mov dword [rsp + 0x28], ecx
xor ecx, ecx
mov dword [rsp + 0x20], eax
mov r8d, edx
mov dword [rsp + 0x30], eax
lea r9d, [rax + 0x40]
mov qword [rsp + 0x34], 1
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
jne 0x14003b2ef
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140094850
add rsp, 0x50
pop rdi
ret
movups xmm0, xmmword [0x140285ae8]
mov r8d, Ordinal_45
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x20]
movups xmmword [rax], xmm0
movsd xmm1, qword [0x140285af8]
lea ecx, [r8 - 0x27]
movsd qword [rax + 0x10], xmm1
mov eax, dword [0x140285b00]
mov dword [rdi + 0x18], eax
movzx eax, word [0x140285b04]
mov word [rdi + 0x1c], ax
call rdi
xor edx, edx
mov r8d, 0x1000
mov rcx, rdi
mov ebx, eax
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test ebx, ebx
mov rbx, qword [rsp + 0x70]
setg al
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140094850
add rsp, 0x50
pop rdi
ret

Function at 0x14003b370
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x13c0
call fcn.140095490
sub rsp, rax
mov rax, qword [0x1400b7060]
xor rax, rsp
mov qword [rsp + 0x13b0], rax
mov edi, edx
mov ebx, ecx
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rsp + 0x13a4], 0xffffffff
mov r8d, 1
mov dword [rsp + 0x24], eax
nop
mov r9d, eax
shr r9d, 0x1e
xor r9d, eax
imul eax, r9d, 0x6c078965
add eax, r8d
mov dword [rsp + r8*4 + 0x24], eax
inc r8
cmp r8, 0x270
jb 0x14003b3c0
lea eax, [rbx - 0x80000000]
mov dword [rsp + 0x20], 0x270
mov ebp, 0x80000000
cmp ebx, ebp
lea esi, [rbx + rbp]
cmovae esi, eax
lea ebx, [rdi + rbp]
cmp edi, ebp
lea eax, [rdi - 0x80000000]
cmovae ebx, eax
sub ebx, esi
cmp ebx, 0xffffffff
jne 0x14003b423
lea rcx, [rsp + 0x20]
call fcn.14004a010
mov edx, eax
jmp 0x14003b461
lea edi, [rbx + 1]
xor r8d, r8d
xor eax, eax
test ebx, ebx
je 0x14003b441
lea rcx, [rsp + 0x20]
call fcn.14004a010
mov r8d, eax
mov eax, 0xffffffff
xor edx, edx
div edi
mov ecx, eax
mov r9d, edx
xor edx, edx
mov eax, r8d
div edi
cmp eax, ecx
jb 0x14003b45a
cmp r9d, ebx
jne 0x14003b426
xor edx, edx
mov eax, r8d
div edi
add edx, esi
cmp edx, ebp
lea ecx, [rdx - 0x80000000]
lea eax, [rdx + rbp]
cmovae eax, ecx
mov rcx, qword [rsp + 0x13b0]
xor rcx, rsp
call fcn.140094850
lea r11, [rsp + 0x13c0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14003b4a0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x1410
call fcn.140095490
sub rsp, rax
mov rax, qword [0x1400b7060]
xor rax, rsp
mov qword [rsp + 0x1400], rax
mov esi, edx
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor ecx, ecx
mov dword [rsp + 0x20], ecx
movups xmm0, xmmword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789]
movups xmmword [rsp + 0x13c0], xmm0
movups xmm1, xmmword [0x1400a81f0]
movups xmmword [rsp + 0x13d0], xmm1
movups xmm0, xmmword [0x1400a8200]
movups xmmword [rsp + 0x13e0], xmm0
movsd xmm1, qword [0x1400a8210]
movsd qword [rsp + 0x13f0], xmm1
mov eax, dword [0x1400a8218]
mov dword [rsp + 0x13f8], eax
movzx eax, word [0x1400a821c]
mov word [rsp + 0x13fc], ax
movzx eax, byte [0x1400a821e]
mov byte [rsp + 0x13fe], al
mov qword [rbx], rcx
mov qword [rbx + 0x10], rcx
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], cl
mov edi, 1
mov dword [rsp + 0x20], edi
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov ecx, eax
mov dword [rsp + 0x13b4], 0xffffffff
mov dword [rsp + 0x34], eax
nop dword [rax]
nop word [rax + rax]
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, edi
mov dword [rsp + rdi*4 + 0x34], ecx
inc rdi
cmp rdi, 0x270
jb 0x14003b580
mov dword [rsp + 0x30], 0x270
test esi, esi
jle 0x14003b638
mov rdi, rsi
lea rcx, [rsp + 0x30]
call fcn.14004a010
mov ecx, eax
mov eax, 0x8421085
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
cmp eax, 0x4210842
jae 0x14003b5b2
mov eax, 0x8421085
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
imul eax, eax, 0x3e
sub ecx, eax
movsxd rax, ecx
movzx r9d, byte [rsp + rax + 0x13c0]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x14003b626
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x14003b61b
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14003b62e
mov rcx, rbx
call fcn.1400491e0
sub rdi, 1
jne 0x14003b5b2
mov rax, rbx
mov rcx, qword [rsp + 0x1400]
xor rcx, rsp
call fcn.140094850
lea r11, [rsp + 0x1410]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14003cc60
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xc], 0
je 0x14003cc83
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xb
jb 0x14003cc70
mov byte [rcx + 0xc], 0
mov rax, rcx
ret

Function at 0x14003cd60
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1400b7060]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov rsi, r8
mov dword [rsp + 0x28], 0x80
mov rdi, rdx
mov dword [rsp + 0x40], 0
xor r8d, r8d
mov dword [rsp + 0x20], 2
lea edx, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov rcx, rax
mov r8d, esi
mov rdx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140094850
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x14003cdf0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x15], 0
je 0x14003ce13
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x14
jb 0x14003ce00
mov byte [rcx + 0x15], 0
mov rax, rcx
ret
Function at 0x14003e2c0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x18], 0
je 0x14003e2e3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x17
jb 0x14003e2d0
mov byte [rcx + 0x18], 0
mov rax, rcx
ret

Function at 0x14003e2f0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x14003e313
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 4
jb 0x14003e300
mov byte [rcx + 5], 0
mov rax, rcx
ret

Function at 0x14003e320
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x4a], 0
je 0x14003e343
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x49
jb 0x14003e330
mov byte [rcx + 0x4a], 0
mov rax, rcx
ret

Function at 0x14003e350
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x6f], 0
je 0x14003e373
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x6e
jb 0x14003e360
mov byte [rcx + 0x6f], 0
mov rax, rcx
ret
Function at 0x14003fe20
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x40], 0
je 0x14003fe43
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x3f
jb 0x14003fe30
mov byte [rcx + 0x40], 0
mov rax, rcx
ret

Function at 0x14003fe50
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x5d], 0
je 0x14003fe73
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x5c
jb 0x14003fe60
mov byte [rcx + 0x5d], 0
mov rax, rcx
ret

Function at 0x14003fe80
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x58], 0
je 0x14003fea3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x57
jb 0x14003fe90
mov byte [rcx + 0x58], 0
mov rax, rcx
ret

Function at 0x14003feb0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xaf], 0
je 0x14003fed8
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xae
jb 0x14003fec0
mov byte [rcx + 0xaf], 0
mov rax, rcx
ret

Function at 0x14003fee0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x76], 0
je 0x14003ff03
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x75
jb 0x14003fef0
mov byte [rcx + 0x76], 0
mov rax, rcx
ret

Function at 0x14003ff10
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x60], 0
je 0x14003ff33
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x5f
jb 0x14003ff20
mov byte [rcx + 0x60], 0
mov rax, rcx
ret

Function at 0x14003ffd0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x61], 0
je 0x14003fff3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x60
jb 0x14003ffe0
mov byte [rcx + 0x61], 0
mov rax, rcx
ret

Function at 0x140040000
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x3b], 0
je 0x140040023
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x3a
jb 0x140040010
mov byte [rcx + 0x3b], 0
mov rax, rcx
ret
Function at 0x140040030
Capabilities:
Encode data using xor
Execute command
Set console window title

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1400b7060]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.14003dab0
movdqa xmm0, xmmword [str.OI_M4a7055gf._4]
movdqu xmmword [rbp - 0x58], xmm0
movdqa xmm1, xmmword [0x1400a8e40]
movdqu xmmword [rbp - 0x48], xmm1
mov dword [rbp - 0x38], 0x140a18
mov byte [rbp - 0x34], 1
xor ebx, ebx
mov ecx, ebx
nop dword [rax]
lea eax, [rcx + 0x3c]
xor byte [rbp + rcx - 0x58], al
inc rcx
cmp rcx, 0x23
jb 0x140040080
mov byte [rbp - 0x34], bl
lea rcx, [rbp - 0x58]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov byte [rbp - 0x60], 0x7b
mov r8b, 0x4a
mov al, Ordinal_79
xor ecx, ecx
xor r8b, 0x7b
mov byte [rbp - 0x5f], r8b
xor al, 0x7b
mov byte [rbp - 0x5e], al
mov byte [rbp - 0x5d], cl
lea r9, [rbp - 0x5f]
call fcn.140037d70
mov r11, rax
cmp r8b, 0x30
jl 0x1400400fc
nop word [rax + rax]
cmp r8b, 0x39
jg 0x1400400fc
mov ecx, 0xa
call fcn.140037d70
imul eax, r11d
movsx r11d, r8b
add r11d, 0xffffffd0
add r11d, eax
inc r9
movzx r8d, byte [r9]
cmp r8b, 0x30
jge 0x1400400d0
mov byte [rbp - 0x60], reloc.WLDAP32.dll_Ordinal_45
mov r8b, Ordinal_26
xor eax, eax
xor r8b, 0x2d
mov byte [rbp - 0x5f], r8b
mov byte [rbp - 0x5e], al
lea r9, [rbp - 0x5f]
xor ecx, ecx
call fcn.140037d70
mov r10, rax
cmp r8b, 0x30
jl 0x140040150
cmp r8b, 0x39
jg 0x140040150
mov ecx, 0xa
call fcn.140037d70
imul eax, r10d
movsx r10d, r8b
add r10d, 0xffffffd0
add r10d, eax
inc r9
movzx r8d, byte [r9]
cmp r8b, 0x30
jge 0x140040124
mov edx, r11d
mov ecx, r10d
call fcn.14003b370
mov edx, eax
lea rcx, [rbp - 0x30]
call fcn.14003b4a0
nop
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov dword [rbp - 0x60], 0x1004544
nop dword [rax]
nop word [rax + rax]
lea eax, [rbx + 0x3c]
xor byte [rbp + rbx - 0x60], al
inc rbx
cmp rbx, 2
jb 0x140040190
mov byte [rbp - 0x5d], 0
lea rcx, [rbp - 0x60]
call fcn.14003e380
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400401ec
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400401e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400401e7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140094df8
xor eax, eax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140094850
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rbp
ret
Function at 0x140043840
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x68], 0
je 0x140043863
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x67
jb 0x140043850
mov byte [rcx + 0x68], 0
ret

Function at 0x140043870
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xa2], 0
je 0x140043898
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xa1
jb 0x140043880
mov byte [rcx + 0xa2], 0
ret

Function at 0x1400438a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xd], 0
je 0x1400438c3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xc
jb 0x1400438b0
mov byte [rcx + 0xd], 0
ret

Function at 0x1400438d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x3d], 0
je 0x1400438f3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x3c
jb 0x1400438e0
mov byte [rcx + 0x3d], 0
ret

Function at 0x140043900
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x28], 0
je 0x140043923
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x27
jb 0x140043910
mov byte [rcx + 0x28], 0
ret

Function at 0x140043930
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x22], 0
je 0x140043953
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x21
jb 0x140043940
mov byte [rcx + 0x22], 0
ret

Function at 0x140043960
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x43], 0
je 0x140043983
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x42
jb 0x140043970
mov byte [rcx + 0x43], 0
ret

Function at 0x140043990
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2c], 0
je 0x1400439b3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x2b
jb 0x1400439a0
mov byte [rcx + 0x2c], 0
ret

Function at 0x1400439c0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2e], 0
je 0x1400439e3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x2d
jb 0x1400439d0
mov byte [rcx + 0x2e], 0
ret

Function at 0x1400439f0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x46], 0
je 0x140043a13
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x45
jb 0x140043a00
mov byte [rcx + 0x46], 0
ret

Function at 0x140043a20
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x34], 0
je 0x140043a43
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x33
jb 0x140043a30
mov byte [rcx + 0x34], 0
ret

Function at 0x140043a50
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2b], 0
je 0x140043a73
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x2a
jb 0x140043a60
mov byte [rcx + 0x2b], 0
ret
Function at 0x140043a80
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1f], 0
je 0x140043aa3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1e
jb 0x140043a90
mov byte [rcx + 0x1f], 0
ret

Function at 0x140043ab0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x5f], 0
je 0x140043ad3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x5e
jb 0x140043ac0
mov byte [rcx + 0x5f], 0
ret

Function at 0x140043ae0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xf], 0
je 0x140043b03
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xe
jb 0x140043af0
mov byte [rcx + 0xf], 0
ret

Function at 0x140043b10
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x29], 0
je 0x140043b33
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x28
jb 0x140043b20
mov byte [rcx + 0x29], 0
ret

Function at 0x140043b40
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1a], 0
je 0x140043b63
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x19
jb 0x140043b50
mov byte [rcx + 0x1a], 0
ret

Function at 0x140043b70
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x40], 0
je 0x140043b93
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x3f
jb 0x140043b80
mov byte [rcx + 0x40], 0
ret

Function at 0x140043ba0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 6], 0
je 0x140043bc3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 5
jb 0x140043bb0
mov byte [rcx + 6], 0
ret

Function at 0x140043be0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 9], 0
je 0x140043c03
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x140043bf0
mov byte [rcx + 9], 0
ret

Function at 0x140043c10
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x68], 0
je 0x140043c35
xor eax, eax
mov r8d, 0x3b3c
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x33
jb 0x140043c20
mov byte [rcx + 0x68], 0
ret

Function at 0x140043c40
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x22], 0
je 0x140043c65
xor eax, eax
mov r8d, 0x3b3c
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x10
jb 0x140043c50
mov byte [rcx + 0x22], 0
ret

Function at 0x140043c70
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 4], 0
je 0x140043c93
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 3
jb 0x140043c80
mov byte [rcx + 4], 0
ret

Function at 0x140043ca0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x16], 0
je 0x140043cc5
xor eax, eax
mov r8d, 0x3b3c
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0xa
jb 0x140043cb0
mov byte [rcx + 0x16], 0
ret
Function at 0x140043cd0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x140043cf3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 4
jb 0x140043ce0
mov byte [rcx + 5], 0
ret

Function at 0x140043d00
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x18], 0
je 0x140043d23
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x17
jb 0x140043d10
mov byte [rcx + 0x18], 0
ret

Function at 0x140043d30
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x25], 0
je 0x140043d53
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x24
jb 0x140043d40
mov byte [rcx + 0x25], 0
ret

Function at 0x140043d60
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 3], 0
je 0x140043d83
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 2
jb 0x140043d70
mov byte [rcx + 3], 0
ret

Function at 0x140043df0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x19], 0
je 0x140043e13
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x18
jb 0x140043e00
mov byte [rcx + 0x19], 0
ret

Function at 0x140043e20
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x37], 0
je 0x140043e43
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x36
jb 0x140043e30
mov byte [rcx + 0x37], 0
ret

Function at 0x140043e50
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2a], 0
je 0x140043e73
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x29
jb 0x140043e60
mov byte [rcx + 0x2a], 0
ret

Function at 0x140043e80
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x16], 0
je 0x140043ea3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x15
jb 0x140043e90
mov byte [rcx + 0x16], 0
ret

Function at 0x140043eb0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x15], 0
je 0x140043ed3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x14
jb 0x140043ec0
mov byte [rcx + 0x15], 0
ret

Function at 0x140043ee0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1d], 0
je 0x140043f03
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1c
jb 0x140043ef0
mov byte [rcx + 0x1d], 0
ret

Function at 0x140043f10
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xc], 0
je 0x140043f33
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xb
jb 0x140043f20
mov byte [rcx + 0xc], 0
ret

Function at 0x140043f40
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xa], 0
je 0x140043f63
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 9
jb 0x140043f50
mov byte [rcx + 0xa], 0
ret