joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800a3350
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov rax, qword [0x1800f2b60]
mov rcx, qword [rax + 0x4888]
mov rcx, qword [rcx]
jmp fcn.1800a32e8

Function at 0x1800a3520
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
test dword [rcx + 0xc], 0x4000000
mov r8, rcx
je 0x1800a3548
mov rax, qword [0x1800f2b60]
mov rcx, qword [rax + 0x5c08]
jmp 0x1800a35d9
test dword [rcx + 0xc], 0x400
je 0x1800a35cb
mov dword [rbp - 0x10], 0x57781710
lea r10, [rbp - 0x10]
mov dword [rbp - 0xc], 0x5f74565e
xor r9d, r9d
mov dword [rbp - 8], 0x5f7f4955
mov word [rbp - 4], 0x404d
mov eax, 0x51eb851f
mul r9d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r9b
inc r9d
sub al, cl
add al, 0x33
xor byte [r10], al
inc r10
cmp r9d, 0xe
jl 0x1800a3573
mov rax, qword [r8]
lea r8, [rbp - 0x10]
sub r8, rax
movzx ecx, byte [rax]
movzx edx, byte [rax + r8]
sub ecx, edx
jne 0x1800a35b7
inc rax
test edx, edx
jne 0x1800a35a4
test ecx, ecx
jne 0x1800a35cb
mov rax, qword [0x1800f2b60]
mov rcx, qword [rax + 0x5c00]
jmp 0x1800a35d9
mov rax, qword [0x1800f2b60]
mov rcx, qword [rax + 0x5c10]
test rcx, rcx
lea rax, [0x180005f10]
cmovne rax, rcx
add rsp, 0x10
pop rbp
ret

Function at 0x1800a35f0
Capabilities:
Contain obfuscated stackstrings
Encode data using add xor sub operations

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov r10, rcx
mov dword [rbp - 0x10], 0x59731710
mov dword [rbp - 0xc], 0x485e5d45
lea r9, [rbp - 0x10]
mov dword [rbp - 8], 0x5a534954
xor r8d, r8d
mov byte [rbp - 4], 0x3f
mov eax, 0x51eb851f
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
inc r8d
sub al, cl
add al, 0x33
xor byte [r9], al
inc r9
cmp r8d, 0xd
jl 0x1800a361c
lea r8, [rbp - 0x10]
mov edx, 1
mov rcx, r10
call fcn.1800a3ee4
add rsp, 0x30
pop rbp
ret

Function at 0x1800a365c
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov rax, qword [0x1800f2b60]
mov rcx, qword [rax + 0x4888]
mov rcx, qword [rcx]
jmp fcn.1800a35f0

Function at 0x1800a3690
Capabilities:
Hash data with crc32

Disassembly:
movsxd r9, dword [rcx + 0xe8]
mov r10, r8
mov r8, qword [rcx + 0xf0]
mov r11, rdx
mov rax, r10
mov rcx, r11
sub rax, rdx
neg r10
mov r8d, dword [r8 + r9*4 - 4]
sbb rdx, rdx
and rdx, rax
jmp fcn.1800a449c

Function at 0x1800a4464
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r9, rcx
not r8d
test rdx, rdx
je 0x1800a4492
movzx eax, byte [r9]
inc r9
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
lea rax, [0x180008470]
xor r8d, dword [rax + rcx*4]
sub rdx, 1
jne 0x1800a446f
not r8d
mov eax, r8d
ret
Function at 0x1800a449c
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
not r8d
mov r10, rcx
mov r9d, r8d
test rdx, rdx
je 0x1800a44f6
mov r11b, 0x23
lea rdi, [0x180008470]
movzx ebx, byte [r10]
dec rdx
inc r10
cmp bl, r11b
jne 0x1800a44e0
cmp rdx, 2
jb 0x1800a44e0
cmp byte [r10], r11b
jne 0x1800a44e0
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
xor rcx, rbx
shr r9d, 8
xor r9d, dword [rdi + rcx*4]
test rdx, rdx
jne 0x1800a44be
jmp 0x1800a4537
mov dl, byte [rcx]
inc r10
test dl, dl
je 0x1800a4537
mov r11b, 0x23
lea rdi, [0x180008470]
cmp dl, r11b
jne 0x1800a451b
cmp byte [r10], r11b
jne 0x1800a451b
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
movzx eax, dl
mov dl, byte [r10]
xor rcx, rax
shr r9d, 8
inc r10
xor r9d, dword [rdi + rcx*4]
test dl, dl
jne 0x1800a4509
mov rbx, qword [rsp + 8]
not r9d
mov rdi, qword [rsp + 0x10]
mov eax, r9d
ret

Function at 0x1800a5714
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0x20
and qword [rax + 0x18], 0
lea r9, [rax + 0x10]
xor r8d, r8d
mov word [rax + 0x10], 0x5641
mov r10, rcx
mov byte [rax + 0x12], 0x35
mov eax, 0x51eb851f
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
inc r8d
sub al, cl
add al, 0x33
xor byte [r9], al
inc r9
cmp r8d, 3
jl 0x1800a5735
xor r9d, r9d
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x38]
mov rcx, r10
call fcn.1800a41f8
mov rbx, rax
test rax, rax
je 0x1800a57ad
mov rdx, qword [rsp + 0x40]
test rdx, rdx
je 0x1800a578b
mov rcx, rax
call fcn.1800a57b4
mov rcx, qword [0x1800f2b60]
test rcx, rcx
je 0x1800a579d
dec dword [rcx + 0xf4]
mov rdx, qword [0x1800f2b88]
mov rcx, rbx
call qword [0x1800ecac8]
add rsp, 0x20
pop rbx
ret

Function at 0x1800a59fc
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [0x1800f2b60]
cmp byte [rbx + 0x5c18], 0
je 0x1800a5af3
mov word [rsp + 0x30], 0x3e3e
lea r9, [rsp + 0x30]
mov byte [rsp + 0x32], 0x35
xor r8d, r8d
mov eax, 0x51eb851f
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
inc r8d
sub al, cl
add al, 0x33
xor byte [r9], al
inc r9
cmp r8d, 3
jl 0x1800a5a2a
lea rcx, [rsp + 0x30]
call fcn.1800a5d68
mov eax, dword [rbx + 0x5c1c]
cmp eax, 2
je 0x1800a5a90
cmp eax, 4
jne 0x1800a5a9c
cmp dword [rbx + 0x5c28], 1
jle 0x1800a5a9c
mov rax, qword [rbx + 0x5c30]
lea rcx, [0x1800f2b80]
test rax, rax
cmovne rcx, rax
call fcn.1800acde4
jmp 0x1800a5a9c
mov rcx, qword [rbx + 0x5c20]
call fcn.1800e5fd0
and dword [rbx + 0x5c1c], 0
and qword [rbx + 0x5c20], 0
mov byte [rbx + 0x5c18], 0
mov rcx, qword [rbx + 0x5c30]
test rcx, rcx
je 0x1800a5af3
and dword [rbx + 0x5c2c], 0
and dword [rbx + 0x5c28], 0
mov rax, qword [0x1800f2b60]
test rax, rax
je 0x1800a5ade
dec dword [rax + 0xf4]
mov rdx, qword [0x1800f2b88]
call qword [0x1800ecac8]
and qword [rbx + 0x5c30], 0
add rsp, 0x20
pop rbx
ret
Function at 0x1800a5afc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
mov rbx, r8
mov r14, rdx
mov r13, rcx
mov rdi, qword [0x1800f2b60]
mov rsi, qword [rdi + 0x5c38]
mov r12, qword [rdi + 0x5c40]
and qword [rdi + 0x5c40], 0
and qword [rdi + 0x5c38], 0
mov r15, qword [rdi + 0x3eb0]
test rbx, rbx
jne 0x1800a5b5a
xor edx, edx
mov rcx, r14
call fcn.1800a2cfc
mov rbx, rax
lea rcx, [r13 + 4]
test r13, r13
je 0x1800a5b8c
movss xmm1, dword [rdi + 0x3820]
lea rdx, [rdi + 0x5c48]
addss xmm1, dword [rdx]
movss xmm0, dword [rcx]
addss xmm1, dword [0x180005fd0]
comiss xmm0, xmm1
jbe 0x1800a5b8c
mov r8b, 1
jmp 0x1800a5b9b
xor r8b, r8b
lea rdx, [rdi + 0x5c48]
test r13, r13
je 0x1800a5bec
mov eax, dword [rcx]
mov dword [rdx], eax
test r8b, r8b
je 0x1800a5bec
mov word [rbp + 0x40], 0x3e3e
lea r9, [rbp + 0x40]
mov byte [rbp + 0x42], 0x35
xor r8d, r8d
mov eax, 0x51eb851f
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
inc r8d
sub al, cl
add al, 0x33
xor byte [r9], al
inc r9
cmp r8d, 3
jl 0x1800a5bb5
lea rcx, [rbp + 0x40]
call fcn.1800a5d68
mov byte [rdi + 0x5c4c], 1
test rsi, rsi
je 0x1800a5c0d
or r8, 0xffffffffffffffff
inc r8
cmp byte [rsi + r8], 0
jne 0x1800a5bf5
add r8, rsi
mov rdx, rsi
mov rcx, r13
call fcn.1800a5afc
mov ecx, dword [rdi + 0x5c50]
mov eax, dword [r15 + 0x180]
cmp ecx, eax
jle 0x1800a5c26
mov dword [rdi + 0x5c50], eax
mov ecx, eax
mov r15d, dword [r15 + 0x180]
sub r15d, ecx
mov r8, rbx
mov edx, 0xa
sub r8, r14
mov rcx, r14
call fcn.1800e65e4
test rax, rax
mov rsi, rbx
cmovne rsi, rax
cmp r14, rsi
jne 0x1800a5c5b
cmp rsi, rbx
je 0x1800a5d30
mov r9d, esi
mov dword [rbp + 0x50], 0x13461e16
sub r9d, r14d
mov dword [rbp + 0x54], 0x3a4a1219
cmp byte [rdi + 0x5c4c], 0
lea eax, [r15*4]
mov r10d, 1
lea r11, [rbp + 0x50]
cmovne r10d, eax
xor r8d, r8d
mov eax, 0x51eb851f
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
inc r8d
sub al, cl
add al, 0x33
xor byte [r11], al
inc r11
cmp r8d, 8
jl 0x1800a5c8f
lea r8, [0x180005f10]
mov qword [rsp + 0x20], r14
mov edx, r10d
lea rcx, [rbp + 0x50]
call fcn.1800a5d68
mov byte [rdi + 0x5c4c], 0
cmp byte [rsi], 0xa
jne 0x1800a5d22
mov word [rbp + 0x48], 0x3e3e
lea r9, [rbp + 0x48]
mov byte [rbp + 0x4a], 0x35
xor r8d, r8d
mov eax, 0x51eb851f
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
inc r8d
sub al, cl
add al, 0x33
xor byte [r9], al
inc r9
cmp r8d, 3
jl 0x1800a5ceb
lea rcx, [rbp + 0x48]
call fcn.1800a5d68
mov byte [rdi + 0x5c4c], 1
cmp rsi, rbx
je 0x1800a5d30
lea r14, [rsi + 1]
jmp 0x1800a5c30
test r12, r12
je 0x1800a5d4e
or rbx, 0xffffffffffffffff
inc rbx
cmp byte [r12 + rbx], 0
jne 0x1800a5d39
add rbx, r12
mov r14, r12
jmp 0x1800a5b1c
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800a90cc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
mov rbx, qword [0x1800f2b60]
movss xmm0, dword [0x180005f9c]
mov rdi, rbx
comiss xmm0, dword [rbx + 0x4a18]
ja 0x1800a933b
cmp qword [rbx + 0x4a10], 0
mov esi, 0x51eb851f
jne 0x1800a9178
movdqa xmm0, xmmword [0x180008ba0]
lea r9, [rbp - 0x20]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x4631372a
xor r8d, r8d
mov eax, esi
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
inc r8d
sub al, cl
add al, 0x33
xor byte [r9], al
inc r9
cmp r8d, 0x14
jl 0x1800a912a
xor r8d, r8d
lea rcx, [rbp - 0x20]
xor edx, edx
call fcn.1800a449c
mov edx, eax
lea rcx, [rbx + 0x3e90]
call fcn.1800a401c
mov qword [rbx + 0x4a10], rax
mov rbx, qword [0x1800f2b60]
mov rax, qword [rbx + 0x4888]
lea rdx, [rbp + 0x20]
mov dword [rbp - 0x18], 0x7f7fffff
mov dword [rbp - 0x14], 0x7f7fffff
mov rcx, qword [rax]
movss xmm2, dword [rcx + 0xc]
movss xmm1, dword [rcx + 0x10]
or dword [rbx + 0x4788], 0x10
and qword [rbx + 0x47d8], 0
and qword [rbx + 0x47e0], 0
mulss xmm1, dword [0x180005fa4]
mulss xmm2, dword [0x180005fa4]
movss dword [rbp - 0x1c], xmm1
movss dword [rbp - 0x20], xmm2
movups xmm1, xmmword [rbp - 0x20]
movdqu xmmword [rbx + 0x47c4], xmm1
mov rax, qword [0x1800f2b60]
movss xmm1, dword [rcx + 0x10]
movss xmm2, dword [rcx + 0xc]
mulss xmm1, dword [0x180005fbc]
mulss xmm2, dword [0x180005fbc]
addss xmm1, dword [rcx + 8]
addss xmm2, dword [rcx + 4]
or dword [rax + 0x4788], 1
mov ecx, 0x3f000000
mov dword [rax + 0x47a0], ecx
movss dword [rax + 0x479c], xmm1
mov dword [rax + 0x47a4], ecx
mov ecx, 2
movss dword [rax + 0x4798], xmm2
mov dword [rax + 0x478c], 1
movss xmm0, dword [rdi + 0x37e8]
movss xmm1, dword [rdi + 0x37ec]
addss xmm0, xmm0
addss xmm1, xmm1
movss dword [rbp + 0x20], xmm0
movss dword [rbp + 0x24], xmm1
call fcn.1800aa348
movdqa xmm0, xmmword [0x180008ba0]
lea r9, [rbp - 0x20]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x4631372a
xor r8d, r8d
mov eax, esi
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
inc r8d
sub al, cl
add al, 0x33
xor byte [r9], al
inc r9
cmp r8d, 0x14
jl 0x1800a927f
xor edx, edx
lea rcx, [rbp - 0x20]
mov r8d, 0xc1347
call fcn.18009d6c8
mov eax, dword [rdi + 0x3e60]
sub eax, 1
movsxd rsi, eax
js 0x1800a932c
mov rax, qword [rdi + 0x3e68]
mov rbx, qword [rax + rsi*8]
cmp byte [rbx + 0xaf], 0
je 0x1800a9326
cmp rbx, qword [rbx + 0x370]
jne 0x1800a9326
test dword [rbx + 0xc], 0x80000
jne 0x1800a9326
mov r14, qword [rbx]
xor edx, edx
mov rcx, r14
call fcn.1800a2cfc
cmp r14, rax
jne 0x1800a9305
mov rcx, rbx
call fcn.1800a3520
mov r14, rax
and dword [rbp + 0x20], 0
lea r9, [rbp + 0x20]
and dword [rbp + 0x24], 0
mov rcx, r14
cmp qword [rdi + 0x4a00], rbx
sete dl
xor r8d, r8d
call fcn.1800d0148
sub rsi, 1
jns 0x1800a92c2
call fcn.1800a1a08
mov ecx, 1
call fcn.1800a9f68
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rbp
ret
Function at 0x1800ac6c0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x1800f2b60]
mov rbx, rcx
and dword [rax + 0x5b84], 0
test rcx, rcx
je 0x1800ac765
and qword [rsp + 0x38], 0
lea rcx, [rsp + 0x38]
call fcn.1800ac770
mov rdi, rax
mov word [rsp + 0x30], 0x4044
xor r8d, r8d
mov byte [rsp + 0x32], 0x35
lea r9, [rsp + 0x30]
mov eax, 0x51eb851f
mul r8d
shr edx, 4
movsx ecx, dl
imul eax, ecx, 0x32
mov cl, r8b
inc r8d
sub cl, al
add cl, 0x33
xor byte [r9], cl
inc r9
cmp r8d, 3
jl 0x1800ac70b
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1800e61c0
mov rbx, rax
test rax, rax
je 0x1800ac765
mov r8, qword [rsp + 0x38]
mov r9, rax
mov edx, 1
mov rcx, rdi
call fcn.1800e6464
mov rcx, rbx
call fcn.1800e5fd0
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1800bbbb0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x20
mov edi, edx
mov rbx, rcx
call fcn.1800be348
xor r8d, r8d
test eax, eax
je 0x1800bbbdc
neg edi
sbb eax, eax
jmp 0x1800bbd77
mov dword [rbp + 0x20], 0x50564047
lea r10, [rbp + 0x20]
mov byte [rbp + 0x24], 0x37
mov r9d, r8d
mov r11d, 0x51eb851f
mov eax, r11d
mul r9d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r9b
inc r9d
sub al, cl
add al, 0x33
xor byte [r10], al
inc r10
cmp r9d, 5
jl 0x1800bbbf4
movzx ecx, byte [rbx]
movsx eax, byte [rbp + 0x20]
cmp ecx, eax
jne 0x1800bbd74
mov dword [rbp + 0x20], 0x50564047
lea r10, [rbp + 0x20]
mov byte [rbp + 0x24], 0x37
mov r9d, r8d
mov eax, r11d
mul r9d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r9b
inc r9d
sub al, cl
add al, 0x33
xor byte [r10], al
inc r10
cmp r9d, 5
jl 0x1800bbc3a
movzx ecx, byte [rbx + 1]
movsx eax, byte [rbp + 0x21]
cmp ecx, eax
jne 0x1800bbd74
mov dword [rbp + 0x20], 0x50564047
lea r10, [rbp + 0x20]
mov byte [rbp + 0x24], 0x37
mov r9d, r8d
mov eax, r11d
mul r9d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r9b
inc r9d
sub al, cl
add al, 0x33
xor byte [r10], al
inc r10
cmp r9d, 5
jl 0x1800bbc81
movzx ecx, byte [rbx + 2]
movsx eax, byte [rbp + 0x22]
cmp ecx, eax
jne 0x1800bbd74
mov dword [rbp + 0x20], 0x50564047
lea r9, [rbp + 0x20]
mov byte [rbp + 0x24], 0x37
mov eax, r11d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
inc r8d
sub al, cl
add al, 0x33
xor byte [r9], al
inc r9
cmp r8d, 5
jl 0x1800bbcc5
movzx ecx, byte [rbx + 3]
movsx eax, byte [rbp + 0x23]
cmp ecx, eax
jne 0x1800bbd74
movzx ecx, byte [rbx + 5]
movzx eax, byte [rbx + 6]
shl eax, 8
shl ecx, 0x10
add ecx, eax
movzx eax, byte [rbx + 4]
shl eax, 0x18
add ecx, eax
movzx eax, byte [rbx + 7]
add eax, 0xffff0000
add ecx, eax
test ecx, 0xfffeffff
jne 0x1800bbd74
movzx eax, byte [rbx + 9]
movzx ecx, byte [rbx + 8]
shl ecx, 8
add ecx, eax
movzx eax, byte [rbx + 0xa]
shl ecx, 8
add ecx, eax
movzx eax, byte [rbx + 0xb]
shl ecx, 8
add ecx, eax
cmp edi, ecx
jge 0x1800bbd74
lea eax, [rdi*4]
movsxd rdx, eax
movzx ecx, byte [rdx + rbx + 0xd]
movzx eax, byte [rdx + rbx + 0xc]
shl eax, 8
add eax, ecx
movzx ecx, byte [rdx + rbx + 0xe]
shl eax, 8
add eax, ecx
movzx ecx, byte [rdx + rbx + 0xf]
shl eax, 8
add eax, ecx
jmp 0x1800bbd77
or eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbp
ret
Function at 0x1800cc554
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
xor r8d, r8d
mov r10, rcx
test edx, edx
jne 0x1800cc5aa
mov dword [rbp - 0x20], 0x64766710
lea r9, [rbp - 0x20]
mov dword [rbp - 0x1c], 0x62757478
mov byte [rbp - 0x18], 0x3b
mov eax, 0x51eb851f
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
inc r8d
sub al, cl
add al, 0x33
xor byte [r9], al
inc r9
cmp r8d, 9
jl 0x1800cc57d
lea rdx, [rbp - 0x20]
jmp 0x1800cc5eb
mov dword [rbp - 0x17], 0x64766710
lea r9, [rbp - 0x17]
mov dword [rbp - 0x13], 0x63757478
mov byte [rbp - 0xf], 0x3b
mov eax, 0x51eb851f
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
inc r8d
sub al, cl
add al, 0x33
xor byte [r9], al
inc r9
cmp r8d, 9
jl 0x1800cc5c0
lea rdx, [rbp - 0x17]
xor r8d, r8d
mov rcx, r10
call fcn.1800a3690
add rsp, 0x40
pop rbp
ret
Function at 0x1800d4104
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
cmp qword [rdx + 0x18], 0x10
mov sil, r8b
mov rbx, rdx
jb 0x1800d412f
mov rdx, qword [rdx]
mov r8d, 0x84222325
mov r15d, 1
jmp 0x1800d414d
movsx eax, al
xor eax, r8d
imul r8d, eax, 0x1b3
add rdx, r15
mov al, byte [rdx]
test al, al
jne 0x1800d413d
lea rdx, [rbp - 0x20]
call fcn.1800d4df8
mov r10, qword [rbp - 0x10]
test r10, r10
jne 0x1800d41df
mov rdx, qword [rbp - 8]
mov edi, 0x1000
cmp rdx, 0x10
jb 0x1800d41a1
mov rcx, qword [rbp - 0x20]
inc rdx
mov rax, rcx
cmp rdx, rdi
jb 0x1800d419c
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800d42e7
call fcn.1800e423c
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1800d41d7
mov rcx, qword [rbx]
inc rdx
cmp rdx, rdi
jb 0x1800d41d2
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800d42e7
mov rcx, r8
call fcn.1800e423c
mov al, sil
jmp 0x1800d42be
mov dword [rbp + 0x28], 0x53404647
lea r9, [rbp + 0x28]
mov byte [rbp + 0x2c], 0x37
xor r8d, r8d
mov eax, 0x51eb851f
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
add r8d, r15d
sub al, cl
add al, 0x33
xor byte [r9], al
add r9, r15
cmp r8d, 5
jl 0x1800d41f1
lea rcx, [rbp + 0x28]
or rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x1800d4220
mov r14, qword [rbp - 8]
lea rcx, [rbp - 0x20]
mov rsi, qword [rbp - 0x20]
cmp r14, 0x10
cmovae rcx, rsi
cmp r10, rax
jne 0x1800d4252
mov r8, r10
lea rdx, [rbp + 0x28]
call fcn.1800e660c
test eax, eax
je 0x1800d4255
xor r15b, r15b
mov edi, 0x1000
cmp r14, 0x10
jb 0x1800d4289
lea rdx, [r14 + 1]
mov rax, rsi
cmp rdx, rdi
jb 0x1800d4281
mov rsi, qword [rsi - 8]
add rdx, 0x27
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800d42e7
mov rcx, rsi
call fcn.1800e423c
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1800d42bb
mov rcx, qword [rbx]
inc rdx
cmp rdx, rdi
jb 0x1800d42b6
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800d42e7
mov rcx, r8
call fcn.1800e423c
mov al, r15b
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
mov byte [rbx], 0
mov qword [rbx + 0x18], 0xf
and qword [rbx + 0x10], 0
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret
call fcn.1800ad4f0
int3
Function at 0x1800d489c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x40
cmp qword [rdx + 0x18], 0x10
mov rbx, rdx
mov rsi, rcx
jb 0x1800d48bb
mov rdx, qword [rdx]
mov edi, 0x84222325
jmp 0x1800d48d0
movsx eax, al
xor eax, edi
imul edi, eax, 0x1b3
inc rdx
mov al, byte [rdx]
test al, al
jne 0x1800d48c2
test r8b, r8b
je 0x1800d491a
mov dword [rbp + 0x28], 0x53404647
lea r9, [rbp + 0x28]
mov byte [rbp + 0x2c], 0x37
xor r8d, r8d
mov eax, 0x51eb851f
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
inc r8d
sub al, cl
add al, 0x33
xor byte [r9], al
inc r9
cmp r8d, 5
jl 0x1800d48ed
lea rdx, [rbp + 0x28]
jmp 0x1800d4959
mov dword [rbp + 0x38], 0x45595555
lea r9, [rbp + 0x38]
mov word [rbp + 0x3c], 0x3852
xor r8d, r8d
mov eax, 0x51eb851f
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
inc r8d
sub al, cl
add al, 0x33
xor byte [r9], al
inc r9
cmp r8d, 6
jl 0x1800d492e
lea rdx, [rbp + 0x38]
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rbp - 0x20], xmm0
or r8, 0xffffffffffffffff
movdqu xmmword [rbp - 0x10], xmm1
inc r8
cmp byte [rdx + r8], 0
jne 0x1800d496c
lea rcx, [rbp - 0x20]
call fcn.180029868
lea r8, [rbp - 0x20]
mov edx, edi
mov rcx, rsi
call fcn.1800d5188
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1800d49c3
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x1800d49be
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800d49e0
mov rcx, r8
call fcn.1800e423c
and qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
call fcn.1800ad4f0
int3
Function at 0x1800d4df8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
mov r14d, r8d
mov word [rbp + 0x20], 0x3439
mov rbx, rdx
lea r10, [rbp + 0x20]
mov rdi, rcx
xor r9d, r9d
mov eax, 0x51eb851f
mul r9d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r9b
inc r9d
sub al, cl
add al, 0x33
xor byte [r10], al
inc r10
cmp r9d, 2
jl 0x1800d4e23
xorps xmm0, xmm0
lea rax, [rbp + 0x20]
xorps xmm1, xmm1
or r8, 0xffffffffffffffff
movups xmmword [rbp - 0x20], xmm0
movdqu xmmword [rbp - 0x10], xmm1
inc r8
cmp byte [rax + r8], 0
jne 0x1800d4e61
lea rdx, [rbp + 0x20]
lea rcx, [rbp - 0x20]
call fcn.180029868
lea rdx, [rdi + 0x20]
lea r8, [rbp - 0x20]
lea rcx, [rbp - 0x38]
call fcn.1800d5860
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x1800d4ec4
mov rcx, qword [rbp - 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800d4ebf
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800d503f
call fcn.1800e423c
mov rdi, qword [rbp - 0x38]
mov rsi, qword [rbp - 0x30]
cmp rdi, rsi
je 0x1800d5002
mov word [rbp + 0x20], 0x340e
lea r9, [rbp + 0x20]
xor r8d, r8d
mov eax, 0x51eb851f
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
inc r8d
sub al, cl
add al, 0x33
xor byte [r9], al
inc r9
cmp r8d, 2
jl 0x1800d4ee2
and qword [rbp - 0x10], 0
lea rax, [rbp + 0x20]
and qword [rbp - 8], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x1800d4f22
lea rdx, [rbp + 0x20]
lea rcx, [rbp - 0x20]
call fcn.180029868
lea r8, [rbp - 0x20]
mov rdx, rdi
lea rcx, [rbp - 0x50]
call fcn.1800d5860
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x1800d4f84
mov rcx, qword [rbp - 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800d4f7f
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800d5039
call fcn.1800e423c
mov rax, qword [rbp - 0x48]
mov rcx, qword [rbp - 0x50]
sub rax, rcx
and rax, 0xffffffffffffffe0
cmp rax, 0x40
jne 0x1800d4fb7
cmp qword [rcx + 0x18], 0x10
jb 0x1800d4fa3
mov rcx, qword [rcx]
mov r8d, 0xa
lea rdx, [rbp + 0x38]
call fcn.1800e68cc
cmp eax, r14d
je 0x1800d4fc9
lea rcx, [rbp - 0x50]
call fcn.180032e78
add rdi, 0x20
jmp 0x1800d4ecc
mov rdx, qword [rbp - 0x50]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
and qword [rbx + 0x10], 0
add rdx, 0x20
and qword [rbx + 0x18], 0
cmp qword [rdx + 0x18], 0x10
mov r8, qword [rdx + 0x10]
jb 0x1800d4fef
mov rdx, qword [rdx]
mov rcx, rbx
call fcn.180029a50
lea rcx, [rbp - 0x50]
call fcn.180032e78
jmp 0x1800d5018
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
and qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
lea rcx, [rbp - 0x38]
call fcn.180032e78
lea r11, [rsp + 0x70]
mov rax, rbx
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.1800ad4f0
int3
call fcn.1800ad4f0
int3
Function at 0x1800d5048
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rsi, rcx
mov word [rax + 8], 0x3441
xor r8d, r8d
lea r9, [rax + 8]
mov eax, 0x51eb851f
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
inc r8d
sub al, cl
add al, 0x33
xor byte [r9], al
inc r9
cmp r8d, 2
jl 0x1800d506b
cmp qword [rsi + 0x18], 0x10
mov rcx, rsi
jb 0x1800d509f
mov rcx, qword [rsi]
lea rdx, [rsp + 0x40]
call fcn.1800e61c0
mov rbp, rax
test rax, rax
je 0x1800d5175
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 2]
call fcn.1800e6374
mov rcx, rbp
call fcn.1800e6414
xor r8d, r8d
movsxd rbx, eax
xor edx, edx
mov rcx, rbp
call fcn.1800e6374
test ebx, ebx
jg 0x1800d50ec
mov rcx, rbp
call fcn.1800e5fd0
jmp 0x1800d5175
mov rcx, rbx
mov rdi, rbx
call fcn.1800e421c
mov r9, rbp
mov r8, rdi
mov edx, 1
mov rcx, rax
mov rbx, rax
call fcn.1800e62f4
mov rcx, rbp
mov r14, rax
call fcn.1800e5fd0
cmp r14, rdi
jne 0x1800d5168
lea rcx, [rsi + 0x20]
cmp r14, qword [rcx + 0x18]
ja 0x1800d514d
cmp qword [rcx + 0x18], 0x10
mov rdi, rcx
jb 0x1800d5134
mov rdi, qword [rcx]
mov qword [rcx + 0x10], r14
mov r8, r14
mov rcx, rdi
mov rdx, rbx
call fcn.1800e663c
mov byte [rdi + r14], 0
jmp 0x1800d515d
mov r8b, byte [rsp + 0x40]
mov r9, rbx
mov rdx, r14
call fcn.18002a950
mov rcx, rsi
call fcn.1800d4dcc
mov dword [rsi + 0x40], eax
test rbx, rbx
je 0x1800d5175
mov rcx, rbx
call fcn.1800e423c
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret