joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140019d10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r11, rsp
push rbp
push r13
push r14
sub rsp, 0xb0
xor eax, eax
movsxd r13, r9d
mov dword [rsp + 0xe8], eax
mov r14, rdx
mov qword [rsp + 0x60], r13
mov rbp, rcx
test r9d, r9d
jle 0x140019f5e
mov qword [r11 + 8], rbx
lea rbx, [r8 + 0x20]
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
mov qword [r11 - 0x20], r12
xor r12d, r12d
mov qword [r11 - 0x28], r15
movaps xmmword [r11 - 0x38], xmm6
movaps xmmword [r11 - 0x48], xmm7
xorps xmm7, xmm7
movaps xmmword [r11 - 0x58], xmm8
mov r11d, 0x100
movss xmm8, dword [0x140059fc0]
nop dword [rax + rax]
movss xmm6, dword [rbx - 0x20]
comiss xmm6, xmm7
jbe 0x140019dcc
movsxd r10, dword [r14 + 0x24]
mov r9, qword [r14 + 8]
movsx ecx, r11w
movzx eax, byte [r10 + r9 + 7]
movzx edx, byte [r10 + r9 + 6]
imul edx, ecx
movsx ecx, r11w
add dx, ax
movzx eax, byte [r10 + r9 + 5]
movsx r8d, dx
movzx edx, byte [r10 + r9 + 4]
imul edx, ecx
add ax, dx
cwde
sub eax, r8d
movd xmm0, eax
jmp 0x140019deb
movsxd rdx, dword [r14 + 0x1c]
xorps xmm6, xmm8
mov rax, qword [r14 + 8]
movzx ecx, byte [rdx + rax + 0x12]
movzx eax, byte [rdx + rax + 0x13]
shl ecx, 8
add ecx, eax
movd xmm0, ecx
movzx eax, byte [rbp + 0x20]
xor edi, edi
cvtdq2ps xmm0, xmm0
mov byte [rbx], al
movzx eax, byte [rbp + 0x24]
mov byte [rbx + 1], al
divss xmm6, xmm0
cmp dword [rbx - 0x10], edi
jle 0x140019f06
mov r15, qword [rsp + 0xf0]
mov rax, r12
mov r13d, dword [rsp + 0xe8]
add r15, 6
shl rax, 4
xor esi, esi
add r15, rax
nop word [rax + rax]
mov rax, qword [rbx - 0x18]
test rax, rax
jne 0x140019e40
mov edx, dword [rbx - 0x1c]
add edx, edi
jmp 0x140019e43
mov edx, dword [rax + rsi]
mov eax, dword [rbp + 0x24]
xorps xmm3, xmm3
xorps xmm2, xmm2
mov rcx, r14
cvtsi2ss xmm3, rax
mov eax, dword [rbp + 0x20]
cvtsi2ss xmm2, rax
mulss xmm3, xmm6
mulss xmm2, xmm6
call fcn.140014de0
mov edx, eax
mov rcx, r14
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
movss dword [rsp + 0x28], xmm7
movss dword [rsp + 0x20], xmm7
call fcn.1400176d0
movzx eax, word [rbp + 0x20]
inc r13d
sub ax, word [rsp + 0x50]
inc r12
dec ax
inc edi
add ax, word [rbp + 0x1c]
add rsi, 4
add ax, word [rsp + 0x54]
mov word [r15 - 2], ax
movzx eax, word [rbp + 0x24]
sub ax, word [rsp + 0x58]
dec ax
add ax, word [rbp + 0x1c]
add ax, word [rsp + 0x5c]
mov word [r15], ax
add r15, 0x10
cmp edi, dword [rbx - 0x10]
jl 0x140019e30
mov dword [rsp + 0xe8], r13d
mov r11d, 0x100
mov r13, qword [rsp + 0x60]
add rbx, 0x28
sub r13, 1
mov qword [rsp + 0x60], r13
jne 0x140019d80
mov eax, dword [rsp + 0xe8]
movaps xmm8, xmmword [rsp + 0x70]
movaps xmm7, xmmword [rsp + 0x80]
movaps xmm6, xmmword [rsp + 0x90]
mov r15, qword [rsp + 0xa0]
mov r12, qword [rsp + 0xa8]
mov rdi, qword [rsp + 0xe0]
mov rsi, qword [rsp + 0xd8]
mov rbx, qword [rsp + 0xd0]
add rsp, 0xb0
pop r14
pop r13
pop rbp
ret
Function at 0x14001d6c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test r9d, 0xff000000
je 0x14001d877
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
movss xmm3, dword [rsp + 0x70]
xorps xmm0, xmm0
comiss xmm3, xmm0
mov esi, r9d
mov rdi, r8
mov rbp, rdx
mov rbx, rcx
jbe 0x14001d756
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x20], eax
call fcn.14001d090
mov r8d, dword [rbx + 0x80]
mov r9d, esi
mov rdx, qword [rbx + 0x88]
mov rcx, rbx
call fcn.14001c6a0
mov ecx, dword [rbx + 0x84]
test ecx, ecx
jns 0x14001d747
mov eax, ecx
cdq
sub eax, edx
xor edx, edx
sar eax, 1
add eax, ecx
lea rcx, [rbx + 0x80]
test eax, eax
cmovg edx, eax
call fcn.140012c50
mov dword [rbx + 0x80], 0
jmp 0x14001d863
mov edx, 6
movaps xmmword [rsp + 0x30], xmm6
lea r8d, [rdx - 2]
call fcn.14001b5c0
movzx edx, word [rbx + 0x48]
mov rax, qword [rbx + 0x38]
movss xmm1, dword [rdi]
movss xmm2, dword [rbp + 4]
movss xmm3, dword [rbp]
lea ecx, [rdx + 1]
movss xmm6, dword [rax + 4]
movss xmm5, dword [rax]
movss xmm4, dword [rdi + 4]
mov rax, qword [rbx + 0x58]
mov word [rax], dx
mov rax, qword [rbx + 0x58]
mov word [rax + 2], cx
lea ecx, [rdx + 2]
mov rax, qword [rbx + 0x58]
mov word [rax + 4], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 6], dx
add dx, 3
mov rax, qword [rbx + 0x58]
mov word [rax + 8], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 0xa], dx
movsd xmm0, qword [rbp]
mov rax, qword [rbx + 0x50]
movsd qword [rax], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 8], xmm5
movss dword [rax + 0xc], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x10], esi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x14], xmm1
movss dword [rax + 0x18], xmm2
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x1c], xmm5
movss dword [rax + 0x20], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x24], esi
movsd xmm0, qword [rdi]
mov rax, qword [rbx + 0x50]
movsd qword [rax + 0x28], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x30], xmm5
movss dword [rax + 0x34], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x38], esi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x3c], xmm3
movss dword [rax + 0x40], xmm4
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x44], xmm5
movss dword [rax + 0x48], xmm6
mov rax, qword [rbx + 0x50]
movaps xmm6, xmmword [rsp + 0x30]
mov dword [rax + 0x4c], esi
add qword [rbx + 0x50], 0x50
add dword [rbx + 0x48], 4
add qword [rbx + 0x58], 0xc
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14002fb60
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x18], 0
je 0x14002fb83
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x5b]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x17
jb 0x14002fb70
mov byte [rcx + 0x18], 0
mov rax, rcx
ret
Function at 0x140034c90
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rdi
sub rsp, 0x50
mov rax, qword [0x140062010]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor eax, eax
mov dword [rsp + 0x2c], edx
mov edx, 0x1000
mov dword [rsp + 0x28], ecx
xor ecx, ecx
mov dword [rsp + 0x20], eax
mov r8d, edx
mov dword [rsp + 0x30], eax
lea r9d, [rax + 0x40]
mov qword [rsp + 0x34], 1
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
jne 0x140034cef
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140045d20
add rsp, 0x50
pop rdi
ret
movups xmm0, xmmword [0x140148850]
mov r8d, 0x28
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x20]
movups xmmword [rax], xmm0
movsd xmm1, qword [0x140148860]
lea ecx, [r8 - 0x27]
movsd qword [rax + 0x10], xmm1
mov eax, dword [0x140148868]
mov dword [rdi + 0x18], eax
movzx eax, word [0x14014886c]
mov word [rdi + 0x1c], ax
call rdi
xor edx, edx
mov r8d, 0x1000
mov rcx, rdi
mov ebx, eax
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test ebx, ebx
mov rbx, qword [rsp + 0x70]
setg al
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140045d20
add rsp, 0x50
pop rdi
ret

Function at 0x140034d70
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x13c0
call fcn.140047200
sub rsp, rax
mov rax, qword [0x140062010]
xor rax, rsp
mov qword [rsp + 0x13b0], rax
mov edi, edx
mov ebx, ecx
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rsp + 0x13a4], 0xffffffff
mov r8d, 1
mov dword [rsp + 0x24], eax
nop
mov r9d, eax
shr r9d, 0x1e
xor r9d, eax
imul eax, r9d, 0x6c078965
add eax, r8d
mov dword [rsp + r8*4 + 0x24], eax
inc r8
cmp r8, 0x270
jb 0x140034dc0
lea eax, [rbx - 0x80000000]
mov dword [rsp + 0x20], 0x270
mov ebp, 0x80000000
cmp ebx, ebp
lea esi, [rbx + rbp]
cmovae esi, eax
lea ebx, [rdi + rbp]
cmp edi, ebp
lea eax, [rdi - 0x80000000]
cmovae ebx, eax
sub ebx, esi
cmp ebx, 0xffffffff
jne 0x140034e23
lea rcx, [rsp + 0x20]
call fcn.140045970
mov edx, eax
jmp 0x140034e61
lea edi, [rbx + 1]
xor r8d, r8d
xor eax, eax
test ebx, ebx
je 0x140034e41
lea rcx, [rsp + 0x20]
call fcn.140045970
mov r8d, eax
mov eax, 0xffffffff
xor edx, edx
div edi
mov ecx, eax
mov r9d, edx
xor edx, edx
mov eax, r8d
div edi
cmp eax, ecx
jb 0x140034e5a
cmp r9d, ebx
jne 0x140034e26
xor edx, edx
mov eax, r8d
div edi
add edx, esi
cmp edx, ebp
lea ecx, [rdx - 0x80000000]
lea eax, [rdx + rbp]
cmovae eax, ecx
mov rcx, qword [rsp + 0x13b0]
xor rcx, rsp
call fcn.140045d20
lea r11, [rsp + 0x13c0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140034ea0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x1340]
mov eax, 0x1440
call fcn.140047200
sub rsp, rax
mov rax, qword [0x140062010]
xor rax, rsp
mov qword [rbp + 0x1330], rax
mov r15d, edx
mov rbx, rcx
mov qword [rsp + 0x70], rcx
xor edi, edi
mov dword [rsp + 0x20], edi
movdqa xmm0, xmmword [0x14005a210]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x14005a0b0]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmm0, xmmword [0x14005a0a0]
movdqa xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x60], 0xa2aeaea2
mov dword [rsp + 0x64], 0xefe9ebe9
mov dword [rsp + 0x68], 0xd7e9ebe9
mov dword [rsp + 0x6c], 0x100dbd9
mov eax, edi
nop word [rax + rax]
lea ecx, [rax - 0x5b]
xor byte [rsp + rax + 0x30], cl
inc rax
cmp rax, 0x3e
jb 0x140034f40
mov byte [rsp + 0x6f], dil
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x78], rdi
mov qword [rbp - 0x70], 0xf
mov byte [rsp + 0x78], dil
lea rax, [rsp + 0x30]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], dil
jne 0x140034f77
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x78]
call fcn.140042150
nop
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov edi, 1
mov dword [rsp + 0x20], edi
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov ecx, eax
mov dword [rbp + 0x1324], 0xffffffff
mov dword [rbp - 0x5c], eax
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, edi
mov dword [rbp + rdi*4 - 0x5c], ecx
inc rdi
cmp rdi, 0x270
jb 0x140034fc0
mov dword [rbp - 0x60], 0x270
mov r14, qword [rbp - 0x70]
mov rsi, qword [rsp + 0x78]
test r15d, r15d
jle 0x140035094
mov rdi, r15
nop dword [rax + rax]
lea rcx, [rbp - 0x60]
call fcn.140045970
mov r8d, eax
mov eax, 0x8421085
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 4
cmp eax, 0x8421084
jae 0x140035000
mov eax, 0x8421085
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 4
imul eax, eax, 0x1f
sub r8d, eax
lea rcx, [rsp + 0x78]
cmp r14, 0x10
cmovae rcx, rsi
movsxd rax, r8d
movzx r9d, byte [rax + rcx]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x140035082
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x140035077
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14003508a
mov rcx, rbx
call fcn.140044de0
sub rdi, 1
jne 0x140035000
cmp r14, 0x10
jb 0x1400350ce
lea rdx, [r14 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1400350c6
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400350c6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.1400462c8
mov rax, rbx
mov rcx, qword [rbp + 0x1330]
xor rcx, rsp
call fcn.140045d20
lea r11, [rsp + 0x1440]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140039210
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xc], 0
je 0x140039233
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x5b]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xb
jb 0x140039220
mov byte [rcx + 0xc], 0
mov rax, rcx
ret
Function at 0x140039f80
Capabilities:
Encode data using base64 via winapi

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140062010]
xor rax, rsp
mov qword [rbp - 8], rax
mov r12, rdx
mov r14, rcx
mov qword [rbp - 0x38], rcx
xor r13d, r13d
mov dword [rbp - 0x40], r13d
mov dword [rbp - 0x30], r13d
mov qword [rcx], r13
mov qword [rcx + 0x10], r13
mov qword [rcx + 0x18], 0xf
mov byte [rcx], r13b
xor r8d, r8d
lea rdx, [0x140049ba6]
call fcn.140042150
mov dword [rbp - 0x40], 1
mov rsi, 0xffffffffffffffff
mov rdi, rsi
nop dword [rax]
inc rdi
cmp byte [r12 + rdi], 0
jne 0x140039ff0
test edi, edi
je 0x14003a19b
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8d, [r9 + 1]
mov edx, edi
mov rcx, r12
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
mov eax, dword [rbp - 0x30]
test eax, eax
je 0x14003a104
xorps xmm0, xmm0
mov r15d, eax
movdqu xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x18], r13
cmp rax, 0x1000
jb 0x14003a06b
lea rcx, [rax + 0x27]
cmp rcx, rax
jbe 0x14003a1c2
call fcn.1400465e4
mov rcx, rax
test rax, rax
je 0x14003a0f8
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14003a073
mov rcx, r15
call fcn.1400465e4
mov qword [rbp - 0x28], rax
lea rbx, [rax + r15]
mov qword [rbp - 0x18], rbx
mov r8, r15
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov qword [rbp - 0x20], rbx
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp - 0x28]
mov r8d, 1
mov edx, edi
mov rcx, r12
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
mov rdx, qword [rbp - 0x28]
inc rsi
cmp byte [rdx + rsi], 0
jne 0x14003a0b2
mov r8, rsi
mov rcx, r14
call fcn.140042150
nop
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x14003a104
mov rdx, qword [rbp - 0x18]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003a0ff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003a0ff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400462c8
mov rcx, r14
call fcn.140041a00
cmp rax, 0xffffffffffffffff
je 0x14003a19b
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x18], r13
mov qword [rbp - 0x10], 0xf
mov byte [rbp - 0x28], 0
mov r8d, 2
lea rdx, [0x140049c6c]
lea rcx, [rbp - 0x28]
call fcn.140042150
nop
mov rcx, r14
call fcn.140041a00
mov qword [rsp + 0x20], r13
mov r8, qword [rbp - 0x18]
mov rdx, rax
mov rcx, r14
call fcn.140041f90
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x14003a104
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003a0ff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003a0ff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, r14
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140045d20
mov rbx, qword [rsp + 0xc0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14002c430
int3
Function at 0x14003a6e0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x4a], 0
je 0x14003a703
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x5b]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x49
jb 0x14003a6f0
mov byte [rcx + 0x4a], 0
mov rax, rcx
ret

Function at 0x14003a710
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x6f], 0
je 0x14003a733
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x5b]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x6e
jb 0x14003a720
mov byte [rcx + 0x6f], 0
mov rax, rcx
ret
Function at 0x14003aec0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x3b], 0
je 0x14003aee3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x5b]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x3a
jb 0x14003aed0
mov byte [rcx + 0x3b], 0
mov rax, rcx
ret
Function at 0x14003bf20
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x40], 0
je 0x14003bf43
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x5b]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x3f
jb 0x14003bf30
mov byte [rcx + 0x40], 0
mov rax, rcx
ret

Function at 0x14003bf50
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x5d], 0
je 0x14003bf73
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x5b]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x5c
jb 0x14003bf60
mov byte [rcx + 0x5d], 0
mov rax, rcx
ret

Function at 0x14003bf80
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x58], 0
je 0x14003bfa3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x5b]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x57
jb 0x14003bf90
mov byte [rcx + 0x58], 0
mov rax, rcx
ret

Function at 0x14003bfb0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xaf], 0
je 0x14003bfd8
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x5b]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xae
jb 0x14003bfc0
mov byte [rcx + 0xaf], 0
mov rax, rcx
ret

Function at 0x14003bfe0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x76], 0
je 0x14003c003
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x5b]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x75
jb 0x14003bff0
mov byte [rcx + 0x76], 0
mov rax, rcx
ret

Function at 0x14003c010
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x60], 0
je 0x14003c033
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x5b]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x5f
jb 0x14003c020
mov byte [rcx + 0x60], 0
mov rax, rcx
ret
Function at 0x140040150
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x68], 0
je 0x140040173
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x5b]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x67
jb 0x140040160
mov byte [rcx + 0x68], 0
ret

Function at 0x140040180
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xa2], 0
je 0x1400401a8
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x5b]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xa1
jb 0x140040190
mov byte [rcx + 0xa2], 0
ret

Function at 0x1400401b0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x3d], 0
je 0x1400401d3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x5b]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x3c
jb 0x1400401c0
mov byte [rcx + 0x3d], 0
ret

Function at 0x1400401e0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x28], 0
je 0x140040203
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x5b]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x27
jb 0x1400401f0
mov byte [rcx + 0x28], 0
ret

Function at 0x140040210
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x12], 0
je 0x140040233
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x5b]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x11
jb 0x140040220
mov byte [rcx + 0x12], 0
ret

Function at 0x140040240
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x22], 0
je 0x140040263
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x5b]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x21
jb 0x140040250
mov byte [rcx + 0x22], 0
ret

Function at 0x140040270
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xad], 0
je 0x140040298
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x5b]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xac
jb 0x140040280
mov byte [rcx + 0xad], 0
ret

Function at 0x1400402a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2c], 0
je 0x1400402c3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x5b]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x2b
jb 0x1400402b0
mov byte [rcx + 0x2c], 0
ret

Function at 0x1400402d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2e], 0
je 0x1400402f3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x5b]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x2d
jb 0x1400402e0
mov byte [rcx + 0x2e], 0
ret

Function at 0x140040300
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x46], 0
je 0x140040323
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x5b]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x45
jb 0x140040310
mov byte [rcx + 0x46], 0
ret

Function at 0x140040330
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x34], 0
je 0x140040353
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x5b]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x33
jb 0x140040340
mov byte [rcx + 0x34], 0
ret

Function at 0x140040360
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2b], 0
je 0x140040383
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x5b]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x2a
jb 0x140040370
mov byte [rcx + 0x2b], 0
ret
Function at 0x140040390
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1f], 0
je 0x1400403b3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x5b]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1e
jb 0x1400403a0
mov byte [rcx + 0x1f], 0
ret

Function at 0x1400403c0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x5f], 0
je 0x1400403e3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x5b]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x5e
jb 0x1400403d0
mov byte [rcx + 0x5f], 0
ret

Function at 0x1400403f0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xe], 0
je 0x140040413
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x5b]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xd
jb 0x140040400
mov byte [rcx + 0xe], 0
ret

Function at 0x140040420
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xd], 0
je 0x140040443
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x5b]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xc
jb 0x140040430
mov byte [rcx + 0xd], 0
ret

Function at 0x140040450
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x40], 0
je 0x140040473
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x5b]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x3f
jb 0x140040460
mov byte [rcx + 0x40], 0
ret

Function at 0x140040480
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x1400404a3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x5b]
xor byte [rax + rcx], dl
inc rax
cmp rax, 4
jb 0x140040490
mov byte [rcx + 5], 0
ret

Function at 0x1400404b0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x68], 0
je 0x1400404d8
xor eax, eax
mov r8d, 0x2d5b
nop
movzx edx, ax
sub dx, r8w
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x33
jb 0x1400404c0
mov byte [rcx + 0x68], 0
ret

Function at 0x1400404e0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x22], 0
je 0x140040508
xor eax, eax
mov r8d, 0x2d5b
nop
movzx edx, ax
sub dx, r8w
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x10
jb 0x1400404f0
mov byte [rcx + 0x22], 0
ret

Function at 0x140040510
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 4], 0
je 0x140040533
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x5b]
xor byte [rax + rcx], dl
inc rax
cmp rax, 3
jb 0x140040520
mov byte [rcx + 4], 0
ret

Function at 0x140040540
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x16], 0
je 0x140040568
xor eax, eax
mov r8d, 0x2d5b
nop
movzx edx, ax
sub dx, r8w
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0xa
jb 0x140040550
mov byte [rcx + 0x16], 0
ret

Function at 0x140040570
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x25], 0
je 0x140040593
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x5b]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x24
jb 0x140040580
mov byte [rcx + 0x25], 0
ret

Function at 0x1400405a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 3], 0
je 0x1400405c3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x5b]
xor byte [rax + rcx], dl
inc rax
cmp rax, 2
jb 0x1400405b0
mov byte [rcx + 3], 0
ret