joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140011520
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
cmp byte [rcx + 0x1b], 0
lea rbx, [rcx + 0x1b]
mov rax, rcx
je 0x1400115a9
mov r11, rcx
neg r11
nop dword [rax + rax]
lea r10, [r11 + rax]
mov ecx, 8
lea r8d, [r10 + 0x10]
mov r9d, r10d
xor r8b, byte [rax]
lea rax, [rax + 2]
movzx edx, r8b
and r9d, 7
sub ecx, r9d
shl dl, cl
movzx ecx, r9b
shr r8b, cl
mov ecx, 8
or dl, r8b
lea r8d, [r10 + 1]
mov byte [rax - 2], dl
add r10b, 0x11
xor r10b, byte [rax - 1]
and r8d, 7
sub ecx, r8d
movzx edx, r10b
shl dl, cl
movzx ecx, r8b
shr r10b, cl
lea rcx, [r11 + rax]
or dl, r10b
mov byte [rax - 1], dl
cmp rcx, 0x1a
jb 0x140011540
mov byte [rbx], 0
mov rbx, qword [rsp + 8]
ret

Function at 0x1400115b0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
cmp byte [rcx + 0x11], 0
mov rax, rcx
je 0x14001175b
mov qword [rsp], rbx
lea r11, [rcx + 2]
mov rbx, 0xfffffffffffffffe
sub rbx, rcx
nop dword [rax]
nop word [rax + rax]
lea r10, [rbx + r11]
mov ecx, 8
lea r8d, [r10 + 0x10]
mov r9d, r10d
xor r8b, byte [r11 - 2]
and r9d, 7
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [r10 + 1]
or dl, r8b
and r9d, 7
mov byte [r11 - 2], dl
lea r8d, [r10 + 0x11]
xor r8b, byte [r11 - 1]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [r10 + 2]
or dl, r8b
and r9d, 7
mov byte [r11 - 1], dl
lea r8d, [r10 + 0x12]
xor r8b, byte [r11]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [r10 + 3]
or dl, r8b
and r9d, 7
mov byte [r11], dl
lea r8d, [r10 + 0x13]
xor r8b, byte [r11 + 1]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [r10 - 4]
or dl, r8b
and r9d, 7
mov byte [r11 + 1], dl
lea r8d, [r10 + 0x14]
xor r8b, byte [r11 + 2]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [r10 - 3]
or dl, r8b
and r9d, 7
mov byte [r11 + 2], dl
lea r8d, [r10 + 0x15]
xor r8b, byte [r11 + 3]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [r10 - 2]
or dl, r8b
and r9d, 7
mov byte [r11 + 3], dl
lea r8d, [r10 + 0x16]
xor r8b, byte [r11 + 4]
mov ecx, 8
movzx edx, r8b
sub ecx, r9d
shl dl, cl
movzx ecx, r9b
lea r11, [r11 + 8]
shr r8b, cl
mov ecx, 8
or dl, r8b
lea r8d, [r10 - 1]
mov byte [r11 - 4], dl
add r10b, 0x17
xor r10b, byte [r11 - 3]
and r8d, 7
sub ecx, r8d
movzx edx, r10b
shl dl, cl
movzx ecx, r8b
shr r10b, cl
lea rcx, [rbx + r11]
or dl, r10b
mov byte [r11 - 3], dl
cmp rcx, 0x10
jb 0x1400115e0
mov rbx, qword [rsp]
mov byte [rax + 0x11], 0
add rsp, 8
ret
Function at 0x140011760
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
cmp byte [rcx + 0x1f], 0
mov rax, rcx
je 0x140011955
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov rsi, 0xfffffffffffffffe
mov qword [rsp], rdi
sub rsi, rcx
lea rdi, [rcx + 2]
nop dword [rax]
lea rbx, [rsi + rdi]
mov r10d, 8
lea r8d, [rbx + 0x10]
mov r11d, ebx
xor r8b, byte [rdi - 2]
lea r9d, [rbx + 1]
movzx edx, r8b
and r9d, 7
and r11d, 7
sub r10d, r11d
mov ecx, r10d
shl dl, cl
movzx ecx, r11b
shr r8b, cl
mov ecx, 8
or dl, r8b
sub ecx, r9d
mov byte [rdi - 2], dl
lea r8d, [rbx + 0x11]
xor r8b, byte [rdi - 1]
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx + 2]
or dl, r8b
and r9d, 7
mov byte [rdi - 1], dl
lea r8d, [rbx + 0x12]
xor r8b, byte [rdi]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx + 3]
or dl, r8b
and r9d, 7
mov byte [rdi], dl
lea r8d, [rbx + 0x13]
xor r8b, byte [rdi + 1]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx - 4]
or dl, r8b
and r9d, 7
mov byte [rdi + 1], dl
lea r8d, [rbx + 0x14]
xor r8b, byte [rdi + 2]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx - 3]
or dl, r8b
and r9d, 7
mov byte [rdi + 2], dl
lea r8d, [rbx + 0x15]
xor r8b, byte [rdi + 3]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx - 2]
or dl, r8b
and r9d, 7
lea r8d, [rbx + 0x16]
mov byte [rdi + 3], dl
xor r8b, byte [rdi + 4]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
lea rdi, [rdi + 0xa]
movzx ecx, r9b
lea r9d, [rbx - 1]
shr r8b, cl
and r9d, 7
or dl, r8b
mov ecx, 8
mov byte [rdi - 6], dl
lea r8d, [rbx + 0x17]
xor r8b, byte [rdi - 5]
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
mov ecx, r10d
or dl, r8b
lea r8d, [rbx + 0x18]
xor r8b, byte [rdi - 4]
mov byte [rdi - 5], dl
movzx edx, r8b
shl dl, cl
movzx ecx, r11b
shr r8b, cl
mov ecx, 8
or dl, r8b
lea r8d, [rbx + 1]
mov byte [rdi - 4], dl
add bl, 0x19
xor bl, byte [rdi - 3]
and r8d, 7
sub ecx, r8d
movzx edx, bl
shl dl, cl
movzx ecx, r8b
shr bl, cl
lea rcx, [rsi + rdi]
or dl, bl
mov byte [rdi - 3], dl
cmp rcx, 0x1e
jb 0x140011790
mov rdi, qword [rsp]
mov rsi, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x10]
mov byte [rax + 0x1f], 0
add rsp, 8
ret
Function at 0x140011960
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
cmp byte [rcx + 0x22], 0
mov rax, rcx
je 0x140011b80
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov rsi, 0xfffffffffffffffe
mov qword [rsp], rdi
sub rsi, rcx
lea rdi, [rcx + 2]
nop dword [rax]
lea rbx, [rsi + rdi]
mov r10d, 8
lea r8d, [rbx + 0x10]
mov r11d, ebx
xor r8b, byte [rdi - 2]
lea r9d, [rbx + 1]
movzx edx, r8b
and r9d, 7
and r11d, 7
sub r10d, r11d
mov ecx, r10d
shl dl, cl
movzx ecx, r11b
shr r8b, cl
mov ecx, 8
or dl, r8b
sub ecx, r9d
mov byte [rdi - 2], dl
lea r8d, [rbx + 0x11]
xor r8b, byte [rdi - 1]
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx + 2]
or dl, r8b
and r9d, 7
mov byte [rdi - 1], dl
lea r8d, [rbx + 0x12]
xor r8b, byte [rdi]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx + 3]
or dl, r8b
and r9d, 7
mov byte [rdi], dl
lea r8d, [rbx + 0x13]
xor r8b, byte [rdi + 1]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx - 4]
or dl, r8b
and r9d, 7
mov byte [rdi + 1], dl
lea r8d, [rbx + 0x14]
xor r8b, byte [rdi + 2]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx - 3]
or dl, r8b
and r9d, 7
mov byte [rdi + 2], dl
lea r8d, [rbx + 0x15]
xor r8b, byte [rdi + 3]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx - 2]
or dl, r8b
and r9d, 7
lea r8d, [rbx + 0x16]
mov byte [rdi + 3], dl
xor r8b, byte [rdi + 4]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
lea rdi, [rdi + 0xb]
movzx ecx, r9b
lea r9d, [rbx - 1]
shr r8b, cl
and r9d, 7
or dl, r8b
mov ecx, 8
sub ecx, r9d
mov byte [rdi - 7], dl
lea r8d, [rbx + 0x17]
xor r8b, byte [rdi - 6]
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx + 1]
or dl, r8b
mov ecx, r10d
mov byte [rdi - 6], dl
lea r8d, [rbx + 0x18]
xor r8b, byte [rdi - 5]
and r9d, 7
movzx edx, r8b
shl dl, cl
movzx ecx, r11b
shr r8b, cl
mov ecx, 8
or dl, r8b
sub ecx, r9d
mov byte [rdi - 5], dl
lea r8d, [rbx + 0x19]
xor r8b, byte [rdi - 4]
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
mov ecx, 8
or dl, r8b
lea r8d, [rbx + 2]
mov byte [rdi - 4], dl
add bl, 0x1a
xor bl, byte [rdi - 3]
and r8d, 7
sub ecx, r8d
movzx edx, bl
shl dl, cl
movzx ecx, r8b
shr bl, cl
lea rcx, [rsi + rdi]
or dl, bl
mov byte [rdi - 3], dl
cmp rcx, 0x21
jb 0x140011990
mov rdi, qword [rsp]
mov rsi, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x10]
mov byte [rax + 0x22], 0
add rsp, 8
ret
Function at 0x140011b90
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
cmp byte [rcx + 0x16], 0
mov rax, rcx
je 0x140011d0f
mov qword [rsp], rbx
lea r11, [rcx + 2]
mov rbx, 0xfffffffffffffffe
sub rbx, rcx
nop dword [rax]
nop word [rax + rax]
lea r10, [rbx + r11]
mov ecx, 8
lea r8d, [r10 + 0x10]
mov r9d, r10d
xor r8b, byte [r11 - 2]
and r9d, 7
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [r10 + 1]
or dl, r8b
and r9d, 7
mov byte [r11 - 2], dl
lea r8d, [r10 + 0x11]
xor r8b, byte [r11 - 1]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [r10 + 2]
or dl, r8b
and r9d, 7
mov byte [r11 - 1], dl
lea r8d, [r10 + 0x12]
xor r8b, byte [r11]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [r10 + 3]
or dl, r8b
and r9d, 7
mov byte [r11], dl
lea r8d, [r10 + 0x13]
xor r8b, byte [r11 + 1]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [r10 - 4]
or dl, r8b
and r9d, 7
mov byte [r11 + 1], dl
lea r8d, [r10 + 0x14]
xor r8b, byte [r11 + 2]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [r10 - 3]
or dl, r8b
and r9d, 7
mov byte [r11 + 2], dl
lea r8d, [r10 + 0x15]
xor r8b, byte [r11 + 3]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
mov ecx, 8
or dl, r8b
lea r8d, [r10 - 2]
add r10b, 0x16
mov byte [r11 + 3], dl
xor r10b, byte [r11 + 4]
and r8d, 7
movzx edx, r10b
sub ecx, r8d
shl dl, cl
movzx ecx, r8b
lea r11, [r11 + 7]
shr r10b, cl
lea rcx, [rbx + r11]
or dl, r10b
mov byte [r11 - 3], dl
cmp rcx, 0x15
jb 0x140011bc0
mov rbx, qword [rsp]
mov byte [rax + 0x16], 0
add rsp, 8
ret
Function at 0x140011d20
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
cmp byte [rcx + 0xf], 0
mov rax, rcx
je 0x140011e9f
mov qword [rsp], rbx
lea r11, [rcx + 2]
mov rbx, 0xfffffffffffffffe
sub rbx, rcx
nop dword [rax]
nop word [rax + rax]
lea r10, [rbx + r11]
mov ecx, 8
lea r8d, [r10 + 0x10]
mov r9d, r10d
xor r8b, byte [r11 - 2]
and r9d, 7
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [r10 + 1]
or dl, r8b
and r9d, 7
mov byte [r11 - 2], dl
lea r8d, [r10 + 0x11]
xor r8b, byte [r11 - 1]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [r10 + 2]
or dl, r8b
and r9d, 7
mov byte [r11 - 1], dl
lea r8d, [r10 + 0x12]
xor r8b, byte [r11]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [r10 + 3]
or dl, r8b
and r9d, 7
mov byte [r11], dl
lea r8d, [r10 + 0x13]
xor r8b, byte [r11 + 1]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [r10 - 4]
or dl, r8b
and r9d, 7
mov byte [r11 + 1], dl
lea r8d, [r10 + 0x14]
xor r8b, byte [r11 + 2]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [r10 - 3]
or dl, r8b
and r9d, 7
mov byte [r11 + 2], dl
lea r8d, [r10 + 0x15]
xor r8b, byte [r11 + 3]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
mov ecx, 8
or dl, r8b
lea r8d, [r10 - 2]
add r10b, 0x16
mov byte [r11 + 3], dl
xor r10b, byte [r11 + 4]
and r8d, 7
movzx edx, r10b
sub ecx, r8d
shl dl, cl
movzx ecx, r8b
lea r11, [r11 + 7]
shr r10b, cl
lea rcx, [rbx + r11]
or dl, r10b
mov byte [r11 - 3], dl
cmp rcx, 0xe
jb 0x140011d50
mov rbx, qword [rsp]
mov byte [rax + 0xf], 0
add rsp, 8
ret
Function at 0x140011eb0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
cmp byte [rcx + 0x2e], 0
mov rax, rcx
je 0x14001207a
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov rsi, 0xfffffffffffffffe
mov qword [rsp], rdi
sub rsi, rcx
lea rdi, [rcx + 2]
nop dword [rax]
lea rbx, [rsi + rdi]
mov r10d, 8
lea r8d, [rbx + 0x10]
mov r11d, ebx
xor r8b, byte [rdi - 2]
lea r9d, [rbx + 1]
movzx edx, r8b
and r9d, 7
and r11d, 7
movzx ecx, r11b
sub r10d, r11d
shr dl, cl
mov ecx, r10d
shl r8b, cl
mov ecx, 8
or dl, r8b
sub ecx, r9d
mov byte [rdi - 2], dl
lea r8d, [rbx + 0x11]
xor r8b, byte [rdi - 1]
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx + 2]
or dl, r8b
and r9d, 7
mov byte [rdi - 1], dl
lea r8d, [rbx + 0x12]
xor r8b, byte [rdi]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx + 3]
or dl, r8b
and r9d, 7
mov byte [rdi], dl
lea r8d, [rbx + 0x13]
xor r8b, byte [rdi + 1]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx - 4]
or dl, r8b
and r9d, 7
mov byte [rdi + 1], dl
lea r8d, [rbx + 0x14]
xor r8b, byte [rdi + 2]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx - 3]
or dl, r8b
and r9d, 7
mov byte [rdi + 2], dl
lea r8d, [rbx + 0x15]
xor r8b, byte [rdi + 3]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx - 2]
or dl, r8b
and r9d, 7
lea r8d, [rbx + 0x16]
mov byte [rdi + 3], dl
xor r8b, byte [rdi + 4]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
lea rdi, [rdi + 9]
movzx ecx, r9b
lea r9d, [rbx - 1]
shr r8b, cl
and r9d, 7
or dl, r8b
mov ecx, 8
mov byte [rdi - 5], dl
lea r8d, [rbx + 0x17]
xor r8b, byte [rdi - 4]
sub ecx, r9d
add bl, 0x18
movzx edx, r8b
xor bl, byte [rdi - 3]
shl dl, cl
movzx ecx, r9b
shr r8b, cl
movzx ecx, r11b
or dl, r8b
mov byte [rdi - 4], dl
movzx edx, bl
shr dl, cl
mov ecx, r10d
shl bl, cl
lea rcx, [rsi + rdi]
or dl, bl
mov byte [rdi - 3], dl
cmp rcx, 0x2d
jb 0x140011ee0
mov rdi, qword [rsp]
mov rsi, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x10]
mov byte [rax + 0x2e], 0
add rsp, 8
ret
Function at 0x140012110
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
cmp byte [rcx + 0x17], 0
mov rax, rcx
je 0x140012330
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov rsi, 0xfffffffffffffffe
mov qword [rsp], rdi
sub rsi, rcx
lea rdi, [rcx + 2]
nop dword [rax]
lea rbx, [rsi + rdi]
mov r10d, 8
lea r8d, [rbx + 0x10]
mov r11d, ebx
xor r8b, byte [rdi - 2]
lea r9d, [rbx + 1]
movzx edx, r8b
and r9d, 7
and r11d, 7
sub r10d, r11d
mov ecx, r10d
shl dl, cl
movzx ecx, r11b
shr r8b, cl
mov ecx, 8
or dl, r8b
sub ecx, r9d
mov byte [rdi - 2], dl
lea r8d, [rbx + 0x11]
xor r8b, byte [rdi - 1]
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx + 2]
or dl, r8b
and r9d, 7
mov byte [rdi - 1], dl
lea r8d, [rbx + 0x12]
xor r8b, byte [rdi]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx + 3]
or dl, r8b
and r9d, 7
mov byte [rdi], dl
lea r8d, [rbx + 0x13]
xor r8b, byte [rdi + 1]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx - 4]
or dl, r8b
and r9d, 7
mov byte [rdi + 1], dl
lea r8d, [rbx + 0x14]
xor r8b, byte [rdi + 2]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx - 3]
or dl, r8b
and r9d, 7
mov byte [rdi + 2], dl
lea r8d, [rbx + 0x15]
xor r8b, byte [rdi + 3]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx - 2]
or dl, r8b
and r9d, 7
lea r8d, [rbx + 0x16]
mov byte [rdi + 3], dl
xor r8b, byte [rdi + 4]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
lea rdi, [rdi + 0xb]
movzx ecx, r9b
lea r9d, [rbx - 1]
shr r8b, cl
and r9d, 7
or dl, r8b
mov ecx, 8
sub ecx, r9d
mov byte [rdi - 7], dl
lea r8d, [rbx + 0x17]
xor r8b, byte [rdi - 6]
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx + 1]
or dl, r8b
mov ecx, r10d
mov byte [rdi - 6], dl
lea r8d, [rbx + 0x18]
xor r8b, byte [rdi - 5]
and r9d, 7
movzx edx, r8b
shl dl, cl
movzx ecx, r11b
shr r8b, cl
mov ecx, 8
or dl, r8b
sub ecx, r9d
mov byte [rdi - 5], dl
lea r8d, [rbx + 0x19]
xor r8b, byte [rdi - 4]
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
mov ecx, 8
or dl, r8b
lea r8d, [rbx + 2]
mov byte [rdi - 4], dl
add bl, 0x1a
xor bl, byte [rdi - 3]
and r8d, 7
sub ecx, r8d
movzx edx, bl
shl dl, cl
movzx ecx, r8b
shr bl, cl
lea rcx, [rsi + rdi]
or dl, bl
mov byte [rdi - 3], dl
cmp rcx, 0x16
jb 0x140012140
mov rdi, qword [rsp]
mov rsi, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x10]
mov byte [rax + 0x17], 0
add rsp, 8
ret
Function at 0x140012340
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
cmp byte [rcx + 0x64], 0
mov rax, rcx
je 0x140012560
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov rsi, 0xfffffffffffffffe
mov qword [rsp], rdi
sub rsi, rcx
lea rdi, [rcx + 2]
nop dword [rax]
lea rbx, [rsi + rdi]
mov r10d, 8
lea r8d, [rbx + 0x10]
mov r11d, ebx
xor r8b, byte [rdi - 2]
lea r9d, [rbx + 1]
movzx edx, r8b
and r9d, 7
and r11d, 7
sub r10d, r11d
mov ecx, r10d
shl dl, cl
movzx ecx, r11b
shr r8b, cl
mov ecx, 8
or dl, r8b
sub ecx, r9d
mov byte [rdi - 2], dl
lea r8d, [rbx + 0x11]
xor r8b, byte [rdi - 1]
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx + 2]
or dl, r8b
and r9d, 7
mov byte [rdi - 1], dl
lea r8d, [rbx + 0x12]
xor r8b, byte [rdi]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx + 3]
or dl, r8b
and r9d, 7
mov byte [rdi], dl
lea r8d, [rbx + 0x13]
xor r8b, byte [rdi + 1]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx - 4]
or dl, r8b
and r9d, 7
mov byte [rdi + 1], dl
lea r8d, [rbx + 0x14]
xor r8b, byte [rdi + 2]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx - 3]
or dl, r8b
and r9d, 7
mov byte [rdi + 2], dl
lea r8d, [rbx + 0x15]
xor r8b, byte [rdi + 3]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx - 2]
or dl, r8b
and r9d, 7
lea r8d, [rbx + 0x16]
mov byte [rdi + 3], dl
xor r8b, byte [rdi + 4]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
lea rdi, [rdi + 0xb]
movzx ecx, r9b
lea r9d, [rbx - 1]
shr r8b, cl
and r9d, 7
or dl, r8b
mov ecx, 8
sub ecx, r9d
mov byte [rdi - 7], dl
lea r8d, [rbx + 0x17]
xor r8b, byte [rdi - 6]
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx + 1]
or dl, r8b
mov ecx, r10d
mov byte [rdi - 6], dl
lea r8d, [rbx + 0x18]
xor r8b, byte [rdi - 5]
and r9d, 7
movzx edx, r8b
shl dl, cl
movzx ecx, r11b
shr r8b, cl
mov ecx, 8
or dl, r8b
sub ecx, r9d
mov byte [rdi - 5], dl
lea r8d, [rbx + 0x19]
xor r8b, byte [rdi - 4]
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
mov ecx, 8
or dl, r8b
lea r8d, [rbx + 2]
mov byte [rdi - 4], dl
add bl, 0x1a
xor bl, byte [rdi - 3]
and r8d, 7
sub ecx, r8d
movzx edx, bl
shl dl, cl
movzx ecx, r8b
shr bl, cl
lea rcx, [rsi + rdi]
or dl, bl
mov byte [rdi - 3], dl
cmp rcx, 0x63
jb 0x140012370
mov rdi, qword [rsp]
mov rsi, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x10]
mov byte [rax + 0x64], 0
add rsp, 8
ret
Function at 0x140012570
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
cmp byte [rcx + 0x37], 0
mov rax, rcx
je 0x14001273a
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov rsi, 0xfffffffffffffffe
mov qword [rsp], rdi
sub rsi, rcx
lea rdi, [rcx + 2]
nop dword [rax]
lea rbx, [rsi + rdi]
mov r10d, 8
lea r8d, [rbx + 0x10]
mov r11d, ebx
xor r8b, byte [rdi - 2]
lea r9d, [rbx + 1]
movzx edx, r8b
and r9d, 7
and r11d, 7
movzx ecx, r11b
sub r10d, r11d
shr dl, cl
mov ecx, r10d
shl r8b, cl
mov ecx, 8
or dl, r8b
sub ecx, r9d
mov byte [rdi - 2], dl
lea r8d, [rbx + 0x11]
xor r8b, byte [rdi - 1]
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx + 2]
or dl, r8b
and r9d, 7
mov byte [rdi - 1], dl
lea r8d, [rbx + 0x12]
xor r8b, byte [rdi]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx + 3]
or dl, r8b
and r9d, 7
mov byte [rdi], dl
lea r8d, [rbx + 0x13]
xor r8b, byte [rdi + 1]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx - 4]
or dl, r8b
and r9d, 7
mov byte [rdi + 1], dl
lea r8d, [rbx + 0x14]
xor r8b, byte [rdi + 2]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx - 3]
or dl, r8b
and r9d, 7
mov byte [rdi + 2], dl
lea r8d, [rbx + 0x15]
xor r8b, byte [rdi + 3]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx - 2]
or dl, r8b
and r9d, 7
lea r8d, [rbx + 0x16]
mov byte [rdi + 3], dl
xor r8b, byte [rdi + 4]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
lea rdi, [rdi + 9]
movzx ecx, r9b
lea r9d, [rbx - 1]
shr r8b, cl
and r9d, 7
or dl, r8b
mov ecx, 8
mov byte [rdi - 5], dl
lea r8d, [rbx + 0x17]
xor r8b, byte [rdi - 4]
sub ecx, r9d
add bl, 0x18
movzx edx, r8b
xor bl, byte [rdi - 3]
shl dl, cl
movzx ecx, r9b
shr r8b, cl
movzx ecx, r11b
or dl, r8b
mov byte [rdi - 4], dl
movzx edx, bl
shr dl, cl
mov ecx, r10d
shl bl, cl
lea rcx, [rsi + rdi]
or dl, bl
mov byte [rdi - 3], dl
cmp rcx, 0x36
jb 0x1400125a0
mov rdi, qword [rsp]
mov rsi, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x10]
mov byte [rax + 0x37], 0
add rsp, 8
ret

Function at 0x140012740
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xe], 0
mov r10, rcx
je 0x140012789
xor eax, eax
nop dword [rax + rax]
mov r9d, eax
lea r8d, [rax + 0x10]
xor r8b, byte [r10 + rax]
and r9d, 7
movzx edx, r8b
mov ecx, 8
sub ecx, r9d
shl dl, cl
movzx ecx, r9b
shr r8b, cl
or dl, r8b
mov byte [r10 + rax], dl
inc rax
cmp rax, 0xd
jb 0x140012750
mov byte [r10 + 0xe], 0
ret
Function at 0x140012790
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
cmp byte [rcx + 0x19], 0
mov rax, rcx
je 0x1400129db
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov rsi, 0xfffffffffffffffe
mov qword [rsp], rdi
sub rsi, rcx
lea rdi, [rcx + 2]
nop dword [rax]
lea rbx, [rdi + rsi]
mov r10d, 8
lea r8d, [rbx + 0x10]
mov r11d, ebx
xor r8b, byte [rdi - 2]
lea r9d, [rbx + 1]
movzx edx, r8b
and r9d, 7
and r11d, 7
movzx ecx, r11b
sub r10d, r11d
shr dl, cl
mov ecx, r10d
shl r8b, cl
mov ecx, 8
or dl, r8b
sub ecx, r9d
mov byte [rdi - 2], dl
lea r8d, [rbx + 0x11]
xor r8b, byte [rdi - 1]
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx + 2]
or dl, r8b
and r9d, 7
mov byte [rdi - 1], dl
lea r8d, [rbx + 0x12]
xor r8b, byte [rdi]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx + 3]
or dl, r8b
and r9d, 7
mov byte [rdi], dl
lea r8d, [rbx + 0x13]
xor r8b, byte [rdi + 1]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx - 4]
or dl, r8b
and r9d, 7
mov byte [rdi + 1], dl
lea r8d, [rbx + 0x14]
xor r8b, byte [rdi + 2]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx - 3]
or dl, r8b
and r9d, 7
mov byte [rdi + 2], dl
lea r8d, [rbx + 0x15]
xor r8b, byte [rdi + 3]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx - 2]
or dl, r8b
and r9d, 7
lea r8d, [rbx + 0x16]
mov byte [rdi + 3], dl
xor r8b, byte [rdi + 4]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
lea rdi, [rdi + 0xc]
movzx ecx, r9b
lea r9d, [rbx - 1]
shr r8b, cl
and r9d, 7
or dl, r8b
mov ecx, 8
sub ecx, r9d
mov byte [rdi - 8], dl
lea r8d, [rbx + 0x17]
xor r8b, byte [rdi - 7]
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx + 1]
or dl, r8b
and r9d, 7
mov byte [rdi - 7], dl
lea r8d, [rbx + 0x18]
xor r8b, byte [rdi - 6]
movzx ecx, r11b
movzx edx, r8b
shr dl, cl
mov ecx, r10d
shl r8b, cl
mov ecx, 8
or dl, r8b
sub ecx, r9d
mov byte [rdi - 6], dl
lea r8d, [rbx + 0x19]
xor r8b, byte [rdi - 5]
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [rbx + 2]
or dl, r8b
and r9d, 7
mov byte [rdi - 5], dl
lea r8d, [rbx + 0x1a]
xor r8b, byte [rdi - 4]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
mov ecx, 8
or dl, r8b
lea r8d, [rbx + 3]
mov byte [rdi - 4], dl
add bl, 0x1b
xor bl, byte [rdi - 3]
and r8d, 7
sub ecx, r8d
movzx edx, bl
shl dl, cl
movzx ecx, r8b
shr bl, cl
lea rcx, [rdi + rsi]
or dl, bl
mov byte [rdi - 3], dl
cmp rcx, 0x18
jb 0x1400127c0
mov rdi, qword [rsp]
mov rsi, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x10]
mov byte [rax + 0x19], 0
add rsp, 8
ret