joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18005dde0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rdi, r8
mov rsi, r9
shl rsi, 6
mov rbp, r9
mov rbx, rdx
mov r14, rcx
mov r8, rsi
mov r10, rdi
cmp rsi, 0x10
jb 0x18005de51
mov r9, rsi
mov r11, rdi
shr r9, 4
sub r11, rdx
imul rax, r9, 0xfffffffffffffff0
add r8, rax
nop dword [rax]
mov rcx, qword [r11 + rdx + 8]
xor rcx, qword [rdx + 8]
mov rax, qword [r10]
add r10, 0x10
xor qword [rdx], rax
mov qword [rdx + 8], rcx
add rdx, 0x10
sub r9, 1
jne 0x18005de30
test r8, r8
je 0x18005de71
sub r10, rdx
nop dword [rax]
movzx eax, byte [r10 + rdx]
xor byte [rdx], al
lea rdx, [rdx + 1]
sub r8, 1
jne 0x18005de60
mov rax, qword [r14]
mov r9, rbp
mov r8, rbx
mov rdx, rbx
mov rcx, r14
call qword [rax + 0x48]
cmp rsi, 0x10
jb 0x18005dec1
mov rdx, rsi
mov r8, rdi
shr rdx, 4
sub r8, rbx
imul rax, rdx, 0xfffffffffffffff0
add rsi, rax
nop dword [rax]
mov rcx, qword [r8 + rbx + 8]
xor rcx, qword [rbx + 8]
mov rax, qword [rdi]
add rdi, 0x10
xor qword [rbx], rax
mov qword [rbx + 8], rcx
add rbx, 0x10
sub rdx, 1
jne 0x18005dea0
test rsi, rsi
je 0x18005dee0
sub rdi, rbx
nop dword [rax]
movzx eax, byte [rdi + rbx]
xor byte [rbx], al
lea rbx, [rbx + 1]
sub rsi, 1
jne 0x18005ded0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x18005df00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
lea rsi, [r9*8]
mov rdi, r8
mov rbp, r9
mov rbx, rdx
mov r14, rcx
mov r8, rsi
mov r10, rdi
cmp rsi, 0x10
jb 0x18005df71
mov r9, rsi
mov r11, rdi
shr r9, 4
sub r11, rdx
imul rax, r9, 0xfffffffffffffff0
add r8, rax
nop
mov rcx, qword [r11 + rdx + 8]
xor rcx, qword [rdx + 8]
mov rax, qword [r10]
add r10, 0x10
xor qword [rdx], rax
mov qword [rdx + 8], rcx
add rdx, 0x10
sub r9, 1
jne 0x18005df50
test r8, r8
je 0x18005df91
sub r10, rdx
nop dword [rax]
movzx eax, byte [r10 + rdx]
xor byte [rdx], al
lea rdx, [rdx + 1]
sub r8, 1
jne 0x18005df80
mov rax, qword [r14]
mov r9, rbp
mov r8, rbx
mov rdx, rbx
mov rcx, r14
call qword [rax + 0x40]
cmp rsi, 0x10
jb 0x18005dfe1
mov rdx, rsi
mov r8, rdi
shr rdx, 4
sub r8, rbx
imul rax, rdx, 0xfffffffffffffff0
add rsi, rax
nop dword [rax]
mov rcx, qword [r8 + rbx + 8]
xor rcx, qword [rbx + 8]
mov rax, qword [rdi]
add rdi, 0x10
xor qword [rbx], rax
mov qword [rbx + 8], rcx
add rbx, 0x10
sub rdx, 1
jne 0x18005dfc0
test rsi, rsi
je 0x18005e000
sub rdi, rbx
nop dword [rax]
movzx eax, byte [rdi + rbx]
xor byte [rbx], al
lea rbx, [rbx + 1]
sub rsi, 1
jne 0x18005dff0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x18005e020
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rdi, r8
mov rsi, r9
shl rsi, 5
mov rbp, r9
mov rbx, rdx
mov r14, rcx
mov r8, rsi
mov r10, rdi
cmp rsi, 0x10
jb 0x18005e091
mov r9, rsi
mov r11, rdi
shr r9, 4
sub r11, rdx
imul rax, r9, 0xfffffffffffffff0
add r8, rax
nop dword [rax]
mov rcx, qword [r11 + rdx + 8]
xor rcx, qword [rdx + 8]
mov rax, qword [r10]
add r10, 0x10
xor qword [rdx], rax
mov qword [rdx + 8], rcx
add rdx, 0x10
sub r9, 1
jne 0x18005e070
test r8, r8
je 0x18005e0b1
sub r10, rdx
nop dword [rax]
movzx eax, byte [r10 + rdx]
xor byte [rdx], al
lea rdx, [rdx + 1]
sub r8, 1
jne 0x18005e0a0
mov rax, qword [r14]
mov r9, rbp
mov r8, rbx
mov rdx, rbx
mov rcx, r14
call qword [rax + 0x40]
cmp rsi, 0x10
jb 0x18005e101
mov rdx, rsi
mov r8, rdi
shr rdx, 4
sub r8, rbx
imul rax, rdx, 0xfffffffffffffff0
add rsi, rax
nop dword [rax]
mov rcx, qword [r8 + rbx + 8]
xor rcx, qword [rbx + 8]
mov rax, qword [rdi]
add rdi, 0x10
xor qword [rbx], rax
mov qword [rbx + 8], rcx
add rbx, 0x10
sub rdx, 1
jne 0x18005e0e0
test rsi, rsi
je 0x18005e120
sub rdi, rbx
nop dword [rax]
movzx eax, byte [rdi + rbx]
xor byte [rbx], al
lea rbx, [rbx + 1]
sub rsi, 1
jne 0x18005e110
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x18005e140
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rdi, r8
mov rsi, r9
shl rsi, 6
mov rbp, r9
mov rbx, rdx
mov r14, rcx
mov r8, rsi
mov r10, rdi
cmp rsi, 0x10
jb 0x18005e1b1
mov r9, rsi
mov r11, rdi
shr r9, 4
sub r11, rdx
imul rax, r9, 0xfffffffffffffff0
add r8, rax
nop dword [rax]
mov rcx, qword [r11 + rdx + 8]
xor rcx, qword [rdx + 8]
mov rax, qword [r10]
add r10, 0x10
xor qword [rdx], rax
mov qword [rdx + 8], rcx
add rdx, 0x10
sub r9, 1
jne 0x18005e190
test r8, r8
je 0x18005e1d1
sub r10, rdx
nop dword [rax]
movzx eax, byte [r10 + rdx]
xor byte [rdx], al
lea rdx, [rdx + 1]
sub r8, 1
jne 0x18005e1c0
mov rax, qword [r14]
mov r9, rbp
mov r8, rbx
mov rdx, rbx
mov rcx, r14
call qword [rax + 0x40]
cmp rsi, 0x10
jb 0x18005e221
mov rdx, rsi
mov r8, rdi
shr rdx, 4
sub r8, rbx
imul rax, rdx, 0xfffffffffffffff0
add rsi, rax
nop dword [rax]
mov rcx, qword [r8 + rbx + 8]
xor rcx, qword [rbx + 8]
mov rax, qword [rdi]
add rdi, 0x10
xor qword [rbx], rax
mov qword [rbx + 8], rcx
add rbx, 0x10
sub rdx, 1
jne 0x18005e200
test rsi, rsi
je 0x18005e240
sub rdi, rbx
nop dword [rax]
movzx eax, byte [rdi + rbx]
xor byte [rbx], al
lea rbx, [rbx + 1]
sub rsi, 1
jne 0x18005e230
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x18005f3b0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r12
push r13
push r15
sub rsp, 0x38
mov rbp, qword [rcx + 0x78]
mov r15, rcx
mov rcx, qword [rcx + 0x80]
mov r13, rdx
mov r12, r8
mov rdx, qword [r15 + 0x18]
mov rax, qword [r15 + 0x20]
sub rax, rdx
cmp rcx, rax
ja 0x18005f5d8
sub rax, rcx
cmp rax, r8
cmovb r8, rax
test r8, r8
je 0x18005f3fe
add rcx, rdx
mov rdx, r13
call fcn.1801a4560
mov rcx, qword [r15 + 0x80]
add rcx, r12
cmp rcx, rbp
jbe 0x18005f5c5
mov r8, qword [r15 + 0x18]
mov r9, rbp
mov rdx, qword [r15 + 0x30]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x30], r14
cmp rbp, 0x10
jb 0x18005f470
mov r10, rbp
shr r10, 4
imul r9, r10, 0xfffffffffffffff0
add r9, rbp
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [r8 + 8]
xor rcx, qword [rdx + 8]
mov rax, qword [r8]
add r8, 0x10
xor qword [rdx], rax
mov qword [rdx + 8], rcx
add rdx, 0x10
sub r10, 1
jne 0x18005f450
test r9, r9
je 0x18005f491
sub r8, rdx
nop dword [rax + rax]
movzx eax, byte [r8 + rdx]
xor byte [rdx], al
lea rdx, [rdx + 1]
sub r9, 1
jne 0x18005f480
mov r14, qword [r15 + 0x10]
mov rsi, qword [r15 + 0x30]
mov rcx, r14
mov rbx, qword [r15 + 0x38]
sub rbx, rsi
mov rdi, qword [r14]
call qword [rdi + 0x28]
xor edx, edx
mov rcx, r14
mov r8, rax
mov rax, rbx
div r8
mov r8, rsi
mov rdx, rsi
mov r9, rax
call qword [rdi + 0x40]
mov rcx, qword [r15 + 0x80]
mov rax, rbp
sub rax, rcx
sub rcx, rbp
add r12, rcx
add r13, rax
cmp r12, rbp
jbe 0x18005f592
nop dword [rax]
nop word [rax + rax]
mov rax, qword [r15 + 0x30]
mov r9, rbp
mov r8, r13
cmp rbp, 0x10
jb 0x18005f530
mov r10, rbp
shr r10, 4
imul r9, r10, 0xfffffffffffffff0
add r9, rbp
nop
mov rdx, qword [r8 + 8]
xor rdx, qword [rax + 8]
mov rcx, qword [r8]
add r8, 0x10
xor qword [rax], rcx
mov qword [rax + 8], rdx
add rax, 0x10
sub r10, 1
jne 0x18005f510
test r9, r9
je 0x18005f551
sub r8, rax
nop dword [rax + rax]
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub r9, 1
jne 0x18005f540
mov r14, qword [r15 + 0x10]
mov rsi, qword [r15 + 0x30]
mov rcx, r14
mov rbx, qword [r15 + 0x38]
sub rbx, rsi
mov rdi, qword [r14]
call qword [rdi + 0x28]
xor edx, edx
mov rcx, r14
mov r8, rax
mov rax, rbx
div r8
mov r8, rsi
mov rdx, rsi
mov r9, rax
call qword [rdi + 0x40]
add r13, rbp
sub r12, rbp
cmp r12, rbp
ja 0x18005f4f0
mov r14, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
test r12, r12
je 0x18005f5ba
mov rcx, qword [r15 + 0x18]
mov r8, r12
mov rdx, r13
call fcn.1801a4560
mov qword [r15 + 0x80], 0
add qword [r15 + 0x80], r12
add rsp, 0x38
pop r15
pop r13
pop r12
pop rbp
ret
lea r9, str.gold
mov dword [rsp + 0x20], 0x6c
lea r8, str.buffer_insert
lea rdx, [0x1801e63c8]
lea rcx, str.buf_offset___buf.size__
call fcn.180043540
int3
Function at 0x18005f6f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r9, qword [rcx + 0x80]
mov r15, rdx
mov r8, qword [rcx + 0x18]
mov rbp, rcx
mov rax, qword [rcx + 0x30]
cmp r9, 0x10
jb 0x18005f751
mov r10, r9
shr r10, 4
imul rdx, r10, 0xfffffffffffffff0
add r9, rdx
mov rdx, qword [r8 + 8]
xor rdx, qword [rax + 8]
mov rcx, qword [r8]
add r8, 0x10
xor qword [rax], rcx
mov qword [rax + 8], rdx
add rax, 0x10
sub r10, 1
jne 0x18005f731
test r9, r9
je 0x18005f771
sub r8, rax
nop dword [rax]
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub r9, 1
jne 0x18005f760
mov rcx, qword [rbp + 0x80]
mov r9, qword [rbp + 0x78]
cmp rcx, r9
jne 0x18005f7e3
mov r8, qword [rbp + 0x48]
mov rdx, qword [rbp + 0x30]
cmp r9, 0x10
jb 0x18005f7c0
mov r10, r9
shr r10, 4
imul rax, r10, 0xfffffffffffffff0
add r9, rax
nop dword [rax]
mov rcx, qword [r8 + 8]
xor rcx, qword [rdx + 8]
mov rax, qword [r8]
add r8, 0x10
xor qword [rdx], rax
mov qword [rdx + 8], rcx
add rdx, 0x10
sub r10, 1
jne 0x18005f7a0
test r9, r9
je 0x18005f851
sub r8, rdx
nop dword [rax]
movzx eax, byte [r8 + rdx]
xor byte [rdx], al
lea rdx, [rdx + 1]
sub r9, 1
jne 0x18005f7d0
jmp 0x18005f851
mov rax, qword [rbp + 0x30]
xor byte [rcx + rax], 0x80
mov r9, qword [rbp + 0x78]
mov r8, qword [rbp + 0x60]
mov rdx, qword [rbp + 0x30]
cmp r9, 0x10
jb 0x18005f830
mov r10, r9
shr r10, 4
imul rax, r10, 0xfffffffffffffff0
add r9, rax
nop dword [rax + rax]
mov rcx, qword [r8 + 8]
xor rcx, qword [rdx + 8]
mov rax, qword [r8]
add r8, 0x10
xor qword [rdx], rax
mov qword [rdx + 8], rcx
add rdx, 0x10
sub r10, 1
jne 0x18005f810
test r9, r9
je 0x18005f851
sub r8, rdx
nop dword [rax + rax]
movzx eax, byte [rdx + r8]
xor byte [rdx], al
lea rdx, [rdx + 1]
sub r9, 1
jne 0x18005f840
mov r14, qword [rbp + 0x10]
mov rsi, qword [rbp + 0x30]
mov rcx, r14
mov rbx, qword [rbp + 0x38]
sub rbx, rsi
mov rdi, qword [r14]
call qword [rdi + 0x28]
xor edx, edx
mov rcx, r14
mov r8, rax
mov rax, rbx
div r8
mov r8, rsi
mov rdx, rsi
mov r9, rax
call qword [rdi + 0x40]
mov r8, qword [rbp + 0x78]
test r8, r8
je 0x18005f898
mov rdx, qword [rbp + 0x30]
mov rcx, r15
call fcn.1801a4560
mov rcx, qword [rbp + 0x30]
mov r8, qword [rbp + 0x38]
sub r8, rcx
je 0x18005f8ac
xor edx, edx
call fcn.1801a4970
mov rcx, qword [rbp + 0x18]
mov r8, qword [rbp + 0x20]
sub r8, rcx
je 0x18005f8c0
xor edx, edx
call fcn.1801a4970
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov qword [rbp + 0x80], 0
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x180063aa0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov rbx, qword [rdx]
mov rax, qword [rbx + 0x18]
mov r9, qword [rbx]
xor rax, rcx
mov r10, qword [rbx + 8]
mov r11, qword [rbx + 0x10]
test r8, r8
je 0x180063af6
nop
add r9, r10
add r11, rax
rol r10, 0xd
xor r10, r9
rol rax, 0x10
xor rax, r11
rol r9, 0x20
add r11, r10
add r9, rax
rol r10, 0x11
rol rax, 0x15
xor r10, r11
xor rax, r9
rol r11, 0x20
sub r8, 1
jne 0x180063ac0
xor r9, rcx
mov qword [rbx], r9
mov rcx, qword [rdx]
mov rbx, qword [rsp + 8]
mov qword [rcx + 8], r10
mov rcx, qword [rdx]
mov qword [rcx + 0x10], r11
mov rcx, qword [rdx]
mov qword [rcx + 0x18], rax
ret

Function at 0x180063b20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0x28]
mov rsi, r8
mov rdi, rdx
mov qword [rsp + 0x40], r14
mov rbx, rcx
cmp qword [rcx + 0x20], rax
jne 0x180063b4d
add rcx, 8
call fcn.180036630
add byte [rbx + 0x48], sil
xor ebp, ebp
cmp qword [rbx + 0x40], rbp
je 0x180063bb1
test rsi, rsi
je 0x180063b91
nop
mov rdx, qword [rbx + 0x40]
cmp rdx, 8
je 0x180063b91
movzx ecx, byte [rdi]
inc rdi
mov rax, qword [rbx + 0x38]
shr rax, 8
shl rcx, 0x38
or rcx, rax
lea rax, [rdx + 1]
mov qword [rbx + 0x40], rax
mov qword [rbx + 0x38], rcx
sub rsi, 1
jne 0x180063b60
cmp qword [rbx + 0x40], 8
jne 0x180063bb1
mov r8, qword [rbx + 0x10]
lea rdx, [rbx + 0x20]
mov rcx, qword [rbx + 0x38]
call fcn.180063aa0
mov qword [rbx + 0x40], rbp
mov qword [rbx + 0x38], rbp
cmp rsi, 8
jb 0x180063c55
mov r11, rsi
mov qword [rsp + 0x48], r15
shr r11, 3
imul rax, r11, 0xfffffffffffffff8
add rsi, rax
nop
mov r9, qword [rbx + 0x20]
mov r15, qword [rdi]
mov r10, qword [rbx + 0x10]
mov rax, qword [r9 + 0x18]
mov rcx, qword [r9]
xor rax, r15
mov rdx, qword [r9 + 8]
mov r8, qword [r9 + 0x10]
test r10, r10
je 0x180063c28
add rcx, rdx
add r8, rax
rol rdx, 0xd
xor rdx, rcx
rol rax, 0x10
xor rax, r8
rol rcx, 0x20
add r8, rdx
add rcx, rax
rol rdx, 0x11
rol rax, 0x15
xor rdx, r8
xor rax, rcx
rol r8, 0x20
sub r10, 1
jne 0x180063bf2
xor rcx, r15
add rdi, 8
mov qword [r9], rcx
mov rcx, qword [rbx + 0x20]
mov qword [rcx + 8], rdx
mov rcx, qword [rbx + 0x20]
mov qword [rcx + 0x10], r8
mov rcx, qword [rbx + 0x20]
mov qword [rcx + 0x18], rax
sub r11, 1
jne 0x180063bd0
mov r15, qword [rsp + 0x48]
mov r14, qword [rsp + 0x40]
test rsi, rsi
je 0x180063c98
mov r8, qword [rbx + 0x40]
mov rdx, qword [rbx + 0x38]
nop word [rax + rax]
movzx ecx, byte [rdi + rbp]
mov rax, rdx
shl rcx, 0x38
inc r8
shr rax, 8
mov rdx, rcx
or rdx, rax
mov qword [rbx + 0x40], r8
inc rbp
mov qword [rbx + 0x38], rdx
cmp rbp, rsi
jne 0x180063c70
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
Function at 0x180063d70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0x28]
mov rsi, rdx
mov rbx, rcx
cmp qword [rcx + 0x20], rax
jne 0x180063d98
add rcx, 8
call fcn.180036630
mov rcx, qword [rbx + 0x40]
test rcx, rcx
jne 0x180063daf
movzx eax, byte [rbx + 0x48]
shl rax, 0x38
mov qword [rbx + 0x38], rax
jmp 0x180063dd8
cmp rcx, 8
jae 0x180063dd8
mov rdx, qword [rbx + 0x38]
mov eax, 8
sub al, cl
movzx ecx, al
movzx eax, byte [rbx + 0x48]
shl cl, 3
shr rdx, cl
shl rax, 0x38
or rdx, rax
mov qword [rbx + 0x38], rdx
mov r8, qword [rbx + 0x10]
lea rdx, [rbx + 0x20]
mov rcx, qword [rbx + 0x38]
call fcn.180063aa0
mov rdx, qword [rbx + 0x20]
xor qword [rdx + 0x10], 0xff
mov r9, qword [rbx + 0x20]
mov r10, qword [rbx + 0x18]
mov rax, qword [r9]
mov rcx, qword [r9 + 8]
mov r8, qword [r9 + 0x10]
mov rdx, qword [r9 + 0x18]
test r10, r10
je 0x180063e47
add rax, rcx
add r8, rdx
rol rcx, 0xd
xor rcx, rax
rol rdx, 0x10
xor rdx, r8
rol rax, 0x20
add r8, rcx
add rax, rdx
rol rcx, 0x11
rol rdx, 0x15
xor rcx, r8
xor rdx, rax
rol r8, 0x20
sub r10, 1
jne 0x180063e11
mov qword [r9], rax
mov rax, qword [rbx + 0x20]
mov qword [rax + 8], rcx
mov rax, qword [rbx + 0x20]
mov qword [rax + 0x10], r8
mov rax, qword [rbx + 0x20]
mov qword [rax + 0x18], rdx
mov rcx, qword [rbx + 0x20]
mov rax, qword [rcx + 0x18]
xor rax, qword [rcx + 0x10]
xor rax, qword [rcx + 8]
xor rax, qword [rcx]
mov qword [rsi], rax
mov rcx, qword [rbx + 0x20]
mov r8, qword [rbx + 0x28]
sub r8, rcx
and r8, 0xfffffffffffffff8
je 0x180063e90
xor edx, edx
call fcn.1801a4970
mov rax, qword [rbx + 0x20]
lea rcx, [rbx + 0x20]
mov qword [rbx + 0x28], rax
call fcn.180063a30
mov rsi, qword [rsp + 0x38]
xor eax, eax
mov qword [rbx + 0x38], rax
mov qword [rbx + 0x40], rax
mov byte [rbx + 0x48], al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1800644b0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r12
push r13
push r15
sub rsp, 0x28
mov rax, qword [rcx + 0x28]
mov r13, r8
mov r15, rdx
mov rbp, rcx
cmp qword [rcx + 0x20], rax
jne 0x1800644d8
add rcx, 8
call fcn.180036630
mov rdx, qword [rbp + 0x38]
mov r12d, 8
sub r12, qword [rbp + 0x38]
mov r8, r15
cmp r13, r12
cmovb r12, r13
add rdx, qword [rbp + 0x20]
mov r9, r12
cmp r12, 0x10
jb 0x180064530
mov r10, r12
shr r10, 4
imul r9, r10, 0xfffffffffffffff0
add r9, r12
nop dword [rax + rax]
mov rcx, qword [r8 + 8]
xor rcx, qword [rdx + 8]
mov rax, qword [r8]
add r8, 0x10
xor qword [rdx], rax
mov qword [rdx + 8], rcx
add rdx, 0x10
sub r10, 1
jne 0x180064510
test r9, r9
je 0x180064551
sub r8, rdx
nop dword [rax + rax]
movzx eax, byte [r8 + rdx]
xor byte [rdx], al
lea rdx, [rdx + 1]
sub r9, 1
jne 0x180064540
add qword [rbp + 0x38], r12
cmp qword [rbp + 0x38], 8
jb 0x180064695
mov qword [rsp + 0x50], rbx
mov rbx, qword [rbp + 0x28]
mov qword [rsp + 0x58], rsi
mov rsi, qword [rbp + 0x20]
mov qword [rsp + 0x60], rdi
sub rbx, rsi
mov qword [rsp + 0x20], r14
mov r14, qword [rbp + 0x10]
mov rcx, r14
mov rdi, qword [r14]
call qword [rdi + 0x28]
xor edx, edx
mov rcx, r14
mov r8, rax
mov rax, rbx
div r8
mov r8, rsi
mov rdx, rsi
mov r9, rax
call qword [rdi + 0x40]
add r15, r12
sub r13, r12
cmp r13, 8
jb 0x18006461f
mov r12, r13
shr r12, 3
imul rax, r12, 0xfffffffffffffff8
add r13, rax
mov rax, qword [rbp + 0x20]
mov r8d, 8
mov rdx, r15
nop dword [rax]
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
xor byte [rax], cl
lea rax, [rax + 1]
sub r8, 1
jne 0x1800645d0
mov r14, qword [rbp + 0x10]
mov rsi, qword [rbp + 0x20]
mov rcx, r14
mov rbx, qword [rbp + 0x28]
sub rbx, rsi
mov rdi, qword [r14]
call qword [rdi + 0x28]
xor edx, edx
mov rcx, r14
mov r8, rax
mov rax, rbx
div r8
mov r8, rsi
mov rdx, rsi
mov r9, rax
call qword [rdi + 0x40]
add r15, 8
sub r12, 1
jne 0x1800645c0
mov rdx, qword [rbp + 0x20]
mov r8, r13
mov r14, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
cmp r13, 0x10
jb 0x180064670
mov r9, r13
shr r9, 4
imul r8, r9, 0xfffffffffffffff0
add r8, r13
nop
mov rcx, qword [r15 + 8]
xor rcx, qword [rdx + 8]
mov rax, qword [r15]
add r15, 0x10
xor qword [rdx], rax
mov qword [rdx + 8], rcx
add rdx, 0x10
sub r9, 1
jne 0x180064650
test r8, r8
je 0x180064691
sub r15, rdx
nop dword [rax + rax]
movzx eax, byte [r15 + rdx]
xor byte [rdx], al
lea rdx, [rdx + 1]
sub r8, 1
jne 0x180064680
mov qword [rbp + 0x38], r13
add rsp, 0x28
pop r15
pop r13
pop r12
pop rbp
ret
Function at 0x180065d70
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x18028f9a8]
xor rax, rsp
mov qword [rbp - 8], rax
xor r8d, r8d
mov dword [rbp - 0x28], 0x756e6547
xor eax, eax
mov dword [rbp - 0x24], 0x6c65746e
mov qword [rbp - 0x34], rax
mov r10, rcx
xor ecx, ecx
mov dword [rbp - 0x20], 0x49656e69
cpuid
mov dword [rbp - 0x2c], edx
mov r11d, eax
mov dword [rbp - 0x38], eax
mov edx, r8d
mov dword [rbp - 0x34], ebx
mov dword [rbp - 0x30], ecx
mov dword [rbp - 0x18], 0x68747541
mov dword [rbp - 0x14], 0x444d4163
mov dword [rbp - 0x10], 0x69746e65
mov dword [rbp - 0x40], r8d
nop word [rax + rax]
mov ecx, dword [rbp + rdx - 0x28]
xor ecx, dword [rbp + rdx - 0x34]
add rdx, 4
mov eax, dword [rbp - 0x40]
or ecx, eax
mov dword [rbp - 0x40], ecx
cmp rdx, 0xc
jne 0x180065df0
mov eax, dword [rbp - 0x40]
mov rdx, r8
test eax, eax
mov dword [rbp - 0x40], r8d
sete sil
nop word [rax + rax]
mov ecx, dword [rbp + rdx - 0x18]
xor ecx, dword [rbp + rdx - 0x34]
add rdx, 4
mov eax, dword [rbp - 0x40]
or ecx, eax
mov dword [rbp - 0x40], ecx
cmp rdx, 0xc
jne 0x180065e20
mov eax, dword [rbp - 0x40]
test eax, eax
sete dil
cmp dword [rbp - 0x38], 1
jb 0x180065f2d
xor ecx, ecx
mov eax, 1
cpuid
mov r9d, ecx
mov eax, edx
shl r9, 0x20
or r9, rax
mov rax, r9
mov rcx, r9
and ecx, 0x10
and eax, 0x4000000
shl rcx, 6
mov rdx, rcx
or rdx, 1
test rax, rax
mov rax, r9
cmove rdx, rcx
movabs rcx, 0x200000000
and rax, rcx
mov rcx, rdx
bts rcx, 0x11
test rax, rax
mov rax, r9
cmove rcx, rdx
movabs rdx, 0x20000000000
and rax, rdx
mov rdx, rcx
or rdx, 2
test rax, rax
mov rax, r9
cmove rdx, rcx
movabs rcx, 0x8000000000000
and rax, rcx
mov rcx, rdx
or rcx, 4
test rax, rax
mov rax, r9
cmove rcx, rdx
movabs rdx, 0x10000000000000
and rax, rdx
mov rdx, rcx
or rdx, 8
test rax, rax
mov rax, r9
cmove rdx, rcx
movabs rcx, 0x200000000000000
mov r8, rdx
bts r8, 0x10
and rax, rcx
movabs rax, 0x4000000000000000
cmove r8, rdx
test rax, r9
je 0x180065f30
bts r8, 0x12
jmp 0x180065f30
mov ebx, dword [rbp - 0x34]
test sil, sil
je 0x180065f47
mov eax, ebx
shr rax, 8
movzx ecx, al
shl rcx, 3
mov qword [r10], rcx
jmp 0x180065f5e
test dil, dil
je 0x180065f5e
mov eax, 0x80000005
xor ecx, ecx
cpuid
movzx eax, cl
mov qword [r10], rax
mov dword [rbp - 0x30], ecx
cmp r11d, 7
jb 0x180065ff5
xor ecx, ecx
mov eax, 7
cpuid
mov eax, ebx
mov rdx, r8
or rdx, 0x10
mov r9d, ecx
shl r9, 0x20
or r9, rax
movzx eax, r9b
and al, 0x20
cmove rdx, r8
test r9b, 8
je 0x180065fa5
bts rdx, 0xd
bt r9, 8
jae 0x180065fa5
bts rdx, 0xb
mov rcx, rdx
mov rax, r9
and eax, 0x10000
or rcx, 0x20
test rax, rax
mov rax, r9
cmove rcx, rdx
and eax, 0x40000
mov rdx, rcx
bts rdx, 0x13
test rax, rax
mov rax, r9
cmove rdx, rcx
and eax, 0x80000
mov r8, rdx
bts r8, 0xc
test rax, rax
cmove r8, rdx
bt r9, 0x1d
jae 0x180065ff5
bts r8, 0x14
test r8, r8
mov eax, 0x401
cmovne rax, r8
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180186840
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret
Function at 0x180099de0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r10, rdx
cmp r9, 0x10
jb 0x180099e27
mov r11, r9
shr r11, 4
imul rax, r11, 0xfffffffffffffff0
add r9, rax
nop dword [rax + rax]
mov rdx, qword [r10 + 8]
mov rax, qword [r10]
add r10, 0x10
xor rdx, qword [r8 + 8]
xor rax, qword [r8]
add r8, 0x10
mov qword [rcx], rax
mov qword [rcx + 8], rdx
add rcx, 0x10
sub r11, 1
jne 0x180099e00
xor r11d, r11d
test r9, r9
je 0x180099ef4
cmp r9, 0x20
jb 0x180099ece
lea rdx, [rcx - 1]
lea rax, [r8 - 1]
add rdx, r9
add rax, r9
cmp rcx, rax
ja 0x180099e55
cmp rdx, r8
jae 0x180099ece
lea rax, [r10 - 1]
add rax, r9
cmp rcx, rax
ja 0x180099e66
cmp rdx, r10
jae 0x180099ece
mov qword [rsp + 0x10], rbx
mov rdx, r10
mov qword [rsp], rdi
sub rdx, r8
mov rdi, r9
mov rbx, rcx
and rdi, 0xffffffffffffffe0
mov rax, r8
sub rbx, r8
nop word [rax + rax]
movdqu xmm0, xmmword [rax]
add r11, 0x20
movdqu xmm1, xmmword [rdx + rax]
lea rax, [rax + 0x20]
pxor xmm1, xmm0
movdqu xmmword [rbx + rax - 0x20], xmm1
movdqu xmm2, xmmword [rdx + rax - 0x10]
movdqu xmm0, xmmword [rax - 0x10]
pxor xmm2, xmm0
movdqu xmmword [rbx + rax - 0x10], xmm2
cmp r11, rdi
jne 0x180099e90
mov rdi, qword [rsp]
mov rbx, qword [rsp + 0x10]
cmp r11, r9
je 0x180099ef4
sub r10, r8
lea rdx, [r11 + r8]
sub rcx, r8
sub r9, r11
movzx eax, byte [rdx + r10]
xor al, byte [rdx]
mov byte [rdx + rcx], al
lea rdx, [rdx + 1]
sub r9, 1
jne 0x180099ee0
add rsp, 8
ret