joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6a9eaa30
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, 1
call qword [sym.imp.KERNEL32.dll_CreateEventA]
test rax, rax
mov qword [0x6ab11ef0], rax
je 0x6a9eaa65
lea rcx, [0x6ab11f00]
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov ecx, 2
call qword [fcn.6a9ec670]
mov r8d, 0x3d
mov edx, 1
lea rcx, str.runtime:_failed_to_create_runtime_initialization_wait_event._n
mov r9, rax
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
nop

Function at 0x6a9eb230
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x6ab12504]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x6a9eb3b8
mov rax, qword [0x6ab12508]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x6a9eb27c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x6a9eb305
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x6a9eb260
mov rcx, rbx
call fcn.6a9ebed0
test rax, rax
mov r12, rax
je 0x6a9eb3ed
mov rax, qword [0x6ab12508]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call fcn.6a9ec000
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x6ab12508]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x6a9eb3d0
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x6a9eb2fe
sub eax, 0x40
and eax, 0xffffffbf
jne 0x6a9eb360
add dword [0x6ab12504], 1
cmp edi, 8
jae 0x6a9eb333
test dil, 4
jne 0x6a9eb3a4
test edi, edi
je 0x6a9eb328
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x6a9eb3bf
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x6a9eb328
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x6a9eb34c
jmp 0x6a9eb328
add rsi, qword [0x6ab12508]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x6a9eb2fe
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.6a9ec6b0
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x6a9eb328
xor esi, esi
jmp 0x6a9eb287
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x6a9eb328
mov rax, qword [0x6ab12508]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call fcn.6a9ec6b0
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.6a9ec6b0
nop
nop dword [rax]
Function at 0x6a9ebb40
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x6ab127e0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x6ab127c0]
test rbx, rbx
je 0x6a9ebb94
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x6a9ebb8b
test rsi, rsi
je 0x6a9ebb8b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x6a9ebb70
lea rcx, [0x6ab127e0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x6a9ebed0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6aac28d0]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x6a9ebf3d
mov rcx, r8
call fcn.6a9ebdb0
test eax, eax
je 0x6a9ebf3d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6a9ebf3d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6a9ebf34
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6a9ebf3f
add rax, 0x28
cmp rax, r9
jne 0x6a9ebf20
xor eax, eax
add rsp, 0x28
ret

Function at 0x6a9ec6b0
Capabilities:
Write file on windows

Disassembly:
lea rcx, [0x6a9413a0]
jmp 0x6a941380
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.6a9ec670
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.6a9ec670
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
jmp 0x6a941390
Function at 0x180001050
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x80
mov r14, rcx
mov dword [rbp - 0x50], 0x67766676
lea rcx, [rbp - 0x50]
mov dword [rbp - 0x4c], 0x2a35705f
mov rdi, r8
mov dword [rbp - 0x48], 0x716f6626
mov rsi, rdx
mov byte [rbp - 0x44], 1
call fcn.1800011a0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, [rbp - 0x50]
mov dword [rbp - 0x50], 0x5a69734e
mov rbx, rax
mov dword [rbp - 0x4c], 0x6056696e
mov dword [rbp - 0x48], 0x6964676a
mov byte [rbp - 0x44], 1
call fcn.1800011a0
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ecx, ecx
lea r8, [0x180002330]
mov qword [rsp + 0x28], rcx
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], ecx
call rax
movdqa xmm0, xmmword [0x1800040a0]
lea rcx, [rbp - 0x38]
movdqa xmm1, xmmword [0x1800040d0]
movdqu xmmword [rbp - 0x38], xmm0
mov dword [rbp - 8], 0x56f6e5c
movdqa xmm0, xmmword [str.pqbjqtOwueefitahatk_esuwti0ms_pchhfdyb_YIOmp__xEdYuvTcmb_N__Pcrfgou_Xzvqafu]
movdqu xmmword [rbp - 0x18], xmm0
movdqu xmmword [rbp - 0x28], xmm1
call fcn.180001490
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x180001171
movdqa xmm0, xmmword [0x180004090]
lea rcx, [rbp - 0x50]
movdqu xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x40], 0x171
call fcn.180001f40
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180001171
mov r8, rdi
mov rdx, rsi
mov rcx, r14
call rax
xor eax, eax
jmp 0x180001176
mov eax, 1
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x141031058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1410311df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141031089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14103106f
add dl, dl
jne 0x141031096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1410310f6
xor eax, eax
add dl, dl
jne 0x1410310a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1410311ad
add dl, dl
jne 0x1410310b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1410310c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1410310d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1410310dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1410310ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14103107e
mov eax, 1
add dl, dl
jne 0x141031106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141031113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1410310fb
sub eax, ebx
mov ebx, 1
jne 0x14103114c
mov ecx, 1
add dl, dl
jne 0x14103112e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14103113b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141031123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14103107e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141031168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141031175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14103115d
cmp eax, 0x7d00
jae 0x14103119b
cmp eax, 0x500
jb 0x141031196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14103107e
cmp eax, 0x7f
ja 0x14103119e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14103107e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1410311d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14103107e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1800257a0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x170
mov rax, qword [0x180110318]
xor rax, rsp
mov qword [rsp + 0x160], rax
imul eax, r8d, 0x222
mov r13d, r8d
mov qword [rsp + 0x38], r9
mov rdi, rdx
mov r12, rcx
mov r15d, r8d
mov dword [rsp + 0x30], eax
mov ebx, dword [rsp + 0x30]
cmp r8d, eax
ja 0x1800258af
mov r14d, dword [rsp + 0x30]
movzx ebp, byte [rsp + 0x34]
nop dword [rax]
cmp r15d, 0x6610
ja 0x180025966
je 0x180025917
cmp r15d, 0x27
je 0x180025859
cmp r15d, 0x11c
je 0x180025851
cmp r15d, 0xe04
jne 0x180025a09
mov rax, qword [rdi]
lea rcx, [rsp + 0x48]
mov r8, qword [rsp + 0x50]
mov r9d, 0x96
mov rdx, r12
mov qword [rsp + 0x48], rax
call fcn.18003a680
jmp 0x1800258b1
xor r14d, r14d
jmp 0x180025a09
mov rax, qword [rdi]
lea r8, [rsp + 0x58]
movss xmm0, dword [r9]
mov edx, 0xfb
movss dword [rsp + 0x40], xmm0
mov rcx, qword [rax + 8]
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0x40]
call fcn.180060140
mov qword [rsp + 0x50], rax
cmp rax, 0
jne 0x180025a04
mov esi, 0xda
nop dword [rax + rax]
mov ecx, esi
sub ecx, 0xda
je 0x1800258dc
cmp ecx, 1
jne 0x180025908
mov eax, ebx
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.180090270
mov rbx, qword [rsp + 0x1c0]
add rsp, 0x170
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rax, qword [rdi]
lea r8, [rsp + 0x48]
mov r9d, 0x8e
mov qword [rsp + 0x20], 0
xor edx, edx
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x48], rcx
xor ecx, ecx
call fcn.18002ad20
mov rbx, rax
inc esi
cmp esi, 0xdc
jb 0x1800258a0
jmp 0x180025a04
xor eax, eax
lea rcx, [rdi + 2]
nop dword [rax]
mov byte [rcx], al
lea rcx, [rcx + 1]
inc eax
cmp eax, 0x100
jb 0x180025920
mov r10d, dword [r9]
xor r8d, r8d
lea r9, [rsp + 0x60]
nop word [rax + rax]
xor edx, edx
lea r9, [r9 + 1]
mov eax, r8d
inc r8d
div r10d
movzx eax, byte [rdx + r12]
mov byte [r9 - 1], al
cmp r8d, 0x100
jb 0x180025940
jmp 0x180025a04
cmp r15d, 0xcb04
je 0x180025985
cmp r15d, 0x12ff8
jne 0x180025a09
mov byte [rdi + 1], 0
jmp 0x180025a09
xor r9d, r9d
nop dword [rax + rax]
mov r8d, 0xe5
cmp r8d, 0xe5
je 0x1800259d0
cmp r8d, 0x9ac1
je 0x1800259bb
cmp r8d, 0x1349d
jne 0x1800259e5
mov eax, r14d
mov byte [rax + rdi + 2], bpl
jmp 0x1800259e5
movzx ebp, byte [r9 + rdi + 2]
mov eax, r14d
movzx ecx, byte [rax + rdi + 2]
mov byte [r9 + rdi + 2], cl
jmp 0x1800259e5
movzx eax, byte [rsp + r9 + 0x60]
movzx edx, byte [r9 + rdi + 2]
add eax, r14d
add edx, eax
movzx r14d, dl
add r8d, 0x99dc
cmp r8d, 0x1cd94
jbe 0x180025996
inc r9d
cmp r9d, 0x100
jb 0x180025990
mov byte [rdi], 0
mov r9, qword [rsp + 0x38]
imul eax, r13d, 0x5b
add r15d, eax
cmp r15d, dword [rsp + 0x30]
jbe 0x180025800
jmp 0x1800258af
Function at 0x180004b00
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x48
test ecx, ecx
jle 0x180004be4
mov qword [rsp + 0x40], rbx
movsxd rbx, ecx
cmp ecx, 0x64
jle 0x180004b74
imul rax, rbx, 0xfffffffffffffff6
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x58], rax
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
xor r9d, r9d
lea rdx, [rsp + 0x58]
mov rbx, rax
xor r8d, r8d
xor eax, eax
mov rcx, rbx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_SetWaitableTimer]
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rcx, [rsp + 0x68]
movaps xmmword [rsp + 0x30], xmm6
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movss xmm6, dword [0x18007fcf4]
call qword [sym.imp.KERNEL32.dll_SwitchToThread]
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x58]
xorps xmm1, xmm1
sub rax, qword [rsp + 0x60]
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [rsp + 0x68]
cvtsi2ss xmm1, rax
divss xmm1, xmm0
mulss xmm1, xmm6
mulss xmm1, xmm6
cvttss2si rax, xmm1
cmp rax, rbx
jl 0x180004b97
movaps xmm6, xmmword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
add rsp, 0x48
ret
Function at 0x18000fae0
Capabilities:
Hash data using sha256

Disassembly:
push rbx
sub rsp, 0xb0
mov rax, qword [0x18008b088]
xor rax, rsp
mov qword [rsp + 0xa0], rax
xor eax, eax
mov dword [rsp + 0x20], 0x6a09e667
mov rbx, rcx
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x50], rax
lea r8, [r8*8]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x24], 0xbb67ae85
mov dword [rsp + 0x28], 0x3c6ef372
mov dword [rsp + 0x2c], 0xa54ff53a
mov dword [rsp + 0x30], 0x510e527f
mov dword [rsp + 0x34], 0x9b05688c
mov dword [rsp + 0x38], 0x1f83d9ab
mov qword [rsp + 0x3c], 0x5be0cd19
call fcn.18000fba0
mov r9b, 1
lea rcx, [rsp + 0x20]
mov r8b, 0x81
mov rdx, rbx
call fcn.18000f880
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.180034ec0
add rsp, 0xb0
pop rbx
ret
Function at 0x180023bb0
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x18
mov rax, qword [0x18008b088]
xor rax, rsp
mov qword [rsp + 8], rax
mov r10, r9
mov r9d, edx
mov r11, rcx
test edx, edx
jne 0x180023be4
xor eax, eax
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.180034ec0
add rsp, 0x18
ret
mov rcx, qword [r8]
mov qword [rsp], rcx
movzx eax, cl
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [rsp + 1]
xor edx, eax
movzx eax, byte [rsp + 2]
imul r8d, edx, 0x1000193
xor r8d, eax
movzx eax, byte [rsp + 3]
imul edx, r8d, 0x1000193
xor edx, eax
movzx eax, byte [rsp + 4]
imul r8d, edx, 0x1000193
xor r8d, eax
movzx eax, byte [rsp + 5]
imul edx, r8d, 0x1000193
xor edx, eax
movzx eax, byte [rsp + 6]
imul r8d, edx, 0x1000193
xor r8d, eax
movzx eax, byte [rsp + 7]
imul edx, r8d, 0x1000193
xor edx, eax
imul r8d, edx, 0x1000193
xor edx, edx
mov eax, r8d
div r9d
mov rax, qword [r11 + rdx*8]
lea rdx, [r11 + rdx*8]
test rax, rax
je 0x180023c84
cmp qword [rax + 8], rcx
je 0x180023c84
mov rdx, rax
mov rax, qword [rax]
test rax, rax
jne 0x180023c73
test r10, r10
je 0x180023c8c
mov dword [r10], r8d
mov rax, rdx
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.180034ec0
add rsp, 0x18
ret

Function at 0x180024240
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x180024376
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov qword [rsp + 0x10], rbp
mov rdi, r8
lea rbp, str._.C
mov rsi, rdx
mov r11, rcx
xor ebx, ebx
nop dword [rax + rax]
movzx r8d, byte [rbx + rsi]
movzx r10d, byte [r11 + 0x40]
movzx eax, r8b
xor al, byte [r11 + r10]
lea r9, [r11 + r10]
mov byte [r9 + 0x20], al
mov ecx, r8d
mov byte [r9 + 0x10], r8b
movzx eax, byte [r11 + 0x41]
xor rcx, rax
movzx eax, byte [r9 + 0x30]
movzx edx, byte [rcx + rbp]
xor edx, eax
lea eax, [r10 + 1]
and eax, 0xf
mov byte [r9 + 0x30], dl
mov byte [r11 + 0x41], dl
mov byte [r11 + 0x40], al
test al, al
jne 0x18002435a
xor dl, dl
xor r8b, r8b
nop dword [rax]
nop dword [rax + rax]
lea rax, [r11 + 1]
mov r9d, 8
nop word [rax + rax]
movzx ecx, dl
lea rax, [rax + 6]
movzx edx, byte [rcx + rbp]
movzx ecx, byte [rax - 7]
xor edx, ecx
movzx ecx, dl
mov byte [rax - 7], dl
movzx edx, byte [rcx + rbp]
movzx ecx, byte [rax - 6]
xor edx, ecx
movzx ecx, dl
mov byte [rax - 6], dl
movzx edx, byte [rcx + rbp]
movzx ecx, byte [rax - 5]
xor edx, ecx
movzx ecx, dl
mov byte [rax - 5], dl
movzx edx, byte [rcx + rbp]
movzx ecx, byte [rax - 4]
xor edx, ecx
movzx ecx, dl
mov byte [rax - 4], dl
movzx edx, byte [rcx + rbp]
movzx ecx, byte [rax - 3]
xor edx, ecx
movzx ecx, dl
mov byte [rax - 3], dl
movzx edx, byte [rcx + rbp]
movzx ecx, byte [rax - 2]
xor edx, ecx
mov byte [rax - 2], dl
sub r9, 1
jne 0x1800242e0
add dl, r8b
inc r8b
cmp r8b, 0x12
jb 0x1800242d0
inc rbx
cmp rbx, rdi
jb 0x180024270
mov rbp, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
pop rdi
ret
Function at 0x180024380
Capabilities:
Encode data using xor

Disassembly:
movzx r9d, byte [rcx + 0x40]
lea r11, str._.C
lea r8, [rcx + r9]
movzx eax, dl
mov byte [r8 + 0x10], dl
mov r10, rcx
xor al, byte [r8]
mov byte [r8 + 0x20], al
movzx eax, byte [rcx + 0x41]
movzx edx, dl
xor rdx, rax
movzx eax, byte [r8 + 0x30]
movzx ecx, byte [rdx + r11]
xor ecx, eax
lea eax, [r9 + 1]
and eax, 0xf
mov byte [r8 + 0x30], cl
mov byte [r10 + 0x41], cl
mov byte [r10 + 0x40], al
test al, al
jne 0x180024470
xor dl, dl
xor r8b, r8b
nop word [rax + rax]
lea rax, [r10 + 1]
mov r9d, 8
nop word [rax + rax]
movzx ecx, dl
lea rax, [rax + 6]
movzx edx, byte [rcx + r11]
movzx ecx, byte [rax - 7]
xor edx, ecx
movzx ecx, dl
mov byte [rax - 7], dl
movzx edx, byte [rcx + r11]
movzx ecx, byte [rax - 6]
xor edx, ecx
movzx ecx, dl
mov byte [rax - 6], dl
movzx edx, byte [rcx + r11]
movzx ecx, byte [rax - 5]
xor edx, ecx
movzx ecx, dl
mov byte [rax - 5], dl
movzx edx, byte [rcx + r11]
movzx ecx, byte [rax - 4]
xor edx, ecx
movzx ecx, dl
mov byte [rax - 4], dl
movzx edx, byte [rcx + r11]
movzx ecx, byte [rax - 3]
xor edx, ecx
movzx ecx, dl
mov byte [rax - 3], dl
movzx edx, byte [rcx + r11]
movzx ecx, byte [rax - 2]
xor edx, ecx
mov byte [rax - 2], dl
sub r9, 1
jne 0x1800243f0
add dl, r8b
inc r8b
cmp r8b, 0x12
jb 0x1800243e0
ret
Function at 0x18002fd50
Capabilities:
Encode data using xor

Disassembly:
push rsi
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x18008b088]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov r15, rcx
xor esi, esi
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.180042180
cmp dword [r15 + 0x64], 0xe83d19
mov r14, rax
jge 0x18002fd9e
cmp qword [r15 + 0x68], 0x400
jae 0x18002fd9e
xor eax, eax
jmp 0x18002fffd
mov edx, 0x30
mov qword [rsp + 0xb8], rbp
lea ecx, [rdx - 0x2f]
call fcn.180040f38
mov rbp, rax
test rax, rax
jne 0x18002fdc3
lea esi, [rax + 2]
jmp 0x18002ffeb
lea rdx, [0x1800671e0]
lea rcx, [rsp + 0x20]
call qword [0x18008d018]
test eax, eax
je 0x18002fde7
mov ecx, eax
call fcn.180023a10
mov esi, eax
jmp 0x18002ffeb
mov qword [rsp + 0xb0], rbx
mov ebx, esi
mov qword [rsp + 0xc0], rdi
mov rdi, rsi
nop dword [rax]
mov rax, qword [rsp + 0x20]
lea ecx, [rbx + 0x2b48]
mov r8d, ebx
mov rdx, r14
shl r8, 4
add r8, rbp
call qword [rax + 8]
test eax, eax
jne 0x18002ffd2
movups xmm1, xmmword [0x180067340]
inc ebx
movups xmmword [rsp + rdi + 0x58], xmm1
movups xmmword [rsp + rdi + 0x28], xmm1
add rdi, 0x10
cmp ebx, 3
jb 0x18002fe00
mov r8, qword [rsp + 0x20]
lea rcx, [rsp + 0x48]
mov rdx, r14
movzx eax, byte [r8]
mov byte [rsp + 0x3f], al
call fcn.180024480
test eax, eax
jne 0x18002ffd9
movdqu xmm3, xmmword [rbp]
mov edx, 0x20
xorps xmm2, xmm2
mov r8d, edx
movdqu xmm0, xmmword [rsp + 0x58]
movdqu xmm4, xmmword [rbp + 0x10]
pxor xmm0, xmm3
movdqu xmm1, xmmword [rsp + 0x68]
pxor xmm1, xmm4
por xmm1, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
por xmm1, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 4
por xmm1, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 2
por xmm1, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 1
por xmm1, xmm0
movd r9d, xmm1
cmp rdx, 0x30
jae 0x18002fefb
lea rcx, [rsp + 0x78]
mov r10, rbp
sub r10, rcx
add r10, rdx
nop dword [rax + rax]
lea rax, [rsp + 0x58]
add rax, r8
inc r8
movzx ecx, byte [r10 + rax]
xor cl, byte [rax]
or r9b, cl
cmp r8, 0x30
jb 0x18002fee0
test r9b, r9b
jne 0x18002ff19
cmp dword [r15 + 0x64], 0xe914e1
jge 0x18002ff19
cmp qword [r15 + 0x68], 0x400
jae 0x18002ff19
mov r10b, 1
jmp 0x18002ff1c
xor r10b, r10b
movdqu xmm0, xmmword [rsp + 0x28]
movdqu xmm1, xmmword [rsp + 0x38]
pxor xmm0, xmm3
por xmm0, xmm2
pxor xmm1, xmm4
por xmm1, xmm2
por xmm1, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
por xmm1, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 4
por xmm1, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 2
por xmm1, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 1
por xmm1, xmm0
movd r8d, xmm1
cmp rdx, 0x30
jae 0x18002ffac
lea rcx, [rsp + 0x48]
mov r9, rbp
sub r9, rcx
nop word [rax + rax]
lea rax, [rsp + 0x28]
add rax, rdx
inc rdx
movzx ecx, byte [r9 + rax + 0x20]
xor cl, byte [rax]
or r8b, cl
cmp rdx, 0x30
jb 0x18002ff90
test r8b, r8b
jne 0x18002ffbf
cmp qword [r15 + 0x68], 0x400
jb 0x18002ffbf
mov al, 1
jmp 0x18002ffc1
xor al, al
test r10b, r10b
jne 0x18002ffdb
test al, al
mov ecx, 0x67
cmove esi, ecx
jmp 0x18002ffdb
mov ecx, eax
call fcn.180023a10
mov esi, eax
mov rbx, qword [rsp + 0xb0]
mov rdi, qword [rsp + 0xc0]
mov rcx, rbp
call fcn.180040f40
mov rbp, qword [rsp + 0xb8]
mov eax, esi
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.180034ec0
add rsp, 0x90
pop r15
pop r14
pop rsi
ret
Function at 0x180030a80
Capabilities:
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rsi, qword [rdx]
lea r14, [rcx + 0x60]
mov rbx, rdx
mov qword [rsp + 0x28], r8
mov edx, dword [r14]
lea r8, [rsp + 0x20]
mov rdi, rcx
mov qword [rsp + 0x20], rsi
mov rcx, qword [r14 + 0x10]
xor r9d, r9d
call fcn.180023bb0
test rax, rax
je 0x180030afa
mov rax, qword [rax]
test rax, rax
je 0x180030afa
mov rax, qword [rax + 0x10]
cmp byte [rax + 4], 0
je 0x180030ae8
cmp byte [rbx + 0x1c], 0
je 0x180030ae8
mov edx, 1
mov byte [rax + 4], dl
xor eax, eax
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
xor edx, edx
mov byte [rax + 4], dl
xor eax, eax
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov edx, dword [rdi + 0xb8]
lea r8, [rsp + 0x28]
mov rcx, qword [rdi + 0xc8]
xor r9d, r9d
call fcn.180023bb0
test rax, rax
je 0x180030b1c
mov rax, qword [rax]
mov rdi, qword [rax + 0x10]
lea rcx, [rsp + 0x38]
mov r8, qword [rbx + 8]
mov rdx, qword [rdi + 8]
call qword [0x18008ca10]
cmp eax, 0x1f4
je 0x180030c9d
test eax, eax
je 0x180030b54
mov ecx, eax
call fcn.180023a10
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, 0x18
call fcn.180032c60
test rax, rax
je 0x180030caa
mov edx, dword [rbx + 0x18]
mov rcx, r14
mov r9, qword [rsp + 0x38]
movzx r8d, byte [rbx + 0x1c]
mov dword [rax], edx
lea rdx, [rsp + 0x28]
mov byte [rax + 4], r8b
mov qword [rax + 8], rsi
mov qword [rax + 0x10], r9
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rax
call fcn.180031630
mov r8d, dword [rdi + 0x68]
test r8d, r8d
jne 0x180030bbc
lea edx, [r8 + 1]
lea rcx, [rdi + 0x68]
call fcn.180031d90
mov r8d, dword [rdi + 0x68]
test r8d, r8d
je 0x180030caa
mov r9, qword [rdi + 0x78]
test r8d, r8d
jne 0x180030bd0
mov ebp, dword [rsp + 0x20]
xor ebx, ebx
jmp 0x180030c61
movzx eax, sil
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [rsp + 0x21]
xor ecx, eax
movzx eax, byte [rsp + 0x22]
imul edx, ecx, 0x1000193
xor edx, eax
movzx eax, byte [rsp + 0x23]
imul ecx, edx, 0x1000193
xor ecx, eax
movzx eax, byte [rsp + 0x24]
imul edx, ecx, 0x1000193
xor edx, eax
movzx eax, byte [rsp + 0x25]
imul ecx, edx, 0x1000193
xor ecx, eax
movzx eax, byte [rsp + 0x26]
imul edx, ecx, 0x1000193
xor edx, eax
movzx eax, byte [rsp + 0x27]
imul ecx, edx, 0x1000193
xor edx, edx
xor ecx, eax
imul ebp, ecx, 0x1000193
mov eax, ebp
div r8d
mov rax, qword [r9 + rdx*8]
lea rbx, [r9 + rdx*8]
test rax, rax
je 0x180030c61
nop
cmp qword [rax + 8], rsi
je 0x180030c61
mov rbx, rax
mov rax, qword [rax]
test rax, rax
jne 0x180030c50
cmp qword [rbx], 0
jne 0x180030c9d
mov ecx, 0x18
call fcn.180032c60
test rax, rax
je 0x180030c84
mov qword [rax], 0
mov qword [rax + 8], rsi
mov dword [rax + 0x10], ebp
mov qword [rbx], rax
test rax, rax
je 0x180030caa
inc qword [rdi + 0x70]
lea rcx, [rdi + 0x68]
mov rdx, qword [rdi + 0x70]
call fcn.180031d90
xor eax, eax
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov eax, 2
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret