joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001990
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x140
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov edi, edx
mov qword [rsp + 0x28], rcx
mov rbx, rcx
xor edx, edx
mov ecx, edi
xor esi, esi
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
shl eax, 0x10
mov r8d, pe_nt_image_headers64
mov ecx, eax
lea rdx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetKeyNameTextA]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
test eax, eax
je 0x140001b03
mov qword [rsp + 0x170], rbp
lea rax, [rsp + 0x30]
mov qword [rbx + 0x10], rsi
mov rdi, 0xffffffffffffffff
mov qword [rbx + 0x18], rsi
inc rdi
cmp byte [rax + rdi], sil
jne 0x140001a03
movabs rbp, 0x7fffffffffffffff
cmp rdi, rbp
ja 0x140001ba9
mov qword [rbx + 0x18], 0xf
cmp rdi, 0xf
ja 0x140001a4a
mov r8, rdi
mov qword [rbx + 0x10], rdi
lea rdx, [rsp + 0x30]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rbx], sil
jmp 0x140001add
mov rax, rdi
or rax, 0xf
cmp rax, rbp
jbe 0x140001a7f
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400063f0
test rax, rax
je 0x140001aaa
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140001abe
mov ecx, 0x16
mov rbp, rax
cmp rax, rcx
cmovb rbp, rcx
lea rcx, [rbp + 1]
cmp rcx, 0x1000
jb 0x140001ab1
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001baf
jmp 0x140001a64
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140001abe
call fcn.1400063f0
mov rsi, rax
mov r8, rdi
mov qword [rbx], rsi
lea rdx, [rsp + 0x30]
mov qword [rbx + 0x10], rdi
mov rcx, rsi
mov qword [rbx + 0x18], rbp
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rdi], 0
mov rbp, qword [rsp + 0x170]
mov rax, rbx
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1400063d0
add rsp, 0x140
pop rdi
pop rsi
pop rbx
ret
cmp edi, 5
jne 0x140001b26
mov qword [rbx + 0x10], 2
mov rax, rbx
mov qword [rbx + 0x18], 0xf
mov word [rbx], 0x344d
mov byte [rbx + 2], sil
jmp 0x140001ae8
cmp edi, 6
jne 0x140001b49
mov qword [rbx + 0x10], 2
mov rax, rbx
mov qword [rbx + 0x18], 0xf
mov word [rbx], 0x354d
mov byte [rbx + 2], sil
jmp 0x140001ae8
cmp edi, 4
jne 0x140001b6f
mov qword [rbx + 0x10], 2
mov rax, rbx
mov qword [rbx + 0x18], 0xf
mov word [rbx], 0x334d
mov byte [rbx + 2], sil
jmp 0x140001ae8
mov qword [rbx + 0x10], 7
mov qword [rbx + 0x18], 0xf
mov rax, qword [str.UNKNOWN]
mov dword [rbx], eax
movzx eax, word [0x1400085f4]
mov word [rbx + 4], ax
movzx eax, byte [0x1400085f6]
mov byte [rbx + 6], al
mov rax, rbx
mov byte [rbx + 7], sil
jmp 0x140001ae8
call fcn.1400011a0
int3
call fcn.140001100
int3
Function at 0x140006200
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x270
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edi, edi
xor edx, edx
lea ecx, [rdi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000627e
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000627e
nop
lea rdx, str.ShellShockLive.exe
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14000627a
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140006250
jmp 0x14000627e
mov edi, dword [rsp + 0x28]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400063d0
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret

Function at 0x140006d50
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140006d9a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140006d9a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140006d9a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140006d9a
cmp dword [rcx + 0x84], 0xe
jbe 0x140006d9a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140006d9c
xor al, al
add rsp, 0x28
ret
Function at 0x180001000
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
xorps xmm0, xmm0
movaps xmmword [rsp + 0x10], xmm0
mov dword [rsp + 0x20], 0
cmp dword [0x1800e4bc0], 9
mov eax, dword [0x1800e4bc4]
setg cl
lea edx, [rax + 1]
imul edx, eax
and dl, cl
mov byte [rsp + 0xf], dl
xor eax, eax
lea rcx, [0x180051b08]
movsxd rdx, dword [rax + rcx]
xor dword [rsp + rdx*4 + 0x10], 0x1e27
add rax, 4
cmp rax, 0x10
jne 0x18000103c
mov eax, dword [0x1800e4bc8]
mov ecx, 1
sub ecx, eax
imul ecx, eax
test cl, 1
mov ecx, 0x36d3
mov eax, 0x6995
cmove eax, ecx
cmp dword [0x1800e4bcc], 0xa
cmovl eax, ecx
mov edx, 0x2e15
mov r11b, 1
xor r10d, r10d
mov r8d, 0x601c
lea rcx, [0x180051afc]
mov r9d, 0x69b3
mov esi, dword [rsp + 0x20]
xor esi, r8d
mov edi, dword [rsp + 0x18]
xor edi, eax
mov ebx, dword [rsp + 0x1c]
cmp edx, 0x7793
jg 0x1800010c9
cmp edx, 0x28d2
je 0x180001149
cmp edx, 0x2e15
jne 0x1800010ab
jmp 0x18000110e
cmp edx, 0x7794
je 0x1800010fc
cmp edx, 0x7e1d
jne 0x1800010ab
mov rdx, qword gs:[0x60]
mov qword [rsp + 0x28], rdx
mov edx, ebx
xor edx, 0x52f6
test r10b, r10b
cmove ebx, edx
mov r10b, 1
mov edx, edi
jmp 0x1800010ab
mov rdx, qword gs:[0x60]
mov qword [rsp + 0x28], rdx
mov edx, esi
jmp 0x1800010ab
mov dword [rsp + 0x1c], ebx
mov dl, byte [rsp + 0xf]
test r11b, 1
je 0x180001131
xor ebx, ebx
movsxd rdi, dword [rbx + rcx]
xor byte [rsp + rdi*4 + 0x10], 0x26
add rbx, 4
cmp rbx, 0xc
jne 0x18000111e
test dl, 1
mov edx, 0x603a
cmovne edx, r9d
xor edx, dword [rsp + 0x10]
xor r11d, r11d
jmp 0x18000109a
mov dword [rsp + 0x1c], ebx
mov rax, qword [rsp + 0x28]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x18000115a
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0
cmp dword [0x1800e4bd0], 9
mov eax, dword [0x1800e4bd4]
setg cl
lea edx, [rax + 1]
imul edx, eax
and dl, cl
mov byte [rsp + 0x2f], dl
xor eax, eax
lea rcx, [0x180051b08]
movsxd rdx, dword [rax + rcx]
xor dword [rsp + rdx*4 + 0x30], 0x1e27
add rax, 4
cmp rax, 0x10
jne 0x18000119f
mov eax, 0x2e15
mov sil, 1
xor r13d, r13d
mov r15d, 0x601c
lea rdi, [0x180051afc]
mov r12d, 0x36d3
mov ebp, dword [rsp + 0x40]
xor ebp, r15d
mov r14d, dword [rsp + 0x38]
mov ebx, dword [rsp + 0x3c]
cmp eax, 0x7793
jg 0x1800011fe
cmp eax, 0x28d2
je 0x1800012a4
cmp eax, 0x2e15
jne 0x1800011e3
jmp 0x180001267
cmp eax, 0x7794
je 0x180001252
cmp eax, 0x7e1d
jne 0x1800011e3
call section..text
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x50], rax
mov eax, dword [0x1800e4bd8]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, ebx
xor eax, 0x52f6
test r13b, r13b
cmove ebx, eax
test cl, 1
mov eax, 0x6995
cmove eax, r12d
cmp dword [0x1800e4bdc], 0xa
cmovl eax, r12d
xor eax, r14d
mov r13b, 1
jmp 0x1800011e3
call section..text
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x50], rax
mov eax, ebp
jmp 0x1800011e3
mov dword [rsp + 0x3c], ebx
mov al, byte [rsp + 0x2f]
test sil, 1
je 0x18000128a
xor ecx, ecx
movsxd rdx, dword [rcx + rdi]
xor byte [rsp + rdx*4 + 0x30], 0x26
add rcx, 4
cmp rcx, 0xc
jne 0x180001277
test al, 1
mov eax, 0x603a
mov ecx, 0x69b3
cmovne eax, ecx
xor eax, dword [rsp + 0x30]
xor esi, esi
jmp 0x1800011d3
mov dword [rsp + 0x3c], ebx
mov rax, qword [rsp + 0x50]
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1800012be
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov r13, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0
cmp dword [0x1800e4be0], 9
mov eax, dword [0x1800e4be4]
setg cl
lea edx, [rax + 1]
imul edx, eax
and dl, cl
mov byte [rsp + 0x2f], dl
xor eax, eax
lea rcx, [0x180051b08]
movsxd rdx, dword [rax + rcx]
xor dword [rsp + rdx*4 + 0x30], 0x1e27
add rax, 4
cmp rax, 0x10
jne 0x180001306
mov eax, 0x2e15
mov sil, 1
xor ebp, ebp
mov ecx, 0x601c
lea rbx, [0x180051afc]
mov r14d, dword [rsp + 0x40]
xor r14d, ecx
mov r12d, dword [rsp + 0x38]
mov r15d, dword [rsp + 0x3c]
cmp eax, 0x7793
jg 0x180001362
cmp eax, 0x28d2
je 0x180001453
cmp eax, 0x2e15
jne 0x180001344
jmp 0x180001410
cmp eax, 0x7794
je 0x1800013dc
cmp eax, 0x7e1d
jne 0x180001344
call fcn.180022fd5
mov rcx, rax
mov edx, 0xb192b48
call fcn.18001ea27
mov rdi, rax
call fcn.18000115a
mov rcx, rax
mov edx, 8
mov r8, r13
call rdi
mov qword [rsp + 0x50], rax
mov eax, dword [0x1800e4be8]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, r15d
xor eax, 0x52f6
test bpl, bpl
cmove r15d, eax
test cl, 1
mov eax, 0x6995
mov ecx, 0x36d3
cmove eax, ecx
cmp dword [0x1800e4bec], 0xa
cmovl eax, ecx
xor eax, r12d
mov bpl, 1
jmp 0x180001344
call fcn.180022fd5
mov rcx, rax
mov edx, 0xb192b48
call fcn.18001ea27
mov rdi, rax
call fcn.18000115a
mov rcx, rax
mov edx, 8
mov r8, r13
call rdi
mov qword [rsp + 0x50], rax
mov eax, r14d
jmp 0x180001344
mov dword [rsp + 0x3c], r15d
mov al, byte [rsp + 0x2f]
test sil, 1
je 0x180001434
xor ecx, ecx
movsxd rdx, dword [rcx + rbx]
xor byte [rsp + rdx*4 + 0x30], 0x26
add rcx, 4
cmp rcx, 0xc
jne 0x180001421
test al, 1
mov eax, 0x603a
mov ecx, 0x69b3
cmovne eax, ecx
xor eax, dword [rsp + 0x30]
xor esi, esi
mov ecx, 0x601c
jmp 0x180001332
mov dword [rsp + 0x3c], r15d
mov rax, qword [rsp + 0x50]
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x18000146e
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov r13, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0
cmp dword [0x1800e4bf0], 0xa
mov eax, dword [0x1800e4bf4]
setl cl
lea edx, [rax + 1]
imul edx, eax
test dl, 1
sete al
mov edx, ecx
and dl, al
mov byte [rsp + 0x2a], dl
xor cl, al
mov byte [rsp + 0x2b], cl
xor eax, eax
lea rcx, [0x180051b08]
movsxd rdx, dword [rax + rcx]
xor dword [rsp + rdx*4 + 0x30], 0x1e27
add rax, 4
cmp rax, 0x10
jne 0x1800014c4
mov eax, 0x2e15
mov sil, 1
xor ebp, ebp
mov ecx, 0x601c
lea rbx, [0x180051afc]
mov r14d, dword [rsp + 0x40]
xor r14d, ecx
mov r12d, dword [rsp + 0x38]
mov r15d, dword [rsp + 0x3c]
cmp eax, 0x7793
jg 0x180001520
cmp eax, 0x28d2
je 0x18000160d
cmp eax, 0x2e15
jne 0x180001502
jmp 0x1800015c6
cmp eax, 0x7794
je 0x180001596
cmp eax, 0x7e1d
jne 0x180001502
call fcn.180022fd5
mov rcx, rax
mov edx, 0xd1f05c5
call fcn.18001ea27
mov rdi, rax
call fcn.18000115a
mov rcx, rax
xor edx, edx
mov r8, r13
call rdi
mov dword [rsp + 0x2c], eax
mov eax, dword [0x1800e4bf8]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, r15d
xor eax, 0x52f6
test bpl, bpl
cmove r15d, eax
test cl, 1
mov eax, 0x6995
mov ecx, 0x36d3
cmove eax, ecx
cmp dword [0x1800e4bfc], 0xa
cmovl eax, ecx
xor eax, r12d
mov bpl, 1
jmp 0x180001502
call fcn.180022fd5
mov rcx, rax
mov edx, 0xd1f05c5
call fcn.18001ea27
mov rdi, rax
call fcn.18000115a
mov rcx, rax
xor edx, edx
mov r8, r13
call rdi
mov dword [rsp + 0x2c], eax
mov eax, r14d
jmp 0x180001502
mov dword [rsp + 0x3c], r15d
mov al, byte [rsp + 0x2a]
or al, byte [rsp + 0x2b]
test sil, 1
je 0x1800015ee
xor ecx, ecx
movsxd rdx, dword [rcx + rbx]
xor byte [rsp + rdx*4 + 0x30], 0x26
add rcx, 4
cmp rcx, 0xc
jne 0x1800015db
test al, 1
mov eax, 0x69b3
mov ecx, 0x603a
cmovne eax, ecx
xor eax, dword [rsp + 0x30]
xor esi, esi
mov ecx, 0x601c
jmp 0x1800014f0
mov dword [rsp + 0x3c], r15d
mov eax, dword [rsp + 0x2c]
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x18000876c
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
xorps xmm0, xmm0
movaps xmmword [rsp + 0x10], xmm0
mov dword [rsp + 0x20], 0
mov eax, dword [0x1800e4bc4]
lea edx, [rax + 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x1800e4bc0], 9
setg dl
setg byte [rsp + 9]
mov bl, byte [rsp + 9]
not bl
or bl, al
and bl, 1
mov byte [rsp + 0xa], bl
and dl, al
mov byte [rsp + 0xb], dl
xor eax, eax
lea rdx, [0x18005250c]
movsxd rbp, dword [rax + rdx]
xor dword [rsp + rbp*4 + 0x10], 0x1e27
add rax, 4
cmp rax, 0x10
jne 0x1800087c3
xor ecx, 0x52535455
mov eax, dword [0x1800e4bc8]
lea edx, [rax + 1]
imul edx, eax
test dl, 1
mov edx, 0x36d3
mov eax, 0x6995
cmove eax, edx
cmp dword [0x1800e4bcc], 0xa
cmovl eax, edx
mov esi, 0x2e15
mov r11b, 1
xor r9d, r9d
mov r8d, 0x601c
lea rdx, [0x180052500]
mov r10d, 0x603a
mov edi, dword [rsp + 0x20]
xor edi, r8d
mov ebx, dword [rsp + 0x18]
xor ebx, eax
mov ebp, dword [rsp + 0x1c]
cmp esi, 0x7793
jg 0x18000884e
cmp esi, 0x28d2
je 0x1800088c1
cmp esi, 0x2e15
jne 0x180008834
jmp 0x18000887f
cmp esi, 0x7794
je 0x180008877
cmp esi, 0x7e1d
jne 0x180008834
mov dword [rsp + 0xc], ecx
mov esi, ebp
xor esi, 0x52f6
test r9b, r9b
cmove ebp, esi
mov r9b, 1
mov esi, ebx
jmp 0x180008834
mov dword [rsp + 0xc], ecx
mov esi, edi
jmp 0x180008834
mov dword [rsp + 0x1c], ebp
mov bl, byte [rsp + 9]
mov bl, byte [rsp + 0xb]
test r11b, 1
je 0x1800088a7
xor ebp, ebp
movsxd rbx, dword [rbp + rdx]
xor byte [rsp + rbx*4 + 0x10], 0x26
add rbp, 4
cmp rbp, 0xc
jne 0x180008893
cmp byte [rsp + 0xa], 0
mov esi, 0x69b3
cmovne esi, r10d
xor esi, dword [rsp + 0x10]
xor r11d, r11d
jmp 0x180008823
mov dword [rsp + 0x1c], ebp
mov eax, dword [rsp + 0xc]
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x180029902
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov dword [rbp], edx
mov rdi, rcx
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0
cmp dword [0x1800e55ac], 9
mov eax, dword [0x1800e55a8]
setg cl
lea edx, [rax + 1]
imul edx, eax
and dl, cl
mov byte [rbp + 7], dl
xor eax, eax
lea rcx, [0x180059d4c]
movsxd rdx, dword [rax + rcx]
xor dword [rbp + rdx*4 - 0x20], 0x1e27
add rax, 4
cmp rax, 0x10
jne 0x18002994f
mov r15d, 0xeaa42104
mov rax, rdi
xor rax, r15
mov rcx, rdi
not rcx
not r15
and r15, rcx
mov ecx, edi
and ecx, 0xeaa42104
add rcx, rdi
add rax, rcx
add rax, 5
mov qword [rbp - 0x30], rax
mov eax, 0x2e15
mov r13b, 1
xor r12d, r12d
lea rsi, [0x180059d40]
cmp eax, 0x7793
jg 0x1800299f3
cmp eax, 0x28d2
je 0x180029b07
cmp eax, 0x2e15
jne 0x1800299a5
mov al, byte [rbp + 7]
test r13b, 1
je 0x1800299dc
xor ecx, ecx
movsxd rdx, dword [rcx + rsi]
xor byte [rbp + rdx*4 - 0x20], 0x26
add rcx, 4
cmp rcx, 0xc
jne 0x1800299c9
test al, 1
mov eax, 0x603a
mov ecx, 0x69b3
cmovne eax, ecx
xor eax, dword [rbp - 0x20]
xor r13d, r13d
jmp 0x1800299a5
cmp eax, 0x7794
je 0x180029aa3
cmp eax, 0x7e1d
jne 0x1800299a5
mov eax, 0x10
call fcn.1800506c0
sub rsp, rax
mov r14, rsp
mov eax, 0x10
call fcn.1800506c0
sub rsp, rax
mov rdx, rsp
mov qword [r14], rdi
mov eax, 0xb8d18b4c
mov qword [rdx], rax
mov dword [rdx + 7], 0xc3050f00
sub rsp, 0x20
mov rcx, rdi
mov r8d, 0xb
call fcn.18000a87d
add rsp, 0x20
mov eax, dword [rbp]
mov rcx, qword [rbp - 0x30]
mov dword [r15 + rcx], eax
mov rax, qword [r14]
mov qword [rbp - 0x28], rax
cmp dword [0x1800e55b8], 0xa
mov eax, dword [0x1800e55bc]
setl cl
lea edx, [rax + 1]
imul edx, eax
test dl, 1
sete al
or al, cl
test r12b, r12b
jne 0x180029a89
xor dword [rbp - 0x14], 0x52f6
test al, al
mov eax, 0x6995
mov ecx, 0x36d3
cmovne eax, ecx
xor eax, dword [rbp - 0x18]
mov r12b, 1
jmp 0x1800299a5
mov eax, 0x10
call fcn.1800506c0
sub rsp, rax
mov rbx, rsp
mov eax, 0x10
call fcn.1800506c0
sub rsp, rax
mov rdx, rsp
mov qword [rbx], rdi
mov eax, 0xb8d18b4c
mov qword [rdx], rax
mov dword [rdx + 7], 0xc3050f00
sub rsp, 0x20
mov rcx, rdi
mov r8d, 0xb
call fcn.18000a87d
add rsp, 0x20
mov eax, dword [rbp]
mov dword [rdi + 4], eax
mov rax, qword [rbx]
mov qword [rbp - 0x28], rax
mov eax, dword [rbp - 0x10]
mov ecx, 0x601c
xor eax, ecx
jmp 0x1800299a5
mov rax, qword [rbp - 0x28]
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x18003b8a7
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
xorps xmm0, xmm0
movaps xmmword [rsp + 0x10], xmm0
mov dword [rsp + 0x20], 0
cmp dword [0x1800e6090], 0xa
mov eax, dword [0x1800e6094]
setl cl
lea edx, [rax + 1]
imul edx, eax
test dl, 1
sete al
mov edx, ecx
and dl, al
mov byte [rsp + 0xe], dl
xor cl, al
mov byte [rsp + 0xf], cl
xor eax, eax
lea rcx, [0x180059d4c]
movsxd rdx, dword [rax + rcx]
xor dword [rsp + rdx*4 + 0x10], 0x1e27
add rax, 4
cmp rax, 0x10
jne 0x18003b8f1
mov eax, dword [0x1800e60f0]
lea ecx, [rax + 1]
imul ecx, eax
test cl, 1
mov ecx, 0x36d3
mov eax, 0x6995
cmove eax, ecx
cmp dword [0x1800e60f4], 0xa
cmovl eax, ecx
mov edx, 0x2e15
mov r11b, 1
xor r10d, r10d
mov r8d, 0x601c
lea rcx, [0x180059d40]
mov r9d, 0x603a
mov esi, dword [rsp + 0x20]
xor esi, r8d
mov edi, dword [rsp + 0x18]
xor edi, eax
mov ebx, dword [rsp + 0x1c]
cmp edx, 0x7793
jg 0x18003b976
cmp edx, 0x28d2
je 0x18003b9de
cmp edx, 0x2e15
jne 0x18003b95c
jmp 0x18003b99f
cmp edx, 0x7794
je 0x18003b99b
cmp edx, 0x7e1d
jne 0x18003b95c
mov edx, ebx
xor edx, 0x52f6
test r10b, r10b
cmove ebx, edx
mov r10b, 1
mov edx, edi
jmp 0x18003b95c
mov edx, esi
jmp 0x18003b95c
mov dword [rsp + 0x1c], ebx
mov dl, byte [rsp + 0xe]
or dl, byte [rsp + 0xf]
test r11b, 1
je 0x18003b9c6
xor ebx, ebx
movsxd rdi, dword [rbx + rcx]
xor byte [rsp + rdi*4 + 0x10], 0x26
add rbx, 4
cmp rbx, 0xc
jne 0x18003b9b3
test dl, 1
mov edx, 0x69b3
cmovne edx, r9d
xor edx, dword [rsp + 0x10]
xor r11d, r11d
jmp 0x18003b94b
mov dword [rsp + 0x1c], ebx
xor eax, eax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret

Function at 0x18003b9ec
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
xorps xmm0, xmm0
movaps xmmword [rsp + 0x10], xmm0
mov dword [rsp + 0x20], 0
cmp dword [0x1800e6158], 9
mov eax, dword [0x1800e615c]
setg cl
lea edx, [rax + 1]
imul edx, eax
and dl, cl
mov byte [rsp + 0xf], dl
xor eax, eax
lea rcx, [0x180059d4c]
movsxd rdx, dword [rax + rcx]
xor dword [rsp + rdx*4 + 0x10], 0x1e27
add rax, 4
cmp rax, 0x10
jne 0x18003ba28
mov eax, dword [0x1800e6028]
lea ecx, [rax + 1]
imul ecx, eax
test cl, 1
mov ecx, 0x36d3
mov eax, 0x6995
cmove eax, ecx
cmp dword [0x1800e602c], 0xa
cmovl eax, ecx
mov edx, 0x2e15
mov r11b, 1
xor r10d, r10d
mov r8d, 0x601c
lea rcx, [0x180059d40]
mov r9d, 0x69b3
mov esi, dword [rsp + 0x20]
xor esi, r8d
mov edi, dword [rsp + 0x18]
xor edi, eax
mov ebx, dword [rsp + 0x1c]
cmp edx, 0x7793
jg 0x18003baad
cmp edx, 0x28d2
je 0x18003bb11
cmp edx, 0x2e15
jne 0x18003ba93
jmp 0x18003bad6
cmp edx, 0x7794
je 0x18003bad2
cmp edx, 0x7e1d
jne 0x18003ba93
mov edx, ebx
xor edx, 0x52f6
test r10b, r10b
cmove ebx, edx
mov r10b, 1
mov edx, edi
jmp 0x18003ba93
mov edx, esi
jmp 0x18003ba93
mov dword [rsp + 0x1c], ebx
mov dl, byte [rsp + 0xf]
test r11b, 1
je 0x18003baf9
xor ebx, ebx
movsxd rdi, dword [rbx + rcx]
xor byte [rsp + rdi*4 + 0x10], 0x26
add rbx, 4
cmp rbx, 0xc
jne 0x18003bae6
test dl, 1
mov edx, 0x603a
cmovne edx, r9d
xor edx, dword [rsp + 0x10]
xor r11d, r11d
jmp 0x18003ba82
mov dword [rsp + 0x1c], ebx
xor eax, eax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x18003bb1f
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
xorps xmm0, xmm0
movaps xmmword [rsp + 0x10], xmm0
mov dword [rsp + 0x20], 0
cmp dword [0x1800e6148], 9
mov eax, dword [0x1800e614c]
setg cl
lea edx, [rax - 0x18be9b29]
not edx
add edx, eax
add edx, eax
add edx, 0xce82c9ad
imul edx, eax
and dl, cl
mov byte [rsp + 0xf], dl
mov al, byte [rsp + 0xf]
xor eax, eax
lea rcx, [0x180059d4c]
movsxd rdx, dword [rax + rcx]
xor dword [rsp + rdx*4 + 0x10], 0x1e27
add rax, 4
cmp rax, 0x10
jne 0x18003bb6e
mov eax, dword [0x1800e6098]
lea ecx, [rax + 1]
imul ecx, eax
test cl, 1
mov ecx, 0x36d3
mov eax, 0x6995
cmove eax, ecx
cmp dword [0x1800e609c], 0xa
cmovl eax, ecx
mov edx, 0x2e15
mov r11b, 1
xor r10d, r10d
mov r8d, 0x601c
lea rcx, [0x180059d40]
mov r9d, 0x69b3
mov esi, dword [rsp + 0x20]
xor esi, r8d
mov edi, dword [rsp + 0x18]
xor edi, eax
mov ebx, dword [rsp + 0x1c]
cmp edx, 0x7793
jg 0x18003bbf3
cmp edx, 0x28d2
je 0x18003bc57
cmp edx, 0x2e15
jne 0x18003bbd9
jmp 0x18003bc1c
cmp edx, 0x7794
je 0x18003bc18
cmp edx, 0x7e1d
jne 0x18003bbd9
mov edx, ebx
xor edx, 0x52f6
test r10b, r10b
cmove ebx, edx
mov r10b, 1
mov edx, edi
jmp 0x18003bbd9
mov edx, esi
jmp 0x18003bbd9
mov dword [rsp + 0x1c], ebx
mov dl, byte [rsp + 0xf]
test r11b, 1
je 0x18003bc3f
xor ebx, ebx
movsxd rdi, dword [rbx + rcx]
xor byte [rsp + rdi*4 + 0x10], 0x26
add rbx, 4
cmp rbx, 0xc
jne 0x18003bc2c
test dl, 1
mov edx, 0x603a
cmovne edx, r9d
xor edx, dword [rsp + 0x10]
xor r11d, r11d
jmp 0x18003bbc8
mov dword [rsp + 0x1c], ebx
xor eax, eax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret

Function at 0x18003bc65
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
xorps xmm0, xmm0
movaps xmmword [rsp + 0x10], xmm0
mov dword [rsp + 0x20], 0
cmp dword [0x1800e60b0], 9
mov eax, dword [0x1800e60b4]
setg cl
lea edx, [rax + 1]
imul edx, eax
and dl, cl
mov byte [rsp + 0xf], dl
xor eax, eax
lea rcx, [0x180059d4c]
movsxd rdx, dword [rax + rcx]
xor dword [rsp + rdx*4 + 0x10], 0x1e27
add rax, 4
cmp rax, 0x10
jne 0x18003bca1
mov eax, dword [0x1800e5fe4]
mov ecx, eax
not ecx
lea edx, [rax + rax]
add edx, ecx
imul edx, eax
test dl, 1
mov ecx, 0x36d3
mov eax, 0x6995
cmove eax, ecx
cmp dword [0x1800e5fe0], 0xa
cmovl eax, ecx
mov edx, 0x2e15
mov r11b, 1
xor r10d, r10d
mov r8d, 0x601c
lea rcx, [0x180059d40]
mov r9d, 0x69b3
mov esi, dword [rsp + 0x20]
xor esi, r8d
mov edi, dword [rsp + 0x18]
xor edi, eax
mov ebx, dword [rsp + 0x1c]
cmp edx, 0x7793
jg 0x18003bd2c
cmp edx, 0x28d2
je 0x18003bd90
cmp edx, 0x2e15
jne 0x18003bd12
jmp 0x18003bd55
cmp edx, 0x7794
je 0x18003bd51
cmp edx, 0x7e1d
jne 0x18003bd12
mov edx, ebx
xor edx, 0x52f6
test r10b, r10b
cmove ebx, edx
mov r10b, 1
mov edx, edi
jmp 0x18003bd12
mov edx, esi
jmp 0x18003bd12
mov dword [rsp + 0x1c], ebx
mov dl, byte [rsp + 0xf]
test r11b, 1
je 0x18003bd78
xor ebx, ebx
movsxd rdi, dword [rbx + rcx]
xor byte [rsp + rdi*4 + 0x10], 0x26
add rbx, 4
cmp rbx, 0xc
jne 0x18003bd65
test dl, 1
mov edx, 0x603a
cmovne edx, r9d
xor edx, dword [rsp + 0x10]
xor r11d, r11d
jmp 0x18003bd01
mov dword [rsp + 0x1c], ebx
xor eax, eax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret