joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400097dc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov r14, rdx
mov rsi, r8
lea rdx, [0x1400113f4]
mov rdi, rcx
xor r13d, r13d
call fcn.140001990
lea ecx, [r13 + 0x10]
mov dword [rbp - 0x20], 0x739573d4
mov dword [rbp - 0x1c], 0x7392739b
mov ebx, 0x73f6
mov dword [rbp - 0x18], 0x73cc73d4
mov dword [rbp - 0x14], 0x73f673d4
mov dword [rbp - 0x10], 0x8ec173f6
call fcn.1400026b0
lea r8, [rbp - 0x20]
mov rdx, rax
sub r8, rax
lea r9d, [r13 + 8]
lea r15d, [r13 + 2]
lea r10d, [r13 + 1]
mov ecx, ebx
xor cx, word [r8 + rdx]
mov word [rdx], cx
add rdx, r15
sub r9, r10
jne 0x14000985a
mov rdx, rax
mov rcx, rdi
call fcn.140001990
mov rcx, rsi
call fcn.1400079f0
mov rdx, rax
mov rcx, rdi
mov rbx, rax
call fcn.1400019e4
mov rcx, rbx
call fcn.1400025b4
lea rdx, [0x1400113f8]
mov rcx, rdi
call fcn.140001990
mov rdx, rsi
mov rcx, r14
call fcn.140009224
test al, al
movzx r12d, r13b
mov eax, 1
lea rbx, [r14 + 8]
mov rdx, r15
mov rcx, rbx
cmovne r12d, eax
call fcn.14000e6f0
mov rcx, rax
mov r8, r15
xor edx, edx
call fcn.140002554
lea r15, [r14 + 0x30]
mov esi, 2
mov edx, esi
mov rcx, r15
call fcn.14000e6f0
mov rcx, rax
mov r8d, esi
xor edx, edx
call fcn.140002554
mov esi, r13d
cmp qword [r14 + 0x18], r13
je 0x14000990f
cmp qword [r14 + 0x18], 2
jb 0x14000992b
mov rax, qword [rbx]
jmp 0x140009923
cmp qword [r14 + 0x40], r13
je 0x1400099d7
cmp qword [r14 + 0x40], 2
jb 0x14000992b
mov rax, qword [r15]
cmp byte [rax + 1], r13b
sete sil
lea rcx, [rbp + 0x38]
call fcn.140007ed4
mov rdx, rax
mov rcx, rdi
call fcn.140001990
test esi, esi
je 0x140009950
mov rdx, qword [rbx]
mov rcx, rdi
call fcn.1400019e4
jmp 0x14000996e
mov rcx, qword [rbx]
call fcn.1400079f0
mov rdx, rax
mov rcx, rdi
mov rbx, rax
call fcn.1400019e4
mov rcx, rbx
call fcn.1400025b4
lea rdx, [0x1400113f8]
mov rcx, rdi
call fcn.140001990
lea rcx, [rbp + 0x38]
call fcn.140008c54
mov rdx, rax
mov rcx, rdi
call fcn.140001990
test esi, esi
je 0x1400099a2
mov rdx, qword [r15]
mov rcx, rdi
call fcn.1400019e4
jmp 0x1400099c0
mov rcx, qword [r15]
call fcn.1400079f0
mov rdx, rax
mov rcx, rdi
mov rbx, rax
call fcn.1400019e4
mov rcx, rbx
call fcn.1400025b4
lea rdx, [0x1400113f8]
mov rcx, rdi
call fcn.140001990
mov qword [r14 + 0x18], r13
mov qword [r14 + 0x40], r13
lea rcx, [rbp + 0x38]
call fcn.14000876c
mov r8d, dword [r14 + 0x60]
mov rdx, rax
mov rcx, rdi
call fcn.140001a70
lea rdx, [0x140011404]
mov rcx, rdi
call fcn.140001990
lea r11, [rsp + 0x40]
mov al, r12b
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x14000a78c
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov r12, rdx
lea rdi, [rbp - 0x40]
mov r13, rcx
mov al, 0x41
mov byte [rdi], al
inc rdi
inc al
cmp al, 0x5a
jle 0x14000a7b4
mov al, 0x61
lea rcx, [rbp - 0x26]
mov byte [rcx], al
inc rcx
inc al
cmp al, 0x7a
jle 0x14000a7c5
mov al, 0x30
lea rcx, [rbp - 0xc]
mov byte [rcx], al
inc rcx
inc al
cmp al, 0x39
jle 0x14000a7d6
lea rcx, [rdx*4]
mov word [rbp - 2], 0x2f2b
xor ebx, ebx
xor r14d, r14d
call fcn.1400025dc
xor r11d, r11d
mov r15, rax
test r12, r12
je 0x14000a952
mov eax, r11d
lea esi, [rbx + 3]
mov r10d, r11d
mov cl, byte [r13]
dec r12
mov byte [rbp + rax + 0x48], cl
inc ebx
mov r9b, byte [rbp + 0x4a]
inc rax
mov dl, byte [rbp + 0x49]
inc r13
mov dil, byte [rbp + 0x48]
cmp rax, rsi
jne 0x14000a894
mov al, dil
mov cl, dil
shr al, 2
and cl, sil
mov byte [rbp + 0x58], al
mov r8, r11
shl cl, 4
mov al, dl
shr al, 4
add cl, al
mov al, r9b
mov byte [rbp + 0x59], cl
mov cl, dl
shr al, 6
and cl, 0xf
shl cl, 2
add cl, al
mov al, r9b
and al, 0x3f
mov byte [rbp + 0x5a], cl
mov byte [rbp + 0x5b], al
add r14d, 4
movzx eax, byte [rbp + r8 + 0x58]
inc r8
movzx ecx, byte [rbp + rax - 0x40]
mov word [r15 + r10*2], cx
inc r10
cmp r8, 4
jl 0x14000a872
mov ebx, r11d
mov rax, r11
test r12, r12
jne 0x14000a811
test ebx, ebx
jle 0x14000a952
cmp ebx, esi
jge 0x14000a8cf
mov eax, esi
movsxd rcx, ebx
sub eax, ebx
xor edx, edx
movsxd r8, eax
lea rax, [rbp + 0x48]
add rcx, rax
call fcn.140002554
mov r9b, byte [rbp + 0x4a]
xor r11d, r11d
mov dl, byte [rbp + 0x49]
mov dil, byte [rbp + 0x48]
mov al, dil
lea ecx, [rbx + 1]
shr al, 2
and dil, sil
mov byte [rbp + 0x58], al
mov al, dl
shr al, 4
and dl, 0xf
shl dil, 4
add dil, al
shl dl, 2
mov al, r9b
mov byte [rbp + 0x59], dil
shr al, 6
and r9b, 0x3f
add dl, al
mov byte [rbp + 0x5b], r9b
mov byte [rbp + 0x5a], dl
movsxd r8, ecx
test ecx, ecx
jle 0x14000a934
movsxd rax, r14d
mov rdx, r11
add r14d, ecx
lea rdi, [r15 + rax*2]
movzx eax, byte [rbp + rdx + 0x58]
inc rdx
movzx ecx, byte [rbp + rax - 0x40]
mov word [rdi], cx
lea rdi, [rdi + 2]
cmp rdx, r8
jl 0x14000a91b
cmp ebx, esi
jge 0x14000a952
movsxd rax, r14d
sub esi, ebx
movsxd rcx, esi
add r14d, esi
lea rdi, [r15 + rax*2]
mov eax, 0x3d
movzx eax, ax
rep stosw word [rdi], ax
mov rcx, qword [rbp + 0x50]
movsxd rax, r14d
mov word [r15 + rax*2], r11w
test rcx, rcx
je 0x14000a966
mov qword [rcx], rax
mov rbx, qword [rsp + 0xa0]
mov rax, r15
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000a988
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, SafeArrayGetElement
mov dword [rbp - 0x20], 0x7281728f
mov dword [rbp - 0x1c], 0x72f772e2
mov ebx, 0x72a3
mov dword [rbp - 0x18], 0x728172f1
mov dword [rbp - 0x14], 0x72837299
mov dword [rbp - 0x10], 0x72a37281
mov dword [rbp - 0xc], 0x8fc172a3
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xa
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000a9de
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14000aa00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov ebx, 0x72d4
mov dword [rbp - 0x50], 0x72f672f8
mov ecx, 0x3e
mov dword [rbp - 0x14], ebx
mov dword [rbp - 0x4c], 0x72b172b9
mov dword [rbp - 0x48], 0x72bc72a0
mov dword [rbp - 0x44], 0x72b072bb
mov dword [rbp - 0x40], 0x72ee72f6
mov dword [rbp - 0x3c], 0x72f672f4
mov dword [rbp - 0x38], 0x72977287
mov dword [rbp - 0x34], 0x72a672b5
mov dword [rbp - 0x30], 0x729872b0
mov dword [rbp - 0x2c], 0x72a772bd
mov dword [rbp - 0x28], 0x728672a0
mov dword [rbp - 0x24], 0x72b572b1
mov dword [rbp - 0x20], 0x72b172b0
mov dword [rbp - 0x1c], 0x72a772a6
mov dword [rbp - 0x18], 0x72f67283
mov dword [rbp - 0x10], 0x8fc172d4
call fcn.1400026b0
lea r9, [rbp - 0x50]
mov rdx, rax
sub r9, rax
mov r8d, 0x1f
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000aa9f
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret

Function at 0x14000aac4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x72ed
mov dword [rbp - 0x20], 0x72cf72c1
mov ecx, SafeArrayGetElement
mov dword [rbp - 0xc], ebx
mov dword [rbp - 0x1c], 0x729f7288
mov dword [rbp - 0x18], 0x7282729f
mov dword [rbp - 0x14], 0x72cf729f
mov dword [rbp - 0x10], 0x72cd72d7
mov dword [rbp - 8], 0x8fc172ed
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xb
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000ab1d
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14000ab3c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ecx, 0x20
mov dword [rbp - 0x30], 0x72f972a8
mov dword [rbp - 0x2c], 0x72eb72e7
mov ebx, 0x728a
mov dword [rbp - 0x28], 0x72fe72f8
mov dword [rbp - 0x24], 0x72e972d5
mov dword [rbp - 0x20], 0x72f872eb
mov dword [rbp - 0x1c], 0x72f972ee
mov dword [rbp - 0x18], 0x72b072a8
mov dword [rbp - 0x14], 0x728a72f1
mov dword [rbp - 0x10], 0x8fc1728a
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, 0x10
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000aba7
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
Function at 0x14000abc8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, SafeArrayGetElement
mov dword [rbp - 0x20], 0x72f472b8
mov dword [rbp - 0x1c], 0x72f772fb
mov ebx, 0x729a
mov dword [rbp - 0x18], 0x72b872ff
mov dword [rbp - 0x14], 0x72ba72a0
mov dword [rbp - 0x10], 0x729a72b8
mov dword [rbp - 0xc], 0x8fc1729a
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xa
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000ac1e
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14000ac40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov dword [rbp - 0x20], 0x728c7282
mov dword [rbp - 0x1c], 0x72cf72cd
mov ebx, 0x72ae
mov dword [rbp - 0x18], 0x72ca72dc
mov dword [rbp - 0x14], 0x728c72dd
mov dword [rbp - 0x10], 0x728e7294
mov dword [rbp - 0xc], 0x72ae72f5
mov dword [rbp - 8], 0x8fc172ae
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xc
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000ac9d
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14000acbc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, 0x1c
mov dword [rbp - 0x20], 0x72b672b8
mov dword [rbp - 0x1c], 0x72f172e6
mov ebx, 0x7294
mov dword [rbp - 0x18], 0x72f072f5
mov dword [rbp - 0x14], 0x72e672f1
mov dword [rbp - 0x10], 0x72b672e7
mov dword [rbp - 0xc], 0x72b472ae
mov dword [rbp - 8], 0x729472cf
mov dword [rbp - 4], 0x8fc17294
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xe
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000ad20
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14000ad40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x72dd
mov dword [rbp - 0x20], 0x72be72ff
mov ecx, SafeArrayGetElement
mov dword [rbp - 0xc], ebx
mov dword [rbp - 0x1c], 0x72af72bc
mov dword [rbp - 0x18], 0x72ae72b9
mov dword [rbp - 0x14], 0x72e772ff
mov dword [rbp - 0x10], 0x728672fd
mov dword [rbp - 8], 0x8fc172dd
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xb
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000ad99
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x14000adb8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov dword [rbp - 0x20], 0x72e372ed
mov dword [rbp - 0x1c], 0x72a072a2
mov ebx, 0x72c1
mov dword [rbp - 0x18], 0x72a572b3
mov dword [rbp - 0x14], 0x72e372b2
mov dword [rbp - 0x10], 0x72e172fb
mov dword [rbp - 0xc], 0x72c1729a
mov dword [rbp - 8], 0x8fc172c1
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xc
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000ae15
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14000ae34
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x72f3
mov dword [rbp - 0x20], 0x72d172df
mov ecx, SafeArrayGetElement
mov dword [rbp - 0xc], ebx
mov dword [rbp - 0x1c], 0x72817296
mov dword [rbp - 0x18], 0x729c7281
mov dword [rbp - 0x14], 0x72d17281
mov dword [rbp - 0x10], 0x72d372c9
mov dword [rbp - 8], 0x8fc172f3
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xb
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000ae8d
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14000aeac
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov ebx, 0x72bd
mov dword [rbp - 0x40], 0x729f7291
mov ecx, 0x3a
mov dword [rbp - 8], ebx
mov dword [rbp - 0x3c], 0x72d872d0
mov dword [rbp - 0x38], 0x72d572c9
mov dword [rbp - 0x34], 0x72d972d2
mov dword [rbp - 0x30], 0x7287729f
mov dword [rbp - 0x2c], 0x729f729d
mov dword [rbp - 0x28], 0x72fe72ee
mov dword [rbp - 0x24], 0x72cf72dc
mov dword [rbp - 0x20], 0x72f172d9
mov dword [rbp - 0x1c], 0x72ce72d4
mov dword [rbp - 0x18], 0x72fe72c9
mov dword [rbp - 0x14], 0x72cf72dc
mov dword [rbp - 0x10], 0x72ce72d9
mov dword [rbp - 0xc], 0x729f72ea
mov dword [rbp - 4], 0x8fc172bd
call fcn.1400026b0
lea r9, [rbp - 0x40]
mov rdx, rax
sub r9, rax
mov r8d, 0x1d
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000af44
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret

Function at 0x14000af64
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ecx, 0x20
mov dword [rbp - 0x30], 0x72f572fb
mov dword [rbp - 0x2c], 0x72b972be
mov ebx, 0x72d7
mov dword [rbp - 0x28], 0x72a572a3
mov dword [rbp - 0x24], 0x72b372b8
mov dword [rbp - 0x20], 0x72b472a2
mov dword [rbp - 0x1c], 0x72b372b2
mov dword [rbp - 0x18], 0x72ed72f5
mov dword [rbp - 0x14], 0x72d772ac
mov dword [rbp - 0x10], 0x8fc172d7
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, 0x10
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000afcf
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
Function at 0x14000aff0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov ecx, 0x38
mov dword [rbp - 0x40], 0x728172ce
mov dword [rbp - 0x3c], 0x72987289
mov ebx, 0x72ec
mov dword [rbp - 0x38], 0x72837284
mov dword [rbp - 0x34], 0x72ce7288
mov dword [rbp - 0x30], 0x72cc72d6
mov dword [rbp - 0x2c], 0x72bf72ce
mov dword [rbp - 0x28], 0x728d72af
mov dword [rbp - 0x24], 0x7288729e
mov dword [rbp - 0x20], 0x728572a0
mov dword [rbp - 0x1c], 0x7298729f
mov dword [rbp - 0x18], 0x728d72af
mov dword [rbp - 0x14], 0x7288729e
mov dword [rbp - 0x10], 0x72bb729f
mov dword [rbp - 0xc], 0x72ec72ce
mov dword [rbp - 8], 0x8fc172ec
call fcn.1400026b0
lea r9, [rbp - 0x40]
mov rdx, rax
sub r9, rax
mov r8d, 0x1c
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000b085
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret

Function at 0x14000b0a4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x72c6
mov dword [rbp - 0x20], 0x72e472ea
mov ecx, SafeArrayGetElement
mov dword [rbp - 0xc], ebx
mov dword [rbp - 0x1c], 0x72b472a3
mov dword [rbp - 0x18], 0x72a972b4
mov dword [rbp - 0x14], 0x72e472b4
mov dword [rbp - 0x10], 0x72e672fc
mov dword [rbp - 8], 0x8fc172c6
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xb
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000b0fd
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14000b11c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x72a2
mov dword [rbp - 0x20], 0x7280728e
mov ecx, 0x1a
mov dword [rbp - 8], ebx
mov dword [rbp - 0x1c], 0x72d672d1
mov dword [rbp - 0x18], 0x72d672c3
mov dword [rbp - 0x14], 0x728072c7
mov dword [rbp - 0x10], 0x72827298
mov dword [rbp - 0xc], 0x72c67287
mov dword [rbp - 4], 0x8fc172a2
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xd
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000b17c
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14000b19c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x72be
mov dword [rbp - 0x20], 0x729c7292
mov ecx, SafeArrayGetElement
mov dword [rbp - 0xc], ebx
mov dword [rbp - 0x1c], 0x72cc72db
mov dword [rbp - 0x18], 0x72d172cc
mov dword [rbp - 0x14], 0x729c72cc
mov dword [rbp - 0x10], 0x729e7284
mov dword [rbp - 8], 0x8fc172be
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xb
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000b1f5
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x14000b214
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x72d5
mov dword [rbp - 0x20], 0x72f772f9
mov ecx, SafeArrayGetElement
mov dword [rbp - 0xc], ebx
mov dword [rbp - 0x1c], 0x72a772b0
mov dword [rbp - 0x18], 0x72ba72a7
mov dword [rbp - 0x14], 0x72f772a7
mov dword [rbp - 0x10], 0x72f572ef
mov dword [rbp - 8], 0x8fc172d5
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xb
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000b26d
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14000b28c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov ebx, 0x72f2
mov dword [rbp - 0x50], 0x72d072de
mov ecx, 0x46
mov dword [rbp - 0xc], ebx
mov dword [rbp - 0x4c], 0x7297729f
mov dword [rbp - 0x48], 0x729a7286
mov dword [rbp - 0x44], 0x7296729d
mov dword [rbp - 0x40], 0x72c872d0
mov dword [rbp - 0x3c], 0x72d072d2
mov dword [rbp - 0x38], 0x72b172a1
mov dword [rbp - 0x34], 0x72807293
mov dword [rbp - 0x30], 0x72b77296
mov dword [rbp - 0x2c], 0x72867281
mov dword [rbp - 0x28], 0x72907293
mov dword [rbp - 0x24], 0x729b729e
mov dword [rbp - 0x20], 0x729a7281
mov dword [rbp - 0x1c], 0x729d72b1
mov dword [rbp - 0x18], 0x7286729c
mov dword [rbp - 0x14], 0x728a7297
mov dword [rbp - 0x10], 0x72d07286
mov dword [rbp - 8], 0x8fc172f2
call fcn.1400026b0
lea r9, [rbp - 0x50]
mov rdx, rax
sub r9, rax
mov r8d, 0x23
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000b33e
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret

Function at 0x14000b364
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov ebx, 0x72c5
mov dword [rbp - 0x50], 0x72e772e9
mov ecx, 0x46
mov dword [rbp - 0xc], ebx
mov dword [rbp - 0x4c], 0x72a072a8
mov dword [rbp - 0x48], 0x72ad72b1
mov dword [rbp - 0x44], 0x72a172aa
mov dword [rbp - 0x40], 0x72ff72e7
mov dword [rbp - 0x3c], 0x72e772e5
mov dword [rbp - 0x38], 0x72867296
mov dword [rbp - 0x34], 0x72b772a4
mov dword [rbp - 0x30], 0x728272a1
mov dword [rbp - 0x2c], 0x72b172a0
mov dword [rbp - 0x28], 0x72b17296
mov dword [rbp - 0x24], 0x72b172a4
mov dword [rbp - 0x20], 0x72b672b0
mov dword [rbp - 0x1c], 0x72ad7286
mov dword [rbp - 0x18], 0x72ab72a4
mov dword [rbp - 0x14], 0x72a072a2
mov dword [rbp - 0x10], 0x72e77292
mov dword [rbp - 8], 0x8fc172c5
call fcn.1400026b0
lea r9, [rbp - 0x50]
mov rdx, rax
sub r9, rax
mov r8d, 0x23
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000b416
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x14000b8f8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x7294
mov dword [rbp - 0x20], 0x72b872b6
mov ecx, 0x1a
mov dword [rbp - 8], ebx
mov dword [rbp - 0x1c], 0x72e072b6
mov dword [rbp - 0x18], 0x72b672e7
mov dword [rbp - 0x14], 0x72b172ae
mov dword [rbp - 0x10], 0x72e172f8
mov dword [rbp - 0xc], 0x72b872e9
mov dword [rbp - 4], 0x8fc17294
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xd
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000b958
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14000b978
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov ebx, 0x72a0
mov dword [rbp - 0x40], 0x72ed72fc
mov ecx, 0x36
mov dword [rbp - 0xc], ebx
mov dword [rbp - 0x3c], 0x72da72cf
mov dword [rbp - 0x38], 0x72cc72c9
mov dword [rbp - 0x34], 0x72c172cc
mov dword [rbp - 0x30], 0x72e672fc
mov dword [rbp - 0x2c], 0x72d272c9
mov dword [rbp - 0x28], 0x72c672c5
mov dword [rbp - 0x24], 0x72d872cf
mov dword [rbp - 0x20], 0x72f072fc
mov dword [rbp - 0x1c], 0x72cf72d2
mov dword [rbp - 0x18], 0x72c972c6
mov dword [rbp - 0x14], 0x72c572cc
mov dword [rbp - 0x10], 0x72fc72d3
mov dword [rbp - 8], 0x8fc172a0
call fcn.1400026b0
lea r9, [rbp - 0x40]
mov rdx, rax
sub r9, rax
mov r8d, 0x1b
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000ba09
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret

Function at 0x14000ba28
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov ecx, 0x34
mov dword [rbp - 0x40], 0x72cc72d7
mov dword [rbp - 0x3c], 0x72e472e4
mov ebx, 0x728b
mov dword [rbp - 0x38], 0x72e772ec
mov dword [rbp - 0x34], 0x72d772ee
mov dword [rbp - 0x30], 0x72e372c8
mov dword [rbp - 0x2c], 0x72e472f9
mov dword [rbp - 0x28], 0x72ee72e6
mov dword [rbp - 0x24], 0x72de72d7
mov dword [rbp - 0x20], 0x72ee72f8
mov dword [rbp - 0x1c], 0x72ab72f9
mov dword [rbp - 0x18], 0x72ea72cf
mov dword [rbp - 0x14], 0x72ea72ff
mov dword [rbp - 0x10], 0x728b72d7
mov dword [rbp - 0xc], 0x8fc1728b
call fcn.1400026b0
lea r9, [rbp - 0x40]
mov rdx, rax
sub r9, rax
mov r8d, 0x1a
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000bab6
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret

Function at 0x14000bad8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov dword [rbp - 0x20], 0x729772da
mov dword [rbp - 0x1c], 0x729d7288
mov ebx, 0x72f8
mov dword [rbp - 0x18], 0x7299728a
mov dword [rbp - 0x14], 0x72a072bf
mov dword [rbp - 0x10], 0x72c272da
mov dword [rbp - 0xc], 0x72f872a3
mov dword [rbp - 8], 0x8fc172f8
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xc
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000bb35
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret