joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ff794c46f20
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbx
push rbp
sub rsp, 0x278
mov rax, qword [0x7ff794c70008]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbp, r8
lea rax, [rsp + 0x30]
xor ebx, ebx
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x30], rbx
mov r9d, 0xf003f
call qword [sym.imp.advapi32.dll_RegOpenKeyExW]
test eax, eax
jne 0x7ff794c470a7
mov qword [rsp + 0x270], rsi
lea rcx, [rsp + 0x40]
mov rsi, qword [rsp + 0x30]
xor edx, edx
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x38]
mov dword [rsp + 0x38], 0x208
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x40]
xor r8d, r8d
mov rdx, rbp
mov qword [rsp + 0x20], rax
mov rcx, rsi
call qword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
jne 0x7ff794c47096
lea rcx, [rsp + 0x40]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], bx
jne 0x7ff794c46fd0
test rax, rax
je 0x7ff794c4706f
mov qword [rsp + 0x268], rdi
mov rcx, rbx
mov qword [rsp + 0x260], r14
lea r14, [0x7ff794c70088]
nop dword [rax]
lea rdi, [rsp + 0x40]
lea rdi, [rdi + rcx*2]
movzx ecx, word [rdi]
call qword [sym.imp.user32.dll_IsCharAlphaNumericW]
test eax, eax
je 0x7ff794c4703d
call qword [sym.imp.ucrtbase.dll_rand]
cdqe
mov rcx, 0xffffffffffffffff
inc rcx
cmp word [r14 + rcx*2], 0
jne 0x7ff794c47025
xor edx, edx
div rcx
movzx eax, word [r14 + rdx*2]
mov word [rdi], ax
inc ebx
lea rdx, [rsp + 0x40]
mov ecx, ebx
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x7ff794c47050
cmp rcx, rax
jb 0x7ff794c47000
mov r14, qword [rsp + 0x260]
mov rdi, qword [rsp + 0x268]
mov eax, dword [rsp + 0x38]
mov r9d, 1
mov dword [rsp + 0x28], eax
xor r8d, r8d
lea rax, [rsp + 0x40]
mov rdx, rbp
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.advapi32.dll_RegSetValueExW]
mov rcx, rsi
call qword [sym.imp.advapi32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x270]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.7ff794c61b10
add rsp, 0x278
pop rbp
pop rbx
ret
Function at 0x7ff794c470d0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbx
push rbp
mov eax, 0x2058
call fcn.7ff794c62ca0
sub rsp, rax
mov rax, qword [0x7ff794c70008]
xor rax, rsp
mov qword [rsp + 0x2040], rax
mov rbp, r8
lea rax, [rsp + 0x30]
xor ebx, ebx
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x30], rbx
mov r9d, 0xf003f
mov rcx, 0xffffffff80000002
call qword [sym.imp.advapi32.dll_RegOpenKeyExW]
test eax, eax
jne 0x7ff794c47239
mov qword [rsp + 0x2070], rsi
lea rcx, [rsp + 0x40]
mov rsi, qword [rsp + 0x30]
xor edx, edx
mov r8d, 0x1ffe
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x38]
mov dword [rsp + 0x38], 0x1ffe
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x40]
xor r8d, r8d
mov rdx, rbp
mov qword [rsp + 0x20], rax
mov rcx, rsi
call qword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
jne 0x7ff794c47228
mov eax, dword [rsp + 0x38]
test eax, eax
je 0x7ff794c47205
mov qword [rsp + 0x2088], rdi
mov qword [rsp + 0x2050], r14
lea r14, [0x7ff794c700e0]
nop dword [rax]
mov eax, ebx
lea rdi, [rsp + 0x40]
movzx ecx, word [rdi + rax*2]
lea rdi, [rdi + rax*2]
call qword [sym.imp.ucrtbase.dll__iswxdigit_l]
test eax, eax
je 0x7ff794c471eb
call qword [sym.imp.ucrtbase.dll_rand]
cdqe
mov rcx, 0xffffffffffffffff
nop dword [rax + rax]
inc rcx
cmp word [r14 + rcx*2], 0
jne 0x7ff794c471d0
dec rcx
xor edx, edx
div rcx
movzx eax, word [r14 + rdx*2]
mov word [rdi], ax
mov eax, dword [rsp + 0x38]
inc ebx
cmp ebx, eax
jb 0x7ff794c471a0
mov r14, qword [rsp + 0x2050]
mov rdi, qword [rsp + 0x2088]
mov dword [rsp + 0x28], eax
mov r9d, 7
lea rax, [rsp + 0x40]
xor r8d, r8d
mov rdx, rbp
mov qword [rsp + 0x20], rax
mov rcx, rsi
call qword [sym.imp.advapi32.dll_RegSetValueExW]
mov rcx, rsi
call qword [sym.imp.advapi32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x2070]
mov rcx, qword [rsp + 0x2040]
xor rcx, rsp
call fcn.7ff794c61b10
add rsp, 0x2058
pop rbp
pop rbx
ret
Function at 0x7ff794c58160
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 0x28], sil
je 0x7ff794c581a5
mov ecx, esi
mov edx, 0x48bc
nop dword [rax]
nop word [rax + rax]
lea eax, [rdx + rcx]
xor word [r8 + rcx*2], ax
inc rcx
cmp rcx, 0x13
jb 0x7ff794c58190
mov byte [r8 + 0x28], sil
lea rax, [r8 + 0x26]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], si
cmp r8, rax
je 0x7ff794c581d9
mov r9, r8
mov edx, 0x13
lea rcx, [rsp + 0x28]
call fcn.7ff794c5dcf0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 8
jb 0x7ff794c581e7
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x28]
call fcn.7ff794c5e530
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x7ff794c58261
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff794c5825c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff794c5825c
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff794c61b74
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x7ff794c58270
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
mov r9, rcx
mov qword [rsp + 0x28], rdx
xor edx, edx
cmp byte [rcx + 0x28], dl
je 0x7ff794c582a6
mov ecx, edx
mov r8d, 0x48bc
lea eax, [r8 + rcx]
xor word [r9 + rcx*2], ax
inc rcx
cmp rcx, 0x13
jb 0x7ff794c58290
mov byte [r9 + 0x28], dl
lea rcx, [r9 + 0x26]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 7
mov word [rbx], dx
cmp r9, rcx
je 0x7ff794c582ce
mov edx, 0x13
mov rcx, rbx
call fcn.7ff794c5dcf0
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x7ff794c582e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
mov r9, rcx
mov qword [rsp + 0x28], rdx
xor edx, edx
cmp byte [rcx + 0x50], dl
je 0x7ff794c58316
mov ecx, edx
mov r8d, 0x48bc
lea eax, [r8 + rcx]
xor word [r9 + rcx*2], ax
inc rcx
cmp rcx, 0x27
jb 0x7ff794c58300
mov byte [r9 + 0x50], dl
lea rcx, [r9 + 0x4e]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 7
mov word [rbx], dx
cmp r9, rcx
je 0x7ff794c5833e
mov edx, 0x27
mov rcx, rbx
call fcn.7ff794c5dcf0
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x7ff794c58350
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
mov r9, rcx
mov qword [rsp + 0x28], rdx
xor edx, edx
cmp byte [rcx + 0x52], dl
je 0x7ff794c58386
mov ecx, edx
mov r8d, 0x48bc
lea eax, [r8 + rcx]
xor word [r9 + rcx*2], ax
inc rcx
cmp rcx, 0x28
jb 0x7ff794c58370
mov byte [r9 + 0x52], dl
lea rcx, [r9 + 0x50]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 7
mov word [rbx], dx
cmp r9, rcx
je 0x7ff794c583ae
mov edx, 0x28
mov rcx, rbx
call fcn.7ff794c5dcf0
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x7ff794c583c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
mov r9, rcx
mov qword [rsp + 0x28], rdx
xor edx, edx
cmp byte [rcx + 0x46], dl
je 0x7ff794c583f6
mov ecx, edx
mov r8d, 0x48bc
lea eax, [r8 + rcx]
xor word [r9 + rcx*2], ax
inc rcx
cmp rcx, 0x22
jb 0x7ff794c583e0
mov byte [r9 + 0x46], dl
lea rcx, [r9 + 0x44]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 7
mov word [rbx], dx
cmp r9, rcx
je 0x7ff794c5841e
mov edx, 0x22
mov rcx, rbx
call fcn.7ff794c5dcf0
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x7ff794c58430
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
mov r9, rcx
mov qword [rsp + 0x28], rdx
xor edx, edx
cmp byte [rcx + 0x6a], dl
je 0x7ff794c58466
mov ecx, edx
mov r8d, 0x48bc
lea eax, [r8 + rcx]
xor word [r9 + rcx*2], ax
inc rcx
cmp rcx, 0x34
jb 0x7ff794c58450
mov byte [r9 + 0x6a], dl
lea rcx, [r9 + 0x68]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 7
mov word [rbx], dx
cmp r9, rcx
je 0x7ff794c5848e
mov edx, 0x34
mov rcx, rbx
call fcn.7ff794c5dcf0
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x7ff794c584a0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
mov r9, rcx
mov qword [rsp + 0x28], rdx
xor edx, edx
cmp byte [rcx + 0x6c], dl
je 0x7ff794c584d6
mov ecx, edx
mov r8d, 0x48bc
lea eax, [r8 + rcx]
xor word [r9 + rcx*2], ax
inc rcx
cmp rcx, 0x35
jb 0x7ff794c584c0
mov byte [r9 + 0x6c], dl
lea rcx, [r9 + 0x6a]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 7
mov word [rbx], dx
cmp r9, rcx
je 0x7ff794c584fe
mov edx, 0x35
mov rcx, rbx
call fcn.7ff794c5dcf0
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x7ff794c58510
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
mov r9, rcx
mov qword [rsp + 0x28], rdx
xor edx, edx
cmp byte [rcx + 0x38], dl
je 0x7ff794c58546
mov ecx, edx
mov r8d, 0x48bc
lea eax, [r8 + rcx]
xor word [r9 + rcx*2], ax
inc rcx
cmp rcx, 0x1b
jb 0x7ff794c58530
mov byte [r9 + 0x38], dl
lea rcx, [r9 + 0x36]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 7
mov word [rbx], dx
cmp r9, rcx
je 0x7ff794c5856e
mov edx, 0x1b
mov rcx, rbx
call fcn.7ff794c5dcf0
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x7ff794c58580
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 0x42], sil
je 0x7ff794c585c5
mov ecx, esi
mov edx, 0x48bc
nop dword [rax]
nop word [rax + rax]
lea eax, [rdx + rcx]
xor word [r8 + rcx*2], ax
inc rcx
cmp rcx, 0x20
jb 0x7ff794c585b0
mov byte [r8 + 0x42], sil
lea rax, [r8 + 0x40]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], si
cmp r8, rax
je 0x7ff794c585f9
mov r9, r8
mov edx, 0x20
lea rcx, [rsp + 0x28]
call fcn.7ff794c5dcf0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 8
jb 0x7ff794c58607
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x28]
call fcn.7ff794c5e530
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x7ff794c58681
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff794c5867c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff794c5867c
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff794c61b74
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x7ff794c58690
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
mov r9, rcx
mov qword [rsp + 0x28], rdx
xor edx, edx
cmp byte [rcx + 0x42], dl
je 0x7ff794c586c6
mov ecx, edx
mov r8d, 0x48bc
lea eax, [r8 + rcx]
xor word [r9 + rcx*2], ax
inc rcx
cmp rcx, 0x20
jb 0x7ff794c586b0
mov byte [r9 + 0x42], dl
lea rcx, [r9 + 0x40]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 7
mov word [rbx], dx
cmp r9, rcx
je 0x7ff794c586ee
mov edx, 0x20
mov rcx, rbx
call fcn.7ff794c5dcf0
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x7ff794c58700
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
mov r9, rcx
mov qword [rsp + 0x28], rdx
xor edx, edx
cmp byte [rcx + 0x34], dl
je 0x7ff794c58736
mov ecx, edx
mov r8d, 0x48bc
lea eax, [r8 + rcx]
xor word [r9 + rcx*2], ax
inc rcx
cmp rcx, 0x19
jb 0x7ff794c58720
mov byte [r9 + 0x34], dl
lea rcx, [r9 + 0x32]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 7
mov word [rbx], dx
cmp r9, rcx
je 0x7ff794c5875e
mov edx, 0x19
mov rcx, rbx
call fcn.7ff794c5dcf0
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x7ff794c58770
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
mov r9, rcx
mov qword [rsp + 0x28], rdx
xor edx, edx
cmp byte [rcx + 0x4c], dl
je 0x7ff794c587a6
mov ecx, edx
mov r8d, 0x48bc
lea eax, [r8 + rcx]
xor word [r9 + rcx*2], ax
inc rcx
cmp rcx, 0x25
jb 0x7ff794c58790
mov byte [r9 + 0x4c], dl
lea rcx, [r9 + 0x4a]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 7
mov word [rbx], dx
cmp r9, rcx
je 0x7ff794c587ce
mov edx, 0x25
mov rcx, rbx
call fcn.7ff794c5dcf0
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x7ff794c587e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
mov r9, rcx
mov qword [rsp + 0x28], rdx
xor edx, edx
cmp byte [rcx + 0x4e], dl
je 0x7ff794c58816
mov ecx, edx
mov r8d, 0x48bc
lea eax, [r8 + rcx]
xor word [r9 + rcx*2], ax
inc rcx
cmp rcx, 0x26
jb 0x7ff794c58800
mov byte [r9 + 0x4e], dl
lea rcx, [r9 + 0x4c]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 7
mov word [rbx], dx
cmp r9, rcx
je 0x7ff794c5883e
mov edx, 0x26
mov rcx, rbx
call fcn.7ff794c5dcf0
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x7ff794c58850
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
mov r9, rcx
mov qword [rsp + 0x28], rdx
xor edx, edx
cmp byte [rcx + 0x56], dl
je 0x7ff794c58886
mov ecx, edx
mov r8d, 0x48bc
lea eax, [r8 + rcx]
xor word [r9 + rcx*2], ax
inc rcx
cmp rcx, 0x2a
jb 0x7ff794c58870
mov byte [r9 + 0x56], dl
lea rcx, [r9 + 0x54]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 7
mov word [rbx], dx
cmp r9, rcx
je 0x7ff794c588ae
mov edx, 0x2a
mov rcx, rbx
call fcn.7ff794c5dcf0
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x7ff794c588c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
mov r9, rcx
mov qword [rsp + 0x28], rdx
xor edx, edx
cmp byte [rcx + 0x4a], dl
je 0x7ff794c588f6
mov ecx, edx
mov r8d, 0x48bc
lea eax, [r8 + rcx]
xor word [r9 + rcx*2], ax
inc rcx
cmp rcx, 0x24
jb 0x7ff794c588e0
mov byte [r9 + 0x4a], dl
lea rcx, [r9 + 0x48]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 7
mov word [rbx], dx
cmp r9, rcx
je 0x7ff794c5891e
mov edx, 0x24
mov rcx, rbx
call fcn.7ff794c5dcf0
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x7ff794c58930
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
mov r9, rcx
mov qword [rsp + 0x28], rdx
xor edx, edx
cmp byte [rcx + 0x8a], dl
je 0x7ff794c58979
mov ecx, edx
mov r8d, 0x48bc
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 + rcx]
xor word [r9 + rcx*2], ax
inc rcx
cmp rcx, 0x44
jb 0x7ff794c58960
mov byte [r9 + 0x8a], dl
lea rcx, [r9 + 0x88]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 7
mov word [rbx], dx
cmp r9, rcx
je 0x7ff794c589a4
mov edx, 0x44
mov rcx, rbx
call fcn.7ff794c5dcf0
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x7ff794c589b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
mov r9, rcx
mov qword [rsp + 0x28], rdx
xor edx, edx
cmp byte [rcx + 0x9a], dl
je 0x7ff794c589f9
mov ecx, edx
mov r8d, 0x48bc
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 + rcx]
xor word [r9 + rcx*2], ax
inc rcx
cmp rcx, 0x4c
jb 0x7ff794c589e0
mov byte [r9 + 0x9a], dl
lea rcx, [r9 + 0x98]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 7
mov word [rbx], dx
cmp r9, rcx
je 0x7ff794c58a24
mov edx, 0x4c
mov rcx, rbx
call fcn.7ff794c5dcf0
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x7ff794c58a30
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
mov r9, rcx
mov qword [rsp + 0x28], rdx
xor edx, edx
cmp byte [rcx + 0x6e], dl
je 0x7ff794c58a66
mov ecx, edx
mov r8d, 0x48bc
lea eax, [r8 + rcx]
xor word [r9 + rcx*2], ax
inc rcx
cmp rcx, 0x36
jb 0x7ff794c58a50
mov byte [r9 + 0x6e], dl
lea rcx, [r9 + 0x6c]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 7
mov word [rbx], dx
cmp r9, rcx
je 0x7ff794c58a8e
mov edx, 0x36
mov rcx, rbx
call fcn.7ff794c5dcf0
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x7ff794c58aa0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
mov r9, rcx
mov qword [rsp + 0x28], rdx
xor edx, edx
cmp byte [rcx + 0x18], dl
je 0x7ff794c58ad6
mov ecx, edx
mov r8d, 0x48bc
lea eax, [r8 + rcx]
xor word [r9 + rcx*2], ax
inc rcx
cmp rcx, 0xb
jb 0x7ff794c58ac0
mov byte [r9 + 0x18], dl
lea rcx, [r9 + 0x16]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 7
mov word [rbx], dx
cmp r9, rcx
je 0x7ff794c58afe
mov edx, 0xb
mov rcx, rbx
call fcn.7ff794c5dcf0
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x7ff794c58b10
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
mov r9, rcx
mov qword [rsp + 0x28], rdx
xor edx, edx
cmp byte [rcx + 0x22], dl
je 0x7ff794c58b46
mov ecx, edx
mov r8d, 0x48bc
lea eax, [r8 + rcx]
xor word [r9 + rcx*2], ax
inc rcx
cmp rcx, 0x10
jb 0x7ff794c58b30
mov byte [r9 + 0x22], dl
lea rcx, [r9 + 0x20]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 7
mov word [rbx], dx
cmp r9, rcx
je 0x7ff794c58b6e
mov edx, 0x10
mov rcx, rbx
call fcn.7ff794c5dcf0
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x7ff794c58b80
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
mov r9, rcx
mov qword [rsp + 0x28], rdx
xor edx, edx
cmp byte [rcx + 0x60], dl
je 0x7ff794c58bb6
mov ecx, edx
mov r8d, 0x48bc
lea eax, [r8 + rcx]
xor word [r9 + rcx*2], ax
inc rcx
cmp rcx, 0x2f
jb 0x7ff794c58ba0
mov byte [r9 + 0x60], dl
lea rcx, [r9 + 0x5e]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 7
mov word [rbx], dx
cmp r9, rcx
je 0x7ff794c58bde
mov edx, 0x2f
mov rcx, rbx
call fcn.7ff794c5dcf0
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x7ff794c58bf0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 0x66], sil
je 0x7ff794c58c35
mov ecx, esi
mov edx, 0x48bc
nop dword [rax]
nop word [rax + rax]
lea eax, [rdx + rcx]
xor word [r8 + rcx*2], ax
inc rcx
cmp rcx, 0x32
jb 0x7ff794c58c20
mov byte [r8 + 0x66], sil
lea rax, [r8 + 0x64]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], si
cmp r8, rax
je 0x7ff794c58c69
mov r9, r8
mov edx, 0x32
lea rcx, [rsp + 0x28]
call fcn.7ff794c5dcf0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 8
jb 0x7ff794c58c77
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x28]
call fcn.7ff794c5e530
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x7ff794c58cf1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff794c58cec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff794c58cec
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff794c61b74
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x7ff794c58d00
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 0x58], sil
je 0x7ff794c58d45
mov ecx, esi
mov edx, 0x48bc
nop dword [rax]
nop word [rax + rax]
lea eax, [rdx + rcx]
xor word [r8 + rcx*2], ax
inc rcx
cmp rcx, 0x2b
jb 0x7ff794c58d30
mov byte [r8 + 0x58], sil
lea rax, [r8 + 0x56]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], si
cmp r8, rax
je 0x7ff794c58d79
mov r9, r8
mov edx, 0x2b
lea rcx, [rsp + 0x28]
call fcn.7ff794c5dcf0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 8
jb 0x7ff794c58d87
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x28]
call fcn.7ff794c5e530
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x7ff794c58e01
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff794c58dfc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff794c58dfc
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff794c61b74
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x7ff794c58e10
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 0x40], sil
je 0x7ff794c58e55
mov ecx, esi
mov edx, 0x48bc
nop dword [rax]
nop word [rax + rax]
lea eax, [rdx + rcx]
xor word [r8 + rcx*2], ax
inc rcx
cmp rcx, 0x1f
jb 0x7ff794c58e40
mov byte [r8 + 0x40], sil
lea rax, [r8 + 0x3e]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], si
cmp r8, rax
je 0x7ff794c58e89
mov r9, r8
mov edx, 0x1f
lea rcx, [rsp + 0x28]
call fcn.7ff794c5dcf0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 8
jb 0x7ff794c58e97
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x28]
call fcn.7ff794c5e530
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x7ff794c58f11
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff794c58f0c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff794c58f0c
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff794c61b74
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x7ff794c58f20
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 0x2a], sil
je 0x7ff794c58f65
mov ecx, esi
mov edx, 0x48bc
nop dword [rax]
nop word [rax + rax]
lea eax, [rdx + rcx]
xor word [r8 + rcx*2], ax
inc rcx
cmp rcx, 0x14
jb 0x7ff794c58f50
mov byte [r8 + 0x2a], sil
lea rax, [r8 + 0x28]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], si
cmp r8, rax
je 0x7ff794c58f99
mov r9, r8
mov edx, 0x14
lea rcx, [rsp + 0x28]
call fcn.7ff794c5dcf0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 8
jb 0x7ff794c58fa7
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x28]
call fcn.7ff794c5e530
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x7ff794c59021
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff794c5901c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff794c5901c
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff794c61b74
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret