joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180006ab2
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov rax, qword [0x1800a8ea8]
xor rax, rsp
mov qword [rsp + 0x80], rax
cmp edx, 0xffffffff
je 0x180006bde
mov esi, edx
mov rdi, rcx
mov rax, qword [rcx + 0x40]
cmp qword [rax], 0
je 0x180006b0f
mov rax, qword [rdi + 0x58]
mov ecx, dword [rax]
test ecx, ecx
jle 0x180006b0f
dec ecx
mov dword [rax], ecx
mov rax, qword [rdi + 0x40]
mov rcx, qword [rax]
lea rdx, [rcx + 1]
mov qword [rax], rdx
mov byte [rcx], sil
jmp 0x180006c23
cmp qword [rdi + 0x80], 0
je 0x180006be2
mov rax, qword [rdi + 0x18]
lea rcx, [rdi + 0x70]
cmp qword [rax], rcx
jne 0x180006b49
mov ecx, dword [rdi + 0x90]
mov rdx, qword [rdi + 0x88]
mov qword [rax], rdx
mov rax, qword [rdi + 0x38]
mov qword [rax], rdx
sub ecx, edx
mov rax, qword [rdi + 0x50]
mov dword [rax], ecx
mov rcx, qword [rdi + 0x68]
test rcx, rcx
je 0x180006be9
lea r9, [rsp + 0x60]
mov byte [r9 - 1], sil
lea rax, [rsp + 0x80]
lea rdx, [rdi + 0x74]
mov r10, qword [rcx]
lea r8, [rsp + 0x48]
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rax
lea r14, [rsp + 0x60]
mov qword [rsp + 0x28], r14
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea rbx, [rsp + 0x5f]
mov r8, rbx
call qword [r10 + 0x38]
mov ebp, 0xffffffff
cmp eax, 2
jae 0x180006c02
mov r15, qword [rsp + 0x48]
sub r15, r14
je 0x180006bce
mov r9, qword [rdi + 0x80]
mov edx, 1
mov rcx, r14
mov r8, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp r15, rax
jne 0x180006c21
mov byte [rdi + 0x71], 1
cmp qword [rsp + 0x50], rbx
mov eax, 0xffffffff
jmp 0x180006c1c
xor esi, esi
jmp 0x180006c23
mov esi, 0xffffffff
jmp 0x180006c23
mov rdx, qword [rdi + 0x80]
movsx ecx, sil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, 0xffffffff
cmove esi, eax
jmp 0x180006c23
cmp eax, 3
jne 0x180006c21
mov rdx, qword [rdi + 0x80]
movsx ecx, byte [rsp + 0x5f]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, 0xffffffff
cmove esi, eax
mov ebp, esi
mov esi, ebp
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.180080ac0
mov eax, esi
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x180006fe2
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
test r8, r8
jle 0x18000701d
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x68], 0
je 0x180007024
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
xor esi, esi
jmp 0x180007107
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x18000706a
mov rax, qword [rbx + 0x50]
movsxd r15, dword [rax]
test r15, r15
je 0x18000706a
cmp r15, rsi
cmovae r15, rsi
mov rcx, rdi
mov r8, r15
call fcn.1800820e0
add rdi, r15
mov r14, rsi
sub r14, r15
mov rax, qword [rbx + 0x50]
sub dword [rax], r15d
mov rax, qword [rbx + 0x38]
movsxd rcx, r15d
add qword [rax], rcx
jmp 0x18000706d
mov r14, rsi
cmp qword [rbx + 0x80], 0
je 0x180007104
mov rax, qword [rbx + 0x18]
lea rcx, [rbx + 0x70]
cmp qword [rax], rcx
jne 0x1800070a7
mov ecx, dword [rbx + 0x90]
mov rdx, qword [rbx + 0x88]
mov qword [rax], rdx
mov rax, qword [rbx + 0x38]
mov qword [rax], rdx
sub ecx, edx
mov rax, qword [rbx + 0x50]
mov dword [rax], ecx
mov r15, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp r14, 0x1000
jb 0x1800070df
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rdi
call r15
add rdi, rax
sub r14, rax
cmp rax, 0xfff
je 0x1800070ae
jmp 0x180007104
test r14, r14
je 0x180007101
mov r9, qword [rbx + 0x80]
mov edx, 1
mov rcx, rdi
mov r8, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub r14, rax
jmp 0x180007104
xor r14d, r14d
sub rsi, r14
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x180007116
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x68], 0
je 0x18000714c
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rbx + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x180007194
test rsi, rsi
jle 0x180007194
mov rax, qword [rbx + 0x58]
mov r15d, dword [rax]
test r15d, r15d
jle 0x180007194
cmp r15, rsi
cmovae r15, rsi
mov rdx, rdi
mov r8, r15
call fcn.1800820e0
add rdi, r15
mov r14, rsi
sub r14, r15
mov rax, qword [rbx + 0x58]
sub dword [rax], r15d
mov rax, qword [rbx + 0x40]
add qword [rax], r15
jmp 0x180007197
mov r14, rsi
test r14, r14
jle 0x1800071bc
mov r9, qword [rbx + 0x80]
test r9, r9
je 0x1800071bc
mov edx, 1
mov rcx, rdi
mov r8, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub r14, rax
sub rsi, r14
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1800074b2
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rax, qword [0x1800a8ea8]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dil, 1
cmp qword [rcx + 0x68], 0
je 0x180007569
mov rsi, rcx
cmp byte [rcx + 0x71], 0
je 0x180007569
mov rax, qword [rsi]
mov rcx, rsi
mov edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x18000755e
mov rcx, qword [rsi + 0x68]
lea r9, [rsp + 0x50]
lea rdx, [rsi + 0x74]
mov rax, qword [rcx]
lea r8, [rsp + 0x28]
mov qword [rsp + 0x20], r8
lea rdi, [rsp + 0x30]
mov r8, rdi
call qword [rax + 0x40]
cmp eax, 3
je 0x180007562
cmp eax, 1
je 0x18000752d
test eax, eax
jne 0x18000755e
mov byte [rsi + 0x71], 0
mov rbx, qword [rsp + 0x28]
sub rbx, rdi
je 0x180007554
mov r9, qword [rsi + 0x80]
mov edx, 1
mov rcx, rdi
mov r8, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x18000755e
cmp byte [rsi + 0x71], 0
sete dil
jmp 0x180007569
xor edi, edi
jmp 0x180007569
mov byte [rsi + 0x71], 0
mov dil, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180080ac0
mov eax, edi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
Function at 0x18000f5ea
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
call fcn.180011592
cmp eax, 0x2f
je 0x18000f630
cmp eax, 0x2a
jne 0x18000f650
mov rcx, rsi
call fcn.180011592
cmp eax, 0x2a
je 0x18000f619
inc eax
cmp eax, 1
ja 0x18000f603
jmp 0x18000f665
mov rcx, rsi
call fcn.180011592
cmp eax, 0x2f
je 0x18000f649
mov rcx, rsi
call fcn.180011636
jmp 0x18000f603
mov edi, 0x4803
mov rcx, rsi
call fcn.180011592
inc eax
cmp eax, 0xf
jae 0x18000f635
bt edi, eax
jae 0x18000f635
mov al, 1
jmp 0x18000f775
cmp byte [0x1800a93e8], 0
je 0x18000f67e
lea r8, [0x1800a4630]
jmp 0x18000f762
cmp byte [0x1800a93b7], 0
je 0x18000f6f8
lea r8, [0x1800a4628]
jmp 0x18000f762
mov rax, qword [0x1800a4620]
movabs r10, 0x5cb4fdf69fe682db
add r10, rax
movabs r11, 0x5cb4fdf69fe682bc
add r11, rax
xor ecx, ecx
movabs rdi, 0x842108421084211
lea rbx, [0x1800a93b8]
lea r8, [0x1800a4630]
lea r9, [0x1800a93e8]
mov rax, rcx
mul rdi
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
mov rdx, rax
shl rdx, 5
sub rax, rdx
add rax, r11
mov al, byte [rcx + rax]
xor al, byte [r10 + rcx]
mov byte [rcx + rbx], al
inc rcx
cmp rcx, 0x30
jne 0x18000f6c0
jmp 0x18000f75e
mov rax, qword [0x1800a4620]
movabs r10, 0x5cb4fdf69fe6827b
add r10, rax
movabs r11, 0x5cb4fdf69fe68265
add r11, rax
xor ecx, ecx
movabs rdi, 0x2e8ba2e8ba2e8ba3
lea rbx, [0x1800a9391]
lea r8, [0x1800a4628]
lea r9, [0x1800a93b7]
mov rax, rcx
mul rdi
shr rdx, 2
imul rax, rdx, 0xffffffffffffffea
add rax, r11
mov al, byte [rcx + rax]
xor al, byte [r10 + rcx]
mov byte [rcx + rbx], al
inc rcx
cmp rcx, 0x26
jne 0x18000f73a
mov byte [r9], 1
movabs rax, 0x5cb4fdf69fe6711e
add rax, qword [r8]
mov qword [rsi + 0x70], rax
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x1800118d2
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rbx, rdx
mov rsi, rcx
mov dl, byte [rcx + 0x14]
lea r14, [rcx + 0x50]
mov rcx, r14
call fcn.180007676
mov r15, qword [rbx]
mov dil, 1
cmp r15, qword [rbx + 8]
je 0x1800119b2
mov rcx, rsi
call fcn.180011592
mov edx, dword [rsi + 0x14]
cmp dword [r15], edx
jg 0x180011926
cmp edx, dword [r15 + 4]
jg 0x180011926
mov rcx, r14
call fcn.180007676
add r15, 8
jmp 0x1800118f8
cmp byte [0x1800a9e85], 0
jne 0x18001199b
mov rax, qword [0x1800a47d8]
movabs r8, 0xb44080110bbf8536
add r8, rax
movabs r9, 0xb44080110bbf8521
add r9, rax
xor ecx, ecx
movabs r10, 0x8618618618618619
lea r11, [0x1800a9e5f]
mov rax, rcx
mul r10
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
imul rax, rax, 0xffffffffffffffeb
add rax, r9
mov al, byte [rcx + rax]
xor al, byte [r8 + rcx]
mov byte [rcx + r11], al
inc rcx
cmp rcx, 0x26
jne 0x180011963
mov byte [0x1800a9e85], 1
movabs rax, 0xb44080110bbf620c
add rax, qword [0x1800a47e0]
mov qword [rsi + 0x70], rax
xor edi, edi
mov eax, edi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x180017156
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0xc8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x40], 0xfffffffffffffffe
mov rsi, rdx
mov rdi, rcx
add rcx, 0x70
lea r9, [rdi + 0xb8]
mov rdx, qword [rdi + 0x10]
sub rdx, qword [rdi + 8]
shr rdx, 3
xor r8d, r8d
call fcn.180017e52
lea rdx, [rbp + 0x3f]
mov byte [rdx], al
mov rax, qword [rdi + 0x38]
mov rcx, rax
shr rcx, 5
movabs r8, 0x3800000000000000
or r8, rcx
test rax, rax
cmovns r8, rcx
lea rcx, [rdi + 0x20]
shl r8, 2
add r8, qword [rdi + 0x20]
and eax, 0x1f
lea rbx, [rbp + 0x18]
mov qword [rbx], r8
mov qword [rbx + 8], rax
mov qword [rsp + 0x20], rdx
lea rdx, [rbp - 0x18]
mov r9d, 1
mov r8, rbx
call fcn.180016bb4
mov byte [rbx], 1
lea rdx, [rbp + 8]
lea r8, [rbp + 0x18]
mov rcx, rdi
mov r9b, 1
call fcn.180017ea6
mov rdx, qword [rdi + 0x10]
cmp rdx, qword [rdi + 0x18]
je 0x180017221
mov rax, qword [rbp + 0x10]
mov qword [rdx], rax
mov rax, qword [rdi + 0x10]
add rax, 8
mov qword [rdi + 0x10], rax
jmp 0x180017232
lea rcx, [rdi + 8]
lea r8, [rbp + 0x10]
call fcn.18001814e
mov rax, qword [rdi + 0x10]
cmp rsi, 0xffffffffffffffff
je 0x180017260
mov rax, qword [rax - 8]
test rax, rax
je 0x180017260
movsx rax, byte [rax]
mov ecx, 1
cmp rax, 2
ja 0x18001725b
lea rcx, [0x180086140]
mov rcx, qword [rcx + rax*8]
cmp rcx, rsi
jb 0x18001726e
mov al, 1
add rsp, 0xc8
pop rbx
pop rdi
pop rsi
pop rbp
ret
lea rcx, [rbp - 0x18]
mov rdx, rsi
call fcn.18000680a
cmp byte [0x1800a9fc8], 0
jne 0x1800172e3
mov rax, qword [0x1800a4940]
movabs r8, 0x359f0a1a78cdaa26
add r8, rax
movabs r9, 0x359f0a1a78cdaa10
add r9, rax
xor ecx, ecx
movabs r10, 0x2e8ba2e8ba2e8ba3
lea r11, [0x1800a9fb0]
mov rax, rcx
mul r10
shr rdx, 2
imul rax, rdx, 0xffffffffffffffea
add rax, r9
mov al, byte [rcx + rax]
xor al, byte [r8 + rcx]
mov byte [rcx + r11], al
inc rcx
cmp rcx, 0x18
jne 0x1800172b7
mov byte [0x1800a9fc8], 1
movabs rsi, 0x359f0a1a78cd83e5
mov rdx, qword [0x1800a4948]
add rdx, rsi
lea rcx, [rbp + 0x18]
lea r8, [rbp - 0x18]
call fcn.1800090d4
lea rcx, [rbp - 0x50]
lea r8, [rbp + 0x18]
mov edx, 0x198
call fcn.180017a20
add rsi, qword [0x1800a4950]
lea rcx, [rbp - 0x50]
mov rdx, rsi
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x18001be46
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0xa0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x18], 0xfffffffffffffffe
mov rsi, rdx
mov rdi, rcx
lea rdx, [rbp - 0x28]
mov byte [rdx], 1
call fcn.18001c1c8
mov qword [rbp - 8], rax
mov rdx, qword [rdi + 0x10]
cmp rdx, qword [rdi + 0x18]
je 0x18001be8a
mov qword [rdx], rax
add qword [rdi + 0x10], 8
jmp 0x18001be97
lea rcx, [rdi + 8]
lea r8, [rbp - 8]
call fcn.18001814e
cmp rsi, 0xffffffffffffffff
je 0x18001bec4
mov rax, qword [rdi + 0x10]
mov rax, qword [rax - 8]
movsx rax, byte [rax]
mov ecx, 1
cmp rax, 2
ja 0x18001bebf
lea rcx, [0x180086140]
mov rcx, qword [rcx + rax*8]
cmp rcx, rsi
jb 0x18001bed1
mov al, 1
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret
lea rcx, [rbp - 0x28]
mov rdx, rsi
call fcn.18000680a
cmp byte [0x1800a9fc8], 0
jne 0x18001bf46
mov rax, qword [0x1800a4ad0]
movabs r8, 0x15be0a7ad60964f2
add r8, rax
movabs r9, 0x15be0a7ad60964dc
add r9, rax
xor ecx, ecx
movabs r10, 0x2e8ba2e8ba2e8ba3
lea r11, [0x1800a9fb0]
mov rax, rcx
mul r10
shr rdx, 2
imul rax, rdx, 0xffffffffffffffea
add rax, r9
mov al, byte [rcx + rax]
xor al, byte [r8 + rcx]
mov byte [rcx + r11], al
inc rcx
cmp rcx, 0x18
jne 0x18001bf1a
mov byte [0x1800a9fc8], 1
movabs rsi, 0x15be0a7ad6093eb1
mov rdx, qword [0x1800a4ad8]
add rdx, rsi
lea rcx, [rbp - 8]
lea r8, [rbp - 0x28]
call fcn.1800090d4
lea rcx, [rbp - 0x60]
lea r8, [rbp - 8]
mov edx, 0x198
call fcn.180017a20
add rsi, qword [0x1800a4ae0]
lea rcx, [rbp - 0x60]
mov rdx, rsi
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x18001dc5e
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
sub rsp, 0x88
lea rbp, [rsp + 0x80]
mov qword [rbp], 0xfffffffffffffffe
mov rax, qword [rcx]
cmp rax, qword [rdx]
jne 0x18001dcb5
movzx eax, byte [rax]
cmp eax, 2
je 0x18001dc96
cmp eax, 1
jne 0x18001dca0
mov rax, qword [rcx + 8]
cmp rax, qword [rdx + 8]
jmp 0x18001dca8
mov rax, qword [rcx + 0x10]
cmp rax, qword [rdx + 0x10]
jmp 0x18001dca8
mov rax, qword [rcx + 0x18]
cmp rax, qword [rdx + 0x18]
sete al
add rsp, 0x88
pop rsi
pop rbp
ret
cmp byte [0x1800aa20d], 0
jne 0x18001dd2a
mov rax, qword [0x1800a4b60]
movabs r8, 0xee4c5207c92c56df
add r8, rax
movabs r9, 0xee4c5207c92c56c6
add r9, rax
xor ecx, ecx
movabs r10, 0x47ae147ae147ae15
lea r11, [0x1800aa1dc]
mov rax, rcx
mul r10
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
imul rax, rax, 0xffffffffffffffe7
add rax, r9
mov al, byte [rcx + rax]
xor al, byte [r8 + rcx]
mov byte [rcx + r11], al
inc rcx
cmp rcx, 0x31
jne 0x18001dcf2
mov byte [0x1800aa20d], 1
lea rdx, [0x1800aa1dc]
lea rsi, [rbp - 0x20]
mov rcx, rsi
call fcn.18000243e
lea rcx, [rbp - 0x58]
mov edx, 0xd4
mov r8, rsi
call fcn.180018810
movabs rdx, 0xee4c5207c92c27c7
add rdx, qword [0x1800a4b70]
lea rcx, [rbp - 0x58]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x18001dd9a
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
cmp byte [rcx], 1
jne 0x18001de74
mov rdi, r9
mov rsi, rdx
lea rdx, [rbp - 0x20]
mov rcx, rbx
call fcn.18001dabc
mov qword [rbp], rbx
xorps xmm0, xmm0
movups xmmword [rbp + 8], xmm0
movabs rax, 0x8000000000000000
mov qword [rbp + 0x18], rax
movzx eax, byte [rbx]
cmp eax, 2
je 0x18001de06
cmp eax, 1
jne 0x18001de14
mov rax, qword [rbx + 8]
mov rax, qword [rax]
mov qword [rbp + 8], rax
jmp 0x18001de1c
mov rax, qword [rbx + 8]
mov rax, qword [rax + 8]
mov qword [rbp + 0x10], rax
jmp 0x18001de1c
mov qword [rbp + 0x18], 1
lea rcx, [rbp - 0x20]
mov rdx, rbp
call fcn.18001dc5e
test al, al
je 0x18001de51
xorps xmm0, xmm0
movups xmmword [rsi + 0x10], xmm0
movups xmmword [rsi], xmm0
mov r8, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 0x10
jb 0x18001de44
mov rdi, qword [rdi]
mov rcx, rsi
mov rdx, rdi
call fcn.180009cea
jmp 0x18001de65
lea rcx, [rbp - 0x20]
call fcn.18001db28
mov rcx, rax
mov rdx, rsi
call fcn.18001df98
mov rax, rsi
add rsp, 0xa8
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov rcx, rbx
call fcn.180009128
mov rcx, rbp
mov rdx, rax
call fcn.18000243e
cmp byte [0x1800aa1db], 0
jne 0x18001ded6
mov rdx, qword [0x1800a4b80]
movabs rax, 0x4f34d86994d3c67b
add rax, rdx
movabs rcx, 0x4f34d86994d3c694
add rcx, rdx
xor edx, edx
lea r8, [0x1800aa1c2]
mov r9b, byte [rax + rdx]
xor r9b, byte [rcx + rdx]
mov byte [rdx + r8], r9b
inc rdx
cmp rdx, 0x19
jne 0x18001deba
mov byte [0x1800aa1db], 1
movabs rsi, 0x4f34d86994d397c5
mov rdx, qword [0x1800a4b88]
add rdx, rsi
lea rcx, [rbp - 0x20]
mov r8, rbp
call fcn.1800090d4
lea rcx, [rbp - 0x58]
lea r8, [rbp - 0x20]
mov edx, 0x132
call fcn.180008d68
add rsi, qword [0x1800a4b90]
lea rcx, [rbp - 0x58]
mov rdx, rsi
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x18001dff2
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x20], 0xfffffffffffffffe
cmp byte [rcx], 3
jne 0x18001e046
mov rax, qword [rcx + 8]
cmp rax, rdx
je 0x18001e03b
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0x10
jb 0x18001e027
mov rax, qword [rax]
mov rcx, rdx
mov rdx, rax
add rsp, 0xa8
pop rsi
pop rbp
jmp 0x18001e180
nop
add rsp, 0xa8
pop rsi
pop rbp
ret
call fcn.180009128
lea rcx, [rbp - 0x20]
mov rdx, rax
call fcn.18000243e
cmp byte [0x1800aa22b], 0
jne 0x18001e0c7
mov rax, qword [0x1800a4ba0]
movabs r8, 0xeab365a4820eff09
add r8, rax
movabs r9, 0xeab365a4820efef5
add r9, rax
xor ecx, ecx
movabs r10, 0xcccccccccccccccd
lea r11, [0x1800aa20e]
mov rax, rcx
mul r10
shr rdx, 2
and rdx, 0xfffffffffffffffc
lea rax, [rdx + rdx*4]
mov rdx, r9
sub rdx, rax
mov al, byte [rdx + rcx]
xor al, byte [r8 + rcx]
mov byte [rcx + r11], al
inc rcx
cmp rcx, 0x1d
jne 0x18001e094
mov byte [0x1800aa22b], 1
movabs rsi, 0xeab365a4820ecf97
mov rdx, qword [0x1800a4ba8]
add rdx, rsi
mov rcx, rbp
lea r8, [rbp - 0x20]
call fcn.1800090d4
lea rcx, [rbp - 0x58]
mov r8, rbp
mov edx, 0x12e
call fcn.180008d68
add rsi, qword [0x1800a4bb0]
lea rcx, [rbp - 0x58]
mov rdx, rsi
call sub.VCRUNTIME140.dll__CxxThrowException
int3
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, r8
mov r9, rdx
mov rdi, rcx
mov rax, qword [rcx + 0x18]
cmp rax, r8
jae 0x18001e1ab
mov rcx, rdi
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.18001e1d8
mov rbx, rdi
cmp rax, 0x10
jb 0x18001e1b7
mov rbx, qword [rdi]
mov qword [rdi + 0x10], rsi
mov rcx, rbx
mov rdx, r9
mov r8, rsi
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rsi], 0
mov rax, rdi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x18001e27f
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x20], 0xfffffffffffffffe
cmp byte [rcx], 4
jne 0x18001e2ac
mov al, byte [rcx + 8]
mov byte [rdx], al
add rsp, 0xa8
pop rsi
pop rbp
ret
call fcn.180009128
lea rcx, [rbp - 0x20]
mov rdx, rax
call fcn.18000243e
cmp byte [0x1800aa24a], 0
jne 0x18001e332
mov rax, qword [0x1800a4bc0]
movabs r8, 0x637383b3033384ab
add r8, rax
movabs r9, 0x637383b30333848e
add r9, rax
xor ecx, ecx
movabs r10, 0x1a7b9611a7b9611b
lea r11, [0x1800aa22c]
mov rax, rcx
mul r10
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
imul rax, rax, 0xffffffffffffffe3
add rax, r9
mov al, byte [rcx + rax]
xor al, byte [r8 + rcx]
mov byte [rcx + r11], al
inc rcx
cmp rcx, 0x1e
jne 0x18001e2fa
mov byte [0x1800aa24a], 1
movabs rsi, 0x637383b3033354e3
mov rdx, qword [0x1800a4bc8]
add rdx, rsi
mov rcx, rbp
lea r8, [rbp - 0x20]
call fcn.1800090d4
lea rcx, [rbp - 0x58]
mov r8, rbp
mov edx, 0x12e
call fcn.180008d68
add rsi, qword [0x1800a4bd0]
lea rcx, [rbp - 0x58]
mov rdx, rsi
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x18001e3ea
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x20], 0xfffffffffffffffe
movzx eax, byte [rcx]
add eax, 0xfffffffc
cmp eax, 3
ja case.default.0x18001e41c
lea r8, [0x180087e8c]
movsxd rax, dword [r8 + rax*4]
add rax, r8
jmp rax
cmp byte [rcx + 8], 0
jne 0x18001e45f
xorps xmm0, xmm0
jmp 0x18001e467
mov rax, qword [rcx + 8]
test rax, rax
js 0x18001e448
cvtsi2ss xmm0, rax
jmp 0x18001e467
cvtsd2ss xmm0, qword [rcx + 8]
jmp 0x18001e467
cvtsi2ss xmm0, qword [rcx + 8]
jmp 0x18001e467
mov rcx, rax
shr rcx, 1
and eax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
jmp 0x18001e467
movss xmm0, dword [0x1800861c0]
movss dword [rdx], xmm0
add rsp, 0xa8
pop rsi
pop rbp
ret
call fcn.180009128
lea rcx, [rbp - 0x20]
mov rdx, rax
call fcn.18000243e
cmp byte [0x1800aa268], 0
jne 0x18001e4d5
mov rdx, qword [0x1800a4be0]
movabs rax, 0x9e37b5e6258f3060
add rax, rdx
movabs rcx, 0x9e37b5e6258f307d
add rcx, rdx
xor edx, edx
lea r8, [0x1800aa24b]
mov r9b, byte [rax + rdx]
xor r9b, byte [rcx + rdx]
mov byte [rdx + r8], r9b
inc rdx
cmp rdx, 0x1d
jne 0x18001e4b9
mov byte [0x1800aa268], 1
movabs rsi, 0x9e37b5e6258f0060
mov rdx, qword [0x1800a4be8]
add rdx, rsi
mov rcx, rbp
lea r8, [rbp - 0x20]
call fcn.1800090d4
lea rcx, [rbp - 0x58]
mov r8, rbp
mov edx, 0x12e
call fcn.180008d68
add rsi, qword [0x1800a4bf0]
lea rcx, [rbp - 0x58]
mov rdx, rsi
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x18001e6b8
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
sub rsp, 0x88
lea rbp, [rsp + 0x80]
mov qword [rbp], 0xfffffffffffffffe
mov rax, qword [rcx]
cmp rax, qword [rdx]
jne 0x18001e70f
movzx eax, byte [rax]
cmp eax, 2
je 0x18001e6f0
cmp eax, 1
jne 0x18001e6fa
mov rax, qword [rcx + 8]
cmp rax, qword [rdx + 8]
jmp 0x18001e702
mov rax, qword [rcx + 0x10]
cmp rax, qword [rdx + 0x10]
jmp 0x18001e702
mov rax, qword [rcx + 0x18]
cmp rax, qword [rdx + 0x18]
sete al
add rsp, 0x88
pop rsi
pop rbp
ret
cmp byte [0x1800aa20d], 0
jne 0x18001e784
mov rax, qword [0x1800a4c00]
movabs r8, 0x7c0626d7a7341583
add r8, rax
movabs r9, 0x7c0626d7a734156a
add r9, rax
xor ecx, ecx
movabs r10, 0x47ae147ae147ae15
lea r11, [0x1800aa1dc]
mov rax, rcx
mul r10
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
imul rax, rax, 0xffffffffffffffe7
add rax, r9
mov al, byte [rcx + rax]
xor al, byte [r8 + rcx]
mov byte [rcx + r11], al
inc rcx
cmp rcx, 0x31
jne 0x18001e74c
mov byte [0x1800aa20d], 1
lea rdx, [0x1800aa1dc]
lea rsi, [rbp - 0x20]
mov rcx, rsi
call fcn.18000243e
lea rcx, [rbp - 0x58]
mov edx, 0xd4
mov r8, rsi
call fcn.180018810
movabs rdx, 0x7c0626d7a733e66b
add rdx, qword [0x1800a4c10]
lea rcx, [rbp - 0x58]
call sub.VCRUNTIME140.dll__CxxThrowException
int3