joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18011327e
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x98
mov r14, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
lea rcx, [rsp + 0x38]
call fcn.18026fb49
lea rcx, [rsp + 0x68]
call fcn.18026fb49
xor eax, eax
mov ecx, dword [rbx + rax*4]
xor ecx, dword [rdi + rax*4]
mov dword [rsp + rax*4 + 0x38], ecx
mov ecx, dword [rbx + rax*4 + 0x14]
xor ecx, dword [rdi + rax*4 + 0x14]
mov dword [rsp + rax*4 + 0x68], ecx
inc rax
cmp rax, 5
jne 0x1801132b0
lea rcx, [rsp + 0x38]
lea r15, [rsp + 0x80]
mov rdx, r15
call fcn.180270158
lea rdx, [rsp + 0x68]
lea r12, [rsp + 0x50]
mov rcx, r15
mov r8, r12
call fcn.18026fe84
lea r15, [rsp + 0x20]
mov rcx, r12
mov rdx, r15
call fcn.18026fb57
mov rcx, r15
call fcn.18026fae4
xor eax, eax
cmp word [r14], 0
je 0x18011333b
mov ecx, dword [rsp + rax*4 + 0x20]
xor ecx, dword [rsp + rax*4 + 0x50]
xor ecx, dword [rdi + rax*4]
xor ecx, dword [rbx + rax*4]
xor ecx, dword [r14 + rax*4 + 2]
mov dword [rsi + rax*4], ecx
inc rax
cmp rax, 5
jne 0x18011331a
jmp 0x180113355
mov ecx, dword [rsp + rax*4 + 0x20]
xor ecx, dword [rsp + rax*4 + 0x50]
xor ecx, dword [rdi + rax*4]
xor ecx, dword [rbx + rax*4]
mov dword [rsi + rax*4], ecx
inc rax
cmp rax, 5
jne 0x18011333b
xor eax, eax
mov ecx, dword [rsi + rax*4]
xor ecx, dword [rdi + rax*4]
mov dword [rsp + rax*4 + 0x38], ecx
inc rax
cmp rax, 5
jne 0x180113357
lea rcx, [rsp + 0x38]
lea rdx, [rsp + 0x50]
lea r8, [rsp + 0x20]
call fcn.18026fe84
xor eax, eax
mov ecx, dword [rsi + rax*4]
xor ecx, dword [rsp + rax*4 + 0x20]
xor ecx, dword [rdi + rax*4 + 0x14]
mov dword [rsi + rax*4 + 0x14], ecx
inc rax
cmp rax, 5
jne 0x180113380
add rsp, 0x98
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1801133a9
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x98
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
lea r14, [rsp + 0x68]
mov rdx, r14
call fcn.180270158
lea rdx, [rdi + 0x14]
lea r8, [rsp + 0x20]
mov rcx, r14
call fcn.18026fe84
xor eax, eax
mov ecx, dword [rsp + rax*4 + 0x20]
xor ecx, dword [rdi + rax*4]
mov dword [rsp + rax*4 + 0x38], ecx
inc rax
cmp rax, 5
jne 0x1801133de
lea rcx, [rsp + 0x38]
lea r14, [rsp + 0x50]
mov rdx, r14
call fcn.18026fb57
mov rcx, r14
call fcn.18026fae4
xor eax, eax
cmp word [rbx], 0
je 0x18011342e
mov ecx, dword [rsp + rax*4 + 0x50]
xor ecx, dword [rsp + rax*4 + 0x38]
xor ecx, dword [rbx + rax*4 + 2]
mov dword [rsi + rax*4], ecx
inc rax
cmp rax, 5
jne 0x180113414
jmp 0x180113442
mov ecx, dword [rsp + rax*4 + 0x50]
xor ecx, dword [rsp + rax*4 + 0x38]
mov dword [rsi + rax*4], ecx
inc rax
cmp rax, 5
jne 0x18011342e
pcmpeqd xmm0, xmm0
movdqu xmmword [rsp + 0x24], xmm0
mov eax, 0x3fffffff
xor eax, dword [rsp + 0x38]
mov dword [rsp + 0x20], eax
xor eax, eax
lea rcx, [rax*4]
or rcx, 4
movdqu xmm0, xmmword [rsp + rcx + 0x20]
movdqu xmm1, xmmword [rsp + rcx + 0x38]
pxor xmm1, xmm0
movdqu xmmword [rsp + rcx + 0x20], xmm1
test rax, rax
lea rax, [rax + 4]
jne 0x18011345b
lea rcx, [rsp + 0x20]
lea r8, [rsp + 0x80]
mov rdx, rsi
call fcn.18026fe84
lea rbx, [rsp + 0x68]
mov rcx, rdi
mov rdx, rbx
call fcn.18026fb57
mov rcx, rbx
call fcn.18026fae4
xor eax, eax
mov ecx, dword [rsp + rax*4 + 0x80]
xor ecx, dword [rsp + rax*4 + 0x68]
mov dword [rsi + rax*4 + 0x14], ecx
inc rax
cmp rax, 5
jne 0x1801134b5
add rsp, 0x98
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x1801134ea
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov r14, r9
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.18026fb57
lea rcx, [rsp + 0x34]
call fcn.18026fb49
xor eax, eax
mov ecx, dword [rsi + rax*4 + 0x14]
xor ecx, dword [rsi + rax*4]
mov dword [rsp + rax*4 + 0x34], ecx
inc rax
cmp rax, 5
jne 0x180113518
lea rdx, [rsp + 0x20]
mov rcx, rbx
mov r8, rdi
mov r9, r14
call fcn.18011327e
nop
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x180115904
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov r14, r8
mov rbp, rdx
mov rsi, rcx
mov ebx, dword [rcx + 0x110]
mov ecx, ebx
call fcn.18010df24
mov edi, eax
test eax, eax
jne 0x180115a81
movsxd rax, ebx
imul r15, rax, 0x78
lea r12, [0x18060d510]
mov edi, dword [r15 + r12 + 0xc]
mov ecx, dword [r15 + r12 + 0x10]
call fcn.1802fb6e2
mov rbx, rax
mov rcx, rdi
call fcn.1802fb6e2
mov r13, rax
test rbx, rbx
je 0x180115969
test r13, r13
jne 0x18011598c
test rbx, rbx
je 0x180115976
mov rcx, rbx
call fcn.1802fbeb6
mov edi, 0xc
test r13, r13
je 0x180115a81
mov rcx, r13
jmp 0x180115a7c
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], rbp
mov rbp, r14
mov rcx, rsi
mov rdx, r13
call qword [r15 + r12 + 0x68]
mov edi, eax
test eax, eax
jne 0x180115a65
lea r14, [r15 + r12]
add r14, 0x10
cmp dword [r14], 0
je 0x1801159d9
xor eax, eax
mov rcx, qword [rsi + 0x228]
mov cl, byte [rcx + rax]
xor cl, 0x5c
mov byte [rbx + rax], cl
inc rax
mov ecx, dword [r14]
cmp rax, rcx
jb 0x1801159be
mov rcx, rsi
call qword [r15 + r12 + 0x58]
mov edi, eax
test eax, eax
jne 0x180115a65
mov r8d, dword [r14]
mov rcx, rsi
mov rdx, rbx
call qword [r15 + r12 + 0x60]
mov edi, eax
test eax, eax
jne 0x180115a65
lea rax, [r15 + r12]
add rax, 0x60
mov rcx, rsi
mov rdx, r13
mov r8, qword [rsp + 0x28]
call qword [rax]
mov edi, eax
test eax, eax
jne 0x180115a65
lea rax, [r15 + r12]
add rax, 0x68
mov rcx, rsi
mov rdx, rbx
call qword [rax]
mov edi, eax
test eax, eax
jne 0x180115a65
xor edi, edi
mov eax, 0
cmp dword [rsp + 0x28], 0
mov r8, qword [rsp + 0x30]
je 0x180115a62
xor ecx, ecx
xor eax, eax
mov edx, dword [rbp]
cmp rcx, rdx
jae 0x180115a60
mov dl, byte [rbx + rcx]
mov byte [r8 + rcx], dl
inc rcx
inc eax
cmp rcx, qword [rsp + 0x28]
jb 0x180115a43
jmp 0x180115a62
mov eax, ecx
mov dword [rbp], eax
mov rcx, qword [rsi + 0x228]
call fcn.1802fbeb6
mov rcx, r13
call fcn.1802fbeb6
mov rcx, rbx
call fcn.1802fbeb6
mov eax, edi
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x180181c24
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
mov eax, 0x16
cmp edx, 4
jb 0x180181d08
mov bl, byte [rcx]
and bl, 0x1f
mov eax, 0x20005
cmp bl, 3
jne 0x180181d08
movzx ebx, byte [rcx + 1]
mov ebp, ebx
and ebp, 0x7f
mov r10d, 2
test bl, bl
js 0x180181c61
mov r11d, ebp
jmp 0x180181c93
mov ebx, ebp
dec bl
cmp bl, 1
ja 0x180181d08
xor r11d, r11d
mov esi, 2
mov edi, ebp
mov ebx, r11d
shl ebx, 8
movzx r11d, byte [rcx + rsi]
inc rsi
or r11d, ebx
dec edi
jne 0x180181c78
add ebp, 2
mov r10d, ebp
test r11d, r11d
je 0x180181d08
lea esi, [r10 + r11]
cmp esi, edx
ja 0x180181d08
lea r11d, [r11*8 - 8]
mov eax, r10d
movzx eax, byte [rcx + rax]
and eax, 7
sub r11d, eax
cmp r11d, dword [r9]
jbe 0x180181cc4
mov dword [r9], r11d
mov eax, 0x20004
jmp 0x180181d08
test r11d, r11d
je 0x180181d03
inc r10d
mov edx, r11d
xor esi, esi
mov ebp, 7
mov edi, r10d
movzx edi, byte [rcx + rdi]
mov ebx, esi
and ebx, 7
mov eax, ebx
xor al, 7
movzx eax, al
bt edi, eax
setb byte [r8 + rsi]
xor eax, eax
cmp ebx, ebp
sete al
add r10d, eax
inc rsi
cmp rsi, rdx
jne 0x180181cd6
mov dword [r9], r11d
xor eax, eax
pop rbx
pop rbp
pop rdi
pop rsi
ret

Function at 0x18019816d
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov eax, 0xfffffffb
test rcx, rcx
je 0x1801982e5
mov r13, rdx
test rdx, rdx
je 0x1801982e5
cmp byte [r13], 1
je 0x1801982e5
mov rsi, r8
xor eax, eax
test r8, r8
je 0x1801982e5
mov r14d, r9d
test r9d, r9d
jle 0x1801982e5
mov rbx, rcx
mov rbp, qword [rsp + 0xa0]
mov edi, r14d
shr edi, 4
mov cl, byte [rcx + 0x14]
cmp cl, 2
je 0x18019824c
mov eax, 0xfffffffb
cmp cl, 1
jne 0x1801982e5
test edi, edi
je 0x180198209
lea rbx, [r13 + 0x54]
mov r9d, dword [r13 + 0x4c]
mov rcx, rsi
mov rdx, rbp
mov r8, rbx
call fcn.180270fe1
add rsi, 0x10
add rbp, 0x10
dec edi
jg 0x1801981eb
mov r8d, r14d
and r8d, 0xf
mov ebx, 0x10
sub ebx, r8d
lea r15, [rsp + 0x20]
mov rcx, r15
mov rdx, rsi
call fcn.1803e4840
mov rcx, r15
sub rcx, rbx
add rcx, 0x10
mov edx, ebx
mov r8, rbx
call fcn.1803e5240
mov r9d, dword [r13 + 0x4c]
add r13, 0x54
mov rcx, r15
jmp 0x1801982cf
test edi, edi
je 0x18019828e
lea r15, [r13 + 0x54]
lea r12, [rsp + 0x20]
mov rax, rbx
mov rbx, rbp
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rax]
xorps xmm1, xmm0
movaps xmmword [rsp + 0x20], xmm1
mov r9d, dword [r13 + 0x4c]
mov rcx, r12
mov rdx, rbp
mov r8, r15
call fcn.180270fe1
add rsi, 0x10
lea rbp, [rbp + 0x10]
mov rax, rbx
dec edi
jg 0x18019825c
mov eax, r14d
and eax, 0xf
je 0x1801982ac
mov edi, eax
xor edx, edx
mov cl, byte [rbx + rdx]
xor cl, byte [rsi + rdx]
mov byte [rsp + rdx + 0x20], cl
inc rdx
cmp rdx, rdi
jne 0x18019829a
mov cl, 0x10
sub cl, al
mov dl, byte [rbx + rax]
xor dl, cl
mov byte [rsp + rax + 0x20], dl
inc rax
cmp rax, 0x10
jne 0x1801982b0
mov r9d, dword [r13 + 0x4c]
add r13, 0x54
lea rcx, [rsp + 0x20]
mov rdx, rbp
mov r8, r13
call fcn.180270fe1
add r14d, 0x10
and r14d, 0xfffffff0
mov eax, r14d
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x18020feb3
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rbx, r8
mov ebp, edx
mov r14, rcx
cmp dword [r8 + 0x94], 1
jne 0x18020ffa8
mov eax, 0x20001
test bpl, 3
jne 0x180210027
test ebp, ebp
je 0x18020ff31
xor esi, esi
lea rdi, [0x180533220]
mov eax, esi
mov eax, dword [r14 + rax]
add dword [rbx + 0x3c], eax
mov rcx, rbx
call fcn.180210101
mov eax, dword [rbx + 0x40]
add eax, dword [rbx]
mov ecx, eax
shr ecx, 0x18
xor eax, dword [rdi + rcx*4]
ror eax, 8
add eax, dword [rbx + 4]
xor eax, dword [rbx + 0x88]
add eax, dword [rbx + 0x18]
mov ecx, eax
shr ecx, 0x18
xor eax, dword [rdi + rcx*4]
add eax, dword [rbx + 0x34]
xor dword [rbx + 0x10], eax
add esi, 4
cmp esi, ebp
jb 0x18020feef
add dword [rbx + 0x3c], ebp
mov rcx, rbx
call fcn.180210153
lea rsi, [0x180533220]
mov rcx, rbx
call fcn.180210101
mov eax, dword [rbx + 0x40]
add eax, dword [rbx]
mov ecx, eax
shr ecx, 0x18
xor eax, dword [rsi + rcx*4]
ror eax, 8
add eax, dword [rbx + 4]
xor eax, dword [rbx + 0x88]
add eax, dword [rbx + 0x18]
mov ecx, eax
shr ecx, 0x18
xor eax, dword [rsi + rcx*4]
add eax, dword [rbx + 0x34]
cmp eax, 0x1000000
jb 0x18020ff43
mov dword [rbx + 0x88], eax
xor eax, eax
mov ecx, dword [rbx + rax*4]
mov dword [rbx + rax*4 + 0x44], ecx
inc rax
cmp rax, 0x11
jne 0x18020ff81
mov qword [rbx + 0x90], 0
mov dword [rbx + 0x98], 1
jmp 0x180210025
lea rsi, [rbx + 0x44]
mov ecx, 0x11
mov rdi, rbx
rep movsd dword [rdi], dword [rsi]
mov eax, 0x20001
test bpl, 3
jne 0x180210027
test ebp, ebp
je 0x180210010
xor esi, esi
lea rdi, [0x180533220]
mov eax, esi
mov eax, dword [r14 + rax]
add dword [rbx + 0x3c], eax
mov rcx, rbx
call fcn.180210101
mov eax, dword [rbx + 0x40]
add eax, dword [rbx]
mov ecx, eax
shr ecx, 0x18
xor eax, dword [rdi + rcx*4]
ror eax, 8
add eax, dword [rbx + 4]
xor eax, dword [rbx + 0x88]
add eax, dword [rbx + 0x18]
mov ecx, eax
shr ecx, 0x18
xor eax, dword [rdi + rcx*4]
add eax, dword [rbx + 0x34]
xor dword [rbx + 0x10], eax
add esi, 4
cmp esi, ebp
jb 0x18020ffce
add dword [rbx + 0x3c], ebp
mov rcx, rbx
call fcn.180210153
mov dword [rbx + 0x90], 0
xor eax, eax
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x180210e74
Capabilities:
Encode data using base64

Disassembly:
push r14
push rsi
push rdi
push rbx
xor eax, eax
test rcx, rcx
je 0x180210fca
test r8, r8
je 0x180210fca
test r9, r9
je 0x180210fca
lea esi, [rdx + 2]
mov edi, 0xaaaaaaab
imul rsi, rdi
shr rsi, 0x20
and esi, 0x7ffffffe
lea esi, [rsi + rsi]
add esi, 1
cmp dword [r9], esi
jb 0x180210fca
mov eax, edx
imul rax, rdi
shr rax, 0x21
lea r11d, [rax + rax*2]
xor eax, eax
test r11d, r11d
jne 0x180210ed8
mov r10, r8
jmp 0x180210f61
lea r14, [0x180533720]
mov r10, r8
xor edi, edi
movzx ebx, byte [rcx]
shr rbx, 2
mov bl, byte [rbx + r14]
mov byte [r10], bl
movzx ebx, byte [rcx]
shl rbx, 4
and ebx, 0x30
movzx esi, byte [rcx + 1]
shr rsi, 4
or rsi, rbx
mov bl, byte [r14 + rsi]
mov byte [r10 + 1], bl
movzx esi, byte [rcx + 1]
and esi, 0xf
movzx ebx, byte [rcx + 2]
shr rbx, 6
lea rsi, [rbx + rsi*4]
mov bl, byte [r14 + rsi]
mov byte [r10 + 2], bl
movzx esi, byte [rcx + 2]
and esi, 0x3f
mov bl, byte [rsi + r14]
mov byte [r10 + 3], bl
cmp dil, 0x10
jae 0x180210f48
add r10, 4
inc dil
jmp 0x180210f55
mov word [r10 + 4], 0xa0d
add r10, 6
xor edi, edi
add rcx, 3
add eax, 3
cmp eax, r11d
jb 0x180210ee4
cmp eax, edx
jae 0x180210fbb
movzx esi, byte [rcx]
inc eax
xor edi, edi
cmp eax, edx
jae 0x180210f74
movzx edi, byte [rcx + 1]
mov rcx, rsi
shr rcx, 2
shl rsi, 4
and esi, 0x30
mov ebx, edi
shr rbx, 4
or rbx, rsi
lea rsi, [0x180533720]
mov cl, byte [rcx + rsi]
mov byte [r10], cl
mov cl, byte [rsi + rbx]
mov byte [r10 + 1], cl
mov cl, 0x3d
cmp eax, edx
jae 0x180210fae
shl edi, 2
and edi, 0x3c
mov cl, byte [rdi + rsi]
mov byte [r10 + 2], cl
mov byte [r10 + 3], 0x3d
add r10, 4
mov byte [r10], 0
sub r10d, r8d
mov dword [r9], r10d
mov eax, 1
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x18022d4b4
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, r9
mov r15d, r8d
mov rdi, rdx
mov rbx, rcx
mov ecx, dword [r9]
call fcn.1801bffc4
mov r14d, eax
test eax, eax
jne 0x18022d5ca
mov ecx, dword [rsi + 4]
lea eax, [rcx - 1]
mov r14d, 0x16
cmp eax, 0x7f
ja 0x18022d5ca
test cl, 7
jne 0x18022d5ca
mov eax, dword [rsi + 8]
cmp eax, 0x80
ja 0x18022d5ca
cmp eax, ecx
jne 0x18022d574
cmp ecx, r15d
ja 0x18022d574
movsxd rax, dword [rsi]
lea rax, [rax + rax*4]
shl rax, 5
lea rdx, [0x18060c0b0]
mov r10, qword [rax + rdx + 0x68]
test r10, r10
je 0x18022d574
lea r8, [rsi + 0x110]
mov r11d, dword [rsi + 0xc]
lea r9, [rsi + 0x10]
mov eax, r15d
xor edx, edx
div ecx
mov qword [rsp + 0x28], r8
mov dword [rsp + 0x20], r11d
mov rcx, rbx
mov rdx, rdi
mov r8d, eax
call r10
mov r14d, eax
test eax, eax
jne 0x18022d5ca
mov ecx, dword [rsi + 4]
mov eax, r15d
xor edx, edx
div ecx
mov r15d, edx
xor r14d, r14d
test r15d, r15d
je 0x18022d5ca
lea rax, [rsi + 0x110]
mov qword [rsp + 0x30], rax
lea r12, [rsi + 0x90]
lea r13, [rsi + 0x10]
mov eax, dword [rsi + 8]
cmp eax, ecx
jne 0x18022d5ea
mov rcx, rsi
call fcn.180276604
movsxd rax, dword [rsi]
lea rbp, [rax + rax*4]
shl rbp, 5
mov rcx, r13
mov rdx, r12
mov r8, qword [rsp + 0x30]
lea rax, [0x18060c0b0]
call qword [rbp + rax + 0x28]
test eax, eax
je 0x18022d5de
mov r14d, eax
mov eax, r14d
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov dword [rsi + 8], 0
mov ecx, dword [rsi + 4]
jmp 0x18022d5ee
test eax, eax
jne 0x18022d633
xor eax, eax
cmp r15d, ecx
jb 0x18022d633
xor eax, eax
test ecx, ecx
jle 0x18022d617
cdqe
mov rcx, qword [rsi + rax + 0x90]
xor rcx, qword [rbx + rax]
mov qword [rdi + rax], rcx
add eax, 8
mov ecx, dword [rsi + 4]
cmp eax, ecx
jl 0x18022d5fb
movsxd rax, ecx
add rbx, rax
add rdi, rax
sub r15d, eax
mov dword [rsi + 8], eax
test r15d, r15d
je 0x18022d5ca
mov ecx, dword [rsi + 4]
jmp 0x18022d593
mov cl, byte [rbx]
lea edx, [rax + 1]
mov dword [rsi + 8], edx
cdqe
xor cl, byte [rsi + rax + 0x90]
inc rbx
mov byte [rdi], cl
inc rdi
dec r15d
jmp 0x18022d626
Function at 0x18026fe84
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0xc78
xorps xmm0, xmm0
movups xmmword [r8], xmm0
mov dword [r8 + 0x10], 0
mov eax, dword [rdx + 0x10]
mov dword [rsp + 0x10], eax
movups xmm0, xmmword [rdx]
movaps xmmword [rsp], xmm0
movups xmm0, xmmword [rcx]
movaps xmmword [rsp + 0x20], xmm0
mov eax, dword [rcx + 0x10]
mov dword [rsp + 0x30], eax
mov r10d, 1
mov r9d, 5
lea rax, [r10 - 1]
xor edx, edx
lea rcx, [rax + rax*4]
lea rcx, [rsp + rcx*4]
add rcx, 0x20
mov esi, dword [rcx + rdx*4]
lea r11, [r10 + r10*4]
lea rcx, [rsp + r11*4]
add rcx, 0x20
mov dword [rcx + rdx*4], esi
inc rdx
cmp rdx, r9
jne 0x18026fecb
mov edx, dword [rsp + r11*4 + 0x30]
and edx, 1
shl edx, 0x1d
xor eax, eax
mov esi, dword [rcx + rax*4]
mov edi, esi
shr edi, 1
or edi, edx
shl esi, 0x1f
mov dword [rcx + rax*4], edi
inc rax
mov edx, esi
cmp rax, r9
jne 0x18026fefe
and byte [rsp + r11*4 + 0x23], 0x3f
inc r10
cmp r10, 0x9e
jne 0x18026fec5
movsx rcx, word [0x180609e50]
xor eax, eax
lea rcx, [rcx + rcx*4]
lea rcx, [rsp + rcx*4]
add rcx, 0x20
mov edx, dword [rcx + rax*4]
and edx, dword [rsp + rax*4]
mov dword [r8 + rax*4], edx
inc rax
cmp rax, 5
jne 0x18026ff3f
mov r11d, 1
mov r9d, 0x3fffffff
lea r10, [0x180609e50]
mov ecx, dword [rsp + 0x10]
and ecx, 1
shl ecx, 0x1d
xor eax, eax
mov edx, dword [rsp + rax*4]
mov esi, edx
shr esi, 1
or esi, ecx
shl edx, 0x1f
mov dword [rsp + rax*4], esi
inc rax
mov ecx, edx
cmp rax, 5
jne 0x18026ff71
mov eax, dword [rsp]
and eax, r9d
mov dword [rsp], eax
movsx rcx, word [r10 + r11*2]
movsx rdx, word [r10 + r11*2 + 0x27a]
lea rcx, [rcx + rcx*4]
lea rdx, [rdx + rdx*4]
mov esi, dword [rsp + rdx*4 + 0x20]
xor esi, dword [rsp + rcx*4 + 0x20]
and esi, eax
xor dword [r8], esi
xor eax, eax
lea rsi, [rax*4]
or rsi, 4
movups xmm0, xmmword [rsp + rsi]
lea rdi, [rsp + rcx*4]
add rdi, 0x20
movups xmm1, xmmword [rsi + rdi]
lea rdi, [rsp + rdx*4 + 0x20]
movups xmm2, xmmword [rsi + rdi]
xorps xmm2, xmm1
andps xmm2, xmm0
movups xmm0, xmmword [r8 + rsi]
xorps xmm0, xmm2
movups xmmword [r8 + rsi], xmm0
test rax, rax
lea rax, [rax + 4]
jne 0x18026ffb9
inc r11
cmp r11, 0x9e
jne 0x18026ff65
add rsp, 0xc78
pop rdi
pop rsi
ret
Function at 0x180270014
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x60
mov rax, rcx
cmp edx, 0x13d
jne 0x180270040
xor ecx, ecx
mov edx, dword [rax + rcx*4]
mov dword [r8 + rcx*4], edx
inc rcx
cmp rcx, 0xa
jne 0x18027002b
jmp 0x18027014d
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
movaps xmmword [rsp + 0x10], xmm0
movaps xmmword [rsp], xmm0
mov dword [rsp + 0x50], 0
mov ecx, edx
shr ecx, 5
movsx r11, cx
mov r10d, 0x14
sub r10, r11
and dx, 0x1f
jne 0x18027009b
mov ecx, 9
mov edx, r10d
mov ebp, dword [rax + rcx*4]
movsx rbx, dx
or dword [rsp + rbx*4], ebp
lea edx, [rdx - 1]
test rcx, rcx
lea rcx, [rcx - 1]
jg 0x180270083
jmp 0x1802700e9
mov ecx, 0x20
sub ecx, edx
movzx r9d, dx
movzx r14d, cx
movsx rcx, r10w
mov ebx, dword [rsp + rcx*4]
mov esi, 9
mov edi, r10d
mov ebp, dword [rax + rsi*4]
mov edx, ebp
mov ecx, r9d
shl edx, cl
or edx, ebx
movsx rbx, di
lea edi, [rdi - 1]
mov ecx, r14d
shr ebp, cl
mov dword [rsp + rbx*4], edx
movsx rcx, di
or ebp, dword [rsp + rcx*4]
mov dword [rsp + rcx*4], ebp
mov ebx, ebp
test rsi, rsi
lea rsi, [rsi - 1]
jg 0x1802700b9
cmp r11, 0x14
ja 0x180270129
mov ax, 0x14
mov dx, 0xb
mov ecx, 0x14
movsx rbp, dx
lea edx, [rdx - 1]
mov ebp, dword [rsp + rbp*4]
shr ebp, 0x1d
or ebp, dword [rsp + rcx*4]
mov dword [rsp + rcx*4], ebp
movsx rbx, dx
mov ebx, dword [rsp + rbx*4]
shl ebx, 3
or ebx, ebp
mov dword [rsp + rcx*4], ebx
dec eax
movsx rcx, ax
cmp r10, rcx
jbe 0x1802700fc
mov eax, dword [rsp + 0x2c]
shl eax, 3
sar eax, 0x1f
xor ecx, ecx
mov edx, dword [rsp + rcx*4 + 0x2c]
xor edx, eax
mov dword [r8 + rcx*4], edx
inc rcx
cmp rcx, 0xa
jne 0x180270135
and byte [r8 + 3], 0xf
add rsp, 0x60
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x180270aa4
Capabilities:
Link many functions at runtime

Disassembly:
push rsi
sub rsp, 0x20
test rcx, rcx
jne 0x1801473f5
mov eax, 0xe
jmp 0x180147421
mov rsi, rcx
mov ecx, 0xc
call fcn.1802fb6e2
test rax, rax
jne 0x18014740e
mov eax, 0xc
jmp 0x180147421
mov qword [rax], 0
mov dword [rax + 8], 0
mov qword [rsi], rax
xor eax, eax
add rsp, 0x20
pop rsi
ret
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
call fcn.18010df5b
cmp eax, 1
je 0x180270acf
test eax, eax
jne 0x180270ae0
mov rcx, rdi
mov rdx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp 0x18032ed04
mov rcx, rdi
mov rdx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp 0x1801473e4
mov eax, 0xe1
add rsp, 0x28
pop rdi
pop rsi
ret
push rsi
push rdi
push rbx
sub rsp, 0x20
test rcx, rcx
jne 0x18032ed1a
mov eax, 0xe
jmp 0x18032ee0a
mov rsi, rcx
mov ecx, 0x68
call fcn.1802fb6e2
test rax, rax
jne 0x18032ed36
mov eax, 0xc
jmp 0x18032ee0a
mov rdi, rax
mov dword [rax], 0
lea rcx, [0x18059edfc]
call sub.KERNEL32.dll_GetModuleHandleA
cmp rax, 0xffffffffffffffff
je 0x18032edec
mov rbx, rax
lea rdx, str.AcquireSRWLockShared
mov rcx, rax
call sub.KERNEL32.dll_GetProcAddress
mov qword [rdi + 0x40], rax
lea rdx, str.ReleaseSRWLockShared
mov rcx, rbx
call sub.KERNEL32.dll_GetProcAddress
mov qword [rdi + 0x48], rax
lea rdx, str.AcquireSRWLockExclusive
mov rcx, rbx
call sub.KERNEL32.dll_GetProcAddress
mov qword [rdi + 0x50], rax
lea rdx, str.ReleaseSRWLockExclusive
mov rcx, rbx
call sub.KERNEL32.dll_GetProcAddress
mov qword [rdi + 0x58], rax
lea rdx, str.InitializeSRWLock
mov rcx, rbx
call sub.KERNEL32.dll_GetProcAddress
mov qword [rdi + 0x60], rax
cmp qword [rdi + 0x40], 0
je 0x18032edec
cmp qword [rdi + 0x48], 0
je 0x18032edec
cmp qword [rdi + 0x50], 0
je 0x18032edec
test rax, rax
je 0x18032edec
mov rax, qword [rdi + 0x58]
test rax, rax
je 0x18032edec
mov dword [rdi], 1
mov rcx, rdi
add rcx, 0x30
call qword [rdi + 0x60]
jmp 0x18032edfd
cmp dword [rdi], 0
jne 0x18032ede0
mov rcx, rdi
add rcx, 8
call sub.KERNEL32.dll_InitializeCriticalSection
mov qword [rdi + 0x38], 0
mov qword [rsi], rdi
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x180270ef6
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
cmp edx, 2
jl 0x180270fd9
mov r8d, edx
mov edx, 1
lea r9, [0x18058edc0]
lea r10, [0x18058f1c0]
lea r11, [0x18058f5c0]
lea r14, [0x18058f9c0]
mov rsi, rdx
shl rsi, 4
movzx edi, byte [rcx + rsi]
movzx ebx, byte [rcx + rsi + 1]
mov ebx, dword [r10 + rbx*4]
xor ebx, dword [r9 + rdi*4]
movzx edi, byte [rcx + rsi + 2]
movzx eax, byte [rcx + rsi + 3]
xor ebx, dword [r11 + rdi*4]
xor ebx, dword [r14 + rax*4]
mov dword [rcx + rsi], ebx
movzx eax, byte [rcx + rsi + 4]
movzx edi, byte [rcx + rsi + 5]
mov edi, dword [r10 + rdi*4]
xor edi, dword [r9 + rax*4]
movzx eax, byte [rcx + rsi + 6]
movzx ebx, byte [rcx + rsi + 7]
xor edi, dword [r11 + rax*4]
xor edi, dword [r14 + rbx*4]
mov dword [rcx + rsi + 4], edi
movzx eax, byte [rcx + rsi + 8]
movzx edi, byte [rcx + rsi + 9]
mov edi, dword [r10 + rdi*4]
xor edi, dword [r9 + rax*4]
movzx eax, byte [rcx + rsi + 0xa]
movzx ebx, byte [rcx + rsi + 0xb]
xor edi, dword [r11 + rax*4]
xor edi, dword [r14 + rbx*4]
mov dword [rcx + rsi + 8], edi
movzx eax, byte [rcx + rsi + 0xc]
movzx edi, byte [rcx + rsi + 0xd]
mov edi, dword [r10 + rdi*4]
xor edi, dword [r9 + rax*4]
movzx eax, byte [rcx + rsi + 0xe]
xor edi, dword [r11 + rax*4]
movzx eax, byte [rcx + rsi + 0xf]
xor edi, dword [r14 + rax*4]
mov dword [rcx + rsi + 0xc], edi
inc rdx
cmp rdx, r8
jne 0x180270f28
xor eax, eax
pop rbx
pop rdi
pop rsi
pop r14
ret