joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a4641
Capabilities:
Terminate thread

Disassembly:
push rax
pushf
mov eax, 0x29cf949c
pushf
not eax
add eax, 0xcf2364a6
xor eax, 0xc144c684
rol eax, 0x8b
popf
pushf
not eax
add eax, 0x8839bf44
xor eax, 0xcf855423
rol eax, 0xbc
popf
cmp eax, 2
jne 0x1400a467e
popf
pop rax
jmp 0x1400a47e9
cmp eax, 0
jne 0x1400a468d
popf
pop rax
jmp 0x1400a469c
cmp eax, 1
jne 0x1400a469c
popf
pop rax
jmp 0x1400a47cd
push rbx
sub rsp, 0x40
mov rax, qword [0x140034010]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rax, qword [rcx + 0x10]
lea rdx, [rsp + 0x20]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rax, qword [rcx + 8]
mov rbx, rcx
mov r9d, 0xf1edc75
pushf
not r9d
add r9d, 0x98ee147f
xor r9d, 0x97d378bf
rol r9d, 0x50
popf
pushf
not r9d
add r9d, 0xbf6e5616
xor r9d, 0x8147c806
rol r9d, 0x59
popf
mov qword [rsp + 0x28], rax
lea ecx, [r8 + 2]
jmp 0x1400a470b
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rcx, qword [rbx + 0x10]
jmp 0x1400a4716
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lock xadd dword [0x14004efd0], eax
mov rcx, qword [rbx + 8]
test eax, eax
je 0x1400a4787
push rax
pushf
mov eax, 0xbecb95f7
pushf
not eax
add eax, 0xbb5f81a3
xor eax, 0xf005c301
rol eax, 0xb3
popf
pushf
not eax
add eax, 0xb3eeaf3b
xor eax, 0xf39e2508
rol eax, 0xe9
popf
pushf
not eax
add eax, 0xb732535f
xor eax, 0xcbf89600
rol eax, 0xff
popf
pushf
not eax
add eax, 0xbedbd7ba
xor eax, 0x8007f4a7
rol eax, 0x2f
popf
jmp 0x1400a466f
push rax
pushf
mov eax, 0x9c9961be
pushf
not eax
add eax, 0xe06a7b24
xor eax, 0xfdde19e5
rol eax, 0x63
popf
pushf
not eax
add eax, 0xc436f7c1
xor eax, 0xe88ff50f
rol eax, 0xaa
popf
pushf
not eax
add eax, 0x9278eb70
xor eax, 0xce5e1a03
rol eax, 0x5a
popf
jmp 0x1400a466f
xor edx, edx
jmp 0x1400a47d0
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400bc272
add rsp, 0x40
pop rbx
ret
mov rdx, rcx
xor r8d, r8d
lea rcx, [0x1aea31fcf]
pushf
sub rcx, 0x6ea2b7af
popf
jmp 0x1400a4802
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov rcx, qword [rbx + 8]
mov edx, 0x1ce2ca3b
pushf
not edx
add edx, 0xf7892b2c
xor edx, 0xb5a20615
rol edx, 0x5d
popf
pushf
not edx
add edx, 0xfd15cf2a
xor edx, 0xb0cabdb2
rol edx, 0xe
popf
jmp 0x1400a483c
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400bc272
add rsp, 0x40
pop rbx
ret
Function at 0x1400b9a0d
Capabilities:
Create thread

Disassembly:
push rax
pushf
mov eax, 0x2c5bdff4
pushf
not eax
add eax, 0xeedf8154
xor eax, 0xb3cc0891
rol eax, 0x5d
popf
pushf
not eax
add eax, 0xca251200
xor eax, 0xfbfb1cc6
rol eax, 0x67
popf
cmp eax, 2
jne 0x1400b9a4a
popf
pop rax
jmp 0x1400b9bc7
cmp eax, 0
jne 0x1400b9a59
popf
pop rax
jmp 0x1400b9a68
cmp eax, 1
jne 0x1400b9a68
popf
pop rax
jmp 0x1400b9bac
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140034010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
mov ecx, 0x4d2dec99
pushf
not ecx
add ecx, 0x8cd1cfe2
xor ecx, 0xd09def07
rol ecx, 0xbe
popf
pushf
not ecx
add ecx, 0xda12e109
xor ecx, 0x88abb1fd
rol ecx, 0xad
popf
pushf
not ecx
add ecx, 0xff264399
xor ecx, 0xe1a5389b
rol ecx, 0x9e
popf
call fcn.14005eea0
lea rcx, [0x19bf010c4]
pushf
sub rcx, 0x5bef5dd4
popf
mov qword [rax], rcx
mov qword [rsp + 0x30], rax
lea rdi, [rbx + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1a1dbbb79]
pushf
sub r8, 0x61da03d9
popf
xor edx, edx
xor ecx, ecx
jmp 0x1400b9b12
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x1400b9b53
push rax
pushf
mov eax, 0xac2e02fd
pushf
not eax
add eax, 0xd5023453
xor eax, 0x87ca1b24
rol eax, 0xb9
popf
pushf
not eax
add eax, 0x897c28e1
xor eax, 0xa61cec8c
rol eax, 0xd0
popf
jmp 0x1400b9a3b
push rax
pushf
mov eax, 0x937f994f
pushf
not eax
add eax, 0xafcdbf2f
xor eax, 0xc8e4a532
rol eax, 0xbe
popf
pushf
not eax
add eax, 0xf8233d32
xor eax, 0x89770574
rol eax, 0x35
popf
pushf
not eax
add eax, 0xdb543d85
xor eax, 0x887526de
rol eax, 0x1c
popf
pushf
not eax
add eax, 0xb1002c5f
xor eax, 0xfec9ad8a
rol eax, 0x43
popf
jmp 0x1400b9a3b
mov rax, rbx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400bc272
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov dword [rdi], 0
mov ecx, 0x3bb21f0a
pushf
not ecx
add ecx, 0xc5bfdca4
xor ecx, 0xad1bb024
rol ecx, 0xc
popf
pushf
not ecx
add ecx, 0xfdeef994
xor ecx, 0x9e132722
rol ecx, 9
popf
jmp 0x1400b9bfd
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x1400c06f8
Capabilities:
Encode data using xor

Disassembly:
push rax
pushf
mov eax, 0xe6b72df2
pushf
not eax
add eax, 0xd3493bb5
xor eax, 0xb068d6a7
rol eax, 0xb3
popf
pushf
not eax
add eax, 0xacc1c595
xor eax, 0xa3df9b31
rol eax, 0xb8
popf
pushf
not eax
add eax, 0xe6297999
xor eax, 0xfdd26756
rol eax, 0xdf
popf
pushf
not eax
add eax, 0xd76a3a6e
xor eax, 0x81b78eeb
rol eax, 0xae
popf
cmp eax, 4
jne 0x1400c075b
popf
pop rax
jmp 0x1400c0924
cmp eax, 0
jne 0x1400c076a
popf
pop rax
jmp 0x1400c0797
cmp eax, 3
jne 0x1400c0779
popf
pop rax
jmp 0x1400c08ec
cmp eax, 1
jne 0x1400c0788
popf
pop rax
jmp 0x1400c0815
cmp eax, 2
jne 0x1400c0797
popf
pop rax
jmp 0x1400c0863
push rbx
push rbp
push rsi
sub rsp, 0x20
cmp byte [r8 + 0x19], 0
mov rbx, r8
mov rbp, rdx
mov rsi, rcx
jne 0x1400c07e2
push rax
pushf
mov eax, 0xa5d731d1
pushf
not eax
add eax, 0x9d6ae3d9
xor eax, 0xcb89a398
rol eax, 8
popf
pushf
not eax
add eax, 0xbc0b9572
xor eax, 0xa1fdf635
rol eax, 0xee
popf
jmp 0x1400c074c
push rax
pushf
mov eax, 0x2b8862fe
pushf
not eax
add eax, 0xcdaa5b0a
xor eax, 0xe39bde8c
rol eax, 0x1f
popf
pushf
not eax
add eax, 0x9b3dc31c
xor eax, 0xfe60afd8
rol eax, 0xe8
popf
jmp 0x1400c074c
mov qword [rsp + 0x58], rdi
nop dword [rax]
push rax
pushf
mov eax, 0xe91ce61f
pushf
not eax
add eax, 0xce09c8bd
xor eax, 0xf0a0b476
rol eax, 0x90
popf
pushf
not eax
add eax, 0xaeb227ad
xor eax, 0xe900de2b
rol eax, 0xf8
popf
pushf
not eax
add eax, 0xfb971c1e
xor eax, 0xa7d85450
rol eax, 0x26
popf
jmp 0x1400c074c
mov r8, qword [rbx + 0x10]
mov rdx, rbp
mov rcx, rsi
call fcn.1400c06f8
mov rdi, rbx
mov rbx, qword [rbx]
lea rcx, [rdi + 0x20]
call fcn.1400fafc4
mov edx, 0x38dbcf54
pushf
not edx
add edx, 0x88bbbed7
xor edx, 0xa543282c
rol edx, 0x93
popf
pushf
not edx
add edx, 0xb40419a4
xor edx, 0xbacac0e3
rol edx, 0x1c
popf
pushf
not edx
add edx, 0xe312a693
xor edx, 0xaec6b61e
rol edx, 0xa9
popf
pushf
not edx
add edx, 0xbe512d99
xor edx, 0xac7086cf
rol edx, 0x21
popf
mov rcx, rdi
call fcn.1400903b4
cmp byte [rbx + 0x19], 0
je 0x1400c0863
mov rdi, qword [rsp + 0x58]
push rax
pushf
mov eax, 0x5acf9c8c
pushf
not eax
add eax, 0xeb11a730
xor eax, 0xd7bfa1bd
rol eax, 0x4a
popf
pushf
not eax
add eax, 0xcdc4c918
xor eax, 0xf7184ff8
rol eax, 0x85
popf
jmp 0x1400c074c
add rsp, 0x20
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400f62fc
Capabilities:
Terminate process

Disassembly:
push rax
pushf
mov eax, 0x28b8a42f
pushf
not eax
add eax, 0xa3fb0167
xor eax, 0xdafb9df0
rol eax, 0xa2
popf
pushf
not eax
add eax, 0xcb7e0c81
xor eax, 0x8bb205db
rol eax, 0x24
popf
pushf
not eax
add eax, 0xe7197100
xor eax, 0x998cdafc
rol eax, 0x33
popf
pushf
not eax
add eax, 0x8e39af96
xor eax, 0x913e4572
rol eax, 0x96
popf
cmp eax, 0
jne 0x1400f635f
popf
pop rax
jmp 0x1400f635f
sub rsp, 0x28
xor ecx, ecx
mov dword [0x14004ee88], 1
jmp 0x1400f6370
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x140001180
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 6]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, [0x140010040]
mov r10, rax
sub rbx, rax
movabs rdi, 0xe525982af70c880f
lea r9, [rax + 1]
nop dword [rax + rax]
movsxd r8, r11d
mov rax, rdi
mul r8
mov rcx, r8
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 1]
mov byte [r9 - 1], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [rbx + r9]
mov byte [r9], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 + 1]
mov byte [r9 + 1], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 + 2]
mov byte [r9 + 2], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 + 3]
mov byte [r9 + 3], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 6]
xor al, byte [rbx + r9 + 4]
mov byte [r9 + 4], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 7]
xor al, byte [rbx + r9 + 5]
mov byte [r9 + 5], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 8]
xor al, byte [rbx + r9 + 6]
mov byte [r9 + 6], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 + 7]
mov byte [r9 + 7], al
lea rcx, [r8 + 9]
mov rax, rdi
lea r9, [r9 + 0xe]
mul rcx
add r11d, 0xe
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xa]
xor al, byte [rbx + r9 - 6]
mov byte [r9 - 6], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xb]
xor al, byte [rbx + r9 - 5]
mov byte [r9 - 5], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xc]
xor al, byte [rbx + r9 - 4]
mov byte [r9 - 4], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xd]
xor al, byte [rbx + r9 - 3]
mov byte [r9 - 3], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 2]
mov byte [r9 - 2], al
cmp r11d, 0xe
jb 0x1400011d0
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140001400
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0x72]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r10d, r10d
lea rsi, [0x140010040]
mov r11, rax
sub rbx, rax
movabs rdi, 0xe525982af70c880f
lea r9, [rax + 1]
nop dword [rax + rax]
movsxd r8, r10d
lea r9, [r9 + 2]
mov rax, rdi
mov rcx, r8
mul r8
add r10d, 2
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 3]
mov byte [r9 - 3], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 2]
mov byte [r9 - 2], al
cmp r10d, 0x7a
jb 0x140001450
mov rbx, qword [rsp + 0x30]
mov rax, r11
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400014c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, [0x140010040]
mov r10, rax
sub rbx, rax
movabs rdi, 0xe525982af70c880f
lea r9, [rax + 1]
nop dword [rax + rax]
movsxd r8, r11d
mov rax, rdi
mul r8
mov rcx, r8
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 1]
mov byte [r9 - 1], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [rbx + r9]
mov byte [r9], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 + 1]
mov byte [r9 + 1], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 + 2]
mov byte [r9 + 2], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 + 3]
mov byte [r9 + 3], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 6]
xor al, byte [rbx + r9 + 4]
mov byte [r9 + 4], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 7]
xor al, byte [rbx + r9 + 5]
mov byte [r9 + 5], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 8]
xor al, byte [rbx + r9 + 6]
mov byte [r9 + 6], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 + 7]
mov byte [r9 + 7], al
lea rcx, [r8 + 9]
mov rax, rdi
lea r9, [r9 + 0xb]
mul rcx
add r11d, 0xb
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xa]
xor al, byte [rbx + r9 - 3]
mov byte [r9 - 3], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 2]
mov byte [r9 - 2], al
cmp r11d, 0xb
jb 0x140001510
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140001770
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx - 6]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r10d, r10d
lea rsi, [0x140010160]
mov r11, rax
sub rbx, rax
movabs rdi, 0xe525982af70c880f
lea r9, [rax + 1]
nop dword [rax + rax]
movsxd r8, r10d
lea r9, [r9 + 2]
mov rax, rdi
mov rcx, r8
mul r8
add r10d, 2
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 3]
mov byte [r9 - 3], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 2]
mov byte [r9 - 2], al
cmp r10d, 2
jb 0x1400017c0
mov rbx, qword [rsp + 0x30]
mov rax, r11
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140001830
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0x39]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, [0x140010160]
mov r10, rax
sub rbx, rax
movabs rdi, 0xe525982af70c880f
lea r9, [rax + 1]
nop dword [rax + rax]
movsxd r8, r11d
mov rax, rdi
mul r8
mov rcx, r8
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 1]
mov byte [r9 - 1], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [rbx + r9]
mov byte [r9], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 + 1]
mov byte [r9 + 1], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 + 2]
mov byte [r9 + 2], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 + 3]
mov byte [r9 + 3], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 6]
xor al, byte [rbx + r9 + 4]
mov byte [r9 + 4], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 7]
xor al, byte [rbx + r9 + 5]
mov byte [r9 + 5], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 8]
xor al, byte [rbx + r9 + 6]
mov byte [r9 + 6], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 + 7]
mov byte [r9 + 7], al
lea rcx, [r8 + 9]
mov rax, rdi
lea r9, [r9 + 0xd]
mul rcx
add r11d, 0xd
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xa]
xor al, byte [rbx + r9 - 5]
mov byte [r9 - 5], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xb]
xor al, byte [rbx + r9 - 4]
mov byte [r9 - 4], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xc]
xor al, byte [rbx + r9 - 3]
mov byte [r9 - 3], al
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 2]
mov byte [r9 - 2], al
cmp r11d, 0x41
jb 0x140001880
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140001df0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 6]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, [0x1400103a0]
mov r10, rax
sub rbx, rax
movabs rdi, 0xe525982af70c880f
lea r9, [rax + 2]
nop dword [rax + rax]
movsxd r8, r11d
lea r9, [r9 + 0xe]
mov rax, rdi
mov rcx, r8
mul r8
add r11d, 7
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [r9 + rbx - 0x10]
movsx eax, al
mov word [r9 - 0x10], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [r9 + rbx - 0xe]
movsx eax, al
mov word [r9 - 0xe], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [r9 + rbx - 0xc]
movsx eax, al
mov word [r9 - 0xc], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [r9 + rbx - 0xa]
movsx eax, al
mov word [r9 - 0xa], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [r9 + rbx - 8]
movsx eax, al
mov word [r9 - 8], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 6]
xor al, byte [r9 + rbx - 6]
movsx eax, al
mov word [r9 - 6], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [r9 + rbx - 4]
movsx eax, al
mov word [r9 - 4], ax
cmp r11d, 7
jb 0x140001e40
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140001f90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 8]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, [0x1400103a0]
mov r10, rax
sub rbx, rax
movabs rdi, 0xe525982af70c880f
lea r9, [rax + 2]
nop dword [rax + rax]
movsxd r8, r11d
mov rax, rdi
mul r8
mov rcx, r8
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 2]
movsx eax, al
mov word [r9 - 2], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [rbx + r9]
movsx eax, al
mov word [r9], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 + 2]
movsx eax, al
mov word [r9 + 2], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 + 4]
movsx eax, al
mov word [r9 + 4], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 + 6]
movsx eax, al
mov word [r9 + 6], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 6]
xor al, byte [rbx + r9 + 8]
movsx eax, al
mov word [r9 + 8], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 7]
xor al, byte [rbx + r9 + 0xa]
movsx eax, al
mov word [r9 + 0xa], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 + 0xc]
movsx eax, al
mov word [r9 + 0xc], ax
add r11d, 8
lea r9, [r9 + 0x10]
cmp r11d, 8
jb 0x140001fe0
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140002150
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, [0x1400103a0]
mov r10, rax
sub rbx, rax
movabs rdi, 0xe525982af70c880f
lea r9, [rax + 2]
nop dword [rax + rax]
movsxd r8, r11d
lea r9, [r9 + 0xa]
mov rax, rdi
mov rcx, r8
mul r8
add r11d, 5
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 0xc]
movsx eax, al
mov word [r9 - 0xc], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [r9 + rbx - 0xa]
movsx eax, al
mov word [r9 - 0xa], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 - 8]
movsx eax, al
mov word [r9 - 8], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 - 6]
movsx eax, al
mov word [r9 - 6], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x11e
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 4]
movsx eax, al
mov word [r9 - 4], ax
cmp r11d, 5
jb 0x1400021a0
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret