joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140043980
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
push rsi
push rdi
push r14
sub rsp, 0x80
mov qword [r11 - 0x40], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov rbx, r9
mov rdi, r8
mov rsi, rdx
mov r14, rcx
xor ebp, ebp
mov qword [r11 - 0x38], rbp
mov dword [rsp + 0x68], ebp
mov qword [r11 - 0x28], rbp
mov qword [r11 - 0x48], rbp
lea rax, [r11 + 0x18]
mov qword [r11 - 0x58], rax
lea rax, [r11 - 0x48]
mov qword [r11 - 0x60], rax
mov qword [r11 - 0x68], rbp
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], 0x100
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rdi]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140043a06
mov dword [rsp + 0x68], ebp
mov rbx, qword [rsp + 0x50]
mov qword [rsp + 0x60], rbx
jmp 0x140043a30
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], ebp
mov r8, qword [rdi]
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14001a4b0
mov rbx, qword [rsp + 0x60]
test eax, eax
je 0x140043a30
xor dil, dil
jmp 0x140043aa2
mov rcx, qword [rsi]
mov eax, ebp
test rcx, rcx
setne al
test eax, eax
jne 0x140043a44
lea edi, [rax + 0xd]
jmp 0x140043a82
or rax, 0xffffffffffffffff
nop dword [rax + rax]
lea rax, [rax + 1]
cmp word [rcx + rax*2], 0
jne 0x140043a50
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rdx, qword [r14]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test rbx, rbx
je 0x140043a98
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, rbp
mov qword [rsp + 0x60], rbx
mov dword [rsp + 0x68], ebp
test edi, edi
sete dil
test rbx, rbx
je 0x140043ab5
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x60], rbp
movzx eax, dil
mov dword [rsp + 0x68], ebp
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140043ae0
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
push rsi
push rdi
push r14
sub rsp, 0x80
mov qword [r11 - 0x40], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov rbx, r9
mov rdi, r8
mov rsi, rdx
mov r14, rcx
xor ebp, ebp
mov qword [r11 - 0x38], rbp
mov dword [rsp + 0x68], ebp
mov qword [r11 - 0x28], rbp
mov qword [r11 - 0x48], rbp
lea rax, [r11 + 0x18]
mov qword [r11 - 0x58], rax
lea rax, [r11 - 0x48]
mov qword [r11 - 0x60], rax
mov qword [r11 - 0x68], rbp
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], 0x100
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rdi]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140043b66
mov dword [rsp + 0x68], ebp
mov rbx, qword [rsp + 0x50]
mov qword [rsp + 0x60], rbx
jmp 0x140043b90
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], ebp
mov r8, qword [rdi]
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14001a4b0
mov rbx, qword [rsp + 0x60]
test eax, eax
je 0x140043b90
xor dil, dil
jmp 0x140043be5
mov eax, dword [rsi]
mov dword [rsp + 0xb0], eax
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, qword [r14]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test rbx, rbx
je 0x140043bdb
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, rbp
mov qword [rsp + 0x60], rbx
mov dword [rsp + 0x68], ebp
test edi, edi
sete dil
test rbx, rbx
je 0x140043bf8
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x60], rbp
movzx eax, dil
mov dword [rsp + 0x68], ebp
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140043c20
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rdi
push r14
push r15
sub rsp, 0x60
mov qword [r11 - 0x40], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
mov r10, r9
mov rax, r8
mov rdi, rdx
mov r14, rcx
xor r15d, r15d
mov ebx, r15d
mov qword [r11 - 0x38], rbx
mov dword [r11 - 0x30], r15d
mov qword [r11 - 0x28], r15
mov qword [r11 + 0x18], r15
lea rcx, [r11 + 0x18]
mov qword [r11 - 0x58], rcx
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, r10
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140043dcb
mov dword [rsp + 0x48], r15d
mov rbx, qword [rsp + 0x90]
mov qword [rsp + 0x40], rbx
mov rax, qword [r14]
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, 0x800
or eax, ecx
jge 0x140043cbd
mov edx, 0x800
mov rcx, r14
call fcn.140002330
mov rsi, qword [r14]
cmp dword [rsi - 0xc], 0x800
jge 0x140043cd4
mov ecx, 0x80070057
call fcn.140001930
int3
mov dword [rsi - 0x10], 0x800
mov rax, qword [r14]
mov word [rax + 0x1000], r15w
mov dword [rsp + 0x90], 0x1000
mov ebp, r15d
lea rax, [rsp + 0x90]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, qword [rdi]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x140043d65
mov eax, dword [rsp + 0x30]
dec eax
cmp eax, 1
jbe 0x140043d32
mov edi, 0xd
jmp 0x140043d65
mov ecx, dword [rsp + 0x90]
test rsi, rsi
je 0x140043d5e
test ecx, ecx
je 0x140043d5a
test cl, 1
jne 0x140043d53
mov eax, ecx
shr rax, 1
cmp word [rsi + rax*2 - 2], bp
je 0x140043d5e
mov edi, 0xd
jmp 0x140043d65
mov word [rsi], r15w
mov ebp, ecx
shr ebp, 1
mov edi, r15d
lea eax, [rbp - 1]
cmp eax, 0xffffffff
jne 0x140043d83
mov rcx, qword [r14]
test rcx, rcx
jne 0x140043d7a
mov eax, r15d
jmp 0x140043d87
movsxd rdx, dword [rcx - 0xc]
call fcn.1400c44a0
test eax, eax
js 0x140043dc0
mov rcx, qword [r14]
cmp eax, dword [rcx - 0xc]
jg 0x140043dc0
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [r14]
mov word [rax + rcx*2], r15w
test rbx, rbx
je 0x140043db3
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, r15
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x48], r15d
test edi, edi
sete dil
jmp 0x140043dce
mov ecx, 0x80070057
call fcn.140001930
int3
xor dil, dil
test rbx, rbx
je 0x140043de1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x48], r15d
movzx eax, dil
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140043e10
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x60
mov qword [r11 - 0x30], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
mov r10, r9
mov rax, r8
mov rdi, rdx
mov rsi, rcx
xor ebp, ebp
mov ebx, ebp
mov qword [r11 - 0x28], rbx
mov dword [rsp + 0x48], ebp
mov qword [r11 - 0x18], rbp
mov qword [r11 + 0x18], rbp
lea rcx, [r11 + 0x18]
mov qword [r11 - 0x48], rcx
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, r10
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140043ee6
mov dword [rsp + 0x48], ebp
mov rbx, qword [rsp + 0x80]
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x80], 4
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, qword [rdi]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x140043ec4
mov edi, ebp
mov eax, 0xd
cmp dword [rsp + 0x30], 4
cmovne edi, eax
test rbx, rbx
je 0x140043eda
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, rbp
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x48], ebp
test edi, edi
sete dil
jmp 0x140043ee9
xor dil, dil
test rbx, rbx
je 0x140043efc
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rbp
movzx eax, dil
mov dword [rsp + 0x48], ebp
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
ret
Function at 0x140048730
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov rbx, rcx
xor edi, edi
mov dword [rsp + 0x30], edi
call qword [sym.imp.KERNEL32.dll_GetVersion]
movzx esi, al
movzx edx, ax
shr dx, 8
movzx ebp, dl
cmp eax, 0x80000000
jae 0x140048772
mov edi, eax
shr edi, 0x10
cmp esi, 6
jb 0x14004878f
cmp ebp, 2
jb 0x14004878f
mov rcx, rbx
call fcn.140048da0
nop
mov dword [rsp + 0x30], 1
jmp 0x1400487f6
lea rcx, [0x1401a19a8]
mov rax, qword [0x1401a19a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x20], edi
mov r9d, ebp
mov r8d, esi
lea rdx, str._d._d___d_
lea rcx, [rsp + 0x68]
call fcn.1400111b0
mov rdi, qword [rsp + 0x68]
lea rcx, [rdi - 0x18]
call fcn.140002390
add rax, 0x18
mov qword [rbx], rax
mov dword [rsp + 0x30], 1
lock add dword [rdi - 8], 0xffffffff
jg 0x1400487f6
mov rcx, qword [rdi - 0x18]
mov rax, qword [rcx]
lea rdx, [rdi - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, rbx
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x14004a3a0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1401a1e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp byte [0x1401aa906], 0
lea rax, [0x1401a5b08]
jne 0x14004a44f
mov dword [rbp - 0x40], 0xd0016
xor ecx, ecx
mov dword [rbp - 0x3c], 0x190000
mov dword [rbp - 0x38], 0x170010
mov dword [rbp - 0x34], 0x180031
mov dword [rbp - 0x30], 0x350004
mov dword [rbp - 0x2c], 0x10000e
mov dword [rbp - 0x28], 0x10000c
mov dword [rbp - 0x24], 0x100006
mov dword [rbp - 0x20], 0x150037
mov dword [rbp - 0x1c], 0xd0003
mov dword [rbp - 0x18], 0x50003
mov dword [rbp - 0x14], 0x14
lea r8, [0x1401a4d90]
nop dword [rax + rax]
movzx edx, byte [rcx + r8]
inc rcx
xor dx, word [rbp + rcx*2 - 0x42]
mov word [rax + rcx*2 - 2], dx
cmp rcx, 0x17
jl 0x14004a430
mov byte [0x1401aa906], 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400c3970
add rsp, 0x40
pop rbp
ret

Function at 0x14004a4f0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1401a1e90]
xor rax, rsp
mov qword [rbp - 8], rax
mov r8d, dword [0x1401a9d80]
lea eax, [r8 + 1]
lea ecx, [r8 + 2]
imul ecx, eax
mov eax, 0x38e38e39
imul ecx, r8d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 9
jne 0x14004a54d
mov eax, 1
test r8d, r8d
cmove r8d, eax
mov dword [0x1401a9d80], r8d
cmp byte [0x1401aa925], 0
lea rax, [0x1401a5608]
jne 0x14004a607
xor ecx, ecx
mov dword [rbp - 0x40], 0x1a001e
mov dword [rbp - 0x3c], 0x2a0019
mov dword [rbp - 0x38], 0x1d0000
mov dword [rbp - 0x34], 0x14000b
mov dword [rbp - 0x30], 0xf001b
mov word [rbp - 0xc], cx
mov dword [rbp - 0x2c], 0x16000e
mov dword [rbp - 0x28], 0x15000c
mov dword [rbp - 0x24], 0x7002d
mov dword [rbp - 0x20], 0xf000d
mov dword [rbp - 0x1c], 0x170005
mov dword [rbp - 0x18], 0x350002
mov dword [rbp - 0x14], 0xc000b
mov dword [rbp - 0x10], 0x40018
lea r9, [0x1401a4d91]
nop dword [rax]
movzx edx, byte [rcx + r9 - 1]
movzx r8d, word [rbp + rcx*2 - 0x3e]
add rcx, 2
xor dx, word [rbp + rcx*2 - 0x44]
mov word [rax + rcx*2 - 4], dx
movzx edx, byte [rcx + r9 - 2]
xor r8w, dx
mov word [rax + rcx*2 - 2], r8w
cmp rcx, 0x1a
jl 0x14004a5d0
mov byte [0x1401aa925], 1
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400c3970
add rsp, 0x40
pop rbp
ret
Function at 0x14004a620
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1401a1e90]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [0x1401aa91a], 0
je 0x14004a655
lea rax, [0x1401a5718]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400c3970
add rsp, 0x38
ret
mov ecx, dword [0x1401a9d80]
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
imul r8d, eax
mov eax, 0x6bca1af3
imul r8d, ecx
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x13
sub r8d, edx
cmp r8d, 0xc
jne 0x14004a68e
dec dword [0x1401aa63c]
xor r9d, r9d
mov dword [rsp], 0x40013
mov dword [rsp + 4], 0xd002c
mov dword [rsp + 8], 0x7001c
mov dword [rsp + 0xc], 0x3002d
mov dword [rsp + 0x10], 0xf000f
mov word [rsp + 0x20], r9w
mov dword [rsp + 0x14], 0x1004b
mov dword [rsp + 0x18], 0x150006
mov dword [rsp + 0x1c], 0x480017
lea r8, [0x1401a5718]
lea r10, [0x1401a4d91]
nop word [rax + rax]
movzx eax, byte [r9 + r10 - 1]
movzx edx, word [rsp + r9*2 + 2]
add r9, 4
xor ax, word [rsp + r9*2 - 8]
mov word [r8 + r9*2 - 8], ax
movzx eax, byte [r9 + r10 - 4]
xor dx, ax
movzx eax, byte [r9 + r10 - 3]
xor ax, word [rsp + r9*2 - 4]
mov word [r8 + r9*2 - 6], dx
mov word [r8 + r9*2 - 4], ax
movzx eax, byte [r9 + r10 - 2]
xor ax, word [rsp + r9*2 - 2]
mov word [r8 + r9*2 - 2], ax
cmp r9, 0x10
jl 0x14004a6f0
imul ecx, ecx
and ecx, 0x8000000f
jge 0x14004a757
dec ecx
or ecx, 0xfffffff0
inc ecx
mov edx, dword [0x1401aa720]
mov eax, 0x7a65390c
cmp ecx, 0xa
cmove edx, eax
mov byte [0x1401aa91a], 1
mov rax, r8
mov dword [0x1401aa720], edx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400c3970
add rsp, 0x38
ret

Function at 0x14004abc0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1401a1e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp byte [0x1401aa905], 0
lea rax, [0x1401a5530]
jne 0x14004ac7f
mov dword [rbp - 0x50], 0x80031
mov dword [rbp - 0x4c], 3
xor ecx, ecx
mov dword [rbp - 0x48], 0x70006
mov dword [rbp - 0x44], 0x3003a
mov dword [rbp - 0x40], 0xf0000
mov dword [rbp - 0x3c], 0x320003
mov dword [rbp - 0x38], 0x18001b
mov dword [rbp - 0x34], 0x1c0004
mov dword [rbp - 0x30], 0x70004
mov dword [rbp - 0x2c], 0x6000d
mov dword [rbp - 0x28], 0x4a0014
mov dword [rbp - 0x24], 0xc0005
mov dword [rbp - 0x20], 0x1c001d
mov dword [rbp - 0x1c], 0xa0016
mov dword [rbp - 0x18], 0x4f
lea r8, [0x1401a4d90]
nop dword [rax]
movzx edx, byte [rcx + r8]
inc rcx
xor dx, word [rbp + rcx*2 - 0x52]
mov word [rax + rcx*2 - 2], dx
cmp rcx, 0x1d
jl 0x14004ac60
mov byte [0x1401aa905], 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400c3970
add rsp, 0x50
pop rbp
ret
Function at 0x14004aca0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1401a1e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp byte [0x1401aa914], 0
lea rax, [0x1401a57b8]
jne 0x14004ad67
xor ecx, ecx
mov dword [rbp - 0x40], 0x11
mov dword [rbp - 0x3c], 0x550005
mov dword [rbp - 0x38], 0x3f0031
mov dword [rbp - 0x34], 0x1f0022
mov dword [rbp - 0x30], 0xe004b
mov word [rbp - 0x14], cx
mov dword [rbp - 0x2c], 0x70002
mov dword [rbp - 0x28], 0x1f001a
mov dword [rbp - 0x24], 0x550006
mov dword [rbp - 0x20], 0x1a000d
mov dword [rbp - 0x1c], 0x100003
mov dword [rbp - 0x18], 0x440013
lea r9, [0x1401a4d91]
nop word [rax + rax]
movzx edx, byte [rcx + r9 - 1]
movzx r8d, word [rbp + rcx*2 - 0x3e]
add rcx, 2
xor dx, word [rbp + rcx*2 - 0x44]
mov word [rax + rcx*2 - 4], dx
movzx edx, byte [rcx + r9 - 2]
xor r8w, dx
mov word [rax + rcx*2 - 2], r8w
cmp rcx, 0x16
jl 0x14004ad30
mov byte [0x1401aa914], 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400c3970
add rsp, 0x40
pop rbp
ret

Function at 0x14004af30
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1401a1e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp byte [0x1401aa8fd], 0
lea rax, [0x1401a5350]
jne 0x14004afff
mov dword [rbp - 0x50], 0x90037
mov dword [rbp - 0x4c], 0x25001d
mov dword [rbp - 0x48], 0x1c0007
mov dword [rbp - 0x44], 0x2d000d
mov dword [rbp - 0x40], 0xe000f
mov dword [rbp - 0x3c], 0x7001f
mov dword [rbp - 0x38], 0x2001a
mov dword [rbp - 0x34], 0x1a0052
mov dword [rbp - 0x30], 0x42000e
mov dword [rbp - 0x2c], 0xc0026
mov dword [rbp - 0x28], 0xe0006
mov dword [rbp - 0x24], 0x4002f
mov dword [rbp - 0x20], 0x20016
mov dword [rbp - 0x1c], 0x1c0012
mov dword [rbp - 0x18], 0x4f0016
mov dword [rbp - 0x14], 0x4e
xor ecx, ecx
lea r8, [0x1401a4d90]
nop word [rax + rax]
movzx edx, byte [rcx + r8]
inc rcx
xor dx, word [rbp + rcx*2 - 0x52]
mov word [rax + rcx*2 - 2], dx
cmp rcx, 0x1f
jl 0x14004afe0
mov byte [0x1401aa8fd], 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400c3970
add rsp, 0x50
pop rbp
ret

Function at 0x14004b020
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1401a1e90]
xor rax, rsp
mov qword [rsp + 0x18], rax
cmp byte [0x1401aa917], 0
lea rax, [0x1401a5c08]
jne 0x14004b09f
mov dword [rsp], 0x2005d
mov dword [rsp + 4], 0x30006
mov dword [rsp + 8], 0x450014
mov dword [rsp + 0xc], 0x42005a
mov dword [rsp + 0x10], 0x6000f
mov dword [rsp + 0x14], 1
xor ecx, ecx
lea r8, [0x1401a4d90]
nop dword [rax + rax]
movzx edx, byte [rcx + r8]
inc rcx
xor dx, word [rsp + rcx*2 - 2]
mov word [rax + rcx*2 - 2], dx
cmp rcx, 0xb
jl 0x14004b080
mov byte [0x1401aa917], 1
mov rcx, qword [rsp + 0x18]
xor rcx, rsp
call fcn.1400c3970
add rsp, 0x28
ret
Function at 0x14004b0c0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1401a1e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp byte [0x1401aa927], 0
lea rax, [0x1401a5740]
jne 0x14004b1cc
xor r8d, r8d
mov dword [rbp - 0x60], 0x11
mov dword [rbp - 0x5c], 0x1a0005
mov dword [rbp - 0x58], 0x530016
mov dword [rbp - 0x54], 0xd0008
mov dword [rbp - 0x50], 0x60002
mov word [rbp - 0x20], r8w
mov dword [rbp - 0x4c], 0x60008
mov dword [rbp - 0x48], 0x10049
mov dword [rbp - 0x44], 0x1a0000
mov dword [rbp - 0x40], 0x42000b
mov dword [rbp - 0x3c], 0x100003
mov dword [rbp - 0x38], 0x1e0047
mov dword [rbp - 0x34], 0x1f0006
mov dword [rbp - 0x30], 0x190019
mov dword [rbp - 0x2c], 0xf001d
mov dword [rbp - 0x28], 0x1c001b
mov dword [rbp - 0x24], 0x40000
lea r9, [0x1401a4d91]
nop word [rax + rax]
movzx ecx, byte [r8 + r9 - 1]
movzx edx, word [rbp + r8*2 - 0x5e]
add r8, 4
xor cx, word [rbp + r8*2 - 0x68]
mov word [rax + r8*2 - 8], cx
movzx ecx, byte [r8 + r9 - 4]
xor dx, cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rbp + r8*2 - 0x64]
mov word [rax + r8*2 - 6], dx
mov word [rax + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rbp + r8*2 - 0x62]
mov word [rax + r8*2 - 2], cx
cmp r8, 0x20
jl 0x14004b170
mov byte [0x1401aa927], 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400c3970
add rsp, 0x60
pop rbp
ret

Function at 0x14004b1e0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [0x1401a1e90]
xor rax, rsp
mov qword [rbp - 8], rax
cmp byte [0x1401aa929], 0
lea rax, [0x1401a5658]
jne 0x14004b2e0
xor r8d, r8d
mov dword [rbp - 0x30], 0x40013
mov dword [rbp - 0x2c], 0x30036
mov dword [rbp - 0x28], 0x10010
mov dword [rbp - 0x24], 0x5001d
mov dword [rbp - 0x20], 0x40004
mov word [rbp - 0xc], r8w
mov dword [rbp - 0x1c], 0x10032
mov dword [rbp - 0x18], 0x100001
mov dword [rbp - 0x14], 0x12001c
mov dword [rbp - 0x10], 0x3d000d
lea r9, [0x1401a4d91]
nop dword [rax]
movzx ecx, byte [r8 + r9 - 1]
movzx edx, word [rbp + r8*2 - 0x2e]
add r8, 6
xor cx, word [rbp + r8*2 - 0x3c]
mov word [rax + r8*2 - 0xc], cx
movzx ecx, byte [r8 + r9 - 6]
xor dx, cx
movzx ecx, byte [r8 + r9 - 5]
xor cx, word [rbp + r8*2 - 0x38]
mov word [rax + r8*2 - 0xa], dx
mov word [rax + r8*2 - 8], cx
movzx ecx, byte [r8 + r9 - 4]
xor cx, word [rbp + r8*2 - 0x36]
mov word [rax + r8*2 - 6], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rbp + r8*2 - 0x34]
mov word [rax + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rbp + r8*2 - 0x32]
mov word [rax + r8*2 - 2], cx
cmp r8, 0x12
jl 0x14004b260
mov byte [0x1401aa929], 1
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400c3970
add rsp, 0x30
pop rbp
ret
Function at 0x14004b300
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1401a1e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp byte [0x1401aa90b], 0
lea rax, [0x1401a5500]
jne 0x14004b3af
mov dword [rbp - 0x40], 0xd0013
mov dword [rbp - 0x3c], 0x10007
mov dword [rbp - 0x38], 0x150055
mov dword [rbp - 0x34], 0x20007
mov dword [rbp - 0x30], 0x4a000f
mov dword [rbp - 0x2c], 0x17000e
mov dword [rbp - 0x28], 0x3001b
mov dword [rbp - 0x24], 0x1b0017
mov dword [rbp - 0x20], 0x2f001c
mov dword [rbp - 0x1c], 0x70005
mov dword [rbp - 0x18], 0x60012
mov dword [rbp - 0x14], 6
xor ecx, ecx
lea r8, [0x1401a4d90]
nop dword [rax + rax]
movzx edx, byte [rcx + r8]
inc rcx
xor dx, word [rbp + rcx*2 - 0x42]
mov word [rax + rcx*2 - 2], dx
cmp rcx, 0x17
jl 0x14004b390
mov byte [0x1401aa90b], 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400c3970
add rsp, 0x40
pop rbp
ret

Function at 0x14004b3d0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1401a1e90]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [0x1401aa8f9], 0
lea rax, [0x1401a5b78]
jne 0x14004b4ac
xor r8d, r8d
mov dword [rsp], 0x1a001e
mov dword [rsp + 4], 0x2a0019
mov dword [rsp + 8], 0x3001c
mov dword [rsp + 0xc], 0x33000d
mov dword [rsp + 0x10], 0x3001f
mov word [rsp + 0x20], r8w
mov dword [rsp + 0x14], 0x70000
mov dword [rsp + 0x18], 0x1e000d
mov dword [rsp + 0x1c], 0x10007
lea r9, [0x1401a4d91]
nop word [rax + rax]
movzx ecx, byte [r8 + r9 - 1]
movzx edx, word [rsp + r8*2 + 2]
add r8, 4
xor cx, word [rsp + r8*2 - 8]
mov word [rax + r8*2 - 8], cx
movzx ecx, byte [r8 + r9 - 4]
xor dx, cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rsp + r8*2 - 4]
mov word [rax + r8*2 - 6], dx
mov word [rax + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rsp + r8*2 - 2]
mov word [rax + r8*2 - 2], cx
cmp r8, 0x10
jl 0x14004b450
mov byte [0x1401aa8f9], 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400c3970
add rsp, 0x38
ret
Function at 0x14004b4c0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1401a1e90]
xor rax, rsp
mov qword [rbp - 8], rax
cmp byte [0x1401aa8fc], 0
lea rax, [0x1401a59b8]
jne 0x14004b5d0
xor r8d, r8d
mov dword [rbp - 0x40], 0x1c003f
mov dword [rbp - 0x3c], 0x1b000c
mov dword [rbp - 0x38], 0x10025
mov dword [rbp - 0x34], 0xf0001
mov dword [rbp - 0x30], 0x19000e
mov word [rbp - 0x10], r8w
mov dword [rbp - 0x2c], 0x36001e
mov dword [rbp - 0x28], 0x1a0006
mov dword [rbp - 0x24], 0x1b0017
mov dword [rbp - 0x20], 0x40048
mov dword [rbp - 0x1c], 0xa000b
mov dword [rbp - 0x18], 0xf000b
mov dword [rbp - 0x14], 0x4d0007
lea r9, [0x1401a4d91]
nop
movzx ecx, byte [r8 + r9 - 1]
movzx edx, word [rbp + r8*2 - 0x3e]
add r8, 6
xor cx, word [rbp + r8*2 - 0x4c]
mov word [rax + r8*2 - 0xc], cx
movzx ecx, byte [r8 + r9 - 6]
xor dx, cx
movzx ecx, byte [r8 + r9 - 5]
xor cx, word [rbp + r8*2 - 0x48]
mov word [rax + r8*2 - 0xa], dx
mov word [rax + r8*2 - 8], cx
movzx ecx, byte [r8 + r9 - 4]
xor cx, word [rbp + r8*2 - 0x46]
mov word [rax + r8*2 - 6], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rbp + r8*2 - 0x44]
mov word [rax + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rbp + r8*2 - 0x42]
mov word [rax + r8*2 - 2], cx
cmp r8, 0x18
jl 0x14004b550
mov byte [0x1401aa8fc], 1
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400c3970
add rsp, 0x40
pop rbp
ret

Function at 0x14004b5f0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1401a1e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp byte [0x1401aa8fe], 0
lea rax, [0x1401a5818]
jne 0x14004b6de
xor r8d, r8d
mov dword [rbp - 0x40], 0x1e0033
mov dword [rbp - 0x3c], 0x14000c
mov dword [rbp - 0x38], 0x160001
mov dword [rbp - 0x34], 0x9003c
mov dword [rbp - 0x30], 0x50006
mov word [rbp - 0x18], r8w
mov dword [rbp - 0x2c], 0x70019
mov dword [rbp - 0x28], 0x19003d
mov dword [rbp - 0x24], 0x100000
mov dword [rbp - 0x20], 0x60009
mov dword [rbp - 0x1c], 0x430050
lea r9, [0x1401a4d91]
movzx ecx, byte [r8 + r9 - 1]
movzx edx, word [rbp + r8*2 - 0x3e]
add r8, 5
xor cx, word [rbp + r8*2 - 0x4a]
mov word [rax + r8*2 - 0xa], cx
movzx ecx, byte [r8 + r9 - 5]
xor dx, cx
movzx ecx, byte [r8 + r9 - 4]
xor cx, word [rbp + r8*2 - 0x46]
mov word [rax + r8*2 - 8], dx
mov word [rax + r8*2 - 6], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rbp + r8*2 - 0x44]
mov word [rax + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rbp + r8*2 - 0x42]
mov word [rax + r8*2 - 2], cx
cmp r8, 0x14
jl 0x14004b670
mov byte [0x1401aa8fe], 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400c3970
add rsp, 0x40
pop rbp
ret