joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180001864
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x470
mov rdi, rcx
cmp rcx, 0xffffffffffffffff
je 0x180001a22
xor edx, edx
lea rcx, [rax - 0x218]
mov r8d, 0x208
call fcn.18002c230
call fcn.180027960
xor ebx, ebx
mov esi, 2
call fcn.18002242c
call fcn.1800062ec
dec esi
test esi, esi
jg 0x1800018a8
call fcn.180021548
call fcn.180027610
call fcn.1800273b0
call fcn.1800062ec
call fcn.180027aac
call fcn.180022bac
call fcn.1800062ec
call fcn.180027610
mov r8d, 0x104
lea rdx, [rsp + 0x260]
lea rcx, [0x180000000]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call fcn.1800062ec
call fcn.180022bac
call fcn.180022824
call fcn.180021548
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x234
mov ebp, eax
call fcn.18002c230
mov dword [rsp + 0x20], 0x238
call fcn.1800062ec
call fcn.180027610
call fcn.180022ff8
call fcn.180022bac
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x180001a22
cmp dword [rsp + 0x28], ebp
je 0x1800019c1
cmp dword [rsp + 0x28], ebx
je 0x1800019c1
call fcn.1800271ec
call fcn.1800062ec
call fcn.1800062ec
mov esi, 3
call fcn.1800271ec
call fcn.18002242c
call fcn.1800062ec
dec esi
test esi, esi
jg 0x18000197b
mov esi, 7
call fcn.180020e1c
dec esi
test esi, esi
jg 0x180001995
mov edx, dword [rsp + 0x28]
lea rcx, [rsp + 0x260]
call fcn.18000170c
test eax, eax
jne 0x180001a06
call fcn.18002746c
call fcn.1800062ec
jmp 0x1800019ef
call fcn.180022ff8
call fcn.1800271ec
call fcn.180022824
call fcn.1800062ec
call fcn.180027960
call fcn.180021548
mov esi, 8
call fcn.1800062ec
dec esi
test esi, esi
jg 0x1800019e4
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x180001a0b
jmp 0x18000195b
mov ebx, 1
call fcn.180020e1c
call fcn.180022824
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x180001a24
xor eax, eax
lea r11, [rsp + 0x470]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x180002f3c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rbp, qword [rcx + 0x168]
lea r15, [rcx + 0xc8]
mov rdi, rcx
shr rbp, 3
mov rcx, qword [rcx + 0x158]
mov r14, rdx
mov rsi, r8
mov rdx, rcx
test rcx, rcx
je 0x180002ffc
lea rax, [rcx + r8]
cmp rax, rbp
jb 0x180002ffc
mov r8, rbp
mov rdx, r14
sub r8, rcx
add rcx, r15
call fcn.18002bd80
mov rdx, qword [rdi + 0x168]
shr rdx, 6
test rdx, rdx
je 0x180002fc2
mov r8, r15
mov rcx, rdi
sub r8, rdi
mov rax, qword [rcx + r8]
xor qword [rcx], rax
lea rcx, [rcx + 8]
sub rdx, 1
jne 0x180002fb1
mov rcx, rdi
call fcn.18001a644
mov rcx, qword [rdi + 0x158]
mov rax, rcx
sub rax, rbp
add rsi, rax
mov rax, rbp
sub rax, rcx
add r14, rax
lea rax, [rbp*8]
add qword [rdi + 0x170], rax
and qword [rdi + 0x158], 0
xor edx, edx
cmp rsi, rbp
jb 0x180003041
mov r9, qword [rdi + 0x168]
xor edx, edx
mov rax, rsi
mov r8, rdi
div rbp
mov rcx, r14
mov rbx, rax
mov rdx, rax
imul rbx, rbp
call fcn.18000c584
lea rax, [rbx*8]
sub rsi, rbx
add r14, rbx
add qword [rdi + 0x170], rax
mov rdx, qword [rdi + 0x158]
lea rcx, [rdx + r15]
mov r8, rsi
mov rdx, r14
call fcn.18002bd80
add qword [rdi + 0x158], rsi
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x180003850
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r13
push rbp
push r14
push r15
lea rbp, [rax - 0x38]
sub rsp, 0x120
mov r8, qword [rcx + 0x108]
mov r13d, 0x80
mov rbx, rcx
mov r14, rdx
lea rax, [r8 + 1]
mov qword [rcx + 0x108], rax
lea esi, [r13 - 0x40]
mov byte [r8 + rcx + 0x80], r13b
mov rcx, qword [rcx + 0x108]
lea rax, [rcx*8]
add qword [rbx + 0x110], rax
cmp qword [rbx + 0x100], 0x100
cmova esi, r13d
xor edi, edi
lea rax, [rsi - 8]
cmp rcx, rax
jbe 0x180003930
cmp rsi, rcx
je 0x1800038e6
mov r8d, esi
xor edx, edx
sub r8, rcx
sub rcx, 0xffffffffffffff80
add rcx, rbx
call fcn.18002c230
lea r15, [rbx + 0x80]
mov r8d, 1
mov rdx, r15
mov rcx, rbx
call fcn.180003b38
cmp qword [rbx + 0x100], 0x100
mov eax, 0x40
mov rcx, rdi
cmova rax, r13
sub rax, qword [rbx + 0x108]
shl rax, 3
add qword [rbx + 0x110], rax
mov qword [rbx + 0x108], rdi
jmp 0x180003937
lea r15, [rbx + 0x80]
mov r8, rsi
xor edx, edx
sub r8, rcx
sub rcx, 0xffffffffffffff80
add rcx, rbx
sub r8, 8
call fcn.18002c230
mov rax, qword [rbx + 0x110]
mov r8d, 0x40
cmp qword [rbx + 0x100], 0x100
cmova r8, r13
xor edx, edx
mov rcx, r8
sub rcx, qword [rbx + 0x108]
lea rax, [rax + rcx*8]
mov qword [rbx + 0x110], rax
shr rax, 3
div r8
mov r8d, 1
mov rdx, r15
mov r9, rax
mov r10, rax
mov rcx, r9
movabs rax, 0xff000000000000
and r10, rax
shr rcx, 0x10
or r10, rcx
movabs rax, 0xff0000000000
shr r10, 0x10
mov rcx, r9
and rcx, rax
mov rax, r9
or r10, rcx
movabs rcx, 0xff00000000
and rax, rcx
shr r10, 0x10
or r10, rax
mov rcx, r9
and ecx, 0xff00
shr r10, 8
mov rax, r9
shl rax, 0x10
or rcx, rax
mov rax, r9
shl rcx, 0x10
and eax, 0xff0000
or rcx, rax
mov eax, 0xff000000
shl rcx, 0x10
and r9, rax
or rcx, r9
shl rcx, 8
or r10, rcx
mov rcx, rbx
mov qword [rsi + rbx + 0x78], r10
call fcn.180003b38
cmp qword [rbx + 0x100], 0x100
mov rdx, rbx
jbe 0x180003a92
mov r8, r13
lea rcx, [rbp - 0x60]
call fcn.18002bd80
mov r8, rdi
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x60]
call fcn.18001b038
lea r8, [rdi + 1]
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x20]
call fcn.18001b038
add rdi, 2
cmp rdi, 0xe
jb 0x180003a42
lea rdx, [rbp - 0x60]
mov rcx, rbx
sub rdx, rbx
mov r8d, 0x10
mov rax, qword [rdx + rcx]
xor qword [rcx], rax
lea rcx, [rcx + 8]
sub r8, 1
jne 0x180003a7f
jmp 0x180003af1
mov r8d, 0x40
lea rcx, [rsp + 0x20]
call fcn.18002bd80
mov r8, rdi
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x20]
call fcn.18001b1c8
lea r8, [rdi + 1]
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x60]
call fcn.18001b1c8
add rdi, 2
cmp rdi, 0xa
jb 0x180003aa2
lea rdx, [rsp + 0x20]
mov rcx, rbx
sub rdx, rbx
mov r8d, 8
mov rax, qword [rdx + rcx]
xor qword [rcx], rax
lea rcx, [rcx + 8]
sub r8, 1
jne 0x180003ae0
mov rax, qword [rbx + 0x100]
mov rcx, rsi
shr rax, 3
sub rcx, rax
jmp 0x180003b10
mov al, byte [rcx + rbx]
inc rcx
mov byte [r14], al
inc r14
cmp rcx, rsi
jb 0x180003b04
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r13, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x180003b38
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x180003d63
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x148]
sub rsp, 0x220
xor edi, edi
mov r15, r8
mov r12, rdx
mov rbx, rcx
movabs r14, 0x100000000000000
lea r13d, [rdi + 8]
cmp qword [rbx + 0x100], 0x100
mov rdx, rdi
mov r8, rbx
jbe 0x180003c6a
shl rdx, 7
lea r9, [rbp + 0x20]
add rdx, r12
lea r10, [rbp + 0xa0]
sub r8, rdx
sub r9, rdx
sub r10, rdx
mov r11d, 0x10
mov rcx, qword [rdx]
mov rax, qword [r8 + rdx]
xor rax, rcx
mov qword [r10 + rdx], rcx
mov qword [r9 + rdx], rax
add rdx, r13
sub r11, 1
jne 0x180003bb8
xor esi, esi
movabs r13, 0x200000000000000
mov r8, rsi
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x20]
call fcn.18001b038
lea r8, [rsi + 1]
lea rdx, [rbp + 0x20]
lea rcx, [rbp - 0x60]
call fcn.18001b038
mov r8, rsi
lea rdx, [rsp + 0x20]
shl r8, 0x38
lea rcx, [rbp + 0xa0]
call fcn.18001b358
mov r8, r14
lea rdx, [rbp + 0xa0]
lea rcx, [rsp + 0x20]
call fcn.18001b358
movabs rax, 0xf00000000000000
add rsi, 2
add r14, r13
cmp r14, rax
jb 0x180003bdf
xor ecx, ecx
lea r13d, [rcx + 8]
mov rax, qword [rbp + rcx + 0xa0]
xor rax, qword [rbp + rcx + 0x20]
xor qword [rcx + rbx], rax
add rcx, r13
cmp rcx, 0x80
jl 0x180003c48
jmp 0x180003d2d
shl rdx, 6
lea r9, [rbp - 0x60]
add rdx, r12
lea r10, [rsp + 0x20]
sub r8, rdx
sub r9, rdx
sub r10, rdx
mov r11, r13
mov rcx, qword [rdx]
mov rax, qword [r8 + rdx]
xor rax, rcx
mov qword [rdx + r10], rcx
mov qword [r9 + rdx], rax
add rdx, r13
sub r11, 1
jne 0x180003c86
xor esi, esi
movabs r13, 0x200000000000000
mov r8, rsi
lea rdx, [rbp + 0x20]
lea rcx, [rbp - 0x60]
call fcn.18001b1c8
lea r8, [rsi + 1]
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x20]
call fcn.18001b1c8
mov r8, rsi
lea rdx, [rbp + 0xa0]
shl r8, 0x38
lea rcx, [rsp + 0x20]
call fcn.18001b4e8
mov r8, r14
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0xa0]
call fcn.18001b4e8
movabs rax, 0xb00000000000000
add rsi, 2
add r14, r13
cmp r14, rax
jb 0x180003cad
xor ecx, ecx
lea r13d, [rcx + 8]
mov rax, qword [rsp + rcx + 0x20]
xor rax, qword [rbp + rcx - 0x60]
xor qword [rcx + rbx], rax
add rcx, r13
cmp rcx, 0x40
jl 0x180003d16
inc rdi
movabs r14, 0x100000000000000
cmp rdi, r15
jb 0x180003b80
lea r11, [rsp + 0x220]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x180004eb4
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x180005096
mov qword [rsp + 8], rbx
mov byte [rsp + 0x20], r9b
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xb0
lea rax, [rbp - 0x19]
xor r12d, r12d
lea rsi, [0x180063840]
mov rdi, rdx
sub rsi, rax
mov r13b, r9b
lea rax, [rbp - 0x59]
mov qword [rbp - 0x69], rsi
sub rax, rcx
lea r14d, [r12 + 8]
mov qword [rbp + 0x77], rax
sub rdi, rcx
mov r15, r8
mov rbx, rcx
test r13b, r13b
je 0x180004f1b
xor ecx, ecx
jmp 0x180004f25
mov rcx, qword [rbx + 0xd0]
add rcx, r12
movups xmm0, xmmword [rbx + 0x10]
movups xmm2, xmmword [rbx]
movups xmm1, xmmword [rbx + 0x20]
movaps xmmword [rbp - 0x49], xmm0
movq rax, xmm2
movups xmm0, xmmword [rbx + 0x30]
xor rax, rcx
lea rcx, [rbp - 0x59]
movaps xmmword [rbp - 0x59], xmm2
movaps xmmword [rbp - 0x29], xmm0
movaps xmmword [rbp - 0x39], xmm1
mov qword [rbp - 0x59], rax
call fcn.180004824
movaps xmm0, xmmword [rbp - 0x39]
xor edx, edx
movaps xmm1, xmmword [rbp - 0x29]
movaps xmm4, xmmword [rbp - 0x59]
movaps xmm5, xmmword [rbp - 0x49]
movaps xmmword [rbp + 7], xmm0
movaps xmmword [rbp + 0x17], xmm1
movaps xmmword [rbp - 0x19], xmm4
movaps xmmword [rbp - 9], xmm5
lea rax, [rdi + rdx*8]
mov rcx, qword [rax + rbx]
xor qword [rbp + rdx*8 - 0x59], rcx
inc rdx
cmp rdx, r14
jl 0x180004f7b
mov r14d, 0xc
lea rcx, [rbp - 0x59]
call fcn.180004824
xor edx, edx
lea rax, [rsi + rdx*8]
mov rcx, qword [rbp + rax - 0x19]
xor qword [rbp + rdx*8 - 0x19], rcx
inc rdx
cmp rdx, 8
jl 0x180004fa1
lea rcx, [rbp - 0x19]
call fcn.180004824
xor ecx, ecx
mov rax, qword [rbp + rcx - 0x19]
xor qword [rbp + rcx - 0x59], rax
add rcx, 8
cmp rcx, 0x40
jl 0x180004fc3
add rsi, 0x40
sub r14, 1
jne 0x180004f96
mov r13, qword [rbp + 0x77]
mov r14d, 8
mov rcx, rbx
mov edx, r14d
lea esi, [r14 - 7]
mov rax, qword [rcx + r13]
xor qword [rcx], rax
add rcx, r14
sub rdx, rsi
jne 0x180004ff5
mov r13b, byte [rbp + 0x7f]
mov rcx, rbx
mov rdx, r14
mov rax, qword [rdi + rcx]
xor qword [rcx], rax
add rcx, r14
sub rdx, rsi
jne 0x18000500e
test r13b, r13b
jne 0x180005064
lea rcx, [rbx + 0x40]
mov r11, rdi
sub r11, rcx
xor r10d, r10d
add r11, rbx
mov r9, r14
mov rax, qword [rcx]
mov r8, qword [r11 + rcx]
lea rdx, [r8 + rax]
cmp rdx, rax
jb 0x18000504f
cmp rdx, r8
jb 0x18000504f
xor r8d, r8d
jmp 0x180005052
mov r8, rsi
lea rax, [r10 + rdx]
mov r10, r8
mov qword [rcx], rax
add rcx, r14
sub r9, rsi
jne 0x180005035
add r12, 0x200
add rdi, 0x40
sub r15, rsi
mov rsi, qword [rbp - 0x69]
jne 0x180004f12
mov rbx, qword [rsp + 0xf0]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18000a130
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rbp, qword [rcx + 0x1b0]
lea r15, [rcx + 0xc8]
mov rdi, rcx
shr rbp, 3
mov rcx, qword [rcx + 0x1b8]
mov r14, rdx
mov rsi, r8
mov rdx, rcx
test rcx, rcx
je 0x18000a1f0
lea rax, [rcx + r8]
cmp rax, rbp
jb 0x18000a1f0
mov r8, rbp
mov rdx, r14
sub r8, rcx
add rcx, r15
call fcn.18002bd80
mov rdx, qword [rdi + 0x1b0]
shr rdx, 6
test rdx, rdx
je 0x18000a1b6
mov r8, r15
mov rcx, rdi
sub r8, rdi
mov rax, qword [rcx + r8]
xor qword [rcx], rax
lea rcx, [rcx + 8]
sub rdx, 1
jne 0x18000a1a5
mov rcx, rdi
call fcn.18001a644
mov rcx, qword [rdi + 0x1b8]
mov rax, rcx
sub rax, rbp
add rsi, rax
mov rax, rbp
sub rax, rcx
add r14, rax
lea rax, [rbp*8]
add qword [rdi + 0x1c0], rax
and qword [rdi + 0x1b8], 0
xor edx, edx
cmp rsi, rbp
jb 0x18000a235
mov r9, qword [rdi + 0x1b0]
xor edx, edx
mov rax, rsi
mov r8, rdi
div rbp
mov rcx, r14
mov rbx, rax
mov rdx, rax
imul rbx, rbp
call fcn.18000c584
lea rax, [rbx*8]
sub rsi, rbx
add r14, rbx
add qword [rdi + 0x1c0], rax
mov rdx, qword [rdi + 0x1b8]
lea rcx, [rdx + r15]
mov r8, rsi
mov rdx, r14
call fcn.18002bd80
add qword [rdi + 0x1b8], rsi
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x18000a794
Capabilities:
Encode data using xor
Hash data using sha512

Disassembly:
test r8, r8
je 0x18000aa14
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x48]
sub rsp, 0x120
movzx r14d, r9b
xor r13d, r13d
mov ebx, r14d
movabs rax, 0x1f83d9abfb41bd6b
xor rbx, 1
mov rdi, r8
dec rbx
mov r15, rdx
xor rbx, rax
mov rsi, rcx
mov r12d, 0x200
mov r8d, 0x80
lea rcx, [rbp - 0x60]
mov rdx, r15
call fcn.18002bd80
movups xmm0, xmmword [rsi]
mov rax, qword [rsi + 0x108]
test r14b, r14b
movups xmm1, xmmword [rsi + 0x10]
lea r8, [rsp + 0x20]
mov rcx, r12
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rbp - 0x60]
movups xmm0, xmmword [rsi + 0x20]
cmovne rcx, r13
shr rax, 3
movaps xmmword [rsp + 0x30], xmm1
movups xmm1, xmmword [rsi + 0x30]
shr rcx, 2
add rcx, rax
movaps xmmword [rsp + 0x40], xmm0
movaps xmm0, xmmword [0x180063b40]
movabs rax, 0x510e527fade682d1
xor rcx, rax
movaps xmmword [rsp + 0x50], xmm1
movaps xmm1, xmmword [0x180063b50]
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rbp - 0x78], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rbp - 0x80], rcx
xor ecx, ecx
mov qword [rbp - 0x68], rax
movups xmmword [rsp + 0x60], xmm0
mov qword [rbp - 0x70], rbx
movups xmmword [rsp + 0x70], xmm1
call fcn.180010738
lea r8, [rsp + 0x20]
mov ecx, 1
lea rdx, [rbp - 0x60]
call fcn.180010738
lea r8, [rsp + 0x20]
mov ecx, 2
lea rdx, [rbp - 0x60]
call fcn.180010738
lea r8, [rsp + 0x20]
mov ecx, 3
lea rdx, [rbp - 0x60]
call fcn.180010738
lea r8, [rsp + 0x20]
mov ecx, 4
lea rdx, [rbp - 0x60]
call fcn.180010738
lea r8, [rsp + 0x20]
mov ecx, 5
lea rdx, [rbp - 0x60]
call fcn.180010738
lea r8, [rsp + 0x20]
mov ecx, 6
lea rdx, [rbp - 0x60]
call fcn.180010738
lea r8, [rsp + 0x20]
mov ecx, 7
lea rdx, [rbp - 0x60]
call fcn.180010738
lea r8, [rsp + 0x20]
mov ecx, 8
lea rdx, [rbp - 0x60]
call fcn.180010738
lea r8, [rsp + 0x20]
mov ecx, 9
lea rdx, [rbp - 0x60]
call fcn.180010738
lea r8, [rsp + 0x20]
mov ecx, 0xa
lea rdx, [rbp - 0x60]
call fcn.180010738
lea r8, [rsp + 0x20]
mov ecx, 0xb
lea rdx, [rbp - 0x60]
call fcn.180010738
mov rax, qword [rsp + 0x20]
xor rax, qword [rsp + 0x60]
xor qword [rsi], rax
sub r15, 0xffffffffffffff80
mov rax, qword [rsp + 0x40]
add r12, 0x200
xor rax, qword [rbp - 0x80]
xor qword [rsi + 0x20], rax
mov rax, qword [rsi + 8]
xor rax, qword [rsp + 0x28]
xor rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
mov rax, qword [rsp + 0x48]
xor rax, qword [rbp - 0x78]
xor qword [rsi + 0x28], rax
mov rax, qword [rsi + 0x10]
xor rax, qword [rsp + 0x30]
xor rax, qword [rsp + 0x70]
mov qword [rsi + 0x10], rax
mov rax, qword [rsp + 0x50]
xor rax, qword [rbp - 0x70]
xor qword [rsi + 0x30], rax
mov rax, qword [rsi + 0x18]
xor rax, qword [rsp + 0x38]
xor rax, qword [rsp + 0x78]
mov qword [rsi + 0x18], rax
mov rax, qword [rsp + 0x58]
xor rax, qword [rbp - 0x68]
xor qword [rsi + 0x38], rax
sub rdi, 1
jne 0x18000a7ed
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x18000aa18
Capabilities:
Encode data using xor
Hash data using sha256

Disassembly:
test r8, r8
je 0x18000ac0f
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r13d, r13d
mov al, r9b
neg al
mov r14b, r9b
mov rdi, r8
mov r15, rdx
sbb ebx, ebx
mov rsi, rcx
and ebx, 0xc0f84ca9
mov r12d, 0x100
add ebx, 0x1f83d9ab
mov r8d, 0x40
lea rcx, [rbp - 9]
mov rdx, r15
call fcn.18002bd80
movups xmm0, xmmword [rsi]
mov rax, qword [rsi + 0x98]
lea r8, [rbp - 0x49]
movups xmm1, xmmword [rsi + 0x10]
lea rdx, [rbp - 9]
test r14b, r14b
movaps xmmword [rbp - 0x49], xmm0
mov rcx, r12
movups xmm0, xmmword [0x18006c000]
cmovne rcx, r13
shr rax, 3
movaps xmmword [rbp - 0x39], xmm1
shr rcx, 2
add rcx, rax
mov dword [rbp - 0x11], ebx
mov rax, rcx
mov dword [rbp - 0xd], 0x5be0cd19
xor ecx, 0x510e527f
shr rax, 0x20
xor eax, 0x9b05688c
mov dword [rbp - 0x19], ecx
xor ecx, ecx
mov dword [rbp - 0x15], eax
movups xmmword [rbp - 0x29], xmm0
call fcn.180010b3c
lea r8, [rbp - 0x49]
mov ecx, 1
lea rdx, [rbp - 9]
call fcn.180010b3c
lea r8, [rbp - 0x49]
mov ecx, 2
lea rdx, [rbp - 9]
call fcn.180010b3c
lea r8, [rbp - 0x49]
mov ecx, 3
lea rdx, [rbp - 9]
call fcn.180010b3c
lea r8, [rbp - 0x49]
mov ecx, 4
lea rdx, [rbp - 9]
call fcn.180010b3c
lea r8, [rbp - 0x49]
mov ecx, 5
lea rdx, [rbp - 9]
call fcn.180010b3c
lea r8, [rbp - 0x49]
mov ecx, 6
lea rdx, [rbp - 9]
call fcn.180010b3c
lea r8, [rbp - 0x49]
mov ecx, 7
lea rdx, [rbp - 9]
call fcn.180010b3c
lea r8, [rbp - 0x49]
mov ecx, 8
lea rdx, [rbp - 9]
call fcn.180010b3c
lea r8, [rbp - 0x49]
mov ecx, 9
lea rdx, [rbp - 9]
call fcn.180010b3c
mov eax, dword [rbp - 0x49]
xor eax, dword [rbp - 0x29]
xor dword [rsi], eax
mov eax, dword [rsi + 0x10]
xor eax, dword [rbp - 0x39]
xor eax, dword [rbp - 0x19]
mov dword [rsi + 0x10], eax
mov eax, dword [rbp - 0x45]
xor eax, dword [rbp - 0x25]
xor dword [rsi + 4], eax
mov eax, dword [rsi + 0x14]
xor eax, dword [rbp - 0x35]
xor eax, dword [rbp - 0x15]
mov dword [rsi + 0x14], eax
mov eax, dword [rbp - 0x41]
xor eax, dword [rbp - 0x21]
xor dword [rsi + 8], eax
add r15, 0x40
mov eax, dword [rsi + 0x18]
add r12, 0x100
xor eax, dword [rbp - 0x31]
xor eax, dword [rbp - 0x11]
mov dword [rsi + 0x18], eax
mov eax, dword [rbp - 0x3d]
xor eax, dword [rbp - 0x1d]
xor dword [rsi + 0xc], eax
mov eax, dword [rsi + 0x1c]
xor eax, dword [rbp - 0x2d]
xor eax, dword [rbp - 0xd]
mov dword [rsi + 0x1c], eax
sub rdi, 1
jne 0x18000aa6c
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x18000ac10
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x18000ae7a
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xf8]
sub rsp, 0x1d0
mov r12, r9
mov rdi, r8
mov r13, rdx
mov rbx, rcx
xor esi, esi
mov rax, rsi
lea rcx, [rbp + 0x50]
shr rax, 6
mov r8d, 0x80
lea rdx, [rax*8]
add rdx, r13
call fcn.18002bd80
movups xmm0, xmmword [rbx]
movabs rdx, 0x1bd11bdaa9fc1a22
xor ecx, ecx
movups xmm1, xmmword [rbx + 0x10]
mov qword [rbp - 0x40], rdx
movups xmmword [rsp + 0x40], xmm0
xorps xmm2, xmm2
movups xmm0, xmmword [rbx + 0x20]
movups xmmword [rsp + 0x50], xmm1
movups xmm1, xmmword [rbx + 0x30]
movups xmmword [rsp + 0x60], xmm0
movups xmm0, xmmword [rbx + 0x40]
movups xmmword [rsp + 0x70], xmm1
movups xmm1, xmmword [rbx + 0x50]
movups xmmword [rbp - 0x80], xmm0
movups xmm0, xmmword [rbx + 0x60]
movups xmmword [rbp - 0x70], xmm1
movups xmm1, xmmword [rbx + 0x70]
movups xmmword [rbp - 0x60], xmm0
movups xmm0, xmmword [rbx + 0x190]
movups xmmword [rbp - 0x50], xmm1
movdqu xmmword [rsp + 0x20], xmm0
mov r15, qword [rsp + 0x28]
movq r14, xmm0
add r14, r12
mov rax, r14
mov qword [rsp + 0x20], r14
xor rax, r15
mov qword [rsp + 0x30], rax
xor eax, eax
movdqu xmm1, xmmword [rsp + rax*8 + 0x40]
add ecx, 2
lea rax, [rax + 2]
movdqa xmm0, xmm1
pxor xmm0, xmm2
movdqa xmm2, xmm0
movdqu xmm0, xmmword [rbp + rax*8 + 0x40]
paddq xmm0, xmm1
movdqu xmmword [rbp + rax*8 - 0x40], xmm0
cmp ecx, 0x10
jb 0x18000acf0
movdqu xmm1, xmmword [rsp + 0x20]
lea r8, [rsp + 0x20]
movdqa xmm0, xmm2
lea rcx, [rbp - 0x30]
psrldq xmm0, 8
pxor xmm2, xmm0
movdqu xmm0, xmmword [rbp + 0x38]
movq rax, xmm2
xor rax, rdx
paddq xmm1, xmm0
lea rdx, [rsp + 0x40]
mov qword [rbp - 0x40], rax
movdqu xmmword [rbp + 0x38], xmm1
call fcn.180010f08
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x30]
call fcn.180011658
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x30]
call fcn.180011da8
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x30]
call fcn.180012538
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x30]
call fcn.180012cbc
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x30]
call fcn.180013478
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x30]
call fcn.180013c2c
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x30]
call fcn.1800143cc
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x30]
call fcn.180014b1c
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x30]
call fcn.180015248
movabs rax, 0xbfffffffffffffff
mov qword [rbx + 0x190], r14
and r15, rax
xor ecx, ecx
mov qword [rbx + 0x198], r15
xor eax, eax
movdqu xmm1, xmmword [rbp + rax*8 - 0x30]
add ecx, 2
movdqu xmm0, xmmword [rbp + rax*8 + 0x50]
pxor xmm1, xmm0
movdqu xmmword [rbx + rax*8], xmm1
lea rax, [rax + 2]
cmp ecx, 0x10
jb 0x18000ae28
add rsi, 0x400
sub rdi, 1
jne 0x18000ac4d
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret