joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18004a8c0
Capabilities:
Log keystrokes via input method manager

Disassembly:
push rsi
push rdi
push r13
sub rsp, 0x30
xor eax, eax
mov rsi, r8
mov rdi, rdx
mov qword [rdx], rax
mov dword [rdx + 8], eax
mov r13, rcx
mov dword [rdx + 0x10], eax
test r8, r8
je 0x18004aa1b
test r9b, 0x20
je 0x18004aa1b
lea edx, [rax + 0x20]
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x58], rbp
call qword [sym.imp.IMM32.dll_ImmGetCompositionStringW]
movsxd rbp, eax
test eax, eax
jle 0x18004aa0a
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x20], r15
mov r15, rbp
shr r15, 2
lea rcx, [r15*4]
call fcn.1800a0a4c
mov r9d, ebp
mov edx, 0x20
mov r8, rax
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.IMM32.dll_ImmGetCompositionStringW]
test eax, eax
jle 0x18004a9e7
cmp r15, 1
jbe 0x18004a9e7
mov qword [rsp + 0x60], r12
mov esi, 1
mov rcx, rbx
mov qword [rsp + 0x28], r14
nop dword [rax + rax]
mov edx, dword [rcx]
mov r8d, dword [r13]
lea r12, [rcx + 4]
cmp edx, dword [r12]
mov ecx, dword [rdi + 0x10]
lea ebp, [rdx + r8]
mov eax, edx
mov r14d, ebp
cmovl eax, dword [r12]
add eax, r8d
cmp ebp, eax
cmovl r14d, eax
inc ecx
cmp ecx, dword [rdi + 8]
jle 0x18004a9b6
mov eax, ecx
cdq
sub eax, edx
lea edx, [rcx + 8]
mov rcx, rdi
sar eax, 1
add edx, eax
and edx, 0xfffffff8
call fcn.180007ec0
movsxd rcx, dword [rdi + 0x10]
lea eax, [rcx + 1]
mov dword [rdi + 0x10], eax
mov rax, qword [rdi]
lea rdx, [rax + rcx*8]
test rdx, rdx
je 0x18004a9d2
mov dword [rdx], ebp
mov dword [rdx + 4], r14d
inc rsi
mov rcx, r12
cmp rsi, r15
jb 0x18004a970
mov r14, qword [rsp + 0x28]
mov r12, qword [rsp + 0x60]
mov rcx, rbx
call fcn.1800a09c8
mov r15, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rax, rdi
add rsp, 0x30
pop r13
pop rdi
pop rsi
ret
mov rax, rdi
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r13
pop rdi
pop rsi
ret
mov rax, rdx
add rsp, 0x30
pop r13
pop rdi
pop rsi
ret
Function at 0x180077f80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
push rbx
push r13
push r14
push r15
sub rsp, 0x48
mov rax, qword [rcx]
mov rbx, rdx
mov r15, rcx
mov r14, qword [rax]
movsxd r13, dword [rax + 0x10]
shl r13, 4
add r13, r14
cmp r14, r13
je 0x180078176
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
mov qword [r11 - 0x28], r12
nop
mov eax, dword [r15 + 8]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x20], eax
mov eax, dword [r15 + 0xc]
mov rcx, r14
mov dword [rsp + 0x24], eax
mov eax, dword [r15 + 0x10]
mov dword [rsp + 0x28], eax
mov eax, dword [r15 + 0x14]
mov dword [rsp + 0x2c], eax
call fcn.18004b8b0
movsxd rsi, dword [rsp + 0x38]
test esi, esi
jle 0x18007814f
mov eax, dword [rsp + 0x3c]
test eax, eax
jle 0x18007814f
mov edi, dword [rsp + 0x34]
lea ebp, [rdi + rax]
cmp edi, ebp
jge 0x18007814f
mov r12d, dword [rsp + 0x30]
nop
mov r8, qword [rbx]
mov r9d, esi
mov eax, dword [r8 + 0xc]
imul eax, edi
movsxd rdx, eax
mov eax, dword [rbx + 0x10]
add rdx, qword [r8]
mov dword [rsp + 0x70], eax
mov qword [rbx + 8], rdx
movsxd r10, dword [r8 + 0x10]
mov ecx, r10d
imul ecx, r12d
movsxd rcx, ecx
add rcx, rdx
cmp r10d, 3
jne 0x180078115
cmp byte [rbx + 0x20], 0
je 0x180078073
shr eax, 0x10
lea r8, [rsi + rsi*2]
movzx edx, al
call fcn.1800a7360
jmp 0x180078145
movzx r8d, byte [rsp + 0x72]
movzx r10d, byte [rsp + 0x71]
test esi, 0xffffffe0
je 0x1800780ed
cmp esi, 8
jle 0x1800780ac
nop dword [rax]
test cl, 7
je 0x1800780ac
dec r9d
mov byte [rcx], al
mov byte [rcx + 1], r10b
mov byte [rcx + 2], r8b
add rcx, 3
cmp r9d, 8
jg 0x180078090
cmp r9d, 4
jle 0x1800780ed
lea edx, [r9 - 5]
shr edx, 2
inc edx
mov r11d, edx
neg edx
lea r9d, [r9 + rdx*4]
nop dword [rax]
nop dword [rax + rax]
mov edx, dword [rbx + 0x14]
mov dword [rcx], edx
lea rdx, [rcx + 4]
mov ecx, dword [rbx + 0x18]
mov dword [rdx], ecx
mov ecx, dword [rbx + 0x1c]
mov dword [rdx + 4], ecx
lea rcx, [rdx + 8]
dec r11
jne 0x1800780d0
dec r9d
js 0x180078145
add rcx, 2
nop word [rax + rax]
dec r9d
mov byte [rcx - 2], al
mov byte [rcx - 1], r10b
mov byte [rcx], r8b
lea rcx, [rcx + 3]
jns 0x180078100
jmp 0x180078145
movzx r8d, byte [rsp + 0x72]
mov rdx, r10
movzx r10d, byte [rsp + 0x71]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov byte [rcx], al
mov byte [rcx + 1], r10b
mov byte [rcx + 2], r8b
add rcx, rdx
test r9d, r9d
jg 0x180078130
inc edi
cmp edi, ebp
jl 0x180078020
add r14, 0x10
cmp r14, r13
jne 0x180077fc0
mov r12, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
add rsp, 0x48
pop r15
pop r14
pop r13
pop rbx
ret
Function at 0x180078460
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
push rbp
push r13
push r14
push r15
sub rsp, 0x48
mov rax, qword [rcx]
mov r15, rdx
mov r14, rcx
mov rbp, qword [rax]
movsxd r13, dword [rax + 0x10]
shl r13, 4
add r13, rbp
cmp rbp, r13
je 0x180078579
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
mov qword [r11 - 0x28], r12
nop
mov eax, dword [r14 + 8]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x20], eax
mov eax, dword [r14 + 0xc]
mov rcx, rbp
mov dword [rsp + 0x24], eax
mov eax, dword [r14 + 0x10]
mov dword [rsp + 0x28], eax
mov eax, dword [r14 + 0x14]
mov dword [rsp + 0x2c], eax
call fcn.18004b8b0
movsxd rsi, dword [rsp + 0x38]
test esi, esi
jle 0x180078552
mov eax, dword [rsp + 0x3c]
test eax, eax
jle 0x180078552
mov ebx, dword [rsp + 0x34]
lea edi, [rbx + rax]
cmp ebx, edi
jge 0x180078552
mov r12d, dword [rsp + 0x30]
mov r9, qword [r15]
mov edx, dword [r15 + 0x10]
mov ecx, esi
mov eax, dword [r9 + 0xc]
mov dword [rsp + 0x70], edx
imul eax, ebx
movsxd r8, eax
add r8, qword [r9]
mov qword [r15 + 8], r8
movsxd r10, dword [r9 + 0x10]
mov eax, r10d
imul eax, r12d
cdqe
add rax, r8
cmp r10d, 1
jne 0x180078537
mov r8, rsi
shr edx, 0x18
mov rcx, rax
call fcn.1800a7360
jmp 0x18007854c
movzx r8d, byte [rsp + 0x73]
nop dword [rax]
dec ecx
mov byte [rax], r8b
add rax, r10
test ecx, ecx
jg 0x180078540
inc ebx
cmp ebx, edi
jl 0x1800784f3
add rbp, 0x10
cmp rbp, r13
jne 0x1800784a0
mov r12, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x78]
add rsp, 0x48
pop r15
pop r14
pop r13
pop rbp
ret
Function at 0x180078590
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
push rsi
push r13
push r14
push r15
sub rsp, 0x48
mov rax, qword [rcx]
mov rsi, rdx
mov r15, rcx
mov r14, qword [rax]
movsxd r13, dword [rax + 0x10]
shl r13, 4
add r13, r14
cmp r14, r13
je 0x1800786f9
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rdi
mov qword [r11 - 0x28], r12
nop
mov eax, dword [r15 + 8]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x20], eax
mov eax, dword [r15 + 0xc]
mov rcx, r14
mov dword [rsp + 0x24], eax
mov eax, dword [r15 + 0x10]
mov dword [rsp + 0x28], eax
mov eax, dword [r15 + 0x14]
mov dword [rsp + 0x2c], eax
call fcn.18004b8b0
movsxd rdi, dword [rsp + 0x38]
test edi, edi
jle 0x1800786d2
mov eax, dword [rsp + 0x3c]
test eax, eax
jle 0x1800786d2
mov ebx, dword [rsp + 0x34]
lea ebp, [rbx + rax]
cmp ebx, ebp
jge 0x1800786d2
mov r12d, dword [rsp + 0x30]
nop
mov r8, qword [rsi]
mov eax, dword [r8 + 0xc]
imul eax, ebx
movsxd rdx, eax
add rdx, qword [r8]
mov qword [rsi + 8], rdx
movsxd r10, dword [r8 + 0x10]
mov eax, r10d
imul eax, r12d
cdqe
add rax, rdx
cmp byte [rsi + 0x13], 0xff
jb 0x18007868e
mov edx, dword [rsi + 0x10]
mov ecx, edi
mov dword [rsp + 0x70], edx
cmp r10d, 1
jne 0x180078679
mov r8, rdi
shr edx, 0x18
mov rcx, rax
call fcn.1800a7360
jmp 0x1800786c8
movzx r8d, byte [rsp + 0x73]
nop
dec ecx
mov byte [rax], r8b
add rax, r10
test ecx, ecx
jg 0x180078680
jmp 0x1800786c8
mov ecx, dword [rsi + 0x10]
mov r8d, 0x100
mov edx, edi
mov dword [rsp + 0x70], ecx
movzx r9d, byte [rsp + 0x73]
sub r8d, r9d
nop word [rax + rax]
movzx ecx, byte [rax]
dec edx
imul ecx, r8d
sar ecx, 8
add cl, r9b
mov byte [rax], cl
add rax, r10
test edx, edx
jg 0x1800786b0
inc ebx
cmp ebx, ebp
jl 0x180078630
add r14, 0x10
cmp r14, r13
jne 0x1800785d0
mov r12, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x78]
add rsp, 0x48
pop r15
pop r14
pop r13
pop rsi
ret
Function at 0x18007c7f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, qword [rcx]
mov r11d, dword [rcx + 0x10]
mov esi, edx
movsxd rdx, dword [rbp + 0x10]
mov edi, r8d
mov rbx, rcx
imul r11d, r9d
mov eax, edx
sar r11d, 8
imul eax, esi
sub esi, dword [rcx + 0x14]
movsxd r10, eax
add r10, qword [rcx + 0x20]
cmp r11d, 0xfe
jge 0x18007c933
mov rbp, rdx
nop
mov rax, qword [rbx + 8]
mov ecx, 0x100
dec edi
mov eax, dword [rax + 0x10]
imul eax, esi
inc esi
cdqe
add rax, qword [rbx + 0x28]
mov edx, dword [rax]
mov r9d, edx
and edx, 0xff00ff
shr r9d, 8
and r9d, 0xff00ff
imul edx, r11d
shr edx, 8
and edx, 0xff00ff
imul r9d, r11d
shr r9d, 8
and r9d, 0xff00ff
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [r10]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
shr r8d, 8
and eax, 0xff00ff
and r8d, 0xff00ff
add r9d, eax
add r8d, edx
mov edx, 0x100
mov eax, r9d
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
shl r9d, 8
or ecx, r8d
shr eax, 8
xor edx, ecx
and eax, 0xff00ff
mov ecx, 0x100
sub ecx, eax
and edx, 0xff00ff
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [r10], edx
add r10, rbp
test edi, edi
jg 0x18007c840
jmp 0x18007ca44
mov r8, qword [rcx + 8]
movsxd rcx, dword [r8 + 0x10]
mov eax, ecx
imul eax, esi
movsxd r11, eax
add r11, qword [rbx + 0x28]
cmp edx, ecx
jne 0x18007c96e
cmp dword [r8 + 8], 1
jne 0x18007c96e
cmp dword [rbp + 8], 1
jne 0x18007c96e
imul ecx, edi
mov rdx, r11
movsxd r8, ecx
mov rcx, r10
call fcn.1800a0460
jmp 0x18007ca44
mov rbx, rdx
mov rsi, rcx
nop dword [rax]
nop dword [rax + rax]
mov edx, dword [r11]
mov ecx, 0x100
dec edi
mov r9d, edx
and edx, 0xff00ff
add r11, rsi
shr r9d, 8
and r9d, 0xff00ff
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [r10]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
shr r8d, 8
and eax, 0xff00ff
and r8d, 0xff00ff
add r9d, eax
add r8d, edx
mov edx, 0x100
mov eax, r9d
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
shl r9d, 8
or ecx, r8d
shr eax, 8
xor edx, ecx
and eax, 0xff00ff
mov ecx, 0x100
sub ecx, eax
and edx, 0xff00ff
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [r10], edx
add r10, rbx
test edi, edi
jg 0x18007c980
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x18007ca60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov edi, r8d
mov r8, qword [rcx]
movsxd rdx, dword [r8 + 0x10]
mov rbx, rcx
mov eax, edx
imul eax, esi
sub esi, dword [rcx + 0x14]
movsxd r11, eax
add r11, qword [rcx + 0x20]
cmp dword [rcx + 0x10], 0xfe
jge 0x18007cbab
mov qword [rsp + 0x30], rbp
mov rbp, rdx
mov rax, qword [rbx + 8]
mov ecx, 0x100
mov edx, 0x100
mov eax, dword [rax + 0x10]
dec edi
imul eax, esi
inc esi
cdqe
add rax, qword [rbx + 0x28]
mov r8d, dword [rax]
mov r10d, r8d
and r8d, 0xff00ff
shr r10d, 8
and r10d, 0xff00ff
imul r8d, dword [rbx + 0x10]
imul r10d, dword [rbx + 0x10]
shr r8d, 8
and r8d, 0xff00ff
shr r10d, 8
and r10d, 0xff00ff
mov eax, r10d
shr eax, 0x10
sub ecx, eax
mov eax, dword [r11]
mov r9d, eax
shr eax, 8
and eax, 0xff00ff
and r9d, 0xff00ff
imul eax, ecx
imul r9d, ecx
mov ecx, 0x100
shr eax, 8
shr r9d, 8
and eax, 0xff00ff
and r9d, 0xff00ff
add r10d, eax
add r9d, r8d
mov eax, r10d
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r10d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r9d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r10d
shl r10d, 8
or ecx, r9d
shr eax, 8
xor edx, ecx
and eax, 0xff00ff
mov ecx, 0x100
sub ecx, eax
and edx, 0xff00ff
shl ecx, 8
or ecx, r10d
xor edx, ecx
mov dword [r11], edx
add r11, rbp
test edi, edi
jg 0x18007caa2
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov r9, qword [rcx + 8]
movsxd rcx, dword [r9 + 0x10]
mov eax, ecx
imul eax, esi
movsxd r10, eax
add r10, qword [rbx + 0x28]
cmp edx, ecx
jne 0x18007cbf1
cmp dword [r9 + 8], 1
jne 0x18007cbf1
cmp dword [r8 + 8], 1
jne 0x18007cbf1
imul ecx, edi
mov rdx, r10
movsxd r8, ecx
mov rcx, r11
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.1800a0460
mov rbx, rdx
mov rsi, rcx
nop word [rax + rax]
mov edx, dword [r10]
mov ecx, 0x100
dec edi
mov r9d, edx
and edx, 0xff00ff
add r10, rsi
shr r9d, 8
and r9d, 0xff00ff
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [r11]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
shr r8d, 8
and eax, 0xff00ff
and r8d, 0xff00ff
add r9d, eax
add r8d, edx
mov edx, 0x100
mov eax, r9d
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
shl r9d, 8
or ecx, r8d
shr eax, 8
xor edx, ecx
and eax, 0xff00ff
mov ecx, 0x100
sub ecx, eax
and edx, 0xff00ff
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [r11], edx
add r11, rbx
test edi, edi
jg 0x18007cc00
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x18007cf40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
movsxd rsi, r8d
mov r14d, r9d
mov ebp, edx
mov rdi, rcx
cmp esi, dword [rcx + 0x80]
jle 0x18007cf8e
mov qword [rcx + 0x80], rsi
mov rcx, qword [rcx + 0x78]
call fcn.1800a09c8
lea rcx, [rsi*4]
call fcn.1800a0a4c
mov qword [rdi + 0x78], rax
mov rbx, qword [rdi + 0x78]
mov r9d, esi
mov r8d, ebp
mov rdx, rbx
mov rcx, rdi
call fcn.18006bae0
mov rax, qword [rdi + 0x48]
mov r11d, dword [rdi + 0x58]
imul r11d, r14d
movsxd rcx, dword [rax + 0x10]
sar r11d, 8
mov eax, ecx
imul eax, ebp
movsxd r10, eax
add r10, qword [rdi + 0x70]
cmp r11d, 0xfe
jge 0x18007d0c4
mov rdi, rcx
nop dword [rax]
nop word [rax + rax]
mov r8d, dword [rbx]
mov edx, dword [r10]
mov ecx, 0x100
mov r9d, r8d
and r8d, 0xff00ff
dec esi
shr r9d, 8
lea rbx, [rbx + 4]
imul r8d, r11d
and r9d, 0xff00ff
shr r8d, 8
and r8d, 0xff00ff
imul r9d, r11d
shr r9d, 8
and r9d, 0xff00ff
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, edx
shr edx, 8
and eax, 0xff00ff
and edx, 0xff00ff
imul eax, ecx
imul edx, ecx
mov ecx, 0x100
shr eax, 8
shr edx, 8
and eax, 0xff00ff
and edx, 0xff00ff
add r8d, eax
add r9d, edx
mov edx, 0x100
mov eax, r9d
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
shl r9d, 8
or ecx, r8d
shr eax, 8
xor edx, ecx
and eax, 0xff00ff
mov ecx, 0x100
sub ecx, eax
and edx, 0xff00ff
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [r10], edx
add r10, rdi
test esi, esi
jg 0x18007cfe0
jmp 0x18007d194
mov r11, rcx
nop word [rax + rax]
mov edx, dword [rbx]
mov ecx, 0x100
dec esi
mov r9d, edx
and edx, 0xff00ff
lea rbx, [rbx + 4]
shr r9d, 8
and r9d, 0xff00ff
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [r10]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
shr r8d, 8
and eax, 0xff00ff
and r8d, 0xff00ff
add r9d, eax
add r8d, edx
mov edx, 0x100
mov eax, r9d
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
shl r9d, 8
or ecx, r8d
shr eax, 8
xor edx, ecx
and eax, 0xff00ff
mov ecx, 0x100
sub ecx, eax
and edx, 0xff00ff
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [r10], edx
add r10, r11
test esi, esi
jg 0x18007d0d0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x18007d2d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rax, qword [rcx + 0x38]
mov edi, edx
mov r14d, r9d
movsxd rdx, dword [rax + 0x10]
mov esi, r8d
mov rbp, rcx
mov eax, edx
imul eax, edi
movsxd rbx, eax
add rbx, qword [rcx + 0x40]
cmp r9d, 0xff
jge 0x18007d416
mov qword [rsp + 0x40], r15
mov r15, rdx
nop word [rax + rax]
lea rdx, [rsp + 0x48]
mov r8d, edi
mov rcx, rbp
call fcn.18005c040
mov ecx, 0x100
dec esi
mov edx, dword [rax]
inc edi
mov r9d, edx
and edx, 0xff00ff
shr r9d, 8
and r9d, 0xff00ff
imul edx, r14d
shr edx, 8
and edx, 0xff00ff
imul r9d, r14d
shr r9d, 8
and r9d, 0xff00ff
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [rbx]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
shr r8d, 8
and eax, 0xff00ff
and r8d, 0xff00ff
add r9d, eax
add r8d, edx
mov edx, 0x100
mov eax, r9d
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
shl r9d, 8
or ecx, r8d
shr eax, 8
xor edx, ecx
and eax, 0xff00ff
mov ecx, 0x100
sub ecx, eax
and edx, 0xff00ff
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [rbx], edx
add rbx, r15
test esi, esi
jg 0x18007d320
mov r15, qword [rsp + 0x40]
jmp 0x18007d4f0
mov r14, rdx
nop dword [rax]
lea rdx, [rsp + 0x48]
mov r8d, edi
mov rcx, rbp
call fcn.18005c040
mov ecx, 0x100
dec esi
mov edx, dword [rax]
inc edi
mov r9d, edx
and edx, 0xff00ff
shr r9d, 8
and r9d, 0xff00ff
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [rbx]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
shr r8d, 8
and eax, 0xff00ff
and r8d, 0xff00ff
add r9d, eax
add r8d, edx
mov edx, 0x100
mov eax, r9d
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
shl r9d, 8
or ecx, r8d
shr eax, 8
xor edx, ecx
and eax, 0xff00ff
mov ecx, 0x100
sub ecx, eax
and edx, 0xff00ff
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [rbx], edx
add rbx, r14
test esi, esi
jg 0x18007d420
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x18007d510
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rax, qword [rcx + 0x38]
mov ebp, r8d
mov esi, edx
movsxd r9, dword [rax + 0x10]
mov rdi, rcx
mov eax, r9d
mov r14, r9
imul eax, edx
movsxd rbx, eax
add rbx, qword [rcx + 0x40]
nop dword [rax]
nop word [rax + rax]
lea rdx, [rsp + 0x48]
mov r8d, esi
mov rcx, rdi
call fcn.18005c040
mov ecx, 0x100
dec ebp
mov edx, dword [rax]
inc esi
mov r9d, edx
and edx, 0xff00ff
shr r9d, 8
and r9d, 0xff00ff
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [rbx]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
shr r8d, 8
and eax, 0xff00ff
and r8d, 0xff00ff
add r9d, eax
add r8d, edx
mov edx, 0x100
mov eax, r9d
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
shl r9d, 8
or ecx, r8d
shr eax, 8
xor edx, ecx
and eax, 0xff00ff
mov ecx, 0x100
sub ecx, eax
and edx, 0xff00ff
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [rbx], edx
add rbx, r14
test ebp, ebp
jg 0x18007d550
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x18007d640
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rax, qword [rcx + 0x70]
mov edi, edx
mov r14d, r9d
movsxd rdx, dword [rax + 0x10]
mov esi, r8d
mov rbp, rcx
mov eax, edx
imul eax, edi
movsxd rbx, eax
add rbx, qword [rcx + 0x78]
cmp r9d, 0xff
jge 0x18007d786
mov qword [rsp + 0x40], r15
mov r15, rdx
nop word [rax + rax]
lea rdx, [rsp + 0x48]
mov r8d, edi
mov rcx, rbp
call fcn.18005c0a0
mov ecx, 0x100
dec esi
mov edx, dword [rax]
inc edi
mov r9d, edx
and edx, 0xff00ff
shr r9d, 8
and r9d, 0xff00ff
imul edx, r14d
shr edx, 8
and edx, 0xff00ff
imul r9d, r14d
shr r9d, 8
and r9d, 0xff00ff
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [rbx]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
shr r8d, 8
and eax, 0xff00ff
and r8d, 0xff00ff
add r9d, eax
add r8d, edx
mov edx, 0x100
mov eax, r9d
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
shl r9d, 8
or ecx, r8d
shr eax, 8
xor edx, ecx
and eax, 0xff00ff
mov ecx, 0x100
sub ecx, eax
and edx, 0xff00ff
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [rbx], edx
add rbx, r15
test esi, esi
jg 0x18007d690
mov r15, qword [rsp + 0x40]
jmp 0x18007d860
mov r14, rdx
nop dword [rax]
lea rdx, [rsp + 0x48]
mov r8d, edi
mov rcx, rbp
call fcn.18005c0a0
mov ecx, 0x100
dec esi
mov edx, dword [rax]
inc edi
mov r9d, edx
and edx, 0xff00ff
shr r9d, 8
and r9d, 0xff00ff
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [rbx]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
shr r8d, 8
and eax, 0xff00ff
and r8d, 0xff00ff
add r9d, eax
add r8d, edx
mov edx, 0x100
mov eax, r9d
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
shl r9d, 8
or ecx, r8d
shr eax, 8
xor edx, ecx
and eax, 0xff00ff
mov ecx, 0x100
sub ecx, eax
and edx, 0xff00ff
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [rbx], edx
add rbx, r14
test esi, esi
jg 0x18007d790
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x18007d880
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rax, qword [rcx + 0x70]
mov ebp, r8d
mov esi, edx
movsxd r9, dword [rax + 0x10]
mov rdi, rcx
mov eax, r9d
mov r14, r9
imul eax, edx
movsxd rbx, eax
add rbx, qword [rcx + 0x78]
nop dword [rax]
nop word [rax + rax]
lea rdx, [rsp + 0x48]
mov r8d, esi
mov rcx, rdi
call fcn.18005c0a0
mov ecx, 0x100
dec ebp
mov edx, dword [rax]
inc esi
mov r9d, edx
and edx, 0xff00ff
shr r9d, 8
and r9d, 0xff00ff
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [rbx]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
shr r8d, 8
and eax, 0xff00ff
and r8d, 0xff00ff
add r9d, eax
add r8d, edx
mov edx, 0x100
mov eax, r9d
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
shl r9d, 8
or ecx, r8d
shr eax, 8
xor edx, ecx
and eax, 0xff00ff
mov ecx, 0x100
sub ecx, eax
and edx, 0xff00ff
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [rbx], edx
add rbx, r14
test ebp, ebp
jg 0x18007d8c0
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret