joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800294b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x70
mov rcx, qword [0x1800801a0]
movabs rdx, 0x7ffffffdfffe
mov rbx, qword [0x18007d6c0]
movaps xmmword [rsp + 0x60], xmm6
movaps xmm6, xmm1
movaps xmmword [rsp + 0x50], xmm7
movaps xmm7, xmm0
lea rax, [rcx - 0x10000]
cmp rax, rdx
jbe 0x180029576
mov eax, dword [0x180071488]
xor r8d, r8d
mov dword [rsp + 0x90], eax
movabs r9, 0x47ae147ae147ae15
movzx eax, word [0x18007148c]
mov word [rsp + 0x94], ax
nop word [rax + rax]
mov rax, r9
mul r8
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
movsx eax, al
imul ecx, eax, 0x32
movzx eax, r8b
sub al, cl
add al, 0x32
xor byte [rsp + r8 + 0x90], al
inc r8
cmp r8, 6
jb 0x180029520
lea rdx, [rsp + 0x90]
movabs rcx, 0x11837e716e5fd5ec
call fcn.18002a300
mov rcx, rax
mov qword [0x1800801a0], rax
xorps xmm1, xmm1
mov qword [rsp + 0x28], 0
xorps xmm0, xmm0
mov qword [rsp + 0x30], rcx
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rbx
cvtss2sd xmm1, xmm6
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x20], rax
cvtss2sd xmm0, xmm7
call fcn.18002ab40
movaps xmm6, xmmword [rsp + 0x60]
movaps xmm7, xmmword [rsp + 0x50]
cvtsd2ss xmm0, xmm0
add rsp, 0x70
pop rbx
ret

Function at 0x1800295d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rdx, qword [0x180080198]
mov rbx, rcx
mov rdi, qword [0x18007d6e0]
movabs rcx, 0x7ffffffdfffe
lea rax, [rdx - 0x10000]
cmp rax, rcx
jbe 0x180029680
mov eax, dword [0x180071480]
xor r8d, r8d
mov dword [rsp + 0x68], eax
movabs r9, 0x47ae147ae147ae15
movzx eax, word [0x180071484]
mov word [rsp + 0x6c], ax
nop dword [rax]
nop dword [rax + rax]
mov rax, r9
mul r8
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
movsx eax, al
imul ecx, eax, 0x32
movzx eax, r8b
sub al, cl
add al, 0x32
xor byte [rsp + r8 + 0x68], al
inc r8
cmp r8, 6
jb 0x180029630
lea rdx, [rsp + 0x68]
movabs rcx, 0x11837e716e5fd5ec
call fcn.18002a300
mov rdx, rax
mov qword [0x180080198], rax
mov qword [rsp + 0x30], rdx
lea rax, [rsp + 0x30]
xor edx, edx
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x38], rdi
mov rcx, rbx
mov qword [rsp + 0x40], 0
call fcn.18002ab40
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x1800296d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x60
mov rcx, qword [0x1800801a8]
movabs rdx, 0x7ffffffdfffe
mov rbx, qword [0x18007d6c8]
movaps xmmword [rsp + 0x50], xmm6
movaps xmm6, xmm0
lea rax, [rcx - 0x10000]
cmp rax, rdx
jbe 0x180029780
mov eax, dword [0x180071490]
xor r8d, r8d
mov dword [rsp + 0x78], eax
movabs r9, 0x47ae147ae147ae15
movzx eax, word [0x180071494]
mov word [rsp + 0x7c], ax
nop word [rax + rax]
mov rax, r9
mul r8
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
movsx eax, al
imul ecx, eax, 0x32
movzx eax, r8b
sub al, cl
add al, 0x32
xor byte [rsp + r8 + 0x78], al
inc r8
cmp r8, 6
jb 0x180029730
lea rdx, [rsp + 0x78]
movabs rcx, 0x11837e716e5fd5ec
call fcn.18002a300
mov rcx, rax
mov qword [0x1800801a8], rax
xorps xmm0, xmm0
mov qword [rsp + 0x28], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x30], rcx
cvtss2sd xmm0, xmm6
xor r9d, r9d
mov qword [rsp + 0x38], rbx
xor r8d, r8d
mov qword [rsp + 0x40], 0
xor edx, edx
mov qword [rsp + 0x20], rax
call fcn.18002ab40
movaps xmm6, xmmword [rsp + 0x50]
cvtsd2ss xmm0, xmm0
add rsp, 0x60
pop rbx
ret

Function at 0x1800298c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x60
mov rcx, qword [0x1800801a8]
movabs rdx, 0x7ffffffdfffe
mov rbx, qword [0x18007d6d0]
movaps xmmword [rsp + 0x50], xmm6
movaps xmm6, xmm0
lea rax, [rcx - 0x10000]
cmp rax, rdx
jbe 0x180029970
mov eax, dword [0x180071490]
xor r8d, r8d
mov dword [rsp + 0x78], eax
movabs r9, 0x47ae147ae147ae15
movzx eax, word [0x180071494]
mov word [rsp + 0x7c], ax
nop word [rax + rax]
mov rax, r9
mul r8
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
movsx eax, al
imul ecx, eax, 0x32
movzx eax, r8b
sub al, cl
add al, 0x32
xor byte [rsp + r8 + 0x78], al
inc r8
cmp r8, 6
jb 0x180029920
lea rdx, [rsp + 0x78]
movabs rcx, 0x11837e716e5fd5ec
call fcn.18002a300
mov rcx, rax
mov qword [0x1800801a8], rax
xorps xmm0, xmm0
mov qword [rsp + 0x28], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x30], rcx
cvtss2sd xmm0, xmm6
xor r9d, r9d
mov qword [rsp + 0x38], rbx
xor r8d, r8d
mov qword [rsp + 0x40], 0
xor edx, edx
mov qword [rsp + 0x20], rax
call fcn.18002ab40
movaps xmm6, xmmword [rsp + 0x50]
cvtsd2ss xmm0, xmm0
add rsp, 0x60
pop rbx
ret
Function at 0x1800299c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x70
mov rcx, qword [0x1800801a0]
movabs rdx, 0x7ffffffdfffe
mov rbx, qword [0x18007d6b0]
movaps xmmword [rsp + 0x60], xmm6
movaps xmm6, xmm1
movaps xmmword [rsp + 0x50], xmm7
movaps xmm7, xmm0
lea rax, [rcx - 0x10000]
cmp rax, rdx
jbe 0x180029a86
mov eax, dword [0x180071488]
xor r8d, r8d
mov dword [rsp + 0x90], eax
movabs r9, 0x47ae147ae147ae15
movzx eax, word [0x18007148c]
mov word [rsp + 0x94], ax
nop word [rax + rax]
mov rax, r9
mul r8
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
movsx eax, al
imul ecx, eax, 0x32
movzx eax, r8b
sub al, cl
add al, 0x32
xor byte [rsp + r8 + 0x90], al
inc r8
cmp r8, 6
jb 0x180029a30
lea rdx, [rsp + 0x90]
movabs rcx, 0x11837e716e5fd5ec
call fcn.18002a300
mov rcx, rax
mov qword [0x1800801a0], rax
xorps xmm1, xmm1
mov qword [rsp + 0x28], 0
xorps xmm0, xmm0
mov qword [rsp + 0x30], rcx
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rbx
cvtss2sd xmm1, xmm6
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x20], rax
cvtss2sd xmm0, xmm7
call fcn.18002ab40
movaps xmm6, xmmword [rsp + 0x60]
movaps xmm7, xmmword [rsp + 0x50]
cvtsd2ss xmm0, xmm0
add rsp, 0x70
pop rbx
ret

Function at 0x180029ae0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x70
mov rcx, qword [0x1800801a0]
movabs rdx, 0x7ffffffdfffe
mov rbx, qword [0x18007d6b8]
movaps xmmword [rsp + 0x60], xmm6
movaps xmm6, xmm1
movaps xmmword [rsp + 0x50], xmm7
movaps xmm7, xmm0
lea rax, [rcx - 0x10000]
cmp rax, rdx
jbe 0x180029ba6
mov eax, dword [0x180071488]
xor r8d, r8d
mov dword [rsp + 0x90], eax
movabs r9, 0x47ae147ae147ae15
movzx eax, word [0x18007148c]
mov word [rsp + 0x94], ax
nop word [rax + rax]
mov rax, r9
mul r8
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
movsx eax, al
imul ecx, eax, 0x32
movzx eax, r8b
sub al, cl
add al, 0x32
xor byte [rsp + r8 + 0x90], al
inc r8
cmp r8, 6
jb 0x180029b50
lea rdx, [rsp + 0x90]
movabs rcx, 0x11837e716e5fd5ec
call fcn.18002a300
mov rcx, rax
mov qword [0x1800801a0], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x30], rcx
movaps xmm1, xmm6
mov qword [rsp + 0x38], rbx
movaps xmm0, xmm7
mov qword [rsp + 0x40], 0
call fcn.18002ab40
movaps xmm6, xmmword [rsp + 0x60]
movaps xmm7, xmmword [rsp + 0x50]
add rsp, 0x70
pop rbx
ret
Function at 0x180029bf0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x70
mov rcx, qword [0x1800801a0]
movabs rdx, 0x7ffffffdfffe
mov rbx, qword [0x18007d6b8]
movaps xmmword [rsp + 0x60], xmm6
movaps xmm6, xmm1
movaps xmmword [rsp + 0x50], xmm7
movaps xmm7, xmm0
lea rax, [rcx - 0x10000]
cmp rax, rdx
jbe 0x180029cb6
mov eax, dword [0x180071488]
xor r8d, r8d
mov dword [rsp + 0x90], eax
movabs r9, 0x47ae147ae147ae15
movzx eax, word [0x18007148c]
mov word [rsp + 0x94], ax
nop word [rax + rax]
mov rax, r9
mul r8
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
movsx eax, al
imul ecx, eax, 0x32
movzx eax, r8b
sub al, cl
add al, 0x32
xor byte [rsp + r8 + 0x90], al
inc r8
cmp r8, 6
jb 0x180029c60
lea rdx, [rsp + 0x90]
movabs rcx, 0x11837e716e5fd5ec
call fcn.18002a300
mov rcx, rax
mov qword [0x1800801a0], rax
xorps xmm1, xmm1
mov qword [rsp + 0x28], 0
xorps xmm0, xmm0
mov qword [rsp + 0x30], rcx
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rbx
cvtss2sd xmm1, xmm6
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x20], rax
cvtss2sd xmm0, xmm7
call fcn.18002ab40
movaps xmm6, xmmword [rsp + 0x60]
movaps xmm7, xmmword [rsp + 0x50]
cvtsd2ss xmm0, xmm0
add rsp, 0x70
pop rbx
ret

Function at 0x180029d10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x50
mov r10, qword [0x1800801b0]
mov rbp, rcx
mov r14, qword [0x18007d688]
movabs rcx, 0x7ffffffdfffe
mov rbx, r9
mov rdi, r8
mov rsi, rdx
lea rax, [r10 - 0x10000]
cmp rax, rcx
jbe 0x180029dd0
mov eax, dword [0x180071498]
xor r8d, r8d
mov dword [rsp + 0x30], eax
movabs r9, 0x47ae147ae147ae15
movzx eax, word [0x18007149c]
mov word [rsp + 0x34], ax
nop dword [rax]
mov rax, r9
mul r8
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
movsx eax, al
imul ecx, eax, 0x32
movzx eax, r8b
sub al, cl
add al, 0x32
xor byte [rsp + r8 + 0x30], al
inc r8
cmp r8, 6
jb 0x180029d80
lea rdx, [rsp + 0x30]
movabs rcx, 0x11837e716e5fd5ec
call fcn.18002a300
mov r10, rax
mov qword [0x1800801b0], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], 0
mov r9, rbx
mov qword [rsp + 0x20], rax
mov r8, rdi
mov qword [rsp + 0x38], r10
mov rdx, rsi
mov qword [rsp + 0x40], r14
mov rcx, rbp
mov qword [rsp + 0x48], 0
call fcn.18002ab40
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret

Function at 0x18002a0e0
Capabilities:
Hash data using fnv

Disassembly:
push rbx
movzx r11d, byte [rdx]
test r9b, r9b
je 0x18002a100
lea r10d, [r11 - 0x41]
lea eax, [r11 + 0x20]
cmp r10b, 0x19
movzx ebx, al
cmova ebx, r11d
jmp 0x18002a104
movzx ebx, r11b
test r8, r8
jne 0x18002a10e
mov rax, rcx
pop rbx
ret
movabs rax, 0x100000001b3
dec r8
imul rcx, rax
movsx rax, bl
inc rdx
xor rcx, rax
pop rbx
jmp fcn.18002a0e0
Function at 0x18002a300
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push r13
push r14
sub rsp, 0x40
mov r14, rcx
xor ecx, ecx
call fcn.18002a4e0
movabs rbx, 0x7ffffffdfffe
mov r13, rax
lea r8, [rax - 0x10000]
cmp r8, rbx
ja 0x18002a47f
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r15
test r14, r14
je 0x18002a457
mov rcx, rax
call fcn.18002a910
lea rcx, [rax - 0x10000]
cmp rcx, rbx
ja 0x18002a457
movzx r12d, word [rax + 0x14]
xor ebx, ebx
movzx ebp, word [rax + 6]
add r12, rax
movzx edi, bx
cmp bx, bp
jae 0x18002a459
movabs rdx, 0xcbf29ce484222325
movabs r9, 0xaf63bd4c8601b7df
nop dword [rax]
movzx eax, di
lea rcx, [rax + rax*4]
mov esi, dword [r12 + rcx*8 + 0x20]
cmp dword [r12 + rcx*8 + 0x28], esi
mov r15d, dword [r12 + rcx*8 + 0x24]
cmovb esi, dword [r12 + rcx*8 + 0x28]
test r15d, r15d
je 0x18002a42e
test esi, esi
je 0x18002a42e
mov rax, qword [r12 + rcx*8 + 0x18]
mov r8, rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
test al, al
je 0x18002a3ea
nop dword [rax + rax]
inc r8
cmp byte [rsp + r8 + 0x20], bl
jne 0x18002a3e0
lea ecx, [rax - 0x41]
cmp cl, 0x19
ja 0x18002a3f4
add al, 0x20
test r8, r8
jne 0x18002a3fe
mov rax, rdx
jmp 0x18002a429
movsx rcx, al
lea rdx, [rsp + 0x21]
xor rcx, r9
dec r8
mov r9b, 1
call fcn.18002a0e0
movabs rdx, 0xcbf29ce484222325
movabs r9, 0xaf63bd4c8601b7df
cmp rax, r14
je 0x18002a43c
inc di
cmp di, bp
jb 0x18002a3a0
jmp 0x18002a459
mov r8, qword [rsp + 0x68]
lea rcx, [r15 + r13]
mov edx, esi
add rdx, r15
add rdx, r13
call fcn.18002a1c0
mov rbx, rax
jmp 0x18002a459
xor ebx, ebx
mov r15, qword [rsp + 0x30]
mov rax, rbx
mov r12, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x60]
add rsp, 0x40
pop r14
pop r13
pop rbx
ret
xor eax, eax
add rsp, 0x40
pop r14
pop r13
pop rbx
ret

Function at 0x18002a490
Capabilities:
Hash data using fnv

Disassembly:
movzx r11d, word [rdx]
test r9b, r9b
je 0x18002a4ac
lea eax, [r11 - 0x41]
cmp ax, 0x19
lea r10d, [r11 + 0x20]
cmova r10w, r11w
jmp 0x18002a4b0
movzx r10d, r11w
test r8, r8
jne 0x18002a4b9
mov rax, rcx
ret
movabs rax, 0x100000001b3
dec r8
imul rcx, rax
movzx eax, r10w
add rdx, 2
xor rcx, rax
jmp fcn.18002a490
Function at 0x18002a730
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
lea rax, [rdx - 0x10000]
movabs r9, 0x7ffffffdfffe
mov rbx, rdx
mov r15, rcx
cmp rax, r9
ja 0x18002a8e9
xor ebp, ebp
mov r11d, ebp
cmp byte [rdx], bpl
je 0x18002a8e9
inc r11
cmp byte [r11 + rdx], bpl
jne 0x18002a776
cmp r11, 1
jbe 0x18002a8e9
lea rax, [rcx - 0x10000]
cmp rax, r9
ja 0x18002a8e9
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x18002a8e9
mov ecx, dword [rcx + 0x3c]
add rcx, r15
cmp dword [rcx], 0x4550
jne 0x18002a8e9
lea rax, [rcx - 0x10000]
cmp rax, r9
ja 0x18002a8e9
lea rax, [rcx - 0xff78]
cmp rax, r9
ja 0x18002a8e9
mov ecx, dword [rcx + 0x88]
add rcx, r15
lea rax, [rcx - 0x10000]
cmp rax, r9
ja 0x18002a8e9
cmp dword [rcx + 0x10], ebp
je 0x18002a8e9
mov eax, dword [rcx + 0x1c]
test eax, eax
je 0x18002a8e9
mov edx, dword [rcx + 0x20]
test edx, edx
je 0x18002a8e9
mov r8d, dword [rcx + 0x24]
test r8d, r8d
je 0x18002a8e9
mov r13d, dword [rcx + 0x14]
test r13d, r13d
je 0x18002a8e9
cmp dword [rcx + 0x18], ebp
je 0x18002a8e9
lea rcx, [r15 + rax]
mov qword [rsp + 0x38], rcx
lea r14, [r15 + rdx]
lea rsi, [r15 + r8]
test r13d, r13d
je 0x18002a8e9
nop
movzx eax, word [rsi]
mov r12d, dword [rcx + rax*4]
test r12d, r12d
je 0x18002a8d6
mov edi, dword [r14]
add rdi, r15
lea rax, [rdi - 0x10000]
cmp rax, r9
ja 0x18002a8d6
mov rax, rbx
sub rdi, rbx
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [rax]
movzx r10d, byte [rdi + rax]
lea r8d, [rdx - 0x41]
lea ecx, [rdx + 0x20]
cmp r8b, 0x19
movzx r9d, cl
lea r8d, [r10 - 0x41]
cmova r9d, edx
lea ecx, [r10 + 0x20]
cmp r8b, 0x19
movzx edx, cl
cmova edx, r10d
cmp dl, r9b
jne 0x18002a8c7
inc rax
mov rcx, rax
sub rcx, rbx
cmp rcx, r11
jb 0x18002a880
lea rax, [r15 + r12]
jmp 0x18002a8eb
mov rcx, qword [rsp + 0x38]
movabs r9, 0x7ffffffdfffe
inc ebp
add rsi, 2
add r14, 4
cmp ebp, r13d
jb 0x18002a850
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x18002a910
Capabilities:
Parse pe header

Disassembly:
lea rax, [rcx - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rax, rdx
ja 0x18002a93e
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x18002a93e
mov eax, dword [rcx + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
je 0x18002a940
xor eax, eax
ret
Function at 0x18002aba0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r15
sub rsp, 0x60
mov rbp, qword [0x18007d698]
lea r15, [rax + 0x20]
mov rbx, r8
mov qword [rax - 0x48], 0
mov r8, qword [0x1800801c0]
mov rsi, rcx
movabs rcx, 0x7ffffffdfffe
mov rdi, rdx
lea rax, [r8 - 0x10000]
cmp rax, rcx
jbe 0x18002ac61
mov eax, dword [0x180071510]
xor r8d, r8d
mov dword [rsp + 0x40], eax
movabs r9, 0x47ae147ae147ae15
movzx eax, word [0x180071514]
mov word [rsp + 0x44], ax
mov rax, r9
mul r8
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
movsx eax, al
imul ecx, eax, 0x32
movzx eax, r8b
sub al, cl
add al, 0x32
xor byte [rsp + r8 + 0x40], al
inc r8
cmp r8, 6
jb 0x18002ac11
lea rdx, [rsp + 0x40]
movabs rcx, 0x11837e716e5fd5ec
call fcn.18002a300
mov r8, rax
mov qword [0x1800801c0], rax
mov qword [rsp + 0x48], r8
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], r15
mov r8, rbx
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov rdx, rdi
mov qword [rsp + 0x20], rax
mov rcx, rsi
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], 0
call fcn.18002ab40
add rsp, 0x60
pop r15
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x18002ad30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov r8, qword [0x1800801c8]
mov rdi, rcx
mov rsi, qword [0x18007d690]
movabs rcx, 0x7ffffffdfffe
mov rbx, rdx
lea rax, [r8 - 0x10000]
cmp rax, rcx
jbe 0x18002ade0
mov eax, dword [0x180071518]
xor r8d, r8d
mov dword [rsp + 0x70], eax
movabs r9, 0x47ae147ae147ae15
movzx eax, word [0x18007151c]
mov word [rsp + 0x74], ax
nop dword [rax]
mov rax, r9
mul r8
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
movsx eax, al
imul ecx, eax, 0x32
movzx eax, r8b
sub al, cl
add al, 0x32
xor byte [rsp + r8 + 0x70], al
inc r8
cmp r8, 6
jb 0x18002ad90
lea rdx, [rsp + 0x70]
movabs rcx, 0x11837e716e5fd5ec
call fcn.18002a300
mov r8, rax
mov qword [0x1800801c8], rax
mov qword [rsp + 0x30], r8
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rax
mov rdx, rbx
mov qword [rsp + 0x38], rsi
mov rcx, rdi
mov qword [rsp + 0x40], 0
call fcn.18002ab40
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x18002ae30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x60
mov r10, qword [0x1800801c0]
mov rbp, rcx
mov r14, qword [0x18007d698]
movabs rcx, 0x7ffffffdfffe
mov rbx, r9
mov rdi, r8
mov rsi, rdx
lea rax, [r10 - 0x10000]
cmp rax, rcx
jbe 0x18002aef0
mov eax, dword [0x180071510]
xor r8d, r8d
mov dword [rsp + 0x40], eax
movabs r9, 0x47ae147ae147ae15
movzx eax, word [0x180071514]
mov word [rsp + 0x44], ax
nop dword [rax]
mov rax, r9
mul r8
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
movsx eax, al
imul ecx, eax, 0x32
movzx eax, r8b
sub al, cl
add al, 0x32
xor byte [rsp + r8 + 0x40], al
inc r8
cmp r8, 6
jb 0x18002aea0
lea rdx, [rsp + 0x40]
movabs rcx, 0x11837e716e5fd5ec
call fcn.18002a300
mov r10, rax
mov qword [0x1800801c0], rax
mov qword [rsp + 0x30], rbx
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov r8, rdi
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov qword [rsp + 0x48], r10
mov rcx, rbp
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], 0
call fcn.18002ab40
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x18002fef0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, qword [0x1800801d0]
mov edi, edx
mov r9, rcx
mov eax, dword [rbx + 0x1be8]
cmp dword [rbx + 0x1bd8], eax
jg 0x18002fe8b
mov dword [rbx + 0x1b20], 0
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x1a80]
xor edx, edx
or edi, 0x141
movsxd rcx, dword [rax + 0xc0]
mov rax, qword [rax + 0xc8]
mov r8d, dword [rax + rcx*4 - 4]
mov rcx, r9
call fcn.180034450
cmp dword [rbx + 0x1ac8], eax
jne 0x18002fec3
mov dword [rbx + 0x1acc], eax
cmp dword [rbx + 0x1b08], eax
jne 0x18002fed2
mov byte [rbx + 0x1b0c], 1
mov edx, edi
mov ecx, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x18002fef0
push rbx
sub rsp, 0x50
mov r9, qword [0x1800801d0]
mov ebx, edx
mov r11d, ecx
movsxd r10, dword [r9 + 0x1be8]
cmp dword [r9 + 0x1bd8], r10d
jle 0x18003003f
mov rax, qword [r9 + 0x1be0]
lea r8, [r10 + r10*2]
add r8, r8
cmp dword [rax + r8*8], ecx
jne 0x18003003f
bt edx, 0x1c
jae 0x18002ff9b
cmp byte [0x180071b5b], 0
movsd xmm0, qword [0x180071b50]
mov eax, dword [str._t_b__]
movsd qword [rsp + 0x20], xmm0
mov dword [rsp + 0x28], eax
je 0x18002ff91
xor ecx, ecx
movabs r8, 0x47ae147ae147ae15
mov rax, r8
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
movsx eax, al
imul edx, eax, 0x32
movzx eax, cl
sub al, dl
add al, 0x31
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0xc
jb 0x18002ff61
mov r9d, r10d
lea r8, [rsp + 0x20]
jmp 0x180030008
mov eax, dword [0x180071b68]
xor ecx, ecx
movsd xmm0, qword [0x180071b60]
movabs r8, 0x47ae147ae147ae15
mov dword [rsp + 0x28], eax
movzx eax, byte [0x180071b6c]
mov byte [rsp + 0x2c], al
movsd qword [rsp + 0x20], xmm0
nop word [rax + rax]
mov rax, r8
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
movsx eax, al
imul edx, eax, 0x32
movzx eax, cl
sub al, dl
add al, 0x31
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0xd
jb 0x18002ffd0
mov r9d, r11d
lea r8, [rsp + 0x20]
mov edx, 0x14
lea rcx, [rsp + 0x30]
call fcn.180034360
bts ebx, 0x1a
lea rcx, [rsp + 0x30]
mov r8d, ebx
xor edx, edx
call fcn.18002d340
movzx ebx, al
test al, al
jne 0x180030036
call fcn.180032980
movzx eax, bl
add rsp, 0x50
pop rbx
ret
xor ecx, ecx
mov dword [r9 + 0x1b20], ecx
xor al, al
add rsp, 0x50
pop rbx
ret
Function at 0x180030050
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x40
mov rdi, qword [0x1800801d0]
xor ebx, ebx
mov ebp, edx
mov esi, ecx
cmp byte [rdi + 0x1f1d], bl
jne 0x180030087
cmp byte [rdi + 0x1f1e], bl
je 0x180030105
movss xmm1, dword [rdi + 0x160c]
mov ebp, 1
movaps xmm0, xmm1
mulss xmm1, dword [0x1800713e0]
mulss xmm0, dword [0x180071cf4]
addss xmm1, dword [rdi + 0x134]
addss xmm0, dword [rdi + 0x130]
or dword [rdi + 0x1b20], 1
mov qword [rdi + 0x1b38], rbx
movss dword [rdi + 0x1b34], xmm1
mov dword [rdi + 0x1b24], 1
movss dword [rdi + 0x1b30], xmm0
movss xmm0, dword [rdi + 0x1668]
mov rax, qword [0x1800801d0]
mulss xmm0, dword [0x180071cb8]
or dword [rax + 0x1b20], 0x40
movss dword [rax + 0x1b80], xmm0
mov eax, dword [0x180071b38]
mov r8, rbx
movsd xmm0, qword [0x180071b30]
movabs r14, 0x47ae147ae147ae15
mov dword [rsp + 0x28], eax
movzx eax, word [0x180071b3c]
mov word [rsp + 0x2c], ax
movzx eax, byte [0x180071b3e]
mov byte [rsp + 0x2e], al
movsd qword [rsp + 0x20], xmm0
mov rax, r14
mul r8
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
movsx eax, al
imul ecx, eax, 0x32
movzx eax, r8b
sub al, cl
add al, 0x31
xor byte [rsp + r8 + 0x20], al
inc r8
cmp r8, 0xf
jb 0x180030141
mov r9d, dword [rdi + 0x2f5c]
lea r8, [rsp + 0x20]
mov edx, 0x10
lea rcx, [rsp + 0x30]
call fcn.180034360
test bpl, 1
je 0x180030254
lea rcx, [rsp + 0x30]
call fcn.1800330b0
test rax, rax
je 0x180030254
cmp byte [rax + 0x7e], bl
je 0x180030254
movsd xmm0, qword [0x180071b40]
mov byte [rax + 0x85], 1
mov dword [rax + 0x9c], 1
mov eax, dword [0x180071b48]
mov r9d, dword [rdi + 0x2f5c]
mov dword [rsp + 0x28], eax
inc r9d
movzx eax, word [0x180071b4c]
mov word [rsp + 0x2c], ax
movzx eax, byte [0x180071b4e]
mov byte [rsp + 0x2e], al
mov dword [rdi + 0x2f5c], r9d
movsd qword [rsp + 0x20], xmm0
nop word [rax + rax]
mov rax, r14
mul rbx
mov rax, rbx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
movsx eax, al
imul ecx, eax, 0x32
movzx eax, bl
sub al, cl
add al, 0x31
xor byte [rsp + rbx + 0x20], al
inc rbx
cmp rbx, 0xf
jb 0x180030210
lea r8, [rsp + 0x20]
mov edx, 0x10
lea rcx, [rsp + 0x30]
call fcn.180034360
or esi, 0x20c0347
lea rcx, [rsp + 0x30]
mov r8d, esi
xor edx, edx
call fcn.18002d340
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret