joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001e20
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d3598], 1
je 0x140001e90
mov r8, rdx
movabs r9, 0x4924924924924925
xor eax, eax
mov r10, rdx
mov r11d, 0x1c
nop word cs:[rax + rax]
nop dword [rax]
mov rsi, rax
shr rax, 2
mul r9
shr rdx, 1
imul rax, rdx, 0xffffffffffffffe4
movzx edx, byte [r8 + r11]
xor dl, byte [r10 + rax]
mov byte [rcx + r11 - 0x1c], dl
mov rax, r11
inc rax
mov r11, rax
inc r10
inc rsi
cmp eax, 0x33
mov rax, rsi
jne 0x140001e50
mov dword [0x1400d3598], 1
mov eax, 0xac130bbe
pop rsi
ret

Function at 0x140001ea0
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d35a8], 1
je 0x140001f03
mov r8, rdx
movabs r10, 0x8888888888888889
xor r9d, r9d
mov eax, 0x1e
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 4
imul rax, rdx, 0xffffffffffffffe2
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x1e], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x2a
mov rdx, rsi
jne 0x140001ec0
mov dword [0x1400d35a8], 1
mov eax, 0x6f5bc205
pop rsi
ret

Function at 0x140001f10
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d35b4], 1
je 0x140001f73
mov r8, rdx
movabs r10, 0x4ec4ec4ec4ec4ec5
xor r9d, r9d
mov eax, 0x1a
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 3
imul rax, rdx, 0xffffffffffffffe6
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x1a], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x22
mov rdx, rsi
jne 0x140001f30
mov dword [0x1400d35b4], 1
mov eax, 0xc15b367d
pop rsi
ret

Function at 0x140001f80
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d35c4], 1
je 0x140001ff9
mov r8, rdx
movabs r10, 0x642c8590b21642c9
xor r9d, r9d
mov r11, rdx
mov esi, 0x17
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub r9, rdx
shr r9, 1
add r9, rdx
shr r9, 4
imul rdx, r9, 0xffffffffffffffe9
movzx r9d, byte [r8 + rsi]
xor r9b, byte [r11 + rdx]
mov byte [rcx + rsi - 0x17], r9b
mov rdx, rsi
inc rdx
mov rsi, rdx
inc r11
inc rax
cmp edx, 0x21
mov r9, rax
jne 0x140001fb0
mov dword [0x1400d35c4], 1
mov eax, 0x3dc9913e
pop rsi
ret

Function at 0x140002000
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d35d4], 1
je 0x140002074
mov r8, rdx
movabs r10, 0xf0f0f0f0f0f0f0f1
xor r9d, r9d
mov r11, rdx
mov eax, 0x11
nop word cs:[rax + rax]
nop dword [rax]
mov rsi, rax
mov rax, r9
mul r10
mov rax, rdx
shr rdx, 4
and rax, 0xfffffffffffffff0
add rax, rdx
neg rax
movzx edx, byte [r8 + rsi]
xor dl, byte [r11 + rax]
mov byte [rcx + rsi - 0x11], dl
inc rsi
mov rax, rsi
mov edx, esi
inc r11
inc r9
cmp esi, 0x1d
jne 0x140002030
mov dword [0x1400d35d4], 1
mov eax, 0xdda627c
pop rsi
ret

Function at 0x140002080
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400d35e4], 1
je 0x1400020b7
xor eax, eax
nop dword [rax + rax]
movzx r8d, byte [rdx + rax + 0x10]
xor r8b, byte [rdx + rax]
mov byte [rcx + rax], r8b
mov r8, rax
inc r8
mov rax, r8
cmp r8d, 0xb
jne 0x140002090
mov dword [0x1400d35e4], 1
mov eax, 0x9e0163ea
ret
Function at 0x1400020c0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
cmp dword [0x1400d3608], 1
je 0x140002120
mov r8, rdx
movabs r10, 0xf0f0f0f0f0f0f0f1
xor r9d, r9d
nop dword [rax]
mov rax, r9
mul r10
shr rdx, 4
mov eax, edx
shl edx, 4
add edx, eax
movzx eax, byte [r8 + r9 + 0x11]
mov r11d, r9d
sub r11d, edx
movsxd rdx, r11d
xor al, byte [r8 + rdx]
mov byte [rcx + r9], al
mov rax, r9
inc rax
mov r9, rax
cmp eax, 0x1d
jne 0x1400020e0
mov dword [0x1400d3608], 1
mov eax, 0xa8cc1850
ret

Function at 0x140002130
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400d3618], 1
je 0x140002167
xor eax, eax
nop dword [rax + rax]
movzx r8d, byte [rdx + rax + 0x10]
xor r8b, byte [rdx + rax]
mov byte [rcx + rax], r8b
mov r8, rax
inc r8
mov rax, r8
cmp r8d, 0xc
jne 0x140002140
mov dword [0x1400d3618], 1
mov eax, 0x51e035c4
ret

Function at 0x140002170
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d3628], 1
je 0x1400021e4
mov r8, rdx
movabs r10, 0xf0f0f0f0f0f0f0f1
xor r9d, r9d
mov r11, rdx
mov eax, 0x11
nop word cs:[rax + rax]
nop dword [rax]
mov rsi, rax
mov rax, r9
mul r10
mov rax, rdx
shr rdx, 4
and rax, 0xfffffffffffffff0
add rax, rdx
neg rax
movzx edx, byte [r8 + rsi]
xor dl, byte [r11 + rax]
mov byte [rcx + rsi - 0x11], dl
inc rsi
mov rax, rsi
mov edx, esi
inc r11
inc r9
cmp esi, 0x1d
jne 0x1400021a0
mov dword [0x1400d3628], 1
mov eax, 0x1e815760
pop rsi
ret

Function at 0x1400021f0
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d363c], 1
je 0x140002260
mov r8, rdx
movabs r9, 0x4924924924924925
xor eax, eax
mov r10, rdx
mov r11d, 0x1c
nop word cs:[rax + rax]
nop dword [rax]
mov rsi, rax
shr rax, 2
mul r9
shr rdx, 1
imul rax, rdx, 0xffffffffffffffe4
movzx edx, byte [r8 + r11]
xor dl, byte [r10 + rax]
mov byte [rcx + r11 - 0x1c], dl
mov rax, r11
inc rax
mov r11, rax
inc r10
inc rsi
cmp eax, 0x2a
mov rax, rsi
jne 0x140002220
mov dword [0x1400d363c], 1
mov eax, 0x7b05c4b2
pop rsi
ret

Function at 0x140002270
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d3654], 1
je 0x1400022e9
mov r8, rdx
movabs r10, 0x642c8590b21642c9
xor r9d, r9d
mov r11, rdx
mov esi, 0x17
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub r9, rdx
shr r9, 1
add r9, rdx
shr r9, 4
imul rdx, r9, 0xffffffffffffffe9
movzx r9d, byte [r8 + rsi]
xor r9b, byte [r11 + rdx]
mov byte [rcx + rsi - 0x17], r9b
mov rdx, rsi
inc rdx
mov rsi, rdx
inc r11
inc rax
cmp edx, 0x2a
mov r9, rax
jne 0x1400022a0
mov dword [0x1400d3654], 1
mov eax, 0x814e699c
pop rsi
ret

Function at 0x1400022f0
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d366c], 1
je 0x140002353
mov r8, rdx
movabs r10, 0x8888888888888889
xor r9d, r9d
mov eax, 0x1e
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 4
imul rax, rdx, 0xffffffffffffffe2
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x1e], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x31
mov rdx, rsi
jne 0x140002310
mov dword [0x1400d366c], 1
mov eax, 0xec391d61
pop rsi
ret
Function at 0x140002360
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d3684], 1
je 0x1400023ca
mov r8, rdx
movabs r10, 0xe38e38e38e38e38f
xor r9d, r9d
mov eax, 0x12
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 3
and rdx, 0xfffffffffffffffe
lea rax, [rdx + rdx*8]
neg rax
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x12], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x24
mov rdx, rsi
jne 0x140002380
mov dword [0x1400d3684], 1
mov eax, 0xdbcb5f96
pop rsi
ret

Function at 0x1400023e0
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d3698], 1
je 0x14000244a
mov r8, rdx
movabs r10, 0xcccccccccccccccd
xor r9d, r9d
mov eax, 0x14
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 2
and rdx, 0xfffffffffffffffc
lea rax, [rdx + rdx*4]
neg rax
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x14], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x23
mov rdx, rsi
jne 0x140002400
mov dword [0x1400d3698], 1
mov eax, 0xe7c31c4a
pop rsi
ret

Function at 0x140002460
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d36ac], 1
je 0x1400024ca
mov r8, rdx
movabs r10, 0xe38e38e38e38e38f
xor r9d, r9d
mov eax, 0x12
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 3
and rdx, 0xfffffffffffffffe
lea rax, [rdx + rdx*8]
neg rax
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x12], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x21
mov rdx, rsi
jne 0x140002480
mov dword [0x1400d36ac], 1
mov eax, 0xbec1089
pop rsi
ret

Function at 0x1400024e0
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d36c0], 1
je 0x140002550
mov r8, rdx
movabs r9, 0x4924924924924925
xor eax, eax
mov r10, rdx
mov r11d, 0x1c
nop word cs:[rax + rax]
nop dword [rax]
mov rsi, rax
shr rax, 2
mul r9
shr rdx, 1
imul rax, rdx, 0xffffffffffffffe4
movzx edx, byte [r8 + r11]
xor dl, byte [r10 + rax]
mov byte [rcx + r11 - 0x1c], dl
mov rax, r11
inc rax
mov r11, rax
inc r10
inc rsi
cmp eax, 0x2c
mov rax, rsi
jne 0x140002510
mov dword [0x1400d36c0], 1
mov eax, 0xf0a28110
pop rsi
ret

Function at 0x140002560
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400d36d0], 1
je 0x140002597
xor eax, eax
nop dword [rax + rax]
movzx r8d, byte [rdx + rax + 0x10]
xor r8b, byte [rdx + rax]
mov byte [rcx + rax], r8b
mov r8, rax
inc r8
mov rax, r8
cmp r8d, 0xb
jne 0x140002570
mov dword [0x1400d36d0], 1
mov eax, 0xf4f08c2
ret

Function at 0x140002910
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d36dc], 1
je 0x140002984
mov r8, rdx
movabs r10, 0xf0f0f0f0f0f0f0f1
xor r9d, r9d
mov r11, rdx
mov eax, 0x11
nop word cs:[rax + rax]
nop dword [rax]
mov rsi, rax
mov rax, r9
mul r10
mov rax, rdx
shr rdx, 4
and rax, 0xfffffffffffffff0
add rax, rdx
neg rax
movzx edx, byte [r8 + rsi]
xor dl, byte [r11 + rax]
mov byte [rcx + rsi - 0x11], dl
inc rsi
mov rax, rsi
mov edx, esi
inc r11
inc r9
cmp esi, 0x19
jne 0x140002940
mov dword [0x1400d36dc], 1
mov eax, 0x82098bc7
pop rsi
ret
Function at 0x140002990
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d36f0], 1
je 0x140002a09
mov r8, rdx
movabs r10, 0x47ae147ae147ae15
xor r9d, r9d
mov r11, rdx
mov esi, 0x19
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub r9, rdx
shr r9, 1
add r9, rdx
shr r9, 4
imul rdx, r9, 0xffffffffffffffe7
movzx r9d, byte [r8 + rsi]
xor r9b, byte [r11 + rdx]
mov byte [rcx + rsi - 0x19], r9b
mov rdx, rsi
inc rdx
mov rsi, rdx
inc r11
inc rax
cmp edx, 0x26
mov r9, rax
jne 0x1400029c0
mov dword [0x1400d36f0], 1
mov eax, 0xba0e39c9
pop rsi
ret

Function at 0x140002a10
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d3700], 1
je 0x140002a73
mov r8, rdx
movabs r10, 0x2e8ba2e8ba2e8ba3
xor r9d, r9d
mov eax, 0x16
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 2
imul rax, rdx, 0xffffffffffffffea
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x16], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x22
mov rdx, rsi
jne 0x140002a30
mov dword [0x1400d3700], 1
mov eax, 0xaa668cef
pop rsi
ret

Function at 0x140002a80
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d3714], 1
je 0x140002ae3
mov r8, rdx
movabs r10, 0x2e8ba2e8ba2e8ba3
xor r9d, r9d
mov eax, 0x16
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 2
imul rax, rdx, 0xffffffffffffffea
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x16], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x24
mov rdx, rsi
jne 0x140002aa0
mov dword [0x1400d3714], 1
mov eax, 0x7571a4aa
pop rsi
ret

Function at 0x140002af0
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d3728], 1
je 0x140002b59
mov r8, rdx
movabs r10, 0xaaaaaaaaaaaaaaab
xor r9d, r9d
mov eax, 0x18
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 1
and rdx, 0xfffffffffffffff8
lea rax, [rdx + rdx*2]
neg rax
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x18], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x26
mov rdx, rsi
jne 0x140002b10
mov dword [0x1400d3728], 1
mov eax, 0xc26ee49a
pop rsi
ret

Function at 0x140002b60
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d3740], 1
je 0x140002bd9
mov r8, rdx
movabs r10, 0x1a7b9611a7b9611b
xor r9d, r9d
mov r11, rdx
mov esi, 0x1d
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub r9, rdx
shr r9, 1
add r9, rdx
shr r9, 4
imul rdx, r9, 0xffffffffffffffe3
movzx r9d, byte [r8 + rsi]
xor r9b, byte [r11 + rdx]
mov byte [rcx + rsi - 0x1d], r9b
mov rdx, rsi
inc rdx
mov rsi, rdx
inc r11
inc rax
cmp edx, 0x2f
mov r9, rax
jne 0x140002b90
mov dword [0x1400d3740], 1
mov eax, 0x7d405a74
pop rsi
ret
Function at 0x140002be0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d3758], 1
je 0x140002c59
mov r8, rdx
movabs r10, 0x47ae147ae147ae15
xor r9d, r9d
mov r11, rdx
mov esi, 0x19
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub r9, rdx
shr r9, 1
add r9, rdx
shr r9, 4
imul rdx, r9, 0xffffffffffffffe7
movzx r9d, byte [r8 + rsi]
xor r9b, byte [r11 + rdx]
mov byte [rcx + rsi - 0x19], r9b
mov rdx, rsi
inc rdx
mov rsi, rdx
inc r11
inc rax
cmp edx, 0x2b
mov r9, rax
jne 0x140002c10
mov dword [0x1400d3758], 1
mov eax, 0x3eccf73e
pop rsi
ret

Function at 0x140002c60
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d376c], 1
je 0x140002cd9
mov r8, rdx
movabs r10, 0x47ae147ae147ae15
xor r9d, r9d
mov r11, rdx
mov esi, 0x19
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub r9, rdx
shr r9, 1
add r9, rdx
shr r9, 4
imul rdx, r9, 0xffffffffffffffe7
movzx r9d, byte [r8 + rsi]
xor r9b, byte [r11 + rdx]
mov byte [rcx + rsi - 0x19], r9b
mov rdx, rsi
inc rdx
mov rsi, rdx
inc r11
inc rax
cmp edx, 0x28
mov r9, rax
jne 0x140002c90
mov dword [0x1400d376c], 1
mov eax, 0x744c493e
pop rsi
ret

Function at 0x140002ce0
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d3780], 1
je 0x140002d43
mov r8, rdx
movabs r10, 0x8888888888888889
xor r9d, r9d
mov eax, 0x1e
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 4
imul rax, rdx, 0xffffffffffffffe2
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x1e], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x2e
mov rdx, rsi
jne 0x140002d00
mov dword [0x1400d3780], 1
mov eax, 0x396b58db
pop rsi
ret

Function at 0x140002d50
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d3794], 1
je 0x140002dba
mov r8, rdx
movabs r10, 0xe38e38e38e38e38f
xor r9d, r9d
mov eax, 0x12
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 3
and rdx, 0xfffffffffffffffe
lea rax, [rdx + rdx*8]
neg rax
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x12], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x21
mov rdx, rsi
jne 0x140002d70
mov dword [0x1400d3794], 1
mov eax, 0x304f0b69
pop rsi
ret

Function at 0x140002dd0
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d37a8], 1
je 0x140002e40
mov r8, rdx
movabs r9, 0x4924924924924925
xor eax, eax
mov r10, rdx
mov r11d, 0x1c
nop word cs:[rax + rax]
nop dword [rax]
mov rsi, rax
shr rax, 2
mul r9
shr rdx, 1
imul rax, rdx, 0xffffffffffffffe4
movzx edx, byte [r8 + r11]
xor dl, byte [r10 + rax]
mov byte [rcx + r11 - 0x1c], dl
mov rax, r11
inc rax
mov r11, rax
inc r10
inc rsi
cmp eax, 0x2a
mov rax, rsi
jne 0x140002e00
mov dword [0x1400d37a8], 1
mov eax, 0x7424717c
pop rsi
ret
Function at 0x140002e50
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d37bc], 1
je 0x140002ec0
mov r8, rdx
movabs r9, 0x4924924924924925
xor eax, eax
mov r10, rdx
mov r11d, 0x1c
nop word cs:[rax + rax]
nop dword [rax]
mov rsi, rax
shr rax, 2
mul r9
shr rdx, 1
imul rax, rdx, 0xffffffffffffffe4
movzx edx, byte [r8 + r11]
xor dl, byte [r10 + rax]
mov byte [rcx + r11 - 0x1c], dl
mov rax, r11
inc rax
mov r11, rax
inc r10
inc rsi
cmp eax, 0x29
mov rax, rsi
jne 0x140002e80
mov dword [0x1400d37bc], 1
mov eax, 0xd410d1e
pop rsi
ret

Function at 0x140002ed0
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d37d0], 1
je 0x140002f33
mov r8, rdx
movabs r10, 0x4ec4ec4ec4ec4ec5
xor r9d, r9d
mov eax, 0x1a
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 3
imul rax, rdx, 0xffffffffffffffe6
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x1a], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x2a
mov rdx, rsi
jne 0x140002ef0
mov dword [0x1400d37d0], 1
mov eax, 0x8fec351c
pop rsi
ret

Function at 0x140003280
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400d469c], 1
je 0x1400032b7
xor eax, eax
nop dword [rax + rax]
movzx r8d, byte [rdx + rax + 0x10]
xor r8b, byte [rdx + rax]
mov byte [rcx + rax], r8b
mov r8, rax
inc r8
mov rax, r8
cmp r8d, 0x10
jne 0x140003290
mov dword [0x1400d469c], 1
mov eax, 0x7c1a797a
ret

Function at 0x1400032c0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d46b8], 1
je 0x140003339
mov r8, rdx
movabs r10, 0x8618618618618619
xor r9d, r9d
mov r11, rdx
mov esi, 0x15
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub r9, rdx
shr r9, 1
add r9, rdx
shr r9, 4
imul rdx, r9, 0xffffffffffffffeb
movzx r9d, byte [r8 + rsi]
xor r9b, byte [r11 + rdx]
mov byte [rcx + rsi - 0x15], r9b
mov rdx, rsi
inc rdx
mov rsi, rdx
inc r11
inc rax
cmp edx, 0x2a
mov r9, rax
jne 0x1400032f0
mov dword [0x1400d46b8], 1
mov eax, 0xe8630b0c
pop rsi
ret

Function at 0x140003420
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d46d0], 1
je 0x140003483
mov r8, rdx
movabs r10, 0xd79435e50d79435f
xor r9d, r9d
mov eax, 0x13
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 4
imul rax, rdx, 0xffffffffffffffed
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x13], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x25
mov rdx, rsi
jne 0x140003440
mov dword [0x1400d46d0], 1
mov eax, 0xec0c55af
pop rsi
ret
Function at 0x140003590
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d47b4], 1
je 0x140003609
mov r8, rdx
movabs r10, 0x47ae147ae147ae15
xor r9d, r9d
mov r11, rdx
mov esi, 0x19
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub r9, rdx
shr r9, 1
add r9, rdx
shr r9, 4
imul rdx, r9, 0xffffffffffffffe7
movzx r9d, byte [r8 + rsi]
xor r9b, byte [r11 + rdx]
mov byte [rcx + rsi - 0x19], r9b
mov rdx, rsi
inc rdx
mov rsi, rdx
inc r11
inc rax
cmp edx, 0x29
mov r9, rax
jne 0x1400035c0
mov dword [0x1400d47b4], 1
mov eax, 0x20c4e82c
pop rsi
ret
Function at 0x14000c440
Capabilities:
Set registry value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
mov rsi, rcx
mov rax, qword [0x140041040]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rdi, [0x1400d344c]
lea rdx, [0x140030f15]
mov rcx, rdi
call fcn.14000d570
lea rax, [rsp + 0x54]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], 0
mov rcx, 0xffffffff80000001
mov rdx, rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x14000c508
lea rsi, [0x1400d3eec]
lea rdx, [0x140032491]
mov rcx, rsi
call fcn.14000d660
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov rdx, rsi
call fcn.14000bc20
mov rsi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rsi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
mov rcx, rsi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::put_char____ptr64]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::flush_void____ptr64]
jmp 0x14000c55e
mov ebx, dword [rsi + 0x10]
inc ebx
cmp qword [rsi + 0x18], 0x10
jb 0x14000c517
mov rsi, qword [rsi]
mov r14, rsi
mov rsi, qword [rsp + 0x58]
lea rdi, [0x1400d3f08]
lea rdx, [0x1400324db]
mov rcx, rdi
call fcn.14000da70
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r14
mov rcx, rsi
mov rdx, rdi
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14002ebc0
nop
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14000d040
Capabilities:
Set registry value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
mov rsi, rcx
mov rax, qword [0x140041040]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rdi, [0x1400d344c]
lea rdx, [0x140030f15]
mov rcx, rdi
call fcn.14000d570
lea rax, [rsp + 0x54]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], 0
mov rcx, 0xffffffff80000001
mov rdx, rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x14000d108
lea rsi, [0x1400d3eec]
lea rdx, [0x140032491]
mov rcx, rsi
call fcn.14000d660
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov rdx, rsi
call fcn.14000bc20
mov rsi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rsi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
mov rcx, rsi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::put_char____ptr64]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::flush_void____ptr64]
jmp 0x14000d15e
mov ebx, dword [rsi + 0x10]
inc ebx
cmp qword [rsi + 0x18], 0x10
jb 0x14000d117
mov rsi, qword [rsi]
mov r14, rsi
mov rsi, qword [rsp + 0x58]
lea rdi, [0x1400d3464]
lea rdx, [0x140030f59]
mov rcx, rdi
call fcn.14000d5e0
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r14
mov rcx, rsi
mov rdx, rdi
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14002ebc0
nop
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x14000d490
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d3ee0], 1
je 0x14000d4f3
mov r8, rdx
movabs r10, 0x2e8ba2e8ba2e8ba3
xor r9d, r9d
mov eax, 0x16
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 2
imul rax, rdx, 0xffffffffffffffea
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x16], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x1e
mov rdx, rsi
jne 0x14000d4b0
mov dword [0x1400d3ee0], 1
mov eax, 0x168df9b0
pop rsi
ret

Function at 0x14000d500
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d3ee8], 1
je 0x14000d569
mov r8, rdx
movabs r10, 0xaaaaaaaaaaaaaaab
xor r9d, r9d
mov eax, 0x18
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 1
and rdx, 0xfffffffffffffff8
lea rax, [rdx + rdx*2]
neg rax
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x18], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x1b
mov rdx, rsi
jne 0x14000d520
mov dword [0x1400d3ee8], 1
mov eax, 0x5a629e5a
pop rsi
ret