joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140152a60
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x178
mov rsi, rcx
mov rax, qword [0x1401b3028]
xor rax, rsp
mov qword [rsp + 0x170], rax
cmp byte [rcx + 0x17], 0
jns 0x140152a87
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140152ab7
test eax, 0x410
sete sil
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400dc300
mov eax, esi
add rsp, 0x178
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.1400b3f70
test al, al
jne 0x140152ac9
xor esi, esi
jmp 0x140152a9b
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 0x73
mov r9d, 2
call fcn.14012f9d0
lea rcx, [rsp + 0x40]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.140113430
mov rcx, rax
mov rdx, rsi
call fcn.140130810
mov rcx, rdi
call fcn.14012fa50
jmp 0x140152ac5

Function at 0x140152b20
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push rsi
push rdi
sub rsp, 0x178
mov rsi, rcx
mov rax, qword [0x1401b3028]
xor rax, rsp
mov qword [rsp + 0x170], rax
cmp byte [rcx + 0x17], 0
jns 0x140152b47
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140152b5e
and eax, 0x410
cmp eax, 0x410
je 0x140152ba3
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x140152b6a
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dil, 1
test eax, eax
jne 0x140152b87
mov ecx, 2
call fcn.1400b3f70
test al, al
jne 0x140152bc4
xor edi, edi
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400dc300
mov eax, edi
add rsp, 0x178
pop rdi
pop rsi
ret
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400dc300
mov rcx, rsi
add rsp, 0x178
pop rdi
pop rsi
jmp fcn.140152c20
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 0x93
mov r9d, 2
call fcn.14012f9d0
lea rcx, [rsp + 0x40]
lea rdx, str.DeleteFile
mov r8d, 0xb
call fcn.140113430
mov rcx, rax
mov rdx, rsi
call fcn.140130810
mov rcx, rdi
call fcn.14012fa50
jmp 0x140152b85

Function at 0x140152c20
Capabilities:
Delete directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x170
mov rsi, rcx
mov rax, qword [0x1401b3028]
xor rax, rsp
mov qword [rsp + 0x168], rax
cmp byte [rcx + 0x17], 0
jns 0x140152c48
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov edi, eax
test eax, eax
jne 0x140152c62
mov ecx, 2
call fcn.1400b3f70
test al, al
jne 0x140152c84
test edi, edi
setne bl
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.1400dc300
mov eax, ebx
add rsp, 0x170
pop rbx
pop rdi
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rbx, [rsp + 0x28]
mov rcx, rbx
mov r8d, 0x2f
mov r9d, 2
call fcn.14012f9d0
lea rcx, [rsp + 0x38]
lea rdx, str.RemoveDirectory
mov r8d, 0x10
call fcn.140113430
mov rcx, rax
mov rdx, rsi
call fcn.140130810
mov rcx, rbx
call fcn.14012fa50
jmp 0x140152c62
Function at 0x140160930
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, r8
mov rax, qword [0x1401b3028]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov eax, 0xaaaaaaaa
lea rdi, [rsp + 0x44]
mov dword [rdi], eax
lea r8, [rsp + 0x40]
mov dword [r8], eax
lea rax, [rsp + 0x3c]
mov dword [rax], 4
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
xor r8d, r8d
mov r9, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rdi]
xor ecx, 4
or ecx, eax
sete bl
jne 0x140160990
mov eax, dword [rsp + 0x40]
mov dword [rsi], eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400dc300
mov eax, ebx
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret

Function at 0x140160a50
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x1a0
mov rax, qword [0x1401b3028]
xor rax, rsp
mov qword [rsp + 0x198], rax
movaps xmm0, xmmword [0x14017f9f0]
lea rsi, [rsp + 0x160]
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rsi + 0x20], 0x100
jb 0x140160aa4
mov ecx, 1
call fcn.1400b3f70
test al, al
jne 0x140160ad3
mov eax, dword [rsp + 0x180]
cmp eax, 0x100
mov esi, 0xff
cmovb esi, eax
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.1400dc300
mov eax, esi
add rsp, 0x1a0
pop rsi
ret
lea rdx, str....._third_partycrashpadcrashpad_snapshotwin_system_snapshot_win.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0x117
mov r9d, 1
call fcn.1400473b0
lea rcx, [rsp + 0x38]
lea rdx, str.dwNumberOfProcessors_exceeds_uint8_t_storage
mov r8d, 0x2c
call fcn.140113430
mov rcx, rsi
call fcn.1400479a0
jmp 0x140160aa4
Function at 0x14016bb40
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1b0
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x1401b3028]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
movaps xmm0, xmmword [0x14017f9f0]
lea r15, [rsp + 0x160]
movaps xmmword [r15 + 0x30], xmm0
movaps xmmword [r15 + 0x20], xmm0
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
lea r14, [rcx + 0x18]
mov rcx, r14
call fcn.140112d00
mov r8d, 0x40
mov rcx, rsi
mov rdx, rax
mov r9, r15
call fcn.14016f170
test al, al
je 0x14016bc92
movzx eax, word [rsp + 0x160]
cmp eax, 0x5a4d
jne 0x14016bc0d
mov rcx, r14
call fcn.140112d00
movsxd r14, dword [rsp + 0x19c]
add r14, rax
mov r8d, 0x108
mov rcx, rsi
mov rdx, r14
mov r9, rbx
call fcn.14016f170
test al, al
je 0x14016bc56
cmp dword [rbx], 0x4550
jne 0x14016bcc3
mov sil, 1
test rdi, rdi
je 0x14016bca2
mov qword [rdi], r14
jmp 0x14016bca2
mov ecx, 1
call fcn.1400b3f70
test al, al
je 0x14016bca0
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x15a
mov r9d, 1
call fcn.1400473b0
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_e_magic_in_dos_header_of
mov r8d, 0x21
jmp 0x14016bd05
mov ecx, 1
call fcn.1400b3f70
test al, al
je 0x14016bca0
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x162
mov r9d, 1
call fcn.1400473b0
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_nt_headers_from
jmp 0x14016bcff
mov ecx, 1
call fcn.1400b3f70
test al, al
jne 0x14016bcd3
xor esi, esi
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.1400dc300
mov eax, esi
add rsp, 0x1b0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, 1
call fcn.1400b3f70
test al, al
je 0x14016bca0
jmp 0x14016bd33
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x154
mov r9d, 1
call fcn.1400473b0
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_dos_header_from
mov r8d, 0x1f
call fcn.140113430
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x14016bd1b
mov r8, qword [rsi + 8]
mov rsi, qword [rsi]
mov rcx, rax
mov rdx, rsi
call fcn.140113430
mov rcx, rdi
call fcn.1400479a0
jmp 0x14016bca0
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x168
mov r9d, 1
call fcn.1400473b0
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_signature_in_nt_headers_of
mov r8d, 0x23
jmp 0x14016bd05
Function at 0x14016bd70
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1b0
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x1401b3028]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
movaps xmm0, xmmword [0x14017f9f0]
lea r15, [rsp + 0x160]
movaps xmmword [r15 + 0x30], xmm0
movaps xmmword [r15 + 0x20], xmm0
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
lea r14, [rcx + 0x18]
mov rcx, r14
call fcn.140112d00
mov r8d, 0x40
mov rcx, rsi
mov rdx, rax
mov r9, r15
call fcn.14016f170
test al, al
je 0x14016bec2
movzx eax, word [rsp + 0x160]
cmp eax, 0x5a4d
jne 0x14016be3d
mov rcx, r14
call fcn.140112d00
movsxd r14, dword [rsp + 0x19c]
add r14, rax
mov r8d, 0xf8
mov rcx, rsi
mov rdx, r14
mov r9, rbx
call fcn.14016f170
test al, al
je 0x14016be86
cmp dword [rbx], 0x4550
jne 0x14016bef3
mov sil, 1
test rdi, rdi
je 0x14016bed2
mov qword [rdi], r14
jmp 0x14016bed2
mov ecx, 1
call fcn.1400b3f70
test al, al
je 0x14016bed0
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x15a
mov r9d, 1
call fcn.1400473b0
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_e_magic_in_dos_header_of
mov r8d, 0x21
jmp 0x14016bf35
mov ecx, 1
call fcn.1400b3f70
test al, al
je 0x14016bed0
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x162
mov r9d, 1
call fcn.1400473b0
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_nt_headers_from
jmp 0x14016bf2f
mov ecx, 1
call fcn.1400b3f70
test al, al
jne 0x14016bf03
xor esi, esi
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.1400dc300
mov eax, esi
add rsp, 0x1b0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, 1
call fcn.1400b3f70
test al, al
je 0x14016bed0
jmp 0x14016bf63
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x154
mov r9d, 1
call fcn.1400473b0
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_dos_header_from
mov r8d, 0x1f
call fcn.140113430
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x14016bf4b
mov r8, qword [rsi + 8]
mov rsi, qword [rsi]
mov rcx, rax
mov rdx, rsi
call fcn.140113430
mov rcx, rdi
call fcn.1400479a0
jmp 0x14016bed0
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x168
mov r9d, 1
call fcn.1400473b0
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_signature_in_nt_headers_of
mov r8d, 0x23
jmp 0x14016bf35
Function at 0x140007c50
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x13], 0
je 0x140007c73
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xf]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x12
jb 0x140007c60
mov byte [rcx + 0x13], 0
mov rax, rcx
ret
Function at 0x14000ea20
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x15], 0
je 0x14000ea43
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xf]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x14
jb 0x14000ea30
mov byte [rcx + 0x15], 0
ret

Function at 0x14000ea50
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x24], 0
je 0x14000ea73
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xf]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x23
jb 0x14000ea60
mov byte [rcx + 0x24], 0
ret

Function at 0x14000ea80
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x3a], 0
je 0x14000eaa3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xf]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x39
jb 0x14000ea90
mov byte [rcx + 0x3a], 0
ret

Function at 0x14000eab0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x44], 0
je 0x14000ead3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xf]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x43
jb 0x14000eac0
mov byte [rcx + 0x44], 0
ret

Function at 0x14000eae0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x45], 0
je 0x14000eb03
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xf]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x44
jb 0x14000eaf0
mov byte [rcx + 0x45], 0
ret

Function at 0x14000eb10
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x36], 0
je 0x14000eb33
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xf]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x35
jb 0x14000eb20
mov byte [rcx + 0x36], 0
ret

Function at 0x14000eb40
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x55], 0
je 0x14000eb63
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xf]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x54
jb 0x14000eb50
mov byte [rcx + 0x55], 0
ret

Function at 0x14000eb70
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xb], 0
je 0x14000eb93
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xf]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xa
jb 0x14000eb80
mov byte [rcx + 0xb], 0
ret

Function at 0x14000eba0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x25], 0
je 0x14000ebc3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xf]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x24
jb 0x14000ebb0
mov byte [rcx + 0x25], 0
ret

Function at 0x14000ebd0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x26], 0
je 0x14000ebf3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xf]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x25
jb 0x14000ebe0
mov byte [rcx + 0x26], 0
ret

Function at 0x14000ec00
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x32], 0
je 0x14000ec23
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xf]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x31
jb 0x14000ec10
mov byte [rcx + 0x32], 0
ret

Function at 0x14000ec30
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x10], 0
je 0x14000ec53
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xf]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xf
jb 0x14000ec40
mov byte [rcx + 0x10], 0
ret
Function at 0x14000ec60
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x51], 0
je 0x14000ec83
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xf]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x50
jb 0x14000ec70
mov byte [rcx + 0x51], 0
ret

Function at 0x14000ec90
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x33], 0
je 0x14000ecb3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xf]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x32
jb 0x14000eca0
mov byte [rcx + 0x33], 0
ret

Function at 0x14000ecc0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x35], 0
je 0x14000ece3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xf]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x34
jb 0x14000ecd0
mov byte [rcx + 0x35], 0
ret

Function at 0x14000ecf0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xa], 0
je 0x14000ed13
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xf]
xor byte [rax + rcx], dl
inc rax
cmp rax, 9
jb 0x14000ed00
mov byte [rcx + 0xa], 0
ret

Function at 0x14000ed20
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x11], 0
je 0x14000ed43
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xf]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x10
jb 0x14000ed30
mov byte [rcx + 0x11], 0
ret

Function at 0x14000ed50
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x12], 0
je 0x14000ed73
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xf]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x11
jb 0x14000ed60
mov byte [rcx + 0x12], 0
ret

Function at 0x14000ed80
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x14], 0
je 0x14000eda3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xf]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x13
jb 0x14000ed90
mov byte [rcx + 0x14], 0
ret

Function at 0x14000fcb0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 9], 0
je 0x14000fcd3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xf]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x14000fcc0
mov byte [rcx + 9], 0
ret

Function at 0x14000fce0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x20], 0
je 0x14000fd03
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xf]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1f
jb 0x14000fcf0
mov byte [rcx + 0x20], 0
ret

Function at 0x14000fd10
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1a], 0
je 0x14000fd33
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xf]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x19
jb 0x14000fd20
mov byte [rcx + 0x1a], 0
ret

Function at 0x14000fd40
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1c], 0
je 0x14000fd63
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xf]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1b
jb 0x14000fd50
mov byte [rcx + 0x1c], 0
ret

Function at 0x14000fd70
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x3c], 0
je 0x14000fd93
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xf]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x3b
jb 0x14000fd80
mov byte [rcx + 0x3c], 0
ret
Function at 0x14000fda0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x27], 0
je 0x14000fdc3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xf]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x26
jb 0x14000fdb0
mov byte [rcx + 0x27], 0
ret

Function at 0x14000fdd0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x28], 0
je 0x14000fdf3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xf]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x27
jb 0x14000fde0
mov byte [rcx + 0x28], 0
ret

Function at 0x14000fe00
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x34], 0
je 0x14000fe23
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xf]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x33
jb 0x14000fe10
mov byte [rcx + 0x34], 0
ret

Function at 0x14000fe30
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x30], 0
je 0x14000fe53
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xf]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x2f
jb 0x14000fe40
mov byte [rcx + 0x30], 0
ret

Function at 0x14000fe60
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1f], 0
je 0x14000fe83
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xf]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1e
jb 0x14000fe70
mov byte [rcx + 0x1f], 0
ret

Function at 0x14000fe90
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2f], 0
je 0x14000feb3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xf]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x2e
jb 0x14000fea0
mov byte [rcx + 0x2f], 0
ret

Function at 0x14000fec0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 4], 0
je 0x14000fee3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xf]
xor byte [rax + rcx], dl
inc rax
cmp rax, 3
jb 0x14000fed0
mov byte [rcx + 4], 0
ret

Function at 0x14000fef0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xd], 0
je 0x14000ff13
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xf]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xc
jb 0x14000ff00
mov byte [rcx + 0xd], 0
ret

Function at 0x14000ff20
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xc], 0
je 0x14000ff43
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xf]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xb
jb 0x14000ff30
mov byte [rcx + 0xc], 0
ret

Function at 0x14000ff50
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2a], 0
je 0x14000ff73
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xf]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x29
jb 0x14000ff60
mov byte [rcx + 0x2a], 0
ret

Function at 0x14000ff80
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x29], 0
je 0x14000ffa3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xf]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x28
jb 0x14000ff90
mov byte [rcx + 0x29], 0
ret

Function at 0x14000ffb0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1b], 0
je 0x14000ffd3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xf]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1a
jb 0x14000ffc0
mov byte [rcx + 0x1b], 0
ret
Function at 0x14000ffe0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2d], 0
je 0x140010003
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xf]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x2c
jb 0x14000fff0
mov byte [rcx + 0x2d], 0
ret

Function at 0x140010010
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2b], 0
je 0x140010033
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xf]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x2a
jb 0x140010020
mov byte [rcx + 0x2b], 0
ret

Function at 0x140010040
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1e], 0
je 0x140010063
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xf]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1d
jb 0x140010050
mov byte [rcx + 0x1e], 0
ret

Function at 0x140010070
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1d], 0
je 0x140010093
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xf]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1c
jb 0x140010080
mov byte [rcx + 0x1d], 0
ret

Function at 0x1400100a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x23], 0
je 0x1400100c3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xf]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x22
jb 0x1400100b0
mov byte [rcx + 0x23], 0
ret

Function at 0x1400100d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x22], 0
je 0x1400100f3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xf]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x21
jb 0x1400100e0
mov byte [rcx + 0x22], 0
ret

Function at 0x140010100
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x19], 0
je 0x140010123
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xf]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x18
jb 0x140010110
mov byte [rcx + 0x19], 0
ret

Function at 0x140010130
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x18], 0
je 0x140010153
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xf]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x17
jb 0x140010140
mov byte [rcx + 0x18], 0
ret

Function at 0x140010160
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x13], 0
je 0x140010183
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xf]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x12
jb 0x140010170
mov byte [rcx + 0x13], 0
ret
Function at 0x140014c80
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
push r12
push r13
mov eax, 0x1070
call fcn.14001ac00
sub rsp, rax
mov rax, qword [0x14002e010]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov rdx, qword [rsp + 0x10b0]
xor ebp, ebp
mov qword [rsp + 0x38], r9
mov r12, r8
mov qword [rsp + 0x30], rdx
mov r13, rcx
test r8, r8
je 0x140014cfb
mov r9d, 0x1000
lea rdx, [rsp + 0x40]
call fcn.140013550
test al, al
jne 0x140014d03
mov rcx, qword [0x14001c2e8]
lea rdx, [0x1400271b0]
call fcn.140015b10
mov rcx, rax
lea rdx, [0x140015ce0]
call qword [fcn.14001c350]
mov rdx, rbp
jmp 0x140014e23
mov qword [rsp + 0x1068], rsi
lea rdx, [0x140026d50]
mov qword [rsp + 0x1060], rdi
mov rdi, 0xffffffffffffffff
mov qword [rsp + 0x1058], r14
mov qword [rsp + 0x1050], r15
inc rdi
cmp byte [rdx + rdi], bpl
jne 0x140014d31
movsxd rax, dword [rsp + 0x7c]
lea rcx, [rsp + 0x40]
add rcx, rax
mov qword [rsp + 0x1098], rbx
mov esi, ebp
movzx eax, word [rcx + 0x14]
lea r15, [rcx + 0x18]
movzx r14d, word [rcx + 6]
add r15, rax
test r14d, r14d
je 0x140014dd5
nop word [rax + rax]
mov eax, esi
mov r8, rdi
lea rcx, [rax + rax*4]
lea rbx, [r15 + rcx*8]
mov rcx, rbx
call fcn.14001ac4e
test eax, eax
jne 0x140014d9e
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], bpl
jne 0x140014d90
cmp rdi, rax
je 0x140014dae
inc esi
cmp esi, r14d
jae 0x140014dd5
lea rdx, [0x140026d50]
jmp 0x140014d70
mov eax, dword [rbx + 0xc]
test eax, eax
je 0x140014dd5
mov ecx, dword [rbx + 8]
lea rdx, [rsp + 0x40]
add rdx, rax
je 0x140014dd5
test ecx, ecx
je 0x140014dd5
lea rax, [rsp + 0x40]
mov ebp, ecx
sub rdx, rax
add rdx, r12
jmp 0x140014dfb
mov rcx, qword [0x14001c2e8]
lea rdx, [0x1400271e8]
call fcn.140015b10
mov rcx, rax
lea rdx, [0x140015ce0]
call qword [fcn.14001c350]
mov rdx, rbp
mov rbx, qword [rsp + 0x1098]
mov rdi, qword [rsp + 0x1060]
mov rsi, qword [rsp + 0x1068]
mov r14, qword [rsp + 0x1058]
mov r15, qword [rsp + 0x1050]
mov rax, qword [rsp + 0x30]
mov rcx, r13
mov r9, qword [rsp + 0x38]
mov r8d, ebp
mov qword [rsp + 0x20], rax
call fcn.140014b00
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.1400199e0
add rsp, 0x1070
pop r13
pop r12
pop rbp
ret