joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180007aa0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x1800380b0]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov r9d, dword [rcx + 8]
xor ebp, ebp
mov rsi, rdx
mov qword [rsp + 0x48], rbp
mov r8, rdx
mov dword [rsp + 0x50], ebp
mov rdx, qword [rcx]
mov rdi, rcx
or r9d, 0x2001f
mov qword [rsp + 0x58], rbp
lea rcx, [rsp + 0x48]
call fcn.180007600
mov ebx, eax
test eax, eax
jne 0x180007bb7
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x40]
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x70]
mov qword [rsp + 0x28], rbp
xor edx, edx
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x40], 0x100
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x180007b91
nop dword [rax + rax]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.180007aa0
mov ebx, eax
test eax, eax
jne 0x180007bb7
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x40]
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x70]
mov qword [rsp + 0x28], rbp
xor edx, edx
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x40], 0x100
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x180007b40
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x180007ba6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], rbp
mov rdx, rsi
mov dword [rsp + 0x50], ebp
mov rcx, rdi
call fcn.1800064a0
mov ebx, eax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x180007bc7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.18000b0c0
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
Function at 0x180007bf0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rdi, rdx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1800064ce
mov r8, rdx
mov rdx, qword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x180007bf0
cmp byte [0x180039198], 0
jne 0x180006519
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180006509
lea rdx, [0x180023c98]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180039190], rax
mov byte [0x180039198], 1
jmp 0x180006520
mov rax, qword [0x180039190]
mov byte [0x180039198], 1
jmp 0x180006520
mov rax, qword [0x180039190]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x18000653f
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x180007c64
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180007c86
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180007c86
mov rcx, qword [rbx]
xor r9d, r9d
mov qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rcx + 8], 0
je 0x180007c86
mov rdx, rdi
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x40]
mov eax, 1
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x180007e90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x490
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rax, qword [0x1800380b0]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov r15, r9
mov rsi, r8
mov rbx, rdx
xor r14d, r14d
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x70], r14
xor edx, edx
lea r8d, [r14 + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x180007f1e
xor edx, edx
lea r8d, [r14 + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x180007f1e
call fcn.180005f00
mov ebx, eax
jmp 0x180008046
mov r8, r15
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x180007f3f
call fcn.180005f00
jmp 0x180008035
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x180007f62
call fcn.180005f00
jmp 0x180008035
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, ebx
jae 0x180007f84
mov ebx, 0x8007000e
jmp 0x180008037
mov ecx, eax
test eax, eax
je 0x180007fbc
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x180007fb2
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x180007fbc
lea rcx, [rsp + 0x70]
call fcn.180005df0
jmp 0x180007fc6
mov ecx, 0x80070216
call fcn.180002a10
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
jmp 0x180007fd9
cmp qword [rsp + 0x70], 0
jne 0x180007fe8
mov ebx, 0x8007000e
jmp 0x180008037
mov dword [rsp + 0x28], ebx
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, rsi
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x180008012
call fcn.180005f00
jmp 0x180008035
mov ecx, eax
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], r14w
mov r8d, dword [rsp + 0x4e0]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.180007ca0
mov ebx, eax
test rdi, rdi
je 0x180008046
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x18000805d
lea rcx, [rsp + 0x70]
call fcn.180006590
nop
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.18000b0c0
add rsp, 0x490
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x1800087f0
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x18], r8d
sub rsp, 0x38
mov rcx, qword [rcx]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], 4
mov r9d, 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x38
ret

Function at 0x180008830
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
mov r9, r8
mov r10, rdx
test r8, r8
jne 0x180008848
lea eax, [r8 + 0xd]
add rsp, 0x38
ret
xor r8d, r8d
mov rdx, r9
nop
or rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], 0
jne 0x180008854
inc eax
lea rdx, [rdx + rax*2]
lea r8d, [r8 + rax*2]
cmp eax, 1
jne 0x180008850
mov rcx, qword [rcx]
mov rdx, r10
mov dword [rsp + 0x28], r8d
xor r8d, r8d
mov qword [rsp + 0x20], r9
lea r9d, [rax + 6]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x38
ret
Function at 0x140022e10
Capabilities:
Check for software breakpoints

Disassembly:
push rbx
sub rsp, 0x20
mov rdx, qword [0x14020fb18]
mov rbx, r8
cmp rdx, qword [0x14020fb20]
je 0x140022eec
mov rdx, qword [rdx]
mov rcx, rdx
movzx eax, byte [rcx]
cmp al, 0xc3
je 0x140022e4c
cmp al, 0xcc
je 0x140022e9e
inc rcx
mov rax, rcx
sub rax, rdx
cmp rax, rdx
jbe 0x140022e33
mov rcx, qword [r8]
test rcx, rcx
je 0x140022e96
mov rdx, qword [r8 + 0x10]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x140022e84
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140022f38
mov rcx, r8
call fcn.14007b5ec
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
xor al, al
add rsp, 0x20
pop rbx
ret
mov rcx, qword [r8]
test rcx, rcx
je 0x140022ee4
mov rdx, qword [r8 + 0x10]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x140022ed2
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140022f38
mov rcx, r8
call fcn.14007b5ec
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
mov al, 1
add rsp, 0x20
pop rbx
ret
mov rcx, qword [r8]
test rcx, rcx
je 0x140022f32
mov rdx, qword [r8 + 0x10]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x140022f20
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140022f38
mov rcx, r8
call fcn.14007b5ec
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
add rsp, 0x20
pop rbx
ret
call qword [0x14007d928]
int3
Function at 0x140026d00
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rsi, rdx
mov rdi, rcx
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x140026e0b
movsxd rax, dword [rdx + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x140026e0b
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x20], xmm0
xor edx, edx
mov qword [rsp + 0x30], rdx
mov ecx, dword [rax + rsi + 0xb0]
test ecx, ecx
jne 0x140026d64
mov qword [rdi], rdx
mov qword [rdi + 8], rdx
mov qword [rdi + 0x10], rdx
jmp 0x140026e18
lea rbx, [rsi + rcx]
mov ebp, dword [rax + rsi + 0xb4]
add rbp, rbx
mov eax, dword [rbx]
mov rcx, qword [rsp + 0x28]
test eax, eax
je 0x140026df9
nop dword [rax]
mov r8d, eax
cmp r8, rbp
jae 0x140026df9
mov r9d, dword [rbx + 4]
test r9d, r9d
je 0x140026df9
lea rax, [r8 + rsi]
mov qword [rsp + 0x38], rax
lea rax, [rbx + 8]
mov qword [rsp + 0x40], rax
lea rax, [r9 - 8]
shr rax, 1
mov dword [rsp + 0x48], eax
cmp rcx, rdx
je 0x140026dd1
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rcx], xmm0
movsd xmm1, qword [rsp + 0x48]
movsd qword [rcx + 0x10], xmm1
add rcx, 0x18
mov qword [rsp + 0x28], rcx
jmp 0x140026ded
lea r8, [rsp + 0x38]
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.140027400
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
mov eax, dword [rbx + 4]
add rbx, rax
mov eax, dword [rbx]
test eax, eax
jne 0x140026d80
mov rax, qword [rsp + 0x20]
mov qword [rdi], rax
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], rdx
jmp 0x140026e18
xor edx, edx
mov qword [rcx], rdx
mov qword [rcx + 8], rdx
mov qword [rcx + 0x10], rdx
mov rax, rdi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x14002a690
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xb], 0
je 0x14002a6b3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 9]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xa
jb 0x14002a6a0
mov byte [rcx + 0xb], 0
ret
Function at 0x14002aff0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rbx, rcx
lea r8, str.Failure
xor ecx, ecx
lea rdx, str.Protection_Error_0x137
mov r9d, 0x10
call qword [0x14007d570]
mov ecx, 0x1388
call qword [0x14007d110]
xor ecx, ecx
mov dword [rsp + 0x34], 0
call qword [0x14007d280]
lea r9, [rsp + 0x34]
mov edx, 0x1000
mov rcx, rax
mov r8d, 4
mov rdi, rax
call qword [0x14007d3c8]
xor eax, eax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov ecx, 0x1000
rep stosb byte [rdi], al
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0x10]
lea ecx, [r8 + 0x13]
mov eax, dword [rdx + 0x30]
add eax, 0x100000
mov dword [rdx + 0x40], eax
mov dl, 1
call qword [0x14007db10]
lea rax, [rsp + 0x38]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 6
mov ecx, 0xc0000420
call qword [0x14007db20]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x14002b0e4
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x14002b0df
mov rdi, qword [rcx - 8]
add rdx, 0x27
sub rcx, rdi
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14002b102
mov rcx, rdi
call fcn.14007b5ec
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
call qword [0x14007d928]
int3
Function at 0x14002e9b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx + 0x2b], 0
mov rbx, rdx
je 0x14002e9e5
xor r8d, r8d
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 + 0xb]
xor byte [r8 + rcx], al
inc r8
cmp r8, 0x2a
jb 0x14002e9d0
mov byte [rcx + 0x2b], 0
lea rax, [rcx + 0x2a]
mov qword [rdx + 0x10], 0
mov qword [rdx + 0x18], 0xf
mov byte [rdx], 0
cmp rcx, rax
je 0x14002ea12
mov rdx, rcx
mov r8d, 0x2a
mov rcx, rbx
call fcn.1400233b0
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x14002ea20
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 7], 0
je 0x14002ea43
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xb]
xor byte [rax + rcx], dl
inc rax
cmp rax, 6
jb 0x14002ea30
mov byte [rcx + 7], 0
ret

Function at 0x14002ea50
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x11], 0
je 0x14002ea73
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xb]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x10
jb 0x14002ea60
mov byte [rcx + 0x11], 0
ret

Function at 0x14002ea80
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx + 0x11], 0
mov rbx, rdx
je 0x14002eab5
xor r8d, r8d
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 + 0xb]
xor byte [r8 + rcx], al
inc r8
cmp r8, 0x10
jb 0x14002eaa0
mov byte [rcx + 0x11], 0
lea rax, [rcx + 0x10]
mov qword [rdx + 0x10], 0
mov qword [rdx + 0x18], 0xf
mov byte [rdx], 0
cmp rcx, rax
je 0x14002eae2
mov rdx, rcx
mov r8d, 0x10
mov rcx, rbx
call fcn.1400233b0
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x14002eaf0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx + 0x15], 0
mov rbx, rdx
je 0x14002eb25
xor r8d, r8d
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 + 0xb]
xor byte [r8 + rcx], al
inc r8
cmp r8, 0x14
jb 0x14002eb10
mov byte [rcx + 0x15], 0
lea rax, [rcx + 0x14]
mov qword [rdx + 0x10], 0
mov qword [rdx + 0x18], 0xf
mov byte [rdx], 0
cmp rcx, rax
je 0x14002eb52
mov rdx, rcx
mov r8d, 0x14
mov rcx, rbx
call fcn.1400233b0
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x14002eb60
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 4], 0
je 0x14002eb83
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xb]
xor byte [rax + rcx], dl
inc rax
cmp rax, 3
jb 0x14002eb70
mov byte [rcx + 4], 0
ret

Function at 0x14002eb90
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x10], 0
je 0x14002ebb3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xb]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xf
jb 0x14002eba0
mov byte [rcx + 0x10], 0
ret

Function at 0x14002ebc0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx + 0x10], 0
mov rbx, rdx
je 0x14002ebf5
xor r8d, r8d
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 + 0xb]
xor byte [r8 + rcx], al
inc r8
cmp r8, 0xf
jb 0x14002ebe0
mov byte [rcx + 0x10], 0
lea rax, [rcx + 0xf]
mov qword [rdx + 0x10], 0
mov qword [rdx + 0x18], 0xf
mov byte [rdx], 0
cmp rcx, rax
je 0x14002ec22
mov rdx, rcx
mov r8d, 0xf
mov rcx, rbx
call fcn.1400233b0
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x14002ec30
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx + 0x14], 0
mov rbx, rdx
je 0x14002ec65
xor r8d, r8d
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 + 0xb]
xor byte [r8 + rcx], al
inc r8
cmp r8, 0x13
jb 0x14002ec50
mov byte [rcx + 0x14], 0
lea rax, [rcx + 0x13]
mov qword [rdx + 0x10], 0
mov qword [rdx + 0x18], 0xf
mov byte [rdx], 0
cmp rcx, rax
je 0x14002ec92
mov rdx, rcx
mov r8d, 0x13
mov rcx, rbx
call fcn.1400233b0
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x14002eca0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx + 0x13], 0
mov rbx, rdx
je 0x14002ecd5
xor r8d, r8d
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 + 0xb]
xor byte [r8 + rcx], al
inc r8
cmp r8, 0x12
jb 0x14002ecc0
mov byte [rcx + 0x13], 0
lea rax, [rcx + 0x12]
mov qword [rdx + 0x10], 0
mov qword [rdx + 0x18], 0xf
mov byte [rdx], 0
cmp rcx, rax
je 0x14002ed02
mov rdx, rcx
mov r8d, 0x12
mov rcx, rbx
call fcn.1400233b0
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x14002ed10
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx + 0xb], 0
mov rbx, rdx
je 0x14002ed45
xor r8d, r8d
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 + 9]
xor byte [r8 + rcx], al
inc r8
cmp r8, 0xa
jb 0x14002ed30
mov byte [rcx + 0xb], 0
lea rax, [rcx + 0xa]
mov qword [rdx + 0x10], 0
mov qword [rdx + 0x18], 0xf
mov byte [rdx], 0
cmp rcx, rax
je 0x14002ed72
mov rdx, rcx
mov r8d, 0xa
mov rcx, rbx
call fcn.1400233b0
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x14002ed80
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xe], 0
je 0x14002eda3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xb]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xd
jb 0x14002ed90
mov byte [rcx + 0xe], 0
ret

Function at 0x14002edb0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx + 0xe], 0
mov rbx, rdx
je 0x14002ede5
xor r8d, r8d
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 + 0xb]
xor byte [r8 + rcx], al
inc r8
cmp r8, 0xd
jb 0x14002edd0
mov byte [rcx + 0xe], 0
lea rax, [rcx + 0xd]
mov qword [rdx + 0x10], 0
mov qword [rdx + 0x18], 0xf
mov byte [rdx], 0
cmp rcx, rax
je 0x14002ee12
mov rdx, rcx
mov r8d, 0xd
mov rcx, rbx
call fcn.1400233b0
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x14002ee20
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xa], 0
je 0x14002ee43
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xb]
xor byte [rax + rcx], dl
inc rax
cmp rax, 9
jb 0x14002ee30
mov byte [rcx + 0xa], 0
ret

Function at 0x14002ee50
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx + 0xa], 0
mov rbx, rdx
je 0x14002ee85
xor r8d, r8d
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 + 0xb]
xor byte [r8 + rcx], al
inc r8
cmp r8, 9
jb 0x14002ee70
mov byte [rcx + 0xa], 0
lea rax, [rcx + 9]
mov qword [rdx + 0x10], 0
mov qword [rdx + 0x18], 0xf
mov byte [rdx], 0
cmp rcx, rax
je 0x14002eeb2
mov rdx, rcx
mov r8d, 9
mov rcx, rbx
call fcn.1400233b0
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x14002eec0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 9], 0
je 0x14002eee3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xb]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x14002eed0
mov byte [rcx + 9], 0
ret

Function at 0x14002eef0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx + 9], 0
mov rbx, rdx
je 0x14002ef25
xor r8d, r8d
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 + 0xb]
xor byte [r8 + rcx], al
inc r8
cmp r8, 8
jb 0x14002ef10
mov byte [rcx + 9], 0
lea rax, [rcx + 8]
mov qword [rdx + 0x10], 0
mov qword [rdx + 0x18], 0xf
mov byte [rdx], 0
cmp rcx, rax
je 0x14002ef52
mov rdx, rcx
mov r8d, 8
mov rcx, rbx
call fcn.1400233b0
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x14002ef60
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xf], 0
je 0x14002ef83
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xb]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xe
jb 0x14002ef70
mov byte [rcx + 0xf], 0
ret

Function at 0x14002ef90
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx + 0xf], 0
mov rbx, rdx
je 0x14002efc5
xor r8d, r8d
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 + 0xb]
xor byte [r8 + rcx], al
inc r8
cmp r8, 0xe
jb 0x14002efb0
mov byte [rcx + 0xf], 0
lea rax, [rcx + 0xe]
mov qword [rdx + 0x10], 0
mov qword [rdx + 0x18], 0xf
mov byte [rdx], 0
cmp rcx, rax
je 0x14002eff2
mov rdx, rcx
mov r8d, 0xe
mov rcx, rbx
call fcn.1400233b0
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x14002f000
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x12], 0
je 0x14002f023
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xb]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x11
jb 0x14002f010
mov byte [rcx + 0x12], 0
ret

Function at 0x14002f030
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx + 0x12], 0
mov rbx, rdx
je 0x14002f065
xor r8d, r8d
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 + 0xb]
xor byte [r8 + rcx], al
inc r8
cmp r8, 0x11
jb 0x14002f050
mov byte [rcx + 0x12], 0
lea rax, [rcx + 0x11]
mov qword [rdx + 0x10], 0
mov qword [rdx + 0x18], 0xf
mov byte [rdx], 0
cmp rcx, rax
je 0x14002f092
mov rdx, rcx
mov r8d, 0x11
mov rcx, rbx
call fcn.1400233b0
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x14002f0a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 8], 0
je 0x14002f0c3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xb]
xor byte [rax + rcx], dl
inc rax
cmp rax, 7
jb 0x14002f0b0
mov byte [rcx + 8], 0
ret

Function at 0x14002f0d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx + 8], 0
mov rbx, rdx
je 0x14002f105
xor r8d, r8d
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 + 0xb]
xor byte [r8 + rcx], al
inc r8
cmp r8, 7
jb 0x14002f0f0
mov byte [rcx + 8], 0
lea rax, [rcx + 7]
mov qword [rdx + 0x10], 0
mov qword [rdx + 0x18], 0xf
mov byte [rdx], 0
cmp rcx, rax
je 0x14002f132
mov rdx, rcx
mov r8d, 7
mov rcx, rbx
call fcn.1400233b0
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x14002f140
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xc], 0
je 0x14002f163
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xb]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xb
jb 0x14002f150
mov byte [rcx + 0xc], 0
ret

Function at 0x14002f170
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx + 0xc], 0
mov rbx, rdx
je 0x14002f1a5
xor r8d, r8d
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 + 0xb]
xor byte [r8 + rcx], al
inc r8
cmp r8, 0xb
jb 0x14002f190
mov byte [rcx + 0xc], 0
lea rax, [rcx + 0xb]
mov qword [rdx + 0x10], 0
mov qword [rdx + 0x18], 0xf
mov byte [rdx], 0
cmp rcx, rax
je 0x14002f1d2
mov rdx, rcx
mov r8d, 0xb
mov rcx, rbx
call fcn.1400233b0
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x14002f1e0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xd], 0
je 0x14002f203
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xb]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xc
jb 0x14002f1f0
mov byte [rcx + 0xd], 0
ret

Function at 0x14002f210
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx + 0xd], 0
mov rbx, rdx
je 0x14002f245
xor r8d, r8d
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 + 0xb]
xor byte [r8 + rcx], al
inc r8
cmp r8, 0xc
jb 0x14002f230
mov byte [rcx + 0xd], 0
lea rax, [rcx + 0xc]
mov qword [rdx + 0x10], 0
mov qword [rdx + 0x18], 0xf
mov byte [rdx], 0
cmp rcx, rax
je 0x14002f272
mov rdx, rcx
mov r8d, 0xc
mov rcx, rbx
call fcn.1400233b0
mov rax, rbx
add rsp, 0x20
pop rbx
ret