joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140139294
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
je 0x1401393d6
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
mov esi, edx
mov r15, rcx
xor r14d, r14d
xor eax, eax
mov word [rbp + 0x40], 0x3731
mov byte [rbp + 0x42], al
xor ecx, ecx
movsxd rax, ecx
xor byte [rbp + rax + 0x40], cl
inc ecx
cmp ecx, 2
jb 0x1401392c4
xor eax, eax
mov byte [rbp + 0x42], 0
mov byte [rbp + 0x3a], al
xor ecx, ecx
mov word [rbp + 0x38], 0x3731
movsxd rax, ecx
xor byte [rbp + rax + 0x38], cl
inc ecx
cmp ecx, 2
jb 0x1401392e3
xor eax, eax
mov byte [rbp + 0x3a], 0
mov byte [rbp - 0xe], al
xor ecx, ecx
mov word [rbp - 0x10], 0x3731
movsxd rax, ecx
xor byte [rbp + rax - 0x10], cl
inc ecx
cmp ecx, 2
jb 0x140139302
xor eax, eax
mov byte [rbp - 0xe], 0
mov byte [rbp + 0x4a], al
xor ecx, ecx
mov word [rbp + 0x48], 0x3131
movsxd rax, ecx
xor byte [rbp + rax + 0x48], cl
inc ecx
cmp ecx, 2
jb 0x140139321
lea rcx, [rbp + 0x38]
mov byte [rbp + 0x4a], 0
call fcn.1403d6dc0
mov r8d, eax
lea rcx, [0x1404c05c8]
xor edx, edx
call fcn.1403d6cb0
lea rcx, [rbp + 0x40]
movzx edi, al
call fcn.1403d6dc0
mov r8d, eax
lea rcx, [0x1404c05b8]
xor edx, edx
call fcn.1403d6cb0
movzx ecx, al
imul edi, ecx
lea rcx, [rbp + 0x48]
call fcn.1403d6dc0
mov r8d, eax
lea rcx, [0x1404c05dc]
xor edx, edx
call fcn.1403d6cb0
movzx ecx, r14b
movzx ebx, al
imul ebx, ecx
lea rcx, [rbp - 0x10]
add bl, dil
call fcn.1403d6dc0
mov r8d, eax
lea rcx, [0x1404c05d0]
xor edx, edx
call fcn.1403d6cb0
movsxd rcx, r14d
add al, bl
inc r14d
xor byte [rcx + r15], al
cmp r14d, esi
jb 0x1401392b7
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14013b1d8
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
call fcn.14014142c
mov rcx, rax
call fcn.14013f97c
cmp byte [rax + 0x8ff], 0
jne 0x14013b328
call fcn.1401be850
test al, al
je 0x14013b2f2
call fcn.14014142c
mov rcx, rax
call fcn.14013f97c
mov byte [rax + 0x8ff], 1
call fcn.14014142c
mov rcx, rax
call fcn.14013f97c
cmp byte [rax + 0x900], 0
jne 0x14013b328
call fcn.14014142c
mov rcx, rax
call fcn.14013f97c
mov dword [rbp - 0x30], 0x6d70646b
mov dword [rbp - 0x2c], 0x35356961
mov dword [rbp - 0x28], 0x67666d26
mov byte [rax + 0x900], 1
xor eax, eax
mov byte [rbp - 0x24], al
xor ecx, ecx
movsxd rax, ecx
xor byte [rbp + rax - 0x30], cl
inc ecx
cmp ecx, 0xc
jb 0x14013b266
lea rcx, [rbp - 0x30]
mov byte [rbp - 0x24], 0
call qword [sym.imp.kernel32.dll_GetModuleHandleA]
mov r8, rax
cmp rax, 0xffffffffffffffff
jne 0x14013b2c6
xor eax, eax
mov dword [rbp - 0x23], 0x6d70646b
mov byte [rbp - 0x17], al
xor ecx, ecx
mov dword [rbp - 0x1f], 0x35356961
mov dword [rbp - 0x1b], 0x67666d26
movsxd rax, ecx
xor byte [rbp + rax - 0x23], cl
inc ecx
cmp ecx, 0xc
jb 0x14013b2a7
lea rcx, [rbp - 0x23]
mov byte [rbp - 0x17], 0
call qword [sym.imp.kernel32.dll_LoadLibraryA]
mov r8, rax
xor eax, eax
mov dword [rbp - 0x16], 0x62677343
mov byte [rbp - 0xa], al
xor ecx, ecx
mov dword [rbp - 0x12], 0x6f526070
mov dword [rbp - 0xe], 0x6f6b6c7a
movsxd rax, ecx
xor byte [rbp + rax - 0x16], cl
inc ecx
cmp ecx, 0xc
jae 0x14013b2f8
jmp 0x14013b2e2
add rsp, 0x70
pop rbp
ret
lea rdx, [rbp - 0x16]
mov byte [rbp - 0xa], 0
mov rcx, r8
call qword [sym.imp.kernel32.dll_GetProcAddress]
and qword [rsp + 0x28], 0
lea r8, [0x1401bf4e0]
and dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [case.0x140173169.0]
call fcn.14013ad48
int3
Function at 0x14013f97c
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
mov r14, qword [rcx]
xor eax, eax
mov byte [rbp + 0x32], al
xor ecx, ecx
mov word [rbp + 0x30], 0x3731
movsxd rax, ecx
xor byte [rbp + rax + 0x30], cl
inc ecx
cmp ecx, 2
jb 0x14013f99a
lea rcx, [rbp + 0x30]
mov byte [rbp + 0x32], 0
call fcn.1403d6dc0
mov r8d, eax
mov dword [rbp - 0x18], 0x33347930
xor eax, eax
mov byte [rbp - 0x14], al
xor ecx, ecx
movsxd rax, ecx
xor byte [rbp + rax - 0x18], cl
inc ecx
cmp ecx, 4
jb 0x14013f9c6
xor edx, edx
mov byte [rbp - 0x14], 0
lea rcx, [rbp - 0x18]
call fcn.1403d6cb0
mov rsi, qword gs:[rax]
xor eax, eax
mov byte [rbp + 0x3a], al
xor ecx, ecx
mov word [rbp + 0x38], 0x3731
movsxd rax, ecx
xor byte [rbp + rax + 0x38], cl
inc ecx
cmp ecx, 2
jb 0x14013f9f4
lea rcx, [rbp + 0x38]
mov byte [rbp + 0x3a], 0
call fcn.1403d6dc0
xor ecx, ecx
mov dword [rbp - 0x13], 0x33347930
mov byte [rbp - 0xf], cl
xor edx, edx
movsxd rcx, edx
xor byte [rbp + rcx - 0x13], dl
inc edx
cmp edx, 4
jb 0x14013fa1d
mov r8d, eax
mov byte [rbp - 0xf], 0
xor edx, edx
lea rcx, [rbp - 0x13]
call fcn.1403d6cb0
mov rdi, qword gs:[rax]
xor eax, eax
mov byte [rbp + 0x42], al
xor ecx, ecx
mov word [rbp + 0x40], 0x3731
movsxd rax, ecx
xor byte [rbp + rax + 0x40], cl
inc ecx
cmp ecx, 2
jb 0x14013fa4e
lea rcx, [rbp + 0x40]
mov byte [rbp + 0x42], 0
call fcn.1403d6dc0
xor edx, edx
mov dword [rbp - 0x20], 0x417930
movsxd rcx, edx
xor byte [rbp + rcx - 0x20], dl
inc edx
cmp edx, 3
jb 0x14013fa72
mov r8d, eax
mov byte [rbp - 0x1d], 0
xor edx, edx
lea rcx, [rbp - 0x20]
call fcn.1403d6cb0
mov ebx, eax
mov word [rbp + 0x48], 0x3731
xor eax, eax
mov byte [rbp + 0x4a], al
xor edx, edx
movsxd rcx, edx
xor byte [rbp + rcx + 0x48], dl
inc edx
cmp edx, 2
jb 0x14013faa1
lea rcx, [rbp + 0x48]
mov byte [rbp + 0x4a], al
call fcn.1403d6dc0
xor edx, edx
mov dword [rbp - 0x1c], 0x447930
movsxd rcx, edx
xor byte [rbp + rcx - 0x1c], dl
inc edx
cmp edx, 3
jb 0x14013fac4
mov r8d, eax
mov byte [rbp - 0x19], 0
xor edx, edx
lea rcx, [rbp - 0x1c]
call fcn.1403d6cb0
mov eax, eax
mov cl, bl
mov edx, edi
not rsi
shr rdx, cl
and rax, rdx
xor rax, rsi
xor rax, r14
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14013fb04
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
mov r14, qword [rcx + 8]
xor eax, eax
mov byte [rbp + 0x32], al
xor ecx, ecx
mov word [rbp + 0x30], 0x3731
movsxd rax, ecx
xor byte [rbp + rax + 0x30], cl
inc ecx
cmp ecx, 2
jb 0x14013fb23
lea rcx, [rbp + 0x30]
mov byte [rbp + 0x32], 0
call fcn.1403d6dc0
mov r8d, eax
mov dword [rbp - 0x18], 0x33347930
xor eax, eax
mov byte [rbp - 0x14], al
xor ecx, ecx
movsxd rax, ecx
xor byte [rbp + rax - 0x18], cl
inc ecx
cmp ecx, 4
jb 0x14013fb4f
xor edx, edx
mov byte [rbp - 0x14], 0
lea rcx, [rbp - 0x18]
call fcn.1403d6cb0
mov rsi, qword gs:[rax]
xor eax, eax
mov byte [rbp + 0x3a], al
xor ecx, ecx
mov word [rbp + 0x38], 0x3731
movsxd rax, ecx
xor byte [rbp + rax + 0x38], cl
inc ecx
cmp ecx, 2
jb 0x14013fb7d
lea rcx, [rbp + 0x38]
mov byte [rbp + 0x3a], 0
call fcn.1403d6dc0
xor ecx, ecx
mov dword [rbp - 0x13], 0x33347930
mov byte [rbp - 0xf], cl
xor edx, edx
movsxd rcx, edx
xor byte [rbp + rcx - 0x13], dl
inc edx
cmp edx, 4
jb 0x14013fba6
mov r8d, eax
mov byte [rbp - 0xf], 0
xor edx, edx
lea rcx, [rbp - 0x13]
call fcn.1403d6cb0
mov rdi, qword gs:[rax]
xor eax, eax
mov byte [rbp + 0x42], al
xor ecx, ecx
mov word [rbp + 0x40], 0x3731
movsxd rax, ecx
xor byte [rbp + rax + 0x40], cl
inc ecx
cmp ecx, 2
jb 0x14013fbd7
lea rcx, [rbp + 0x40]
mov byte [rbp + 0x42], 0
call fcn.1403d6dc0
xor edx, edx
mov dword [rbp - 0x20], 0x417930
movsxd rcx, edx
xor byte [rbp + rcx - 0x20], dl
inc edx
cmp edx, 3
jb 0x14013fbfb
mov r8d, eax
mov byte [rbp - 0x1d], 0
xor edx, edx
lea rcx, [rbp - 0x20]
call fcn.1403d6cb0
mov ebx, eax
mov word [rbp + 0x48], 0x3731
xor eax, eax
mov byte [rbp + 0x4a], al
xor edx, edx
movsxd rcx, edx
xor byte [rbp + rcx + 0x48], dl
inc edx
cmp edx, 2
jb 0x14013fc2a
lea rcx, [rbp + 0x48]
mov byte [rbp + 0x4a], al
call fcn.1403d6dc0
xor edx, edx
mov dword [rbp - 0x1c], 0x447930
movsxd rcx, edx
xor byte [rbp + rcx - 0x1c], dl
inc edx
cmp edx, 3
jb 0x14013fc4d
mov r8d, eax
mov byte [rbp - 0x19], 0
xor edx, edx
lea rcx, [rbp - 0x1c]
call fcn.1403d6cb0
mov eax, eax
mov cl, bl
mov edx, edi
not rsi
shr rdx, cl
and rax, rdx
xor rax, rsi
xor rax, r14
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140140ddc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x140548828]
mov word [rbp + 0x30], 0x3731
mov r14, qword [rax]
xor eax, eax
mov byte [rbp + 0x32], al
xor ecx, ecx
movsxd rax, ecx
xor byte [rbp + rax + 0x30], cl
inc ecx
cmp ecx, 2
jb 0x140140e05
lea rcx, [rbp + 0x30]
mov byte [rbp + 0x32], 0
call fcn.1403d6dc0
mov r8d, eax
mov dword [rbp - 0x18], 0x33347930
xor eax, eax
mov byte [rbp - 0x14], al
xor ecx, ecx
movsxd rax, ecx
xor byte [rbp + rax - 0x18], cl
inc ecx
cmp ecx, 4
jb 0x140140e31
xor edx, edx
mov byte [rbp - 0x14], 0
lea rcx, [rbp - 0x18]
call fcn.1403d6cb0
mov rsi, qword gs:[rax]
xor eax, eax
mov byte [rbp + 0x3a], al
xor ecx, ecx
mov word [rbp + 0x38], 0x3731
movsxd rax, ecx
xor byte [rbp + rax + 0x38], cl
inc ecx
cmp ecx, 2
jb 0x140140e5f
lea rcx, [rbp + 0x38]
mov byte [rbp + 0x3a], 0
call fcn.1403d6dc0
xor ecx, ecx
mov dword [rbp - 0x13], 0x33347930
mov byte [rbp - 0xf], cl
xor edx, edx
movsxd rcx, edx
xor byte [rbp + rcx - 0x13], dl
inc edx
cmp edx, 4
jb 0x140140e88
mov r8d, eax
mov byte [rbp - 0xf], 0
xor edx, edx
lea rcx, [rbp - 0x13]
call fcn.1403d6cb0
mov rdi, qword gs:[rax]
xor eax, eax
mov byte [rbp + 0x42], al
xor ecx, ecx
mov word [rbp + 0x40], 0x3731
movsxd rax, ecx
xor byte [rbp + rax + 0x40], cl
inc ecx
cmp ecx, 2
jb 0x140140eb9
lea rcx, [rbp + 0x40]
mov byte [rbp + 0x42], 0
call fcn.1403d6dc0
xor edx, edx
mov dword [rbp - 0x20], 0x417930
movsxd rcx, edx
xor byte [rbp + rcx - 0x20], dl
inc edx
cmp edx, 3
jb 0x140140edd
mov r8d, eax
mov byte [rbp - 0x1d], 0
xor edx, edx
lea rcx, [rbp - 0x20]
call fcn.1403d6cb0
mov ebx, eax
mov word [rbp + 0x48], 0x3731
xor eax, eax
mov byte [rbp + 0x4a], al
xor edx, edx
movsxd rcx, edx
xor byte [rbp + rcx + 0x48], dl
inc edx
cmp edx, 2
jb 0x140140f0c
lea rcx, [rbp + 0x48]
mov byte [rbp + 0x4a], al
call fcn.1403d6dc0
xor edx, edx
mov dword [rbp - 0x1c], 0x447930
movsxd rcx, edx
xor byte [rbp + rcx - 0x1c], dl
inc edx
cmp edx, 3
jb 0x140140f2f
mov r8d, eax
mov byte [rbp - 0x19], 0
xor edx, edx
lea rcx, [rbp - 0x1c]
call fcn.1403d6cb0
mov eax, eax
mov cl, bl
mov edx, edi
not rsi
shr rdx, cl
and rax, rdx
xor rax, rsi
xor rax, r14
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140140f70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x140548828]
mov word [rbp + 0x30], 0x3731
mov r14, qword [rax + 8]
xor eax, eax
mov byte [rbp + 0x32], al
xor ecx, ecx
movsxd rax, ecx
xor byte [rbp + rax + 0x30], cl
inc ecx
cmp ecx, 2
jb 0x140140f9a
lea rcx, [rbp + 0x30]
mov byte [rbp + 0x32], 0
call fcn.1403d6dc0
mov r8d, eax
mov dword [rbp - 0x18], 0x33347930
xor eax, eax
mov byte [rbp - 0x14], al
xor ecx, ecx
movsxd rax, ecx
xor byte [rbp + rax - 0x18], cl
inc ecx
cmp ecx, 4
jb 0x140140fc6
xor edx, edx
mov byte [rbp - 0x14], 0
lea rcx, [rbp - 0x18]
call fcn.1403d6cb0
mov rsi, qword gs:[rax]
xor eax, eax
mov byte [rbp + 0x3a], al
xor ecx, ecx
mov word [rbp + 0x38], 0x3731
movsxd rax, ecx
xor byte [rbp + rax + 0x38], cl
inc ecx
cmp ecx, 2
jb 0x140140ff4
lea rcx, [rbp + 0x38]
mov byte [rbp + 0x3a], 0
call fcn.1403d6dc0
xor ecx, ecx
mov dword [rbp - 0x13], 0x33347930
mov byte [rbp - 0xf], cl
xor edx, edx
movsxd rcx, edx
xor byte [rbp + rcx - 0x13], dl
inc edx
cmp edx, 4
jb 0x14014101d
mov r8d, eax
mov byte [rbp - 0xf], 0
xor edx, edx
lea rcx, [rbp - 0x13]
call fcn.1403d6cb0
mov rdi, qword gs:[rax]
xor eax, eax
mov byte [rbp + 0x42], al
xor ecx, ecx
mov word [rbp + 0x40], 0x3731
movsxd rax, ecx
xor byte [rbp + rax + 0x40], cl
inc ecx
cmp ecx, 2
jb 0x14014104e
lea rcx, [rbp + 0x40]
mov byte [rbp + 0x42], 0
call fcn.1403d6dc0
xor edx, edx
mov dword [rbp - 0x20], 0x417930
movsxd rcx, edx
xor byte [rbp + rcx - 0x20], dl
inc edx
cmp edx, 3
jb 0x140141072
mov r8d, eax
mov byte [rbp - 0x1d], 0
xor edx, edx
lea rcx, [rbp - 0x20]
call fcn.1403d6cb0
mov ebx, eax
mov word [rbp + 0x48], 0x3731
xor eax, eax
mov byte [rbp + 0x4a], al
xor edx, edx
movsxd rcx, edx
xor byte [rbp + rcx + 0x48], dl
inc edx
cmp edx, 2
jb 0x1401410a1
lea rcx, [rbp + 0x48]
mov byte [rbp + 0x4a], al
call fcn.1403d6dc0
xor edx, edx
mov dword [rbp - 0x1c], 0x447930
movsxd rcx, edx
xor byte [rbp + rcx - 0x1c], dl
inc edx
cmp edx, 3
jb 0x1401410c4
mov r8d, eax
mov byte [rbp - 0x19], 0
xor edx, edx
lea rcx, [rbp - 0x1c]
call fcn.1403d6cb0
mov eax, eax
mov cl, bl
mov edx, edi
not rsi
shr rdx, cl
and rax, rdx
xor rax, rsi
xor rax, r14
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140141104
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x140548828]
mov word [rbp + 0x30], 0x3731
mov r14, qword [rax + 0x18]
xor eax, eax
mov byte [rbp + 0x32], al
xor ecx, ecx
movsxd rax, ecx
xor byte [rbp + rax + 0x30], cl
inc ecx
cmp ecx, 2
jb 0x14014112e
lea rcx, [rbp + 0x30]
mov byte [rbp + 0x32], 0
call fcn.1403d6dc0
mov r8d, eax
mov dword [rbp - 0x18], 0x33347930
xor eax, eax
mov byte [rbp - 0x14], al
xor ecx, ecx
movsxd rax, ecx
xor byte [rbp + rax - 0x18], cl
inc ecx
cmp ecx, 4
jb 0x14014115a
xor edx, edx
mov byte [rbp - 0x14], 0
lea rcx, [rbp - 0x18]
call fcn.1403d6cb0
mov rsi, qword gs:[rax]
xor eax, eax
mov byte [rbp + 0x3a], al
xor ecx, ecx
mov word [rbp + 0x38], 0x3731
movsxd rax, ecx
xor byte [rbp + rax + 0x38], cl
inc ecx
cmp ecx, 2
jb 0x140141188
lea rcx, [rbp + 0x38]
mov byte [rbp + 0x3a], 0
call fcn.1403d6dc0
xor ecx, ecx
mov dword [rbp - 0x13], 0x33347930
mov byte [rbp - 0xf], cl
xor edx, edx
movsxd rcx, edx
xor byte [rbp + rcx - 0x13], dl
inc edx
cmp edx, 4
jb 0x1401411b1
mov r8d, eax
mov byte [rbp - 0xf], 0
xor edx, edx
lea rcx, [rbp - 0x13]
call fcn.1403d6cb0
mov rdi, qword gs:[rax]
xor eax, eax
mov byte [rbp + 0x42], al
xor ecx, ecx
mov word [rbp + 0x40], 0x3731
movsxd rax, ecx
xor byte [rbp + rax + 0x40], cl
inc ecx
cmp ecx, 2
jb 0x1401411e2
lea rcx, [rbp + 0x40]
mov byte [rbp + 0x42], 0
call fcn.1403d6dc0
xor edx, edx
mov dword [rbp - 0x20], 0x417930
movsxd rcx, edx
xor byte [rbp + rcx - 0x20], dl
inc edx
cmp edx, 3
jb 0x140141206
mov r8d, eax
mov byte [rbp - 0x1d], 0
xor edx, edx
lea rcx, [rbp - 0x20]
call fcn.1403d6cb0
mov ebx, eax
mov word [rbp + 0x48], 0x3731
xor eax, eax
mov byte [rbp + 0x4a], al
xor edx, edx
movsxd rcx, edx
xor byte [rbp + rcx + 0x48], dl
inc edx
cmp edx, 2
jb 0x140141235
lea rcx, [rbp + 0x48]
mov byte [rbp + 0x4a], al
call fcn.1403d6dc0
xor edx, edx
mov dword [rbp - 0x1c], 0x447930
movsxd rcx, edx
xor byte [rbp + rcx - 0x1c], dl
inc edx
cmp edx, 3
jb 0x140141258
mov r8d, eax
mov byte [rbp - 0x19], 0
xor edx, edx
lea rcx, [rbp - 0x1c]
call fcn.1403d6cb0
mov eax, eax
mov cl, bl
mov edx, edi
not rsi
shr rdx, cl
and rax, rdx
xor rax, rsi
xor rax, r14
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140141298
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x140548828]
mov word [rbp + 0x30], 0x3731
mov r14, qword [rax + 0x20]
xor eax, eax
mov byte [rbp + 0x32], al
xor ecx, ecx
movsxd rax, ecx
xor byte [rbp + rax + 0x30], cl
inc ecx
cmp ecx, 2
jb 0x1401412c2
lea rcx, [rbp + 0x30]
mov byte [rbp + 0x32], 0
call fcn.1403d6dc0
mov r8d, eax
mov dword [rbp - 0x18], 0x33347930
xor eax, eax
mov byte [rbp - 0x14], al
xor ecx, ecx
movsxd rax, ecx
xor byte [rbp + rax - 0x18], cl
inc ecx
cmp ecx, 4
jb 0x1401412ee
xor edx, edx
mov byte [rbp - 0x14], 0
lea rcx, [rbp - 0x18]
call fcn.1403d6cb0
mov rsi, qword gs:[rax]
xor eax, eax
mov byte [rbp + 0x3a], al
xor ecx, ecx
mov word [rbp + 0x38], 0x3731
movsxd rax, ecx
xor byte [rbp + rax + 0x38], cl
inc ecx
cmp ecx, 2
jb 0x14014131c
lea rcx, [rbp + 0x38]
mov byte [rbp + 0x3a], 0
call fcn.1403d6dc0
xor ecx, ecx
mov dword [rbp - 0x13], 0x33347930
mov byte [rbp - 0xf], cl
xor edx, edx
movsxd rcx, edx
xor byte [rbp + rcx - 0x13], dl
inc edx
cmp edx, 4
jb 0x140141345
mov r8d, eax
mov byte [rbp - 0xf], 0
xor edx, edx
lea rcx, [rbp - 0x13]
call fcn.1403d6cb0
mov rdi, qword gs:[rax]
xor eax, eax
mov byte [rbp + 0x42], al
xor ecx, ecx
mov word [rbp + 0x40], 0x3731
movsxd rax, ecx
xor byte [rbp + rax + 0x40], cl
inc ecx
cmp ecx, 2
jb 0x140141376
lea rcx, [rbp + 0x40]
mov byte [rbp + 0x42], 0
call fcn.1403d6dc0
xor edx, edx
mov dword [rbp - 0x20], 0x417930
movsxd rcx, edx
xor byte [rbp + rcx - 0x20], dl
inc edx
cmp edx, 3
jb 0x14014139a
mov r8d, eax
mov byte [rbp - 0x1d], 0
xor edx, edx
lea rcx, [rbp - 0x20]
call fcn.1403d6cb0
mov ebx, eax
mov word [rbp + 0x48], 0x3731
xor eax, eax
mov byte [rbp + 0x4a], al
xor edx, edx
movsxd rcx, edx
xor byte [rbp + rcx + 0x48], dl
inc edx
cmp edx, 2
jb 0x1401413c9
lea rcx, [rbp + 0x48]
mov byte [rbp + 0x4a], al
call fcn.1403d6dc0
xor edx, edx
mov dword [rbp - 0x1c], 0x447930
movsxd rcx, edx
xor byte [rbp + rcx - 0x1c], dl
inc edx
cmp edx, 3
jb 0x1401413ec
mov r8d, eax
mov byte [rbp - 0x19], 0
xor edx, edx
lea rcx, [rbp - 0x1c]
call fcn.1403d6cb0
mov eax, eax
mov cl, bl
mov edx, edi
not rsi
shr rdx, cl
and rax, rdx
xor rax, rsi
xor rax, r14
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14014142c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x140548828]
mov word [rbp + 0x30], 0x3731
mov r14, qword [rax + 0x28]
xor eax, eax
mov byte [rbp + 0x32], al
xor ecx, ecx
movsxd rax, ecx
xor byte [rbp + rax + 0x30], cl
inc ecx
cmp ecx, 2
jb 0x140141456
lea rcx, [rbp + 0x30]
mov byte [rbp + 0x32], 0
call fcn.1403d6dc0
mov r8d, eax
mov dword [rbp - 0x18], 0x33347930
xor eax, eax
mov byte [rbp - 0x14], al
xor ecx, ecx
movsxd rax, ecx
xor byte [rbp + rax - 0x18], cl
inc ecx
cmp ecx, 4
jb 0x140141482
xor edx, edx
mov byte [rbp - 0x14], 0
lea rcx, [rbp - 0x18]
call fcn.1403d6cb0
mov rsi, qword gs:[rax]
xor eax, eax
mov byte [rbp + 0x3a], al
xor ecx, ecx
mov word [rbp + 0x38], 0x3731
movsxd rax, ecx
xor byte [rbp + rax + 0x38], cl
inc ecx
cmp ecx, 2
jb 0x1401414b0
lea rcx, [rbp + 0x38]
mov byte [rbp + 0x3a], 0
call fcn.1403d6dc0
xor ecx, ecx
mov dword [rbp - 0x13], 0x33347930
mov byte [rbp - 0xf], cl
xor edx, edx
movsxd rcx, edx
xor byte [rbp + rcx - 0x13], dl
inc edx
cmp edx, 4
jb 0x1401414d9
mov r8d, eax
mov byte [rbp - 0xf], 0
xor edx, edx
lea rcx, [rbp - 0x13]
call fcn.1403d6cb0
mov rdi, qword gs:[rax]
xor eax, eax
mov byte [rbp + 0x42], al
xor ecx, ecx
mov word [rbp + 0x40], 0x3731
movsxd rax, ecx
xor byte [rbp + rax + 0x40], cl
inc ecx
cmp ecx, 2
jb 0x14014150a
lea rcx, [rbp + 0x40]
mov byte [rbp + 0x42], 0
call fcn.1403d6dc0
xor edx, edx
mov dword [rbp - 0x20], 0x417930
movsxd rcx, edx
xor byte [rbp + rcx - 0x20], dl
inc edx
cmp edx, 3
jb 0x14014152e
mov r8d, eax
mov byte [rbp - 0x1d], 0
xor edx, edx
lea rcx, [rbp - 0x20]
call fcn.1403d6cb0
mov ebx, eax
mov word [rbp + 0x48], 0x3731
xor eax, eax
mov byte [rbp + 0x4a], al
xor edx, edx
movsxd rcx, edx
xor byte [rbp + rcx + 0x48], dl
inc edx
cmp edx, 2
jb 0x14014155d
lea rcx, [rbp + 0x48]
mov byte [rbp + 0x4a], al
call fcn.1403d6dc0
xor edx, edx
mov dword [rbp - 0x1c], 0x447930
movsxd rcx, edx
xor byte [rbp + rcx - 0x1c], dl
inc edx
cmp edx, 3
jb 0x140141580
mov r8d, eax
mov byte [rbp - 0x19], 0
xor edx, edx
lea rcx, [rbp - 0x1c]
call fcn.1403d6cb0
mov eax, eax
mov cl, bl
mov edx, edi
not rsi
shr rdx, cl
and rax, rdx
xor rax, rsi
xor rax, r14
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1401415c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x140548828]
mov word [rbp + 0x30], 0x3731
mov r14, qword [rax + 0x10]
xor eax, eax
mov byte [rbp + 0x32], al
xor ecx, ecx
movsxd rax, ecx
xor byte [rbp + rax + 0x30], cl
inc ecx
cmp ecx, 2
jb 0x1401415ea
lea rcx, [rbp + 0x30]
mov byte [rbp + 0x32], 0
call fcn.1403d6dc0
mov r8d, eax
mov dword [rbp - 0x18], 0x33347930
xor eax, eax
mov byte [rbp - 0x14], al
xor ecx, ecx
movsxd rax, ecx
xor byte [rbp + rax - 0x18], cl
inc ecx
cmp ecx, 4
jb 0x140141616
xor edx, edx
mov byte [rbp - 0x14], 0
lea rcx, [rbp - 0x18]
call fcn.1403d6cb0
mov rsi, qword gs:[rax]
xor eax, eax
mov byte [rbp + 0x3a], al
xor ecx, ecx
mov word [rbp + 0x38], 0x3731
movsxd rax, ecx
xor byte [rbp + rax + 0x38], cl
inc ecx
cmp ecx, 2
jb 0x140141644
lea rcx, [rbp + 0x38]
mov byte [rbp + 0x3a], 0
call fcn.1403d6dc0
xor ecx, ecx
mov dword [rbp - 0x13], 0x33347930
mov byte [rbp - 0xf], cl
xor edx, edx
movsxd rcx, edx
xor byte [rbp + rcx - 0x13], dl
inc edx
cmp edx, 4
jb 0x14014166d
mov r8d, eax
mov byte [rbp - 0xf], 0
xor edx, edx
lea rcx, [rbp - 0x13]
call fcn.1403d6cb0
mov rdi, qword gs:[rax]
xor eax, eax
mov byte [rbp + 0x42], al
xor ecx, ecx
mov word [rbp + 0x40], 0x3731
movsxd rax, ecx
xor byte [rbp + rax + 0x40], cl
inc ecx
cmp ecx, 2
jb 0x14014169e
lea rcx, [rbp + 0x40]
mov byte [rbp + 0x42], 0
call fcn.1403d6dc0
xor edx, edx
mov dword [rbp - 0x20], 0x417930
movsxd rcx, edx
xor byte [rbp + rcx - 0x20], dl
inc edx
cmp edx, 3
jb 0x1401416c2
mov r8d, eax
mov byte [rbp - 0x1d], 0
xor edx, edx
lea rcx, [rbp - 0x20]
call fcn.1403d6cb0
mov ebx, eax
mov word [rbp + 0x48], 0x3731
xor eax, eax
mov byte [rbp + 0x4a], al
xor edx, edx
movsxd rcx, edx
xor byte [rbp + rcx + 0x48], dl
inc edx
cmp edx, 2
jb 0x1401416f1
lea rcx, [rbp + 0x48]
mov byte [rbp + 0x4a], al
call fcn.1403d6dc0
xor edx, edx
mov dword [rbp - 0x1c], 0x447930
movsxd rcx, edx
xor byte [rbp + rcx - 0x1c], dl
inc edx
cmp edx, 3
jb 0x140141714
mov r8d, eax
mov byte [rbp - 0x19], 0
xor edx, edx
lea rcx, [rbp - 0x1c]
call fcn.1403d6cb0
mov eax, eax
mov cl, bl
mov edx, edi
not rsi
shr rdx, cl
and rax, rdx
xor rax, rsi
xor rax, r14
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140141754
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x140548828]
mov word [rbp + 0x30], 0x3731
mov r14, qword [rax + 0x38]
xor eax, eax
mov byte [rbp + 0x32], al
xor ecx, ecx
movsxd rax, ecx
xor byte [rbp + rax + 0x30], cl
inc ecx
cmp ecx, 2
jb 0x14014177e
lea rcx, [rbp + 0x30]
mov byte [rbp + 0x32], 0
call fcn.1403d6dc0
mov r8d, eax
mov dword [rbp - 0x18], 0x33347930
xor eax, eax
mov byte [rbp - 0x14], al
xor ecx, ecx
movsxd rax, ecx
xor byte [rbp + rax - 0x18], cl
inc ecx
cmp ecx, 4
jb 0x1401417aa
xor edx, edx
mov byte [rbp - 0x14], 0
lea rcx, [rbp - 0x18]
call fcn.1403d6cb0
mov rsi, qword gs:[rax]
xor eax, eax
mov byte [rbp + 0x3a], al
xor ecx, ecx
mov word [rbp + 0x38], 0x3731
movsxd rax, ecx
xor byte [rbp + rax + 0x38], cl
inc ecx
cmp ecx, 2
jb 0x1401417d8
lea rcx, [rbp + 0x38]
mov byte [rbp + 0x3a], 0
call fcn.1403d6dc0
xor ecx, ecx
mov dword [rbp - 0x13], 0x33347930
mov byte [rbp - 0xf], cl
xor edx, edx
movsxd rcx, edx
xor byte [rbp + rcx - 0x13], dl
inc edx
cmp edx, 4
jb 0x140141801
mov r8d, eax
mov byte [rbp - 0xf], 0
xor edx, edx
lea rcx, [rbp - 0x13]
call fcn.1403d6cb0
mov rdi, qword gs:[rax]
xor eax, eax
mov byte [rbp + 0x42], al
xor ecx, ecx
mov word [rbp + 0x40], 0x3731
movsxd rax, ecx
xor byte [rbp + rax + 0x40], cl
inc ecx
cmp ecx, 2
jb 0x140141832
lea rcx, [rbp + 0x40]
mov byte [rbp + 0x42], 0
call fcn.1403d6dc0
xor edx, edx
mov dword [rbp - 0x20], 0x417930
movsxd rcx, edx
xor byte [rbp + rcx - 0x20], dl
inc edx
cmp edx, 3
jb 0x140141856
mov r8d, eax
mov byte [rbp - 0x1d], 0
xor edx, edx
lea rcx, [rbp - 0x20]
call fcn.1403d6cb0
mov ebx, eax
mov word [rbp + 0x48], 0x3731
xor eax, eax
mov byte [rbp + 0x4a], al
xor edx, edx
movsxd rcx, edx
xor byte [rbp + rcx + 0x48], dl
inc edx
cmp edx, 2
jb 0x140141885
lea rcx, [rbp + 0x48]
mov byte [rbp + 0x4a], al
call fcn.1403d6dc0
xor edx, edx
mov dword [rbp - 0x1c], 0x447930
movsxd rcx, edx
xor byte [rbp + rcx - 0x1c], dl
inc edx
cmp edx, 3
jb 0x1401418a8
mov r8d, eax
mov byte [rbp - 0x19], 0
xor edx, edx
lea rcx, [rbp - 0x1c]
call fcn.1403d6cb0
mov eax, eax
mov cl, bl
mov edx, edi
not rsi
shr rdx, cl
and rax, rdx
xor rax, rsi
xor rax, r14
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret