joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180059e70
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov ebx, 1
mov eax, ebx
shl rax, cl
cmp rdx, rax
jbe 0x180059ea8
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x38], rdi
mov rdi, qword [rsi + 8]
or rax, rbx
bsr rcx, rax
mov r8, rdi
mov qword [rsp + 0x40], r14
inc ecx
shl rbx, cl
lea rcx, [rsi + 0x18]
lea rdx, [rbx + rbx]
call fcn.18001ef40
mov qword [rsi + 0x38], rbx
lea rax, [rbx - 1]
mov qword [rsi + 0x30], rax
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
cmp rcx, rdi
je 0x180059fe6
mov qword [rsp + 0x30], rbp
mov rax, rcx
movabs rbp, 0xcbf29ce484222325
movabs rbx, 0x100000001b3
nop
movzx edx, byte [rax + 0x11]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rcx, qword [rcx]
imul r9, rbx
xor r9, rdx
movzx edx, byte [rax + 0x12]
imul r9, rbx
xor r9, rdx
movzx edx, byte [rax + 0x13]
imul r9, rbx
xor r9, rdx
imul r9, rbx
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rdi
jne 0x180059f60
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x180059fd5
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x180059f9d
mov r10, qword [rdx]
cmp r10, rax
je 0x180059f97
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x180059fd5
cmp r9, rdx
je 0x180059fb1
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x180059ffb
cmp r9, rdx
jne 0x180059fa2
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rdi
jne 0x180059f10
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov r14, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x180059fd5
Function at 0x18005a1f0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x18005a228
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x40], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.18001ef40
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x18005a394
mov qword [rsp + 0x38], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop
movzx edx, byte [rax + 0x11]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rcx, qword [rcx]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x12]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x13]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x14]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x15]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x16]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x17]
imul r9, rdi
xor r9, rdx
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x18005a30c
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x18005a383
mov rdx, qword [r11 + 8]
mov r8, qword [rax + 0x10]
cmp r8, qword [rdx + 0x10]
jne 0x18005a349
mov r10, qword [rdx]
cmp r10, rax
je 0x18005a343
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x18005a383
cmp r9, rdx
je 0x18005a35f
nop
mov rdx, qword [rdx + 8]
cmp r8, qword [rdx + 0x10]
je 0x18005a3a9
cmp r9, rdx
jne 0x18005a350
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x18005a290
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x18005a383
Function at 0x18006bbf0
Capabilities:
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x30
cmp qword [0x1801ec870], 0
mov rdi, rcx
je 0x18006bd8e
movzx eax, byte [0x1801c42c0]
nop
test al, al
je 0x18006bd8e
mov qword [rsp + 0x40], rbx
xor r8b, r8b
mov qword [rsp + 0x50], rbp
xor al, al
mov qword [rsp + 0x58], rsi
movabs rbp, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
mov byte [rsp + 0x48], r8b
nop dword [rax]
nop dword [rax + rax]
movzx edx, al
mov rax, qword [0x1801ec870]
lea rbx, [rax + rdx*8]
cmp qword [rbx + 0x180], 0
je 0x18006bcc6
mov rax, qword [0x1801ec670]
movzx ecx, r8b
mov rbx, qword [rbx + 0x180]
call rax
cmp rax, rbx
jne 0x18006bcc0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x20]
test al, al
je 0x18006bcc0
mov rax, qword [0x1801ec670]
movzx ecx, byte [rsp + 0x48]
call rax
lea r8, [rsp + 0x48]
mov rcx, rdi
lea rdx, [rsp + 0x20]
mov rbx, rax
call fcn.18006bda0
mov rcx, qword [rax]
mov qword [rcx + 0x18], rbx
jmp 0x18006bd63
movzx r8d, byte [rsp + 0x48]
mov rdx, qword [rdi + 0x30]
mov r9, qword [rdi + 8]
movzx eax, r8b
xor rax, rsi
imul rax, rbp
and rdx, rax
shl rdx, 4
add rdx, qword [rdi + 0x18]
mov r10, qword [rdx + 8]
mov rcx, r10
cmp r10, r9
je 0x18006bd11
mov rax, qword [rdx]
cmp r8b, byte [r10 + 0x10]
je 0x18006bd13
nop dword [rax]
cmp rcx, rax
je 0x18006bd11
mov rcx, qword [rcx + 8]
cmp r8b, byte [rcx + 0x10]
jne 0x18006bd00
jmp 0x18006bd13
xor ecx, ecx
test rcx, rcx
je 0x18006bd69
mov rax, qword [rdx]
cmp r10, rcx
jne 0x18006bd38
cmp rax, rcx
jne 0x18006bd2e
mov qword [rdx], r9
mov qword [rdx + 8], r9
jmp 0x18006bd43
mov r9, qword [rcx + 8]
mov qword [rdx + 8], r9
jmp 0x18006bd43
cmp rax, rcx
jne 0x18006bd43
mov rax, qword [rcx]
mov qword [rdx], rax
mov rdx, qword [rcx]
dec qword [rdi + 0x10]
mov rax, qword [rcx + 8]
mov qword [rax], rdx
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov edx, 0x20
call fcn.180111228
movzx r8d, byte [rsp + 0x48]
inc r8b
mov byte [rsp + 0x48], r8b
movzx eax, r8b
cmp r8b, 0x20
jb 0x18006bc50
mov rsi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x18006c040
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x18006c078
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x40], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.18001ef40
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x18006c194
mov qword [rsp + 0x38], rbp
movabs rdi, 0xcbf29ce484222325
movabs rbp, 0x100000001b3
nop
movzx r9d, byte [rax + 0x10]
mov rcx, qword [rcx]
mov r11d, r9d
xor r11, rdi
imul r11, rbp
and r11, qword [rsi + 0x30]
shl r11, 4
add r11, qword [rsi + 0x18]
mov r8, qword [r11]
cmp r8, rbx
jne 0x18006c10f
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x18006c183
mov rdx, qword [r11 + 8]
cmp r9b, byte [rdx + 0x10]
jne 0x18006c148
mov r10, qword [rdx]
cmp r10, rax
je 0x18006c142
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x18006c183
cmp r8, rdx
je 0x18006c15f
nop dword [rax]
mov rdx, qword [rdx + 8]
cmp r9b, byte [rdx + 0x10]
je 0x18006c1a9
cmp r8, rdx
jne 0x18006c150
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x18006c0e0
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x18006c183
Function at 0x1800ab220
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x50
movabs rax, 0xfffffffffffffff
mov ebx, 1
bsr rcx, rax
mov eax, ebx
shl rax, cl
cmp rdx, rax
jbe 0x1800ab251
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x70], rdi
or rax, rbx
mov qword [rsp + 0x40], r13
mov r13, qword [0x180200c68]
bsr rcx, rax
mov r8, r13
inc ecx
shl rbx, cl
lea rcx, [0x180200c78]
lea rdx, [rbx + rbx]
call fcn.18001ef40
mov rdi, qword [0x180200c68]
lea r10, [rbx - 1]
mov qword [0x180200c90], r10
mov qword [0x180200c98], rbx
mov rdi, qword [rdi]
cmp rdi, r13
je 0x1800ab443
mov qword [rsp + 0x60], rbp
mov rbx, rdi
mov qword [rsp + 0x68], rsi
movabs r11, 0x100000001b3
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r15
movups xmm0, xmmword [rbx + 0x10]
mov r8, qword [rbx + 0x18]
xor edx, edx
mov rdi, qword [rdi]
movabs rax, 0xcbf29ce484222325
movaps xmmword [rsp + 0x20], xmm0
mov rcx, rax
test r8, r8
je 0x1800ab314
mov r9, qword [rsp + 0x20]
nop dword [rax]
movzx eax, byte [rdx + r9]
inc rdx
xor rcx, rax
imul rcx, r11
cmp rdx, r8
jb 0x1800ab300
mov r15, qword [0x180200c78]
and rcx, r10
shl rcx, 4
add r15, rcx
mov r14, qword [r15]
cmp r14, r13
jne 0x1800ab339
mov qword [r15], rbx
mov qword [r15 + 8], rbx
jmp 0x1800ab3f0
mov rsi, qword [r15 + 8]
cmp r8, qword [rsi + 0x18]
jne 0x1800ab384
mov rdx, qword [rsi + 0x10]
movq rcx, xmm0
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1800ab384
mov r8, qword [rsi]
cmp r8, rbx
je 0x1800ab37e
mov rdx, qword [rbx + 8]
mov qword [rdx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], r8
mov rax, qword [r8 + 8]
mov qword [rax], rbx
mov qword [r8 + 8], rcx
mov qword [rdi + 8], rdx
mov qword [rbx + 8], rax
mov qword [r15 + 8], rbx
jmp 0x1800ab3e6
cmp r14, rsi
je 0x1800ab3c2
movups xmm0, xmmword [rbx + 0x10]
movaps xmmword [rsp + 0x20], xmm0
mov rbp, qword [rsp + 0x28]
mov r12, qword [rsp + 0x20]
nop dword [rax]
mov rsi, qword [rsi + 8]
cmp rbp, qword [rsi + 0x18]
jne 0x1800ab3bd
mov rdx, qword [rsi + 0x10]
mov r8, rbp
mov rcx, r12
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1800ab404
cmp r14, rsi
jne 0x1800ab3a0
mov rdx, qword [rbx + 8]
mov qword [rdx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rsi
mov rax, qword [rsi + 8]
mov qword [rax], rbx
mov qword [rsi + 8], rcx
mov qword [rdi + 8], rdx
mov qword [rbx + 8], rax
mov qword [r15], rbx
movabs r11, 0x100000001b3
mov rbx, rdi
cmp rdi, r13
je 0x1800ab42a
mov r10, qword [0x180200c90]
jmp 0x1800ab2d0
mov r8, qword [rsi]
mov rdx, qword [rbx + 8]
mov qword [rdx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], r8
mov rax, qword [r8 + 8]
mov qword [rax], rbx
mov qword [r8 + 8], rcx
mov qword [rdi + 8], rdx
mov qword [rbx + 8], rax
jmp 0x1800ab3e6
mov r14, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x60]
mov r12, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x68]
mov r15, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x70]
mov r13, qword [rsp + 0x40]
add rsp, 0x50
pop rbx
ret
Function at 0x1800b9470
Capabilities:
Hash data using fnv

Disassembly:
movzx r8d, byte [rdx]
mov r9, rcx
movabs rcx, 0x100000001b3
mov r10, rdx
movabs rax, 0xcbf29ce484222325
xor r8, rax
movzx eax, byte [rdx + 1]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 2]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 3]
mov rdx, qword [r9 + 0x30]
imul r8, rcx
xor r8, rax
imul r8, rcx
and rdx, r8
xor r8d, r8d
shl rdx, 4
add rdx, qword [r9 + 0x18]
mov rax, qword [rdx + 8]
cmp rax, qword [r9 + 8]
je 0x1800b94f9
mov ecx, dword [r10]
mov rdx, qword [rdx]
cmp ecx, dword [rax + 0x10]
je 0x1800b94fc
nop dword [rax]
cmp rax, rdx
je 0x1800b94f9
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x1800b94e0
test rax, rax
setne r8b
mov rax, r8
ret
mov rax, r8
test rax, rax
setne r8b
mov rax, r8
ret
Function at 0x1800c7c60
Capabilities:
Encode data using xor

Disassembly:
push rdi
mov r11, rdx
mov rdi, rcx
xor r10d, r10d
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], r10b
jne 0x1800c7c72
add rax, r11
cmp r11, rax
je 0x1800c7ccd
mov qword [rsp + 0x10], rbx
mov rbx, r11
nop dword [rax + rax]
movzx r9d, byte [rbx]
movzx ecx, r9b
or cl, 0x20
movzx edx, cl
lea r8d, [r9 - 0x41]
cmp r8b, 0x19
cmova edx, r9d
inc rbx
movsx ecx, dl
add ecx, r10d
imul r10d, ecx, 0x401
mov ecx, r10d
shr ecx, 6
xor r10d, ecx
cmp rbx, rax
jne 0x1800c7c90
mov rbx, qword [rsp + 0x10]
lea eax, [r10 + r10*8]
mov qword [rdi + 8], r11
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
imul eax, ecx, 0x8001
mov dword [rdi], eax
mov rax, rdi
pop rdi
ret

Function at 0x1800c7cf0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
lea rdi, str.CSectorDataNode
mov r11, rcx
mov r10, rdi
lea rbx, [0x180181437]
xor eax, eax
movzx r9d, byte [r10]
movzx edx, r9b
or dl, 0x20
movzx ecx, dl
lea r8d, [r9 - 0x41]
cmp r8b, 0x19
cmova ecx, r9d
inc r10
movsx ecx, cl
add ecx, eax
imul eax, ecx, 0x401
mov ecx, eax
shr ecx, 6
xor eax, ecx
cmp r10, rbx
jne 0x1800c7d10
mov rbx, qword [rsp + 8]
lea ecx, [rax + rax*8]
mov eax, ecx
mov qword [r11 + 8], rdi
mov rdi, qword [rsp + 0x10]
shr eax, 0xb
xor eax, ecx
imul eax, eax, 0x8001
mov dword [r11], eax
mov rax, r11
ret

Function at 0x1800c7d70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
lea rdi, str.CVehicleProximityMigrationDataNode
mov r11, rcx
mov r10, rdi
lea rbx, [0x1801817c2]
xor eax, eax
movzx r9d, byte [r10]
movzx edx, r9b
or dl, 0x20
movzx ecx, dl
lea r8d, [r9 - 0x41]
cmp r8b, 0x19
cmova ecx, r9d
inc r10
movsx ecx, cl
add ecx, eax
imul eax, ecx, 0x401
mov ecx, eax
shr ecx, 6
xor eax, ecx
cmp r10, rbx
jne 0x1800c7d90
mov rbx, qword [rsp + 8]
lea ecx, [rax + rax*8]
mov eax, ecx
mov qword [r11 + 8], rdi
mov rdi, qword [rsp + 0x10]
shr eax, 0xb
xor eax, ecx
imul eax, eax, 0x8001
mov dword [r11], eax
mov rax, r11
ret

Function at 0x1800c7df0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
lea rdi, str.CPropSetUncommonGameStateDataNode
mov r11, rcx
mov r10, rdi
lea rbx, [0x180181e61]
xor eax, eax
movzx r9d, byte [r10]
movzx edx, r9b
or dl, 0x20
movzx ecx, dl
lea r8d, [r9 - 0x41]
cmp r8b, 0x19
cmova ecx, r9d
inc r10
movsx ecx, cl
add ecx, eax
imul eax, ecx, 0x401
mov ecx, eax
shr ecx, 6
xor eax, ecx
cmp r10, rbx
jne 0x1800c7e10
mov rbx, qword [rsp + 8]
lea ecx, [rax + rax*8]
mov eax, ecx
mov qword [r11 + 8], rdi
mov rdi, qword [rsp + 0x10]
shr eax, 0xb
xor eax, ecx
imul eax, eax, 0x8001
mov dword [r11], eax
mov rax, r11
ret
Function at 0x1800c7e70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
lea rdi, str.CIncidentPointOfInterestFinderDataNode
mov r11, rcx
mov r10, rdi
lea rbx, [0x180181c7e]
xor eax, eax
movzx r9d, byte [r10]
movzx edx, r9b
or dl, 0x20
movzx ecx, dl
lea r8d, [r9 - 0x41]
cmp r8b, 0x19
cmova ecx, r9d
inc r10
movsx ecx, cl
add ecx, eax
imul eax, ecx, 0x401
mov ecx, eax
shr ecx, 6
xor eax, ecx
cmp r10, rbx
jne 0x1800c7e90
mov rbx, qword [rsp + 8]
lea ecx, [rax + rax*8]
mov eax, ecx
mov qword [r11 + 8], rdi
mov rdi, qword [rsp + 0x10]
shr eax, 0xb
xor eax, ecx
imul eax, eax, 0x8001
mov dword [r11], eax
mov rax, r11
ret

Function at 0x1800c7ef0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
lea rdi, str.CGuardZonePointOfInterestFinderDataNode
mov r11, rcx
mov r10, rdi
lea rbx, [0x180181c3f]
xor eax, eax
movzx r9d, byte [r10]
movzx edx, r9b
or dl, 0x20
movzx ecx, dl
lea r8d, [r9 - 0x41]
cmp r8b, 0x19
cmova ecx, r9d
inc r10
movsx ecx, cl
add ecx, eax
imul eax, ecx, 0x401
mov ecx, eax
shr ecx, 6
xor eax, ecx
cmp r10, rbx
jne 0x1800c7f10
mov rbx, qword [rsp + 8]
lea ecx, [rax + rax*8]
mov eax, ecx
mov qword [r11 + 8], rdi
mov rdi, qword [rsp + 0x10]
shr eax, 0xb
xor eax, ecx
imul eax, eax, 0x8001
mov dword [r11], eax
mov rax, r11
ret
Function at 0x1800c9700
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov ebx, edx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
cmp ebx, 1
jne 0x1800c9750
lea rax, [0x1801c42b4]
mov qword [0x1801ec3f8], rdi
mov qword [rsp + 0x28], rax
lea r8, [0x1800c9280]
xor r9d, r9d
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x1801c42b8], rax
mov rbx, qword [rsp + 0x40]
mov eax, 1
add rsp, 0x30
pop rdi
ret

Function at 0x1800c9ac0
Capabilities:
Encode data using xor

Disassembly:
mov r10, qword [rcx]
xor eax, eax
mov r11, qword [rcx + 8]
add r11, r10
cmp r10, r11
je 0x1800c9b05
movzx r9d, byte [r10]
movzx ecx, r9b
or cl, 0x20
movzx edx, cl
lea r8d, [r9 - 0x41]
cmp r8b, 0x19
cmova edx, r9d
inc r10
movsx ecx, dl
add ecx, eax
imul eax, ecx, 0x401
mov ecx, eax
shr ecx, 6
xor eax, ecx
cmp r10, r11
jne 0x1800c9ad1
lea ecx, [rax + rax*8]
mov eax, ecx
shr eax, 0xb
xor eax, ecx
imul eax, eax, 0x8001
ret
Function at 0x1800ce260
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x30
movsxd rax, edx
mov rdi, rcx
dec rax
mov qword [r11 + 0x18], rbp
mov rbp, r9
xor r9d, r9d
lea rax, [rcx + rax*2]
mov qword [rsp + 8], rax
cmp rcx, rax
jae 0x1800ce489
mov qword [r11 + 0x20], rsi
lea rsi, [0x180000000]
mov qword [r11 + 0x10], rbx
mov qword [r11 - 0x10], r12
mov qword [r11 - 0x18], r13
mov qword [r11 - 0x20], r14
mov qword [r11 - 0x28], r15
mov qword [rsp], r8
test rbp, rbp
je 0x1800ce2c2
cmp r8, rbp
jae 0x1800ce466
movzx edx, byte [r8]
test dl, dl
je 0x1800ce466
mov eax, edx
mov rcx, rbp
shr rax, 3
movsx r9, byte [rax + rsi + 0x190f48]
xor eax, eax
test r9d, r9d
mov ebx, eax
sete bl
add ebx, r9d
test rbp, rbp
jne 0x1800ce2f8
movsxd rcx, ebx
add rcx, r8
cmp r8, rcx
mov r14d, edx
cmovae r14d, eax
lea rax, [r8 + 1]
cmp rax, rcx
jae 0x1800ce311
movzx r13d, byte [rax]
jmp 0x1800ce314
xor r13b, r13b
lea rax, [r8 + 2]
cmp rax, rcx
jae 0x1800ce323
movzx r12d, byte [rax]
jmp 0x1800ce326
xor r12b, r12b
lea rax, [r8 + 3]
cmp rax, rcx
jae 0x1800ce335
movzx r15d, byte [rax]
jmp 0x1800ce338
xor r15b, r15b
lea r10, [r9*4]
movzx eax, r14b
mov esi, dword [r10 + rsi + 0x191590]
and esi, eax
movzx r9d, r13b
shl esi, 6
mov eax, r9d
and eax, 0x3f
movzx edx, r12b
or esi, eax
movzx r11d, r15b
shl esi, 6
and r9d, 0xc0
mov eax, edx
and edx, 0xc0
and eax, 0x3f
or esi, eax
mov eax, r11d
shr r11d, 2
and eax, 0x3f
or r11d, edx
shl esi, 6
or esi, eax
shr r11d, 2
or r11d, r9d
lea rax, [0x180000000]
mov ecx, dword [r10 + rax + 0x190f30]
shr r11d, 2
shr esi, cl
mov ecx, 0x100
cmp esi, dword [r10 + rax + 0x190f18]
sbb eax, eax
xor r9d, r9d
and eax, 0x40
mov edx, r9d
or r11d, eax
mov eax, esi
and eax, 0xfffff800
cmp eax, 0xd800
mov eax, 0x80
cmove edx, eax
mov eax, r9d
or r11d, edx
cmp esi, 0xffff
cmova eax, ecx
lea rcx, [0x180000000]
mov ecx, dword [r10 + rcx + 0x191510]
or r11d, eax
xor r11d, 0x2a
sar r11d, cl
test r11d, r11d
je 0x1800ce443
test r14b, r14b
mov eax, r9d
mov ecx, r9d
mov esi, 0xfffd
setne cl
test r15b, r15b
setne al
add ecx, eax
mov eax, r9d
test r12b, r12b
setne al
add ecx, eax
mov eax, r9d
test r13b, r13b
setne al
add ecx, eax
cmp ebx, ecx
cmovl ecx, ebx
movsxd r8, ecx
add r8, qword [rsp]
jmp 0x1800ce44d
movsxd rax, ebx
add r8, rax
test esi, esi
je 0x1800ce466
mov word [rdi], si
add rdi, 2
lea rsi, [0x180000000]
cmp rdi, qword [rsp + 8]
jb 0x1800ce2b0
mov rcx, qword [rsp + 0x40]
mov r15, qword [rsp + 0x10]
mov r14, qword [rsp + 0x18]
mov r13, qword [rsp + 0x20]
mov r12, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x50]
mov word [rdi], r9w
test rax, rax
je 0x1800ce49f
mov qword [rax], r8
sub rdi, rcx
sar rdi, 1
mov eax, edi
add rsp, 0x30
pop rdi
ret
Function at 0x1800ce4b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push r13
push r14
push r15
mov qword [rsp + 0x28], rbp
xor r10d, r10d
mov qword [rsp + 0x30], rsi
mov rbx, rdx
mov qword [rsp + 0x38], rdi
mov rax, rcx
mov qword [rsp + 0x40], r12
mov r14d, r10d
lea r15, [0x180000000]
mov r13, rax
test rbx, rbx
je 0x1800ce4f0
cmp rax, rbx
jae 0x1800ce69c
movzx r8d, byte [rax]
test r8b, r8b
je 0x1800ce69c
mov r11d, r10d
mov ecx, r8d
shr rcx, 3
mov rdx, rbx
movsx r9, byte [rcx + r15 + 0x190f48]
test r9d, r9d
sete r11b
add r11d, r9d
test rbx, rbx
jne 0x1800ce528
movsxd rdx, r11d
add rdx, rax
cmp rax, rdx
lea rcx, [rax + 1]
mov edi, r8d
cmovae edi, r10d
cmp rcx, rdx
jae 0x1800ce541
movzx r12d, byte [rcx]
jmp 0x1800ce544
xor r12b, r12b
lea rcx, [rax + 2]
cmp rcx, rdx
jae 0x1800ce552
movzx ebp, byte [rcx]
jmp 0x1800ce555
xor bpl, bpl
lea rcx, [rax + 3]
cmp rcx, rdx
jae 0x1800ce563
movzx esi, byte [rcx]
jmp 0x1800ce566
xor sil, sil
lea r9, [r9*4]
movzx ecx, dil
mov r15d, dword [r9 + r15 + 0x191590]
and r15d, ecx
movzx r8d, r12b
shl r15d, 6
mov ecx, r8d
and ecx, 0x3f
movzx edx, bpl
or r15d, ecx
movzx r10d, sil
shl r15d, 6
mov ecx, edx
and ecx, 0x3f
and edx, 0xc0
or r15d, ecx
and r8d, 0xc0
mov ecx, r10d
shl r15d, 6
and ecx, 0x3f
shr r10d, 2
or r10d, edx
or r15d, ecx
shr r10d, 2
lea rcx, [0x180000000]
mov ecx, dword [r9 + rcx + 0x190f30]
or r10d, r8d
shr r15d, cl
lea rcx, [0x180000000]
shr r10d, 2
mov edx, r15d
cmp r15d, dword [r9 + rcx + 0x190f18]
sbb ecx, ecx
and edx, 0xfffff800
and ecx, 0x40
xor r8d, r8d
or r10d, ecx
mov ecx, 0x80
cmp edx, 0xd800
cmove r8d, ecx
xor edx, edx
or r10d, r8d
mov ecx, 0x100
cmp r15d, 0xffff
cmova edx, ecx
lea rcx, [0x180000000]
mov ecx, dword [r9 + rcx + 0x191510]
or r10d, edx
xor r10d, 0x2a
sar r10d, cl
test r10d, r10d
je 0x1800ce686
xor r10d, r10d
test dil, dil
mov eax, r10d
mov ecx, r10d
setne cl
test sil, sil
setne al
add ecx, eax
mov eax, r10d
test bpl, bpl
setne al
add ecx, eax
mov eax, r10d
test r12b, r12b
setne al
add ecx, eax
cmp r11d, ecx
cmovl ecx, r11d
movsxd rax, ecx
add rax, r13
inc r14d
jmp 0x1800ce4d8
movsxd rcx, r11d
add rax, rcx
test r15d, r15d
je 0x1800ce69c
xor r10d, r10d
inc r14d
jmp 0x1800ce4d8
mov r12, qword [rsp + 0x40]
mov eax, r14d
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x28]
pop r15
pop r14
pop r13
pop rbx
ret