joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000483c
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
xor r14d, r14d
mov rbx, rcx
cmp qword [0x18000a7a8], r14
jne 0x180004997
mov dword [rbp - 0x49], 0xf739f703
mov edx, r14d
mov dword [rbp - 0x45], 0xf73cf73d
mov dword [rbp - 0x41], 0xf730f720
mov dword [rbp - 0x3d], 0xf710f724
mov dword [rbp - 0x39], 0xf734f739
mov dword [rbp - 0x35], 0xf775f73f
mov dword [rbp - 0x31], 0xf735f70f
mov dword [rbp - 0x2d], 0xf730f731
mov dword [rbp - 0x29], 0xf704f714
mov dword [rbp - 0x25], 0xf721f710
mov dword [rbp - 0x21], 0xf710f708
mov dword [rbp - 0x1d], 0xf717f703
mov dword [rbp - 0x19], 0xf700f71a
mov dword [rbp - 0x15], 0xf71ff704
mov dword [rbp - 0x11], 0xf704f720
mov dword [rbp - 0xd], 0xf71df70c
mov dword [rbp - 9], 0xf703f711
mov dword [rbp - 5], 0xf75df70b
mov dword [rbp - 1], 0xf710f733
mov dword [rbp + 3], 0xf731f702
mov dword [rbp + 7], 0xf70bf711
mov dword [rbp + 0xb], 0xf70ff709
mov dword [rbp + 0xf], 0xf712f730
mov dword [rbp + 0x13], 0xf71ef71d
mov dword [rbp + 0x17], 0xf7d1f7ec
mov dword [rbp + 0x1b], 0xf7e2f7ee
mov dword [rbp + 0x1f], 0xf7e0f7fd
mov dword [rbp + 0x23], 0xf7c4f7f4
mov dword [rbp + 0x27], 0xf7e7f7e7
mov dword [rbp + 0x2b], 0xf7f9f7fe
mov dword [rbp + 0x2f], 0xf7e1f7e3
mov dword [rbp + 0x33], 0xf7eaf7e2
mov dword [rbp + 0x37], 0xf7e2
movsxd rcx, edx
movzx eax, dx
mov r8d, 0x8b0
inc edx
sub ax, r8w
xor word [rbp + rcx*2 - 0x49], ax
cmp edx, 0x41
jb 0x180004958
mov rax, qword [0x1800082a8]
lea r8, [rbp - 0x49]
add rax, 0x3f4f800
mov word [rbp + 0x39], r14w
xor edx, edx
xor ecx, ecx
call rax
mov qword [0x18000a7a8], rax
mov qword [rbp + 0x3f], rbx
call fcn.180006860
mov r9, qword [0x1800082a8]
lea r8, [rbp + 0x3f]
mov rdx, qword [0x18000a7a8]
add r9, 0x3f3b160
mov rcx, rax
call r9
mov rax, qword [rbp + 0x47]
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1800049e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x18000a7b8]
xor r11d, r11d
mov rbx, rcx
test rax, rax
jne 0x180004b04
mov dword [rbp - 0x19], 0xf739f703
mov edx, r11d
mov dword [rbp - 0x15], 0xf73cf73d
mov dword [rbp - 0x11], 0xf730f720
mov dword [rbp - 0xd], 0xf710f724
mov dword [rbp - 9], 0xf734f739
mov dword [rbp - 5], 0xf775f73f
mov dword [rbp - 1], 0xf72ff71d
mov dword [rbp + 3], 0xf72cf73b
mov dword [rbp + 7], 0xf70df730
mov dword [rbp + 0xb], 0xf71af703
mov dword [rbp + 0xf], 0xf717f701
mov dword [rbp + 0x13], 0xf708f725
mov dword [rbp + 0x17], 0xf71df706
mov dword [rbp + 0x1b], 0xf704f718
mov dword [rbp + 0x1f], 0xf701f700
mov dword [rbp + 0x23], 0xf71df70b
mov dword [rbp + 0x27], 0xf736f75e
mov dword [rbp + 0x2b], 0xf707f717
mov dword [rbp + 0x2f], 0xf71df727
mov dword [rbp + 0x33], 0xf718f719
mov dword [rbp + 0x37], 0xf71cf70c
mov dword [rbp + 0x3b], 0xf738f708
mov dword [rbp + 0x3f], 0xf71cf714
mov dword [rbp + 0x43], 0xf71ef70c
mov dword [rbp + 0x47], 0xf7f5f7e3
mov dword [rbp + 0x4b], 0xf7f1f7e7
mov word [rbp + 0x4f], ax
movsxd rcx, edx
movzx eax, dx
mov r8d, 0x8b0
inc edx
sub ax, r8w
xor word [rbp + rcx*2 - 0x19], ax
cmp edx, 0x34
jb 0x180004ac5
mov rax, qword [0x1800082a8]
lea r8, [rbp - 0x19]
add rax, 0x3f4f800
mov word [rbp + 0x4f], r11w
xor edx, edx
xor ecx, ecx
call rax
mov qword [0x18000a7b8], rax
mov r9, qword [0x1800082a8]
lea r8, [rbp + 0x6f]
add r9, 0x3f3b160
mov rdx, rax
mov rcx, rbx
call r9
mov rax, qword [rbp + 0x6f]
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rbp
ret

Function at 0x180004b34
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x18000a7e0]
xor edi, edi
mov rbx, rcx
test rax, rax
jne 0x180004c1d
mov dword [rbp - 0x50], 0xf739f703
mov edx, edi
mov dword [rbp - 0x4c], 0xf73cf73d
mov dword [rbp - 0x48], 0xf730f720
mov dword [rbp - 0x44], 0xf710f724
mov dword [rbp - 0x40], 0xf734f739
mov dword [rbp - 0x3c], 0xf775f73f
mov dword [rbp - 0x38], 0xf735f70f
mov dword [rbp - 0x34], 0xf730f731
mov dword [rbp - 0x30], 0xf704f714
mov dword [rbp - 0x2c], 0xf720f710
mov dword [rbp - 0x28], 0xf704f70c
mov dword [rbp - 0x24], 0xf706f714
mov dword [rbp - 0x20], 0xf71df70b
mov dword [rbp - 0x1c], 0xf719f70f
mov dword [rbp - 0x18], 0xf724f742
mov dword [rbp - 0x14], 0xf72ef71d
mov dword [rbp - 0x10], 0xf718f71c
mov dword [rbp - 0xc], 0xf716f704
mov word [rbp - 8], ax
movsxd rcx, edx
movzx eax, dx
mov r8d, 0x8b0
inc edx
sub ax, r8w
xor word [rbp + rcx*2 - 0x50], ax
cmp edx, 0x24
jb 0x180004bdf
mov rax, qword [0x1800082a8]
lea r8, [rbp - 0x50]
add rax, 0x3f4f800
mov word [rbp - 8], di
xor edx, edx
xor ecx, ecx
call rax
mov qword [0x18000a7e0], rax
mov r9, qword [0x1800082a8]
lea r8, [rbp + 0x18]
add r9, 0x3f3b160
mov rdx, rax
mov rcx, rbx
call r9
mov al, byte [rbp + 0x18]
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x180004c50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
xor r10d, r10d
mov rbx, rdx
cmp qword [0x18000a7f0], r10
mov rdi, rcx
jne 0x180004d43
xor eax, eax
mov dword [rbp - 1], 0xf739f703
mov word [rbp + 0x47], ax
mov edx, r10d
mov dword [rbp + 3], 0xf73cf73d
mov dword [rbp + 7], 0xf730f720
mov dword [rbp + 0xb], 0xf710f724
mov dword [rbp + 0xf], 0xf734f739
mov dword [rbp + 0x13], 0xf775f73f
mov dword [rbp + 0x17], 0xf73cf71e
mov dword [rbp + 0x1b], 0xf73af72d
mov dword [rbp + 0x1f], 0xf704f734
mov dword [rbp + 0x23], 0xf70ef703
mov dword [rbp + 0x27], 0xf70af727
mov dword [rbp + 0x2b], 0xf717f70b
mov dword [rbp + 0x2f], 0xf707f707
mov dword [rbp + 0x33], 0xf705f70f
mov dword [rbp + 0x37], 0xf743f718
mov dword [rbp + 0x3b], 0xf71cf727
mov dword [rbp + 0x3f], 0xf71df731
mov dword [rbp + 0x43], 0xf70af71e
movsxd rcx, edx
movzx eax, dx
mov r8d, 0x8b0
inc edx
sub ax, r8w
xor word [rbp + rcx*2 - 1], ax
cmp edx, 0x24
jb 0x180004d04
mov rax, qword [0x1800082a8]
lea r8, [rbp - 1]
add rax, 0x3f4f800
mov word [rbp + 0x47], r10w
xor edx, edx
xor ecx, ecx
call rax
mov qword [0x18000a7f0], rax
mov qword [rbp - 0x19], rdi
mov qword [rbp - 0x11], rbx
call fcn.180006788
mov r9, qword [0x1800082a8]
lea r8, [rbp - 0x19]
mov rdx, qword [0x18000a7f0]
add r9, 0x3f3b160
mov rcx, rax
call r9
mov al, byte [rbp - 9]
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret

Function at 0x180004d94
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rax, qword [0x18000a830]
xor r10d, r10d
mov rbx, rdx
mov rdi, rcx
test rax, rax
jne 0x180004e8f
mov dword [rbp - 1], 0xf73ff715
mov edx, r10d
mov dword [rbp + 3], 0xf73af735
mov dword [rbp + 7], 0xf730f73a
mov dword [rbp + 0xb], 0xf707f778
mov dword [rbp + 0xf], 0xf738f734
mov dword [rbp + 0x13], 0xf73ef723
mov dword [rbp + 0x17], 0xf71ef72e
mov dword [rbp + 0x1b], 0xf731f731
mov dword [rbp + 0x1f], 0xf713f714
mov dword [rbp + 0x23], 0xf70ff70d
mov dword [rbp + 0x27], 0xf700f708
mov dword [rbp + 0x2b], 0xf749f714
mov dword [rbp + 0x2f], 0xf71af721
mov dword [rbp + 0x33], 0xf705f723
mov dword [rbp + 0x37], 0xf718f71c
mov dword [rbp + 0x3b], 0xf724f71a
mov dword [rbp + 0x3f], 0xf708f715
mov dword [rbp + 0x43], 0xf71cf736
mov dword [rbp + 0x47], 0xf71bf703
mov word [rbp + 0x4b], ax
movsxd rcx, edx
movzx eax, dx
mov r8d, 0x8b0
inc edx
sub ax, r8w
xor word [rbp + rcx*2 - 1], ax
cmp edx, 0x26
jb 0x180004e50
mov rax, qword [0x1800082a8]
lea r8, [rbp - 1]
add rax, 0x3f4f800
mov word [rbp + 0x4b], r10w
xor edx, edx
xor ecx, ecx
call rax
mov qword [0x18000a830], rax
movups xmm1, xmmword [rbx + 0x10]
mov r9, qword [0x1800082a8]
lea r8, [rbp - 0x29]
xorps xmm0, xmm0
add r9, 0x3f3b160
movups xmmword [rbp - 0x21], xmm0
mov rdx, rax
mov rcx, rdi
movups xmm0, xmmword [rbx]
movups xmmword [rbp - 0x19], xmm1
movups xmmword [rbp - 0x29], xmm0
call r9
mov al, byte [rbp - 9]
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x180004ed8
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
lea rbp, [rax - 0x57]
sub rsp, 0xa0
mov qword [rbp + 7], rdx
xor r9d, r9d
mov rdx, qword [0x18000a7d8]
mov rbx, rcx
movaps xmmword [rax - 0x18], xmm6
movaps xmm6, xmm3
mov qword [rbp + 0xf], r8
test rdx, rdx
jne 0x180004fb0
mov dword [rbp - 0x31], 0xf73ff715
mov edx, r9d
mov dword [rbp - 0x2d], 0xf73af735
mov dword [rbp - 0x29], 0xf730f73a
mov dword [rbp - 0x25], 0xf714f778
mov dword [rbp - 0x21], 0xf737f739
mov dword [rbp - 0x1d], 0xf73af72c
mov dword [rbp - 0x19], 0xf773f72f
mov dword [rbp - 0x15], 0xf76df715
mov dword [rbp - 0x11], 0xf725f73f
mov dword [rbp - 0xd], 0xf702f710
mov dword [rbp - 9], 0xf729f713
mov dword [rbp - 5], 0xf709f70f
mov dword [rbp - 1], 0xf70d
movsxd rcx, edx
movzx eax, dx
mov r8d, 0x8b0
inc edx
sub ax, r8w
xor word [rbp + rcx*2 - 0x31], ax
cmp edx, 0x19
jb 0x180004f6e
mov rax, qword [0x1800082a8]
lea r8, [rbp - 0x31]
add rax, 0x3f4f800
mov word [rbp + 1], r9w
xor edx, edx
xor ecx, ecx
call rax
mov rdx, rax
mov qword [0x18000a7d8], rax
movss xmm0, dword [rbp + 7]
lea r8, [rbp + 0x17]
movss xmm1, dword [rbp + 0xb]
mov rcx, qword [rbp + 0x7f]
mov rax, qword [0x1800082a8]
movss dword [rbp + 0x17], xmm0
add rax, 0x3f3b160
movss xmm0, dword [rbp + 0xf]
movss dword [rbp + 0x1f], xmm0
movups xmm0, xmmword [rcx]
mov rcx, rbx
movss dword [rbp + 0x1b], xmm1
movss xmm1, dword [rbp + 0x13]
movdqu xmmword [rbp + 0x2b], xmm0
movss dword [rbp + 0x23], xmm1
movss dword [rbp + 0x27], xmm6
call rax
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop rbp
ret
Function at 0x180005018
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 7]
sub rsp, 0xd0
mov rdi, rdx
mov qword [rbp + 0x2f], r9
mov rdx, qword [0x18000a7e8]
xor r9d, r9d
mov rbx, r8
mov rsi, rcx
test rdx, rdx
jne 0x1800050f8
mov dword [rsp + 0x20], 0xf73ff715
mov edx, r9d
mov dword [rsp + 0x24], 0xf73af735
mov dword [rsp + 0x28], 0xf730f73a
mov dword [rsp + 0x2c], 0xf714f778
mov dword [rsp + 0x30], 0xf737f739
mov dword [rsp + 0x34], 0xf73af72c
mov dword [rsp + 0x38], 0xf773f72f
mov dword [rsp + 0x3c], 0xf76df715
mov dword [rsp + 0x40], 0xf725f73f
mov dword [rsp + 0x44], 0xf702f710
mov dword [rsp + 0x48], 0xf731f713
mov dword [rbp - 0x7d], 0xf71ff703
mov dword [rbp - 0x79], 0xf71c
movsxd rcx, edx
movzx eax, dx
mov r8d, 0x8b0
inc edx
sub ax, r8w
xor word [rsp + rcx*2 + 0x20], ax
cmp edx, 0x19
jb 0x1800050b5
mov rax, qword [0x1800082a8]
lea r8, [rsp + 0x20]
add rax, 0x3f4f800
mov word [rbp - 0x77], r9w
xor edx, edx
xor ecx, ecx
call rax
mov rdx, rax
mov qword [0x18000a7e8], rax
movss xmm1, dword [rbp + 0x2f]
lea r8, [rbp - 0x69]
movups xmm0, xmmword [rbx]
mov rax, qword [rbp + 0x4f]
mov rcx, rsi
movss dword [rbp - 0x51], xmm1
movss xmm1, dword [rbp + 0x47]
movdqu xmmword [rbp - 0x61], xmm0
mov qword [rbp - 0x69], rdi
movss xmm0, dword [rbp + 0x33]
movss dword [rbp - 0x4d], xmm0
movss xmm0, dword [rbp + 0x4b]
movss dword [rbp - 0x49], xmm1
movups xmm1, xmmword [rax]
mov rax, qword [rbp + 0x5f]
movss dword [rbp - 0x45], xmm0
movss xmm0, dword [rbp + 0x57]
movdqu xmmword [rbp - 0x41], xmm1
movups xmm1, xmmword [rax]
mov al, byte [rbp + 0x6f]
mov byte [rbp - 0x15], al
mov al, byte [rbp + 0x77]
mov byte [rbp - 0x14], al
mov al, byte [rbp + 0x7f]
mov byte [rbp - 0x13], al
mov rax, qword [rbp + 0x87]
movss dword [rbp - 0x31], xmm0
movss xmm0, dword [rbp + 0x67]
movss dword [rbp - 0x1d], xmm0
movups xmm0, xmmword [rax]
mov rax, qword [0x1800082a8]
movdqu xmmword [rbp - 0x2d], xmm1
add rax, 0x3f3b160
movss xmm1, dword [rbp + 0x6b]
movdqu xmmword [rbp - 0x11], xmm0
movss dword [rbp - 0x19], xmm1
call rax
mov rbx, qword [rsp + 0xf0]
add rsp, 0xd0
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800061f4
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov rdi, rdx
xor r10d, r10d
mov rdx, qword [0x18000a7d0]
mov rbx, r8
mov rsi, rcx
test rdx, rdx
jne 0x18000632c
xor eax, eax
mov dword [rbp - 0x39], 0xf73ff715
mov word [rbp + 0x2f], ax
mov edx, r10d
mov dword [rbp - 0x35], 0xf73af735
mov dword [rbp - 0x31], 0xf730f73a
mov dword [rbp - 0x2d], 0xf707f778
mov dword [rbp - 0x29], 0xf738f734
mov dword [rbp - 0x25], 0xf73ef723
mov dword [rbp - 0x21], 0xf71ef72e
mov dword [rbp - 0x1d], 0xf731f731
mov dword [rbp - 0x19], 0xf713f714
mov dword [rbp - 0x15], 0xf70ff70d
mov dword [rbp - 0x11], 0xf700f708
mov dword [rbp - 0xd], 0xf749f714
mov dword [rbp - 9], 0xf71bf738
mov dword [rbp - 5], 0xf701f705
mov dword [rbp - 1], 0xf70ef709
mov dword [rbp + 3], 0xf738f71a
mov dword [rbp + 7], 0xf703f71f
mov dword [rbp + 0xb], 0xf717f71e
mov dword [rbp + 0xf], 0xf71af738
mov dword [rbp + 0x13], 0xf716f715
mov dword [rbp + 0x17], 0xf710f70c
mov dword [rbp + 0x1b], 0xf715f715
mov dword [rbp + 0x1f], 0xf712f728
mov dword [rbp + 0x23], 0xf71cf72d
mov dword [rbp + 0x27], 0xf7e4f7f2
mov dword [rbp + 0x2b], 0xf7edf7e7
movsxd rcx, edx
movzx eax, dx
mov r8d, 0x8b0
inc edx
sub ax, r8w
xor word [rbp + rcx*2 - 0x39], ax
cmp edx, 0x34
jb 0x1800062ea
mov rax, qword [0x1800082a8]
lea r8, [rbp - 0x39]
add rax, 0x3f4f800
mov word [rbp + 0x2f], r10w
xor edx, edx
xor ecx, ecx
call rax
mov rdx, rax
mov qword [0x18000a7d0], rax
movss xmm1, dword [rbx]
lea r8, [rbp + 0x37]
mov rax, qword [0x1800082a8]
mov rcx, rsi
movss xmm0, dword [rbx + 4]
add rax, 0x3f3b160
and dword [rbp + 0x43], 0
and dword [rbp + 0x47], 0
movss dword [rbp + 0x37], xmm1
movss xmm1, dword [rbx + 8]
movss dword [rbp + 0x3f], xmm1
movss dword [rbp + 0x3b], xmm0
mov byte [rbp + 0x4b], 1
call rax
movsd xmm0, qword [rbp + 0x43]
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rax, rdi
mov rsi, qword [r11 + 0x18]
movsd qword [rdi], xmm0
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x18000647c
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x57]
sub rsp, 0xb0
xor r9d, r9d
movaps xmmword [rax - 0x18], xmm6
cmp qword [0x18000a808], r9
movaps xmm6, xmm3
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
jne 0x180006576
xor eax, eax
mov dword [rbp - 0x11], 0xf73ff715
mov word [rbp + 0x33], ax
mov edx, r9d
mov dword [rbp - 0xd], 0xf73af735
mov dword [rbp - 9], 0xf730f73a
mov dword [rbp - 5], 0xf71cf778
mov dword [rbp - 1], 0xf72af731
mov dword [rbp + 3], 0xf73ef737
mov dword [rbp + 7], 0xf710f728
mov dword [rbp + 0xb], 0xf72bf73f
mov dword [rbp + 0xf], 0xf72df708
mov dword [rbp + 0x13], 0xf701f70b
mov dword [rbp + 0x17], 0xf704f716
mov dword [rbp + 0x1b], 0xf71ef714
mov dword [rbp + 0x1f], 0xf73bf746
mov dword [rbp + 0x23], 0xf705f723
mov dword [rbp + 0x27], 0xf708f718
mov dword [rbp + 0x2b], 0xf71ff71c
mov dword [rbp + 0x2f], 0xf71ef724
movsxd rcx, edx
movzx eax, dx
mov r8d, 0x8b0
inc edx
sub ax, r8w
xor word [rbp + rcx*2 - 0x11], ax
cmp edx, 0x22
jb 0x180006537
mov rax, qword [0x1800082a8]
lea r8, [rbp - 0x11]
add rax, 0x3f4f800
mov word [rbp + 0x33], r9w
xor edx, edx
xor ecx, ecx
call rax
mov qword [0x18000a808], rax
movsd xmm0, qword [rsi]
mov eax, dword [rsi + 8]
and dword [rbp - 0x21], 0
and dword [rbp - 0x1d], 0
and dword [rbp - 0x19], 0
movsd qword [rbp - 0x41], xmm0
movsd xmm0, qword [rdi]
movsd qword [rbp - 0x35], xmm0
movss xmm0, dword [rbp + 0x7f]
mov dword [rbp - 0x39], eax
mov eax, dword [rdi + 8]
movss dword [rbp - 0x25], xmm0
movss dword [rbp - 0x29], xmm6
mov dword [rbp - 0x2d], eax
call fcn.180006a18
mov r9, qword [0x1800082a8]
lea r8, [rbp - 0x41]
mov rdx, qword [0x18000a808]
add r9, 0x3f3b160
mov rcx, rax
call r9
mov eax, dword [rbp - 0x19]
lea r11, [rsp + 0xb0]
movsd xmm0, qword [rbp - 0x21]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
movaps xmm6, xmmword [r11 - 0x10]
movsd qword [rbx], xmm0
mov dword [rbx + 8], eax
mov rax, rbx
mov rbx, qword [r11 + 0x10]
mov rsp, r11
pop rbp
ret
Function at 0x180006788
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
xor eax, eax
mov dword [rbp - 0x50], 0xf739f703
xor r9d, r9d
mov dword [rbp - 0x4c], 0xf73cf73d
mov edx, r9d
mov dword [rbp - 0x48], 0xf730f720
mov dword [rbp - 0x44], 0xf710f724
mov dword [rbp - 0x40], 0xf734f739
mov dword [rbp - 0x3c], 0xf775f73f
mov dword [rbp - 0x38], 0xf738f718
mov dword [rbp - 0x34], 0xf73ef738
mov dword [rbp - 0x30], 0xf70df715
mov dword [rbp - 0x2c], 0xf73cf716
mov dword [rbp - 0x28], 0xf727f73b
mov dword [rbp - 0x24], 0xf714f707
mov dword [rbp - 0x20], 0xf73df70d
mov dword [rbp - 0x1c], 0xf70af70f
mov dword [rbp - 0x18], 0xf72ef701
mov dword [rbp - 0x14], 0xf702f701
mov dword [rbp - 0x10], 0xf71ef700
mov dword [rbp - 0xc], 0xf716f71c
mov dword [rbp - 8], 0xf701f71a
mov word [rbp - 4], ax
movsxd rcx, edx
movzx eax, dx
mov r8d, 0x8b0
inc edx
sub ax, r8w
xor word [rbp + rcx*2 - 0x50], ax
cmp edx, 0x26
jb 0x180006822
mov rax, qword [0x1800082a8]
lea r8, [rbp - 0x50]
add rax, 0x3f4f800
mov word [rbp - 4], r9w
xor edx, edx
xor ecx, ecx
call rax
add rsp, 0x70
pop rbp
ret

Function at 0x180006860
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
xor eax, eax
mov dword [rbp - 0x60], 0xf739f703
xor r9d, r9d
mov dword [rbp - 0x5c], 0xf73cf73d
mov edx, r9d
mov dword [rbp - 0x58], 0xf730f720
mov dword [rbp - 0x54], 0xf710f724
mov dword [rbp - 0x50], 0xf734f739
mov dword [rbp - 0x4c], 0xf775f73f
mov dword [rbp - 0x48], 0xf738f718
mov dword [rbp - 0x44], 0xf73ef738
mov dword [rbp - 0x40], 0xf70df715
mov dword [rbp - 0x3c], 0xf73cf716
mov dword [rbp - 0x38], 0xf736f73b
mov dword [rbp - 0x34], 0xf708f70e
mov dword [rbp - 0x30], 0xf71df707
mov dword [rbp - 0x2c], 0xf719f70f
mov dword [rbp - 0x28], 0xf701f72e
mov dword [rbp - 0x24], 0xf70af71b
mov dword [rbp - 0x20], 0xf703f700
mov dword [rbp - 0x1c], 0xf71df71b
mov dword [rbp - 0x18], 0xf739f700
mov dword [rbp - 0x14], 0xf715f71f
mov dword [rbp - 0x10], 0xf718f70a
mov dword [rbp - 0xc], 0xf702f708
mov word [rbp - 8], ax
movsxd rcx, edx
movzx eax, dx
mov r8d, 0x8b0
inc edx
sub ax, r8w
xor word [rbp + rcx*2 - 0x60], ax
cmp edx, 0x2c
jb 0x18000691b
mov rax, qword [0x1800082a8]
lea r8, [rbp - 0x60]
add rax, 0x3f4f800
mov word [rbp - 8], r9w
xor edx, edx
xor ecx, ecx
call rax
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x180006968
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
xor eax, eax
mov dword [rbp - 0x40], 0xf73ff715
xor r9d, r9d
mov dword [rbp - 0x3c], 0xf73af735
mov edx, r9d
mov dword [rbp - 0x38], 0xf730f73a
mov dword [rbp - 0x34], 0xf71cf778
mov dword [rbp - 0x30], 0xf72af731
mov dword [rbp - 0x2c], 0xf73ef737
mov dword [rbp - 0x28], 0xf70ef728
mov dword [rbp - 0x24], 0xf72df72a
mov dword [rbp - 0x20], 0xf70ff709
mov dword [rbp - 0x1c], 0xf72ff705
mov dword [rbp - 0x18], 0xf707f70d
mov dword [rbp - 0x14], 0xf706f714
mov dword [rbp - 0x10], 0xf710f71a
mov word [rbp - 0xc], ax
movsxd rcx, edx
movzx eax, dx
mov r8d, 0x8b0
inc edx
sub ax, r8w
xor word [rbp + rcx*2 - 0x40], ax
cmp edx, 0x1a
jb 0x1800069d8
mov rax, qword [0x1800082a8]
lea r8, [rbp - 0x40]
add rax, 0x3f4f800
mov word [rbp - 0xc], r9w
xor edx, edx
xor ecx, ecx
call rax
add rsp, 0x60
pop rbp
ret

Function at 0x180006a18
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
xor r9d, r9d
mov dword [rbp - 0x50], 0xf73ff715
mov edx, r9d
mov dword [rbp - 0x4c], 0xf73af735
mov dword [rbp - 0x48], 0xf730f73a
mov dword [rbp - 0x44], 0xf713f778
mov dword [rbp - 0x40], 0xf73ff73d
mov dword [rbp - 0x3c], 0xf72ef73b
mov dword [rbp - 0x38], 0xf729f730
mov dword [rbp - 0x34], 0xf700f701
mov dword [rbp - 0x30], 0xf708f72b
mov dword [rbp - 0x2c], 0xf70ef711
mov dword [rbp - 0x28], 0xf711f701
mov dword [rbp - 0x24], 0xf706f72b
mov dword [rbp - 0x20], 0xf701f71c
mov dword [rbp - 0x1c], 0xf702f726
mov dword [rbp - 0x18], 0xf71ff70e
mov dword [rbp - 0x14], 0xf71df70f
mov dword [rbp - 0x10], 0xf709
movsxd rcx, edx
movzx eax, dx
mov r8d, 0x8b0
inc edx
sub ax, r8w
xor word [rbp + rcx*2 - 0x50], ax
cmp edx, 0x21
jb 0x180006a9e
mov rax, qword [0x1800082a8]
lea r8, [rbp - 0x50]
add rax, 0x3f4f800
mov word [rbp - 0xe], r9w
xor edx, edx
xor ecx, ecx
call rax
add rsp, 0x70
pop rbp
ret
Function at 0x140008150
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000819a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000819a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000819a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000819a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000819a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000819c
xor al, al
add rsp, 0x28
ret
Function at 0x100002454
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], r12
push r13
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
xor r12d, r12d
xor eax, eax
lock cmpxchg qword [0x100004758], rdi
je 0x1000024a2
cmp rax, rdi
jne 0x100002495
mov edi, 1
mov r12d, edi
jmp 0x1000024a7
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100002479
mov edi, 1
mov eax, dword [0x100004750]
cmp eax, edi
jne 0x1000024bd
mov ecx, 0x1f
call sub.msvcrt.dll__amsg_exit
jmp 0x10000251a
mov eax, dword [0x100004750]
test eax, eax
jne 0x100002514
mov dword [0x100004750], edi
lea r13, [0x100001290]
lea rsi, [0x100001278]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], eax
cmp rsi, r13
jae 0x100002506
test eax, eax
jne 0x100002506
mov rcx, qword [rsi]
test rcx, rcx
je 0x1000024fb
call rcx
mov dword [rsp + 0x20], eax
add rsi, 8
mov qword [rsp + 0x28], rsi
jmp 0x1000024e4
test eax, eax
je 0x10000251a
mov eax, 0xff
jmp 0x1000025ec
mov dword [0x100004184], edi
mov eax, dword [0x100004750]
cmp eax, edi
jne 0x100002541
lea rdx, [0x100001270]
lea rcx, [0x100001260]
call sub.msvcrt.dll__initterm
mov dword [0x100004750], 2
test r12d, r12d
jne 0x10000254f
xor eax, eax
xchg qword [0x100004758], rax
cmp qword [0x100004760], 0
je 0x100002578
lea rcx, [0x100004760]
call fcn.10000284c
test eax, eax
je 0x100002578
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x100004760]
mov r8, qword [0x100004168]
mov rdx, qword [0x100004170]
mov ecx, dword [0x100004160]
call fcn.100001b54
mov dword [0x100004180], eax
cmp dword [0x100004164], 0
jne 0x1000025a8
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x100004184], 0
jne 0x1000025bd
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x100004180]
jmp 0x1000025ec
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
add rsp, 0x30
pop r13
ret
sub rsp, 0x28
call fcn.10017f000
add rsp, 0x28
jmp 0x100002454