joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140171ea0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1402d0768]
mov rbx, rdx
test rax, rax
jne 0x140171f9b
mov dword [rbp - 0x50], 0x18
mov eax, dword [rbp - 0x50]
xor al, 0x56
mov byte [rbp - 0x4c], al
mov eax, dword [rbp - 0x50]
inc al
xor al, 0x69
mov byte [rbp - 0x4b], al
mov eax, dword [rbp - 0x50]
add al, 2
xor al, 0x72
mov byte [rbp - 0x4a], al
mov eax, dword [rbp - 0x50]
add al, 3
xor al, 0x74
mov byte [rbp - 0x49], al
mov eax, dword [rbp - 0x50]
add al, 4
xor al, 0x75
mov byte [rbp - 0x48], al
mov eax, dword [rbp - 0x50]
add al, 5
xor al, 0x61
mov byte [rbp - 0x47], al
mov eax, dword [rbp - 0x50]
add al, 6
xor al, 0x6c
mov byte [rbp - 0x46], al
mov eax, dword [rbp - 0x50]
add al, 7
xor al, 0x51
mov byte [rbp - 0x45], al
mov eax, dword [rbp - 0x50]
add al, 8
xor al, 0x75
mov byte [rbp - 0x44], al
mov eax, dword [rbp - 0x50]
add al, 9
xor al, 0x65
mov byte [rbp - 0x43], al
mov eax, dword [rbp - 0x50]
add al, 0xa
xor al, 0x72
mov byte [rbp - 0x42], al
mov eax, dword [rbp - 0x50]
add al, 0xb
xor al, 0x79
mov byte [rbp - 0x41], al
xor eax, eax
mov byte [rbp - 0x40], al
xor edx, edx
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
add cl, dl
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x140171f47
lea rcx, [0x140290e10]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x1402d0768], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1402d0768]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x140171fc4
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x140171fed
cmp dword [rbp - 0x18], 0x10000
je 0x140171fed
cmp qword [rbp - 0x20], 0x1000
jb 0x140171fed
cmp dword [rbp - 0x10], 0x1000000
je 0x140171fe9
cmp dword [rbp - 0x10], 0x40000
jne 0x140171fed
mov al, 1
jmp 0x140171fef
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x140173574
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov qword [rax - 0x68], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov rsi, rdx
mov rbp, rcx
mov rax, qword gs:[0x60]
mov r8, qword [rax + 0x18]
mov rax, qword [r8 + 0x20]
mov qword [rsp + 0xb0], rax
mov rbx, rax
xor r13d, r13d
lea r12d, [r13 + 1]
mov edi, r13d
mov rdx, qword [rbx + 0x50]
test rdx, rdx
je 0x1401737d2
lea rcx, [rsp + 0x38]
call fcn.1400ac71c
nop
mov r15, r13
mov r10, qword [rsi]
mov r11, qword [rsi + 8]
sub r11, r10
sar r11, 5
test r11, r11
je 0x140173681
mov r14, qword [r10 + 0x10]
mov rsi, r10
cmp qword [r10 + 0x18], 0x10
jb 0x140173609
mov rsi, qword [r10]
lea rcx, [r14 + r14]
movzx eax, word [rbx + 0x48]
cmp rcx, rax
jne 0x1401737f3
mov ebp, r13d
test r14, r14
je 0x140173676
mov r12, qword [rbx + 0x50]
movzx edx, byte [rsi]
movzx r9d, byte [r12]
lea ecx, [rdx - 0x41]
lea eax, [rdx + 0x20]
movzx r8d, al
cmp cl, 0x19
cmova r8d, edx
lea edx, [r9 - 0x41]
lea eax, [r9 + 0x20]
movzx ecx, al
cmp dl, 0x19
cmova ecx, r9d
cmp r8b, cl
jne 0x1401737ed
mov eax, 1
add ebp, eax
add rsi, rax
add r12, 2
movsxd rax, ebp
cmp rax, r14
jb 0x140173626
mov r12d, 1
mov edi, r12d
mov rbp, qword [rsp + 0xa0]
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rcx, qword [rsp + 0x38]
mov qword [rsp + 0x20], 4
lea r9, str..exe
xor r8d, r8d
mov rdx, qword [rsp + 0x48]
call fcn.1400ad7d0
cmp rax, 0xffffffffffffffff
cmovne edi, r12d
mov eax, 2
cmp word [rbx + 0x38], ax
jbe 0x1401737a7
test edi, edi
jne 0x1401737a7
mov r12, qword [rbx + 0x50]
mov r15, qword [rbx + 0x20]
mov r9, r15
mov r8, r12
mov rdx, qword [rbx + 0x40]
mov rcx, rbp
call fcn.14017380c
mov rdi, rax
test rax, rax
je 0x1401737a1
movsxd r14, dword [rax + 0x3c]
mov eax, dword [r14 + rax + 0x54]
mov qword [rsp + 0x20], rax
mov r9, r15
mov r8, rdi
call fcn.140173e98
movsxd rax, dword [rdi + 0x3c]
lea r13, [rdi + 0x108]
add r13, rax
xor edx, edx
mov ebp, edx
cmp dx, word [r14 + rdi + 6]
jae 0x14017378d
mov eax, ebp
lea rcx, [rax + rax*4]
lea rsi, [rcx*8]
add rsi, r13
cmp dword [rsi + 0x24], edx
jl 0x140173781
lea rdx, str.clr.dll
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
test eax, eax
jne 0x140173767
lea rdx, str..text
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcmp]
xor edx, edx
test eax, eax
je 0x140173781
mov eax, dword [rsi + 0xc]
mov ecx, dword [rsi + 8]
lea r9, [rax + r15]
lea r8, [rax + rdi]
mov qword [rsp + 0x20], rcx
call fcn.140173e98
xor edx, edx
inc ebp
movzx eax, word [r14 + rdi + 6]
cmp ebp, eax
jb 0x140173727
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor r13d, r13d
mov r12d, 1
mov rbx, qword [rbx]
lea rcx, [rsp + 0x38]
call fcn.1400ac668
cmp rbx, qword [rsp + 0xb0]
mov rsi, qword [rsp + 0xa8]
mov rbp, qword [rsp + 0xa0]
jne 0x1401735c3
mov al, r12b
mov rbx, qword [rsp + 0xb8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r12d, 1
add r15, r12
add r10, 0x20
cmp r15, r11
jae 0x140173679
jmp 0x1401735f8
Function at 0x140173ca4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
xor ebx, ebx
mov r12, r8
mov rdi, rdx
test rdx, rdx
jne 0x140173cd6
xor eax, eax
jmp 0x140173e7f
movsxd r13, dword [rdx + 0x3c]
mov ecx, dword [rdx + r13 + 0x88]
add rcx, rdi
mov r15d, dword [rcx + 0x1c]
mov ebp, dword [rcx + 0x20]
add r15, rdi
mov esi, dword [rcx + 0x24]
add rbp, rdi
add rsi, rdi
test r12d, 0xffff0000
jne 0x140173d14
movzx eax, r12w
sub eax, dword [rcx + 0x10]
mov ebx, dword [r15 + rax*4]
add rbx, rdi
jmp 0x140173e7c
mov r14d, dword [rcx + 0x18]
jmp 0x140173d38
mov ecx, dword [rbp]
mov rdx, r12
add rcx, rdi
dec r14d
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcmp]
test eax, eax
je 0x140173d42
add rbp, 4
add rsi, 2
test r14d, r14d
jne 0x140173d1a
jmp 0x140173e7c
movzx eax, word [rsi]
mov edx, dword [rdi + r13 + 0x88]
mov ecx, dword [r15 + rax*4]
cmp rdx, rcx
ja 0x140173e78
mov eax, dword [rdi + r13 + 0x8c]
add eax, edx
cmp rcx, rax
jae 0x140173e78
lea rsi, [rcx + rdi]
mov rcx, rsi
lea rdx, [0x140290e48]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
mov r15d, 2
mov rbp, rax
mov edx, r15d
lea rdi, [rax + 1]
sub rdi, rsi
lea rcx, [rdi + 4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov r14, rax
test rax, rax
je 0x140173e7c
lea r8, [rdi + 1]
mov qword [rsp + 0x20], rdi
mov r9, rsi
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_mbstowcs_s]
lea rdi, [r14 + rdi*2]
lea ecx, [r15 + 4]
lea rsi, [0x140291520]
rep movsb byte [rdi], byte [rsi]
lea edi, [r15 + 2]
mov rcx, r14
mov r8d, edi
lea rdx, str.api_
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x140173e04
mov r8d, edi
lea rdx, str.ext_
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x140173e4d
mov rdx, qword [rsp + 0x88]
lea r9, [rsp + 0x78]
mov r8, r14
call fcn.140173324
mov rsi, rax
test rax, rax
je 0x140173e4d
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rdi, qword [rsp + 0x78]
mov rdx, r15
lea rcx, [rdi + 1]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov r14, rax
test rax, rax
je 0x140173e7c
lea rcx, [rdi + rdi]
mov rdi, rax
rep movsb byte [rdi], byte [rsi]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, qword [rsp + 0x70]
lea r8, [rbp + 1]
mov rdx, rax
mov r9, r14
call fcn.140173ca4
mov rcx, r14
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140173e7c
lea rbx, [rcx + rdi]
mov rax, rbx
mov rbx, qword [rsp + 0x80]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140173e98
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
mov rsi, r8
mov rdx, r9
mov r8, qword [rsp + 0x50]
mov rcx, rsi
mov rbx, r9
call qword [sym.imp.VCRUNTIME140.dll_memcmp]
test eax, eax
je 0x140173f06
mov rdx, qword [rsp + 0x50]
lea r9, [rsp + 0x38]
mov r8d, 0x40
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x140173f06
mov rcx, qword [rsp + 0x50]
lea r9, [rsp + 0x38]
mov r8d, dword [rsp + 0x38]
mov rdi, rbx
mov rdx, qword [rsp + 0x50]
rep movsb byte [rdi], byte [rsi]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140176b28
Capabilities:
Authenticate hmac

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov qword [rbp - 0x19], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rdi
lea rbx, [0x1402cf2a0]
mov rdx, rbx
lea rcx, [rbp - 0x11]
call fcn.1400ac788
nop
lea rdx, [rbp - 0x11]
lea rcx, [rbp + 0xf]
call fcn.1400ac788
mov rdi, rax
mov qword [rbp + 0x67], rax
mov rdx, rax
lea rcx, [rbp + 0x2f]
call fcn.1400ac788
mov rdx, rax
lea rcx, [rbp - 0x39]
call fcn.140195bd8
nop
lea rdx, [rbp - 0x39]
mov cl, 1
call fcn.140173fb4
nop
mov rdx, qword [rbp - 0x21]
cmp rdx, 0x10
jb 0x140176bcb
inc rdx
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140176bc6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140176c1d
call fcn.14027b384
and qword [rbp - 0x29], 0
mov qword [rbp - 0x21], 0xf
mov byte [rbp - 0x39], 0
mov rcx, rdi
call fcn.1400ac668
nop
lea rcx, [rbp - 0x11]
call fcn.1400ac668
add rbx, 0x20
lea rax, [0x1402cf640]
cmp rbx, rax
jne 0x140176b4e
mov cl, 1
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
jmp fcn.1401742f0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
Function at 0x14018e370
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x67
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x14018e37d
xor edx, edx
mov word [rcx + 0xd2], dx
ret

Function at 0x14018e3b4
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x69
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x14018e3c1
xor edx, edx
mov word [rcx + 0xd6], dx
ret

Function at 0x14018e450
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x53
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x14018e45d
xor edx, edx
mov word [rcx + 0xaa], dx
ret

Function at 0x14018e4dc
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x4e
jb 0x14018e4e9
mov word [rcx + 0xa0], r11w
ret

Function at 0x14018e57c
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x43
jb 0x14018e589
mov word [rcx + 0x8a], r11w
ret

Function at 0x14018e5c4
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x19
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x14018e5d1
xor edx, edx
mov word [rcx + 0x36], dx
ret

Function at 0x14018e640
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x62
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x14018e64d
xor edx, edx
mov word [rcx + 0xc8], dx
ret

Function at 0x14018e6d8
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x3b
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x14018e6e5
xor edx, edx
mov word [rcx + 0x7a], dx
ret

Function at 0x14018e708
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x21
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x14018e715
mov byte [rcx + 0x25], r10b
ret

Function at 0x14018e74c
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x2c
jb 0x14018e759
mov word [rcx + 0x5c], r11w
ret
Function at 0x14018f71c
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x46
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x14018f729
xor edx, edx
mov word [rcx + 0x90], dx
ret

Function at 0x14018f7a0
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x4d
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x14018f7ad
xor edx, edx
mov word [rcx + 0x9e], dx
ret

Function at 0x14018f7d0
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x31
jb 0x14018f7dd
mov word [rcx + 0x66], r11w
ret

Function at 0x14018f804
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x39
jb 0x14018f811
mov word [rcx + 0x76], r11w
ret

Function at 0x14018f854
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x3d
jb 0x14018f861
mov word [rcx + 0x7e], r11w
ret

Function at 0x14018f8a4
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x31
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x14018f8b1
xor edx, edx
mov word [rcx + 0x66], dx
ret

Function at 0x14018f944
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x3a
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x14018f951
xor edx, edx
mov word [rcx + 0x78], dx
ret

Function at 0x14018fa38
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x15
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x14018fa45
xor edx, edx
mov word [rcx + 0x2e], dx
ret

Function at 0x14018fac8
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x2c7
jb 0x14018fad5
mov word [rcx + 0x592], r11w
ret

Function at 0x14018fb18
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x2ad
jb 0x14018fb25
mov word [rcx + 0x55e], r11w
ret
Function at 0x14018fb68
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x3bb
jb 0x14018fb75
mov word [rcx + 0x77a], r11w
ret

Function at 0x14018fc48
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x367
jb 0x14018fc55
mov word [rcx + 0x6d2], r11w
ret
Function at 0x1401903d4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1402d07b8]
mov rbx, rdx
test rax, rax
jne 0x1401904cf
mov dword [rbp - 0x50], 0x18
mov eax, dword [rbp - 0x50]
xor al, 0x56
mov byte [rbp - 0x4c], al
mov eax, dword [rbp - 0x50]
inc al
xor al, 0x69
mov byte [rbp - 0x4b], al
mov eax, dword [rbp - 0x50]
add al, 2
xor al, 0x72
mov byte [rbp - 0x4a], al
mov eax, dword [rbp - 0x50]
add al, 3
xor al, 0x74
mov byte [rbp - 0x49], al
mov eax, dword [rbp - 0x50]
add al, 4
xor al, 0x75
mov byte [rbp - 0x48], al
mov eax, dword [rbp - 0x50]
add al, 5
xor al, 0x61
mov byte [rbp - 0x47], al
mov eax, dword [rbp - 0x50]
add al, 6
xor al, 0x6c
mov byte [rbp - 0x46], al
mov eax, dword [rbp - 0x50]
add al, 7
xor al, 0x51
mov byte [rbp - 0x45], al
mov eax, dword [rbp - 0x50]
add al, 8
xor al, 0x75
mov byte [rbp - 0x44], al
mov eax, dword [rbp - 0x50]
add al, 9
xor al, 0x65
mov byte [rbp - 0x43], al
mov eax, dword [rbp - 0x50]
add al, 0xa
xor al, 0x72
mov byte [rbp - 0x42], al
mov eax, dword [rbp - 0x50]
add al, 0xb
xor al, 0x79
mov byte [rbp - 0x41], al
xor eax, eax
mov byte [rbp - 0x40], al
xor edx, edx
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
add cl, dl
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x14019047b
lea rcx, [0x140290e10]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x1402d07b8], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1402d07b8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x1401904f8
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x140190521
cmp dword [rbp - 0x18], 0x10000
je 0x140190521
cmp qword [rbp - 0x20], 0x1000
jb 0x140190521
cmp dword [rbp - 0x10], 0x1000000
je 0x14019051d
cmp dword [rbp - 0x10], 0x40000
jne 0x140190521
mov al, 1
jmp 0x140190523
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x140192090
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1402d07f0]
mov rbx, rdx
test rax, rax
jne 0x14019218b
mov dword [rbp - 0x50], 0x18
mov eax, dword [rbp - 0x50]
xor al, 0x56
mov byte [rbp - 0x4c], al
mov eax, dword [rbp - 0x50]
inc al
xor al, 0x69
mov byte [rbp - 0x4b], al
mov eax, dword [rbp - 0x50]
add al, 2
xor al, 0x72
mov byte [rbp - 0x4a], al
mov eax, dword [rbp - 0x50]
add al, 3
xor al, 0x74
mov byte [rbp - 0x49], al
mov eax, dword [rbp - 0x50]
add al, 4
xor al, 0x75
mov byte [rbp - 0x48], al
mov eax, dword [rbp - 0x50]
add al, 5
xor al, 0x61
mov byte [rbp - 0x47], al
mov eax, dword [rbp - 0x50]
add al, 6
xor al, 0x6c
mov byte [rbp - 0x46], al
mov eax, dword [rbp - 0x50]
add al, 7
xor al, 0x51
mov byte [rbp - 0x45], al
mov eax, dword [rbp - 0x50]
add al, 8
xor al, 0x75
mov byte [rbp - 0x44], al
mov eax, dword [rbp - 0x50]
add al, 9
xor al, 0x65
mov byte [rbp - 0x43], al
mov eax, dword [rbp - 0x50]
add al, 0xa
xor al, 0x72
mov byte [rbp - 0x42], al
mov eax, dword [rbp - 0x50]
add al, 0xb
xor al, 0x79
mov byte [rbp - 0x41], al
xor eax, eax
mov byte [rbp - 0x40], al
xor edx, edx
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
add cl, dl
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x140192137
lea rcx, [0x140290e10]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x1402d07f0], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1402d07f0]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x1401921b4
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x1401921dd
cmp dword [rbp - 0x18], 0x10000
je 0x1401921dd
cmp qword [rbp - 0x20], 0x1000
jb 0x1401921dd
cmp dword [rbp - 0x10], 0x1000000
je 0x1401921d9
cmp dword [rbp - 0x10], 0x40000
jne 0x1401921dd
mov al, 1
jmp 0x1401921df
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x140193d4c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1402d07d0]
mov rbx, rdx
test rax, rax
jne 0x140193e47
mov dword [rbp - 0x50], 0x18
mov eax, dword [rbp - 0x50]
xor al, 0x56
mov byte [rbp - 0x4c], al
mov eax, dword [rbp - 0x50]
inc al
xor al, 0x69
mov byte [rbp - 0x4b], al
mov eax, dword [rbp - 0x50]
add al, 2
xor al, 0x72
mov byte [rbp - 0x4a], al
mov eax, dword [rbp - 0x50]
add al, 3
xor al, 0x74
mov byte [rbp - 0x49], al
mov eax, dword [rbp - 0x50]
add al, 4
xor al, 0x75
mov byte [rbp - 0x48], al
mov eax, dword [rbp - 0x50]
add al, 5
xor al, 0x61
mov byte [rbp - 0x47], al
mov eax, dword [rbp - 0x50]
add al, 6
xor al, 0x6c
mov byte [rbp - 0x46], al
mov eax, dword [rbp - 0x50]
add al, 7
xor al, 0x51
mov byte [rbp - 0x45], al
mov eax, dword [rbp - 0x50]
add al, 8
xor al, 0x75
mov byte [rbp - 0x44], al
mov eax, dword [rbp - 0x50]
add al, 9
xor al, 0x65
mov byte [rbp - 0x43], al
mov eax, dword [rbp - 0x50]
add al, 0xa
xor al, 0x72
mov byte [rbp - 0x42], al
mov eax, dword [rbp - 0x50]
add al, 0xb
xor al, 0x79
mov byte [rbp - 0x41], al
xor eax, eax
mov byte [rbp - 0x40], al
xor edx, edx
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
add cl, dl
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x140193df3
lea rcx, [0x140290e10]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x1402d07d0], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1402d07d0]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x140193e70
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x140193e99
cmp dword [rbp - 0x18], 0x10000
je 0x140193e99
cmp qword [rbp - 0x20], 0x1000
jb 0x140193e99
cmp dword [rbp - 0x10], 0x1000000
je 0x140193e95
cmp dword [rbp - 0x10], 0x40000
jne 0x140193e99
mov al, 1
jmp 0x140193e9b
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret