joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800dc440
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x80], 0
jne 0x1800dc46d
xor ecx, ecx
call sub.KERNEL32.dll_GetModuleHandleW
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1800dc48d
mov ecx, 0xc1
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x1800dc606
mov rax, qword [rsp + 0x40]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x40]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp dword [rax], 0x4550
je 0x1800dc4c4
mov ecx, 0xbf
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x1800dc606
mov rax, qword [rsp + 0x38]
movzx eax, word [rax + 0x14]
test eax, eax
jne 0x1800dc4e2
mov ecx, 0xc0
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x1800dc606
mov rax, qword [rsp + 0x38]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x38]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x20], 0
jmp 0x1800dc50e
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x38]
movzx eax, word [rax + 6]
cmp dword [rsp + 0x20], eax
jae 0x1800dc5ea
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
lea rdx, [0x180180898]
mov rcx, rax
call fcn.18014e710
test eax, eax
jne 0x1800dc5e5
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x48]
cmp dword [rcx + rax + 0xc], 0
je 0x1800dc573
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x48]
cmp dword [rcx + rax + 0x10], 0
jne 0x1800dc575
jmp 0x1800dc5ea
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x48]
mov eax, dword [rcx + rax + 0xc]
mov rcx, qword [rsp + 0x40]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax]
cmp rax, 0x40
jb 0x1800dc5bb
mov rax, qword [rsp + 0x28]
cmp dword [rax + 4], 0x727444
je 0x1800dc5bd
jmp 0x1800dc5ea
mov rax, qword [rsp + 0x28]
cmp dword [rax + 8], 0
jne 0x1800dc5d7
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x28]
mov ecx, dword [rcx]
mov dword [rax + 8], ecx
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rsp + 0x28]
jmp 0x1800dc606
jmp 0x1800dc504
mov ecx, 0xc0
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x1800dc606
add rsp, 0x78
ret
Function at 0x1800dc610
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov rax, qword [rsp + 0x90]
add rax, 0x10000
mov qword [rsp + 0x30], rax
mov r8d, gethostbyname
xor edx, edx
lea rcx, [rsp + 0x48]
call fcn.180136140
jmp 0x1800dc658
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov r8d, gethostbyname
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
ja 0x1800dc677
jmp 0x1800dc71b
cmp dword [rsp + 0x68], 0x1000
jne 0x1800dc69c
mov eax, dword [rsp + 0x6c]
and eax, 0xff
cmp eax, 1
je 0x1800dc69c
mov eax, dword [rsp + 0x6c]
and eax, 0x100
test eax, eax
je 0x1800dc69e
jmp 0x1800dc643
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
jne 0x1800dc6d4
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x3c]
cmp rax, qword [rsp + 0x60]
ja 0x1800dc6d4
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x3c]
cmp rax, 0x40
jae 0x1800dc6d9
jmp 0x1800dc643
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp dword [rax], 0x4550
jne 0x1800dc643
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rsp + 0x20]
jmp 0x1800dc71d
xor eax, eax
add rsp, 0x88
ret

Function at 0x1800dc970
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov r8d, gethostbyname
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.180136140
nop
mov r8d, gethostbyname
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x80]
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
ja 0x1800dc9ba
mov ecx, 0xc1
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x1800dca82
cmp dword [rsp + 0x60], 0x1000
jne 0x1800dc9df
mov eax, dword [rsp + 0x64]
and eax, 0xff
cmp eax, 1
je 0x1800dc9df
mov eax, dword [rsp + 0x64]
and eax, 0x100
test eax, eax
je 0x1800dc9f0
mov ecx, 0xc1
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x1800dca82
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1800dca17
mov ecx, 0xc1
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x1800dca82
mov rax, qword [rsp + 0x28]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x1800dca4b
mov ecx, 0xbf
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x1800dca82
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x14]
test eax, eax
jne 0x1800dca66
mov ecx, 0xc0
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x1800dca82
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rsp + 0x28]
jmp 0x1800dca82
add rsp, 0x78
ret
Function at 0x1800e0680
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
movsxd r11, dword [rcx + 8]
xor edi, edi
mov rsi, rdx
mov r14, rcx
movsxd rdx, dword [rdx + 8]
mov r8d, edi
mov r9, r11
cmp r11, rdx
jge 0x1800e06cd
mov rax, qword [rsi]
lea r10, [rax + r11*8]
mov rax, rdx
sub rax, r11
nop dword [rax]
or r8, qword [r10]
lea r10, [r10 + 8]
sub rax, 1
jne 0x1800e06c0
cmp rdx, r9
jge 0x1800e06ed
mov rax, qword [rcx]
sub r9, rdx
lea rcx, [rax + rdx*8]
nop dword [rax]
or r8, qword [rcx]
lea rcx, [rcx + 8]
sub r9, 1
jne 0x1800e06e0
cmp r11d, edx
cmovge r11d, edx
mov edx, edi
test r11d, r11d
jle 0x1800e077f
cmp r11d, 4
jb 0x1800e077f
mov r9, qword [r14]
mov ecx, r11d
mov r10, qword [rsi]
xorps xmm3, xmm3
xorps xmm2, xmm2
and ecx, 0x80000003
jge 0x1800e0723
dec ecx
or ecx, 0xfffffffc
inc ecx
mov eax, r11d
sub eax, ecx
movsxd rcx, eax
mov rax, rdi
nop
movdqu xmm0, xmmword [r9 + rax*8]
add edx, 4
movdqu xmm1, xmmword [r10 + rax*8]
pxor xmm1, xmm0
movdqu xmm0, xmmword [r9 + rax*8 + 0x10]
por xmm3, xmm1
movdqu xmm1, xmmword [r10 + rax*8 + 0x10]
add rax, 4
pxor xmm1, xmm0
por xmm2, xmm1
cmp rax, rcx
jl 0x1800e0730
por xmm2, xmm3
movdqa xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movq rax, xmm2
or r8, rax
movsxd rdx, edx
movsxd r9, r11d
cmp rdx, r9
jge 0x1800e07a3
mov rax, qword [r14]
mov r10, qword [rsi]
mov rcx, qword [r10 + rdx*8]
xor rcx, qword [rax + rdx*8]
inc rdx
or r8, rcx
cmp rdx, r9
jl 0x1800e0790
movsxd rdx, dword [r14 + 0x10]
movsxd rcx, dword [rsi + 0x10]
mov rbx, qword [rsp + 8]
xor rdx, rcx
mov rsi, qword [rsp + 0x10]
or rdx, r8
mov r14, qword [rsp + 0x20]
sete dil
mov eax, edi
mov rdi, qword [rsp + 0x18]
ret
Function at 0x1800e4590
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x1800e4757
push rbx
push rsi
push rdi
push r12
sub rsp, 0x28
mov qword [rsp + 0x58], r13
mov r12, r9
mov r13, qword [rsp + 0x70]
mov rdi, r8
mov qword [rsp + 0x20], r15
mov rax, r13
mov r15, qword [rsp + 0x78]
mov rbx, rdx
mov rsi, rcx
cmp r8, 0x10
jb 0x1800e4631
mov qword [rsp + 0x50], rbp
mov rbp, r8
shr rbp, 4
imul rcx, rbp, 0xfffffffffffffff0
add rdi, rcx
nop
mov r8, rsi
mov r9, rbx
sub r8, rax
mov edx, 2
sub r9, rax
mov rcx, qword [rax]
xor rcx, qword [r8 + rax]
mov qword [r9 + rax], rcx
lea rax, [rax + 8]
sub rdx, 1
jne 0x1800e45f1
mov r8, r12
mov rdx, rbx
mov rcx, rbx
call r15
mov rax, rbx
add rsi, 0x10
add rbx, 0x10
sub rbp, 1
jne 0x1800e45e0
mov rbp, qword [rsp + 0x50]
test rdi, rdi
je 0x1800e473c
mov qword [rsp + 0x60], r14
nop word [rax + rax]
mov r9, rax
lea rdx, [rsi + 1]
mov r10, rbx
mov r11d, 1
sub r9, rsi
sub r10, rsi
sub r11, rsi
xor r8d, r8d
mov r14d, 2
sub r14, rsi
cmp r8, rdi
jae 0x1800e46e1
movzx ecx, byte [r9 + rdx - 1]
xor cl, byte [rdx - 1]
mov byte [r10 + rdx - 1], cl
mov rcx, rdx
sub rcx, rsi
cmp rcx, rdi
jae 0x1800e46d8
movzx ecx, byte [r9 + rdx]
xor cl, byte [rdx]
mov byte [r10 + rdx], cl
lea rcx, [r11 + rdx]
cmp rcx, rdi
jae 0x1800e46d2
movzx ecx, byte [r9 + rdx + 1]
xor cl, byte [rdx + 1]
mov byte [r10 + rdx + 1], cl
lea rcx, [r14 + rdx]
cmp rcx, rdi
jae 0x1800e46cc
movzx ecx, byte [r9 + rdx + 2]
add r8, 4
xor cl, byte [rdx + 2]
mov byte [r10 + rdx + 2], cl
add rdx, 4
cmp r8, 0x10
jb 0x1800e4665
jmp 0x1800e4710
add r8, 3
jmp 0x1800e46db
add r8, 2
jmp 0x1800e46db
inc r8
cmp r8, 0x10
jae 0x1800e4710
sub rax, rbx
lea rdx, [r8 + rbx]
mov r9d, reloc.WS2_32.dll_recv
sub r9, r8
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [rax + rdx]
mov byte [rdx], cl
lea rdx, [rdx + 1]
sub r9, 1
jne 0x1800e4700
mov r8, r12
mov rdx, rbx
mov rcx, rbx
call r15
mov rax, rbx
cmp rdi, 0x10
jbe 0x1800e4737
add rsi, 0x10
add rbx, 0x10
sub rdi, 0x10
jne 0x1800e4640
mov r14, qword [rsp + 0x60]
movups xmm0, xmmword [rax]
mov r15, qword [rsp + 0x20]
movups xmmword [r13], xmm0
mov r13, qword [rsp + 0x58]
add rsp, 0x28
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x1800ebbe0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x138
mov rax, qword [0x180201ac0]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov rdi, r9
mov rbx, r8
mov rbp, rdx
mov rsi, rcx
test r9, r9
jne 0x1800ebc17
mov rdi, qword [rcx]
mov rax, rdi
jmp 0x1800ebc1a
mov rax, qword [rcx]
mov qword [rsp + 0x130], r14
cmp rdi, rax
jne 0x1800ebc30
test rbp, rbp
je 0x1800ebdfb
mov eax, dword [rdi + 0x28]
cmp rax, rbx
jae 0x1800ebc8a
mov r8, qword [rsp + 0x180]
mov rdx, rdi
add rcx, 8
call fcn.1800eaec0
test eax, eax
je 0x1800ebe13
mov rax, qword [rsi + 8]
lea rcx, [rsi + 8]
mov r8, rbx
mov rdx, rbp
call qword [rax + Ordinal_26]
mov rax, qword [rsi + 8]
lea rdx, [rsp + 0x20]
lea rcx, [rsi + 8]
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
mov rax, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
mov edx, dword [rax + 0x2c]
mov ebx, dword [rax + 4]
call fcn.180107a50
jmp 0x1800ebc99
test rbx, rbx
je 0x1800ebc99
lea rcx, [rsp + 0x20]
call fcn.180135a90
cmp ebx, 0x80
je 0x1800ebcbd
mov eax, ebx
mov r8d, 0x80
sub r8, rax
je 0x1800ebcbd
lea rcx, [rsp + 0x20]
xor edx, edx
add rcx, rax
call fcn.180136140
movdqa xmm2, xmmword [str.6666666666666666_]
xor ebx, ebx
mov eax, ebx
nop dword [rax]
movdqu xmm0, xmmword [rsp + rax + 0x20]
movdqu xmm1, xmmword [rsp + rax + 0x30]
pxor xmm0, xmm2
movdqu xmmword [rsp + rax + 0xa0], xmm0
movdqu xmm0, xmmword [rsp + rax + 0x40]
pxor xmm1, xmm2
movdqu xmmword [rsp + rax + 0xb0], xmm1
movdqu xmm1, xmmword [rsp + rax + 0x50]
pxor xmm0, xmm2
movdqu xmmword [rsp + rax + 0xc0], xmm0
pxor xmm1, xmm2
movdqu xmmword [rsp + rax + 0xd0], xmm1
add rax, 0x40
cmp rax, 0x80
jb 0x1800ebcd0
mov r8, qword [rsp + 0x180]
lea rcx, [rsi + 0x28]
mov rdx, rdi
call fcn.1800eaec0
test eax, eax
je 0x1800ebe13
mov rax, qword [rsi + 0x28]
lea rdx, [rsp + 0xa0]
mov r8d, dword [rdi + 0x28]
lea rcx, [rsi + 0x28]
call qword [rax + Ordinal_26]
movdqa xmm2, xmmword [0x1801a9720]
nop dword [rax]
nop word [rax + rax]
movdqu xmm0, xmmword [rsp + rbx + 0x20]
movdqu xmm1, xmmword [rsp + rbx + 0x30]
pxor xmm0, xmm2
movdqu xmmword [rsp + rbx + 0xa0], xmm0
movdqu xmm0, xmmword [rsp + rbx + 0x40]
pxor xmm1, xmm2
movdqu xmmword [rsp + rbx + 0xb0], xmm1
movdqu xmm1, xmmword [rsp + rbx + 0x50]
pxor xmm0, xmm2
movdqu xmmword [rsp + rbx + 0xc0], xmm0
pxor xmm1, xmm2
movdqu xmmword [rsp + rbx + 0xd0], xmm1
add rbx, 0x40
cmp rbx, 0x80
jb 0x1800ebd70
mov r8, qword [rsp + 0x180]
lea rcx, [rsi + 0x48]
mov rdx, rdi
call fcn.1800eaec0
test eax, eax
je 0x1800ebe13
mov rax, qword [rsi + 0x48]
lea rdx, [rsp + 0xa0]
mov r8d, dword [rdi + 0x28]
lea rcx, [rsi + 0x48]
call qword [rax + Ordinal_26]
mov qword [rsi], rdi
lea rdx, [rsi + 0x28]
lea rcx, [rsi + 8]
call fcn.1800eb170
test eax, eax
je 0x1800ebe13
mov eax, 1
jmp 0x1800ebe15
xor eax, eax
mov r14, qword [rsp + 0x130]
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.180133630
add rsp, 0x138
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800f0a00
Capabilities:
Hash data using sha512

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x110
mov rax, qword [0x180201ac0]
xor rax, rsp
mov qword [rsp + 0x100], rax
movabs rax, 0x6a09e667f3bcc908
mov dword [rsp + 0xf4], 0x40
mov qword [rsp + 0x20], rax
mov rsi, r8
movabs rax, 0xbb67ae8584caa73b
mov rbx, rdx
mov qword [rsp + 0x28], rax
mov rdi, rcx
movabs rax, 0x3c6ef372fe94f82b
mov qword [rsp + 0x30], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rsp + 0x38], rax
movabs rax, 0x510e527fade682d1
mov qword [rsp + 0x40], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rsp + 0x48], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rsp + 0x50], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rsp + 0x58], rax
xor eax, eax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov dword [rsp + 0xf0], eax
test rdx, rdx
je 0x1800f0b1c
mov rax, rdx
lea rcx, [rdx*8]
shr rax, 0x3d
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x60], rcx
cmp rdx, 0x80
jb 0x1800f0b05
mov r8, rdx
lea rcx, [rsp + 0x20]
shr r8, 7
mov rdx, rdi
call fcn.180025b80
add rdi, rbx
and ebx, 0x7f
sub rdi, rbx
test rbx, rbx
je 0x1800f0b1c
mov r8, rbx
lea rcx, [rsp + 0x70]
mov rdx, rdi
call fcn.180135a90
mov dword [rsp + 0xf0], ebx
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.180104510
mov edx, 0xd8
lea rcx, [rsp + 0x20]
call fcn.180107a50
mov rax, rsi
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.180133630
add rsp, 0x110
pop rdi
pop rsi
pop rbx
ret
Function at 0x1800f1980
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rax, qword [rcx]
mov rbx, r8
xor qword [r8], rax
mov r14, rdx
mov rax, qword [rcx + 8]
mov rsi, rcx
xor qword [r8 + 8], rax
mov rax, qword [rcx + 0x10]
xor qword [r8 + 0x10], rax
mov rax, qword [rcx + 0x18]
xor qword [r8 + 0x18], rax
mov rax, qword [rcx + 0x20]
xor qword [r8 + 0x20], rax
mov rax, qword [rcx + 0x28]
xor qword [r8 + 0x28], rax
mov rax, qword [rcx + 0x30]
xor qword [r8 + 0x30], rax
mov rax, qword [rcx + 0x38]
xor qword [r8 + 0x38], rax
cmp rdx, 1
jbe 0x1800f1a5b
mov qword [rsp + 0x30], rbp
lea rbp, [rdx - 1]
mov qword [rsp + 0x38], rdi
lea rdi, [rcx + 0x50]
nop
mov rcx, rbx
call fcn.1800f2e10
mov rcx, rbx
call fcn.1800f2c40
mov rcx, rbx
call fcn.1800f21f0
mov rax, qword [rdi - 0x10]
lea rdi, [rdi + 0x40]
xor qword [rbx], rax
mov rax, qword [rdi - 0x48]
xor qword [rbx + 8], rax
mov rax, qword [rdi - 0x40]
xor qword [rbx + 0x10], rax
mov rax, qword [rdi - 0x38]
xor qword [rbx + 0x18], rax
mov rax, qword [rdi - 0x30]
xor qword [rbx + 0x20], rax
mov rax, qword [rdi - 0x28]
xor qword [rbx + 0x28], rax
mov rax, qword [rdi - 0x20]
xor qword [rbx + 0x30], rax
mov rax, qword [rdi - 0x18]
xor qword [rbx + 0x38], rax
sub rbp, 1
jne 0x1800f19f0
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rcx, rbx
call fcn.1800f2e10
mov rcx, rbx
call fcn.1800f2c40
lea rcx, [r14*8]
mov rax, qword [rsi + rcx*8]
xor qword [rbx], rax
mov rax, qword [rsi + rcx*8 + 8]
xor qword [rbx + 8], rax
mov rax, qword [rsi + rcx*8 + 0x10]
xor qword [rbx + 0x10], rax
mov rax, qword [rsi + rcx*8 + 0x18]
xor qword [rbx + 0x18], rax
mov rax, qword [rsi + rcx*8 + 0x20]
xor qword [rbx + 0x20], rax
mov rax, qword [rsi + rcx*8 + 0x28]
xor qword [rbx + 0x28], rax
mov rax, qword [rsi + rcx*8 + 0x30]
xor qword [rbx + 0x30], rax
mov rax, qword [rsi + rcx*8 + 0x38]
xor qword [rbx + 0x38], rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1800f1ad0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rax, [rdx + 0xf0]
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], rax
mov r13, rdx
lea rax, [rcx + 8]
movabs r8, 0x5555555555555555
nop word [rax + rax]
movups xmm0, xmmword [r13]
movq qword [rax - 8], xmm0
psrldq xmm0, 8
movq qword [rax + 0x18], xmm0
movups xmm0, xmmword [r13]
movq qword [rax], xmm0
psrldq xmm0, 8
movq qword [rax + 0x20], xmm0
movups xmm0, xmmword [r13]
movq qword [rax + 8], xmm0
psrldq xmm0, 8
movq qword [rax + 0x28], xmm0
movups xmm0, xmmword [r13]
movq qword [rax + 0x10], xmm0
psrldq xmm0, 8
movq qword [rax + 0x30], xmm0
mov rbp, qword [rax]
mov rdi, qword [rax + 8]
mov r14, qword [rax - 8]
shr rdi, 1
xor rdi, qword [rax + 0x10]
and rdi, r8
shr r14, 1
xor r14, rbp
and r14, r8
xor rbp, r14
lea r9, [rdi + rdi]
xor r9, qword [rax + 8]
mov qword [rax + 8], r9
xor rdi, qword [rax + 0x10]
mov qword [rax + 0x10], rdi
mov rsi, qword [rax + 0x30]
mov r12, qword [rax + 0x20]
mov rdx, qword [rax + 0x28]
mov r15, qword [rax + 0x18]
shr rdx, 1
xor rdx, rsi
shr r15, 1
and rdx, r8
xor r15, r12
xor rsi, rdx
and r15, r8
lea r8, [r14 + r14]
xor r12, r15
lea r10, [rdx + rdx]
xor r10, qword [rax + 0x28]
mov qword [rax + 0x28], r10
mov qword [rax + 0x30], rsi
xor r8, qword [rax - 8]
mov rdx, r8
shr rdx, 2
xor rdx, r9
movabs r9, 0x3333333333333333
and rdx, r9
lea rcx, [rdx*4]
xor rcx, r8
lea r8, [r15 + r15]
mov qword [rax - 8], rcx
xor qword [rax + 8], rdx
mov rdx, rbp
shr rdx, 2
xor rdx, rdi
and rdx, r9
lea rcx, [rdx*4]
xor rcx, rbp
mov qword [rax], rcx
xor qword [rax + 0x10], rdx
xor r8, qword [rax + 0x18]
mov rdx, r8
shr rdx, 2
xor rdx, r10
and rdx, r9
lea rcx, [rdx*4]
xor rcx, r8
mov qword [rax + 0x18], rcx
xor qword [rax + 0x28], rdx
mov rdx, r12
shr rdx, 2
xor rdx, rsi
and rdx, r9
lea rcx, [rdx*4]
xor rcx, r12
lea r13, [r13 + 0x10]
mov qword [rax + 0x20], rcx
movabs r8, 0x5555555555555555
xor qword [rax + 0x30], rdx
lea rax, [rax + 0x40]
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
inc rdx
mov qword [rsp + 0x40], rdx
mov ecx, dword [rcx]
cmp rdx, rcx
jbe 0x1800f1b10
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x50]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x1800f1cb0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rdi
sub rsp, 0x88
mov rax, qword [0x180201ac0]
xor rax, rsp
mov qword [rsp + 0x60], rax
movups xmm0, xmmword [r8]
mov rdi, rcx
lea rcx, [rsp + 0x20]
movups xmm1, xmmword [r8 + 0x10]
mov rbx, rdx
movaps xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [r8 + 0x20]
movaps xmmword [rsp + 0x30], xmm1
movups xmm1, xmmword [r8 + 0x30]
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x50], xmm1
call fcn.1800f3380
xor r11d, r11d
test rbx, rbx
je 0x1800f1e3e
mov qword [rsp + 0xa8], rbp
movabs rbp, 0xff000000ff00
mov qword [rsp + 0x80], rsi
mov esi, 0xffff0000
mov qword [rsp + 0x78], r14
movabs r14, 0xf000f000f000f0
mov qword [rsp + 0x70], r15
movabs r15, 0xffffffff00000000
nop dword [rax]
mov r10, qword [rsp + r11*8 + 0x40]
lea rdi, [rdi + 0x10]
mov rdx, qword [rsp + r11*8 + 0x20]
mov r9, r10
shl r9, 0x20
and r10, r15
mov eax, edx
inc r11
or r9, rax
shr rdx, 0x20
or r10, rdx
mov rcx, r9
shr rcx, 0x10
xor rcx, r9
and rcx, rsi
mov rax, rcx
shl rax, 0x10
xor rax, rcx
xor r9, rax
mov rcx, r9
shr rcx, 8
xor rcx, r9
and rcx, rbp
mov rax, rcx
shl rax, 8
xor rax, rcx
mov rcx, r10
xor r9, rax
shr rcx, 0x10
xor rcx, r10
mov r8, r9
and rcx, rsi
shr r8, 4
mov rax, rcx
xor r8, r9
shl rax, 0x10
and r8, r14
xor rax, rcx
xor r10, rax
mov rcx, r10
shr rcx, 8
xor rcx, r10
and rcx, rbp
mov rax, rcx
shl rax, 8
xor rax, rcx
xor r10, rax
mov rax, r8
shl rax, 4
mov rcx, r10
xor rax, r8
shr rcx, 4
xor rax, r9
xor rcx, r10
mov qword [rdi - 0x10], rax
and rcx, r14
mov rax, rcx
shl rax, 4
xor rax, rcx
xor rax, r10
mov qword [rdi - 8], rax
cmp r11, rbx
jb 0x1800f1d50
mov r15, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.180133630
add rsp, 0x88
pop rdi
pop rbx
ret
Function at 0x1800f24f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rdi, r8
sub edx, 0x80
je 0x1800f2564
sub edx, 0x40
je 0x1800f2546
cmp edx, 0x40
je 0x1800f2528
mov eax, 1
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
mov rdx, rcx
mov rcx, rdi
call fcn.1800f2a00
xor eax, eax
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
mov rdx, rcx
mov rcx, rdi
call fcn.1800f26d0
xor eax, eax
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
mov qword [rsp + 0x90], rbp
mov rdx, rcx
mov qword [rsp + 0x98], rsi
lea rcx, [rsp + 0x20]
mov qword [rsp + 0xa0], r14
mov dword [r8 + 0xf0], 0xa
call fcn.1800f1340
movups xmm0, xmmword [rsp + 0x20]
mov ebx, 1
lea r14, [0x1801a7438]
movabs rbp, 0xf000000000000
movups xmmword [rdi], xmm0
add rdi, 0x10
xor esi, esi
nop dword [rax + rax]
mov rax, qword [rsp + 0x20]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
mov rax, qword [rsp + 0x28]
xorps xmm1, xmm1
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x48], rsi
movdqa xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x68], rsi
movdqa xmmword [rsp + 0x70], xmm1
call fcn.1800f3380
lea rcx, [rsp + 0x40]
call fcn.1800f2e10
lea rcx, [rsp + 0x40]
call fcn.1800f3380
mov rax, qword [rsp + 0x40]
mov r9, rsi
movzx r10d, byte [rbx + r14 - 1]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x38], rax
nop dword [rax + rax]
mov rdx, qword [rsp + r9*8 + 0x30]
movzx ecx, r9b
mov rax, rdx
shl cl, 2
shr rax, 0x10
and rdx, rbp
or rax, rdx
mov r8, r10
shr rax, 0x24
shr r8, cl
and r8d, 0xf
xor r8, rax
xor r8, qword [rsp + r9*8 + 0x20]
mov rax, r8
shl rax, 0x10
xor rax, r8
shl rax, 0x10
xor rax, r8
shl rax, 0x10
xor rax, r8
mov qword [rsp + r9*8 + 0x20], rax
inc r9
cmp r9, 2
jb 0x1800f2630
movups xmm0, xmmword [rsp + 0x20]
inc rbx
movups xmmword [rdi], xmm0
add rdi, 0x10
cmp rbx, 0xa
jbe 0x1800f25c0
mov r14, qword [rsp + 0xa0]
xor eax, eax
mov rsi, qword [rsp + 0x98]
mov rbp, qword [rsp + 0x90]
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret