joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18003d012
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
xorps xmm0, xmm0
movaps xmmword [rsp + 0x10], xmm0
mov dword [rsp + 0x20], 0
mov eax, dword [0x1800e72e0]
cmp dword [0x1800e72e4], 9
setg cl
lea edx, [rax + 1]
imul edx, eax
and dl, cl
mov byte [rsp + 0xf], dl
mov al, byte [rsp + 0xf]
xor eax, eax
lea rcx, [0x180059d4c]
movsxd rdx, dword [rax + rcx]
xor dword [rsp + rdx*4 + 0x10], 0x1e27
add rax, 4
cmp rax, 0x10
jne 0x18003d052
mov eax, dword [0x1800e72e8]
lea ecx, [rax + 1]
imul ecx, eax
test cl, 1
mov ecx, 0x36d3
mov eax, 0x6995
cmove eax, ecx
cmp dword [0x1800e72ec], 0xa
cmovl eax, ecx
mov edx, 0x2e15
mov r11b, 1
xor r10d, r10d
mov r8d, 0x601c
lea rcx, [0x180059d40]
mov r9d, 0x69b3
mov esi, dword [rsp + 0x20]
xor esi, r8d
mov edi, dword [rsp + 0x18]
xor edi, eax
mov ebx, dword [rsp + 0x1c]
cmp edx, 0x7793
jg 0x18003d0d7
cmp edx, 0x28d2
je 0x18003d13b
cmp edx, 0x2e15
jne 0x18003d0bd
jmp 0x18003d100
cmp edx, 0x7794
je 0x18003d0fc
cmp edx, 0x7e1d
jne 0x18003d0bd
mov edx, ebx
xor edx, 0x52f6
test r10b, r10b
cmove ebx, edx
mov r10b, 1
mov edx, edi
jmp 0x18003d0bd
mov edx, esi
jmp 0x18003d0bd
mov dword [rsp + 0x1c], ebx
mov dl, byte [rsp + 0xf]
test r11b, 1
je 0x18003d123
xor ebx, ebx
movsxd rdi, dword [rbx + rcx]
xor byte [rsp + rdi*4 + 0x10], 0x26
add rbx, 4
cmp rbx, 0xc
jne 0x18003d110
test dl, 1
mov edx, 0x603a
cmovne edx, r9d
xor edx, dword [rsp + 0x10]
xor r11d, r11d
jmp 0x18003d0ac
mov dword [rsp + 0x1c], ebx
xor eax, eax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret

Function at 0x18003d149
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
xorps xmm0, xmm0
movaps xmmword [rsp + 0x10], xmm0
mov dword [rsp + 0x20], 0
cmp dword [0x1800e72f0], 0xa
mov eax, dword [0x1800e72f4]
setl cl
lea edx, [rax + 1]
imul edx, eax
test dl, 1
sete al
mov edx, ecx
and dl, al
mov byte [rsp + 0xe], dl
xor cl, al
mov byte [rsp + 0xf], cl
xor eax, eax
lea rcx, [0x180059d4c]
movsxd rdx, dword [rax + rcx]
xor dword [rsp + rdx*4 + 0x10], 0x1e27
add rax, 4
cmp rax, 0x10
jne 0x18003d193
mov eax, dword [0x1800e72f8]
lea ecx, [rax + 1]
imul ecx, eax
test cl, 1
mov ecx, 0x36d3
mov eax, 0x6995
cmove eax, ecx
cmp dword [0x1800e72fc], 0xa
cmovl eax, ecx
mov edx, 0x2e15
mov r11b, 1
xor r10d, r10d
mov r8d, 0x601c
lea rcx, [0x180059d40]
mov r9d, 0x603a
mov esi, dword [rsp + 0x20]
xor esi, r8d
mov edi, dword [rsp + 0x18]
xor edi, eax
mov ebx, dword [rsp + 0x1c]
cmp edx, 0x7793
jg 0x18003d218
cmp edx, 0x28d2
je 0x18003d280
cmp edx, 0x2e15
jne 0x18003d1fe
jmp 0x18003d241
cmp edx, 0x7794
je 0x18003d23d
cmp edx, 0x7e1d
jne 0x18003d1fe
mov edx, ebx
xor edx, 0x52f6
test r10b, r10b
cmove ebx, edx
mov r10b, 1
mov edx, edi
jmp 0x18003d1fe
mov edx, esi
jmp 0x18003d1fe
mov dword [rsp + 0x1c], ebx
mov dl, byte [rsp + 0xe]
or dl, byte [rsp + 0xf]
test r11b, 1
je 0x18003d268
xor ebx, ebx
movsxd rdi, dword [rbx + rcx]
xor byte [rsp + rdi*4 + 0x10], 0x26
add rbx, 4
cmp rbx, 0xc
jne 0x18003d255
test dl, 1
mov edx, 0x69b3
cmovne edx, r9d
xor edx, dword [rsp + 0x10]
xor r11d, r11d
jmp 0x18003d1ed
mov dword [rsp + 0x1c], ebx
xor eax, eax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x18003d28e
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
xorps xmm0, xmm0
movaps xmmword [rsp + 0x10], xmm0
mov dword [rsp + 0x20], 0
cmp dword [0x1800e7300], 9
mov eax, dword [0x1800e7304]
setg cl
lea edx, [rax + 1]
imul edx, eax
and dl, cl
mov byte [rsp + 0xf], dl
xor eax, eax
lea rcx, [0x180059d4c]
movsxd rdx, dword [rax + rcx]
xor dword [rsp + rdx*4 + 0x10], 0x1e27
add rax, 4
cmp rax, 0x10
jne 0x18003d2ca
mov eax, dword [0x1800e7308]
lea ecx, [rax + 1]
imul ecx, eax
test cl, 1
mov ecx, 0x36d3
mov eax, 0x6995
cmove eax, ecx
cmp dword [0x1800e730c], 0xa
cmovl eax, ecx
mov edx, 0x2e15
mov r11b, 1
xor r10d, r10d
mov r8d, 0x601c
lea rcx, [0x180059d40]
mov r9d, 0x69b3
mov esi, dword [rsp + 0x20]
xor esi, r8d
mov edi, dword [rsp + 0x18]
xor edi, eax
mov ebx, dword [rsp + 0x1c]
cmp edx, 0x7793
jg 0x18003d34f
cmp edx, 0x28d2
je 0x18003d3b3
cmp edx, 0x2e15
jne 0x18003d335
jmp 0x18003d378
cmp edx, 0x7794
je 0x18003d374
cmp edx, 0x7e1d
jne 0x18003d335
mov edx, ebx
xor edx, 0x52f6
test r10b, r10b
cmove ebx, edx
mov r10b, 1
mov edx, edi
jmp 0x18003d335
mov edx, esi
jmp 0x18003d335
mov dword [rsp + 0x1c], ebx
mov dl, byte [rsp + 0xf]
test r11b, 1
je 0x18003d39b
xor ebx, ebx
movsxd rdi, dword [rbx + rcx]
xor byte [rsp + rdi*4 + 0x10], 0x26
add rbx, 4
cmp rbx, 0xc
jne 0x18003d388
test dl, 1
mov edx, 0x603a
cmovne edx, r9d
xor edx, dword [rsp + 0x10]
xor r11d, r11d
jmp 0x18003d324
mov dword [rsp + 0x1c], ebx
xor eax, eax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret

Function at 0x18003d3c1
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
xorps xmm0, xmm0
movaps xmmword [rsp + 0x10], xmm0
mov dword [rsp + 0x20], 0
cmp dword [0x1800e7310], 9
mov eax, dword [0x1800e7314]
setg cl
lea edx, [rax + 1]
imul edx, eax
and dl, cl
mov byte [rsp + 0xf], dl
xor eax, eax
lea rcx, [0x180059d4c]
movsxd rdx, dword [rax + rcx]
xor dword [rsp + rdx*4 + 0x10], 0x1e27
add rax, 4
cmp rax, 0x10
jne 0x18003d3fd
mov eax, dword [0x1800e7318]
lea ecx, [rax + 1]
imul ecx, eax
test cl, 1
mov ecx, 0x36d3
mov eax, 0x6995
cmove eax, ecx
cmp dword [0x1800e731c], 0xa
cmovl eax, ecx
mov edx, 0x2e15
mov r11b, 1
xor r10d, r10d
mov r8d, 0x601c
lea rcx, [0x180059d40]
mov r9d, 0x69b3
mov esi, dword [rsp + 0x20]
xor esi, r8d
mov edi, dword [rsp + 0x18]
xor edi, eax
mov ebx, dword [rsp + 0x1c]
cmp edx, 0x7793
jg 0x18003d482
cmp edx, 0x28d2
je 0x18003d4e6
cmp edx, 0x2e15
jne 0x18003d468
jmp 0x18003d4ab
cmp edx, 0x7794
je 0x18003d4a7
cmp edx, 0x7e1d
jne 0x18003d468
mov edx, ebx
xor edx, 0x52f6
test r10b, r10b
cmove ebx, edx
mov r10b, 1
mov edx, edi
jmp 0x18003d468
mov edx, esi
jmp 0x18003d468
mov dword [rsp + 0x1c], ebx
mov dl, byte [rsp + 0xf]
test r11b, 1
je 0x18003d4ce
xor ebx, ebx
movsxd rdi, dword [rbx + rcx]
xor byte [rsp + rdi*4 + 0x10], 0x26
add rbx, 4
cmp rbx, 0xc
jne 0x18003d4bb
test dl, 1
mov edx, 0x603a
cmovne edx, r9d
xor edx, dword [rsp + 0x10]
xor r11d, r11d
jmp 0x18003d457
mov dword [rsp + 0x1c], ebx
xor eax, eax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x18003d4f4
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
xorps xmm0, xmm0
movaps xmmword [rsp + 0x10], xmm0
mov dword [rsp + 0x20], 0
cmp dword [0x1800e7320], 0xa
mov eax, dword [0x1800e7324]
setl cl
lea edx, [rax + 1]
imul edx, eax
test dl, 1
sete al
or al, cl
mov byte [rsp + 0xe], al
xor al, 1
mov byte [rsp + 0xf], al
xor eax, eax
lea rcx, [0x180059d4c]
movsxd rdx, dword [rax + rcx]
xor dword [rsp + rdx*4 + 0x10], 0x1e27
add rax, 4
cmp rax, 0x10
jne 0x18003d53c
mov eax, dword [0x1800e7328]
lea ecx, [rax + 1]
imul ecx, eax
test cl, 1
mov ecx, 0x36d3
mov eax, 0x6995
cmove eax, ecx
cmp dword [0x1800e732c], 0xa
cmovl eax, ecx
mov edx, 0x2e15
mov r11b, 1
xor r10d, r10d
mov r8d, 0x601c
lea rcx, [0x180059d40]
mov r9d, 0x603a
mov esi, dword [rsp + 0x20]
xor esi, r8d
mov edi, dword [rsp + 0x18]
xor edi, eax
mov ebx, dword [rsp + 0x1c]
cmp edx, 0x7793
jg 0x18003d5c1
cmp edx, 0x28d2
je 0x18003d627
cmp edx, 0x2e15
jne 0x18003d5a7
jmp 0x18003d5ea
cmp edx, 0x7794
je 0x18003d5e6
cmp edx, 0x7e1d
jne 0x18003d5a7
mov edx, ebx
xor edx, 0x52f6
test r10b, r10b
cmove ebx, edx
mov r10b, 1
mov edx, edi
jmp 0x18003d5a7
mov edx, esi
jmp 0x18003d5a7
mov dword [rsp + 0x1c], ebx
mov dl, byte [rsp + 0xf]
test r11b, 1
je 0x18003d60d
xor edx, edx
movsxd rbx, dword [rdx + rcx]
xor byte [rsp + rbx*4 + 0x10], 0x26
add rdx, 4
cmp rdx, 0xc
jne 0x18003d5fa
cmp byte [rsp + 0xe], 0
mov edx, 0x69b3
cmovne edx, r9d
xor edx, dword [rsp + 0x10]
xor r11d, r11d
jmp 0x18003d596
mov dword [rsp + 0x1c], ebx
xor eax, eax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret

Function at 0x18003d635
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
xorps xmm0, xmm0
movaps xmmword [rsp + 0x10], xmm0
mov dword [rsp + 0x20], 0
cmp dword [0x1800e7330], 9
mov eax, dword [0x1800e7334]
setg cl
lea edx, [rax + 1]
imul edx, eax
and dl, cl
mov byte [rsp + 0xf], dl
xor eax, eax
lea rcx, [0x180059d4c]
movsxd rdx, dword [rax + rcx]
xor dword [rsp + rdx*4 + 0x10], 0x1e27
add rax, 4
cmp rax, 0x10
jne 0x18003d671
mov eax, dword [0x1800e7338]
lea ecx, [rax + 1]
imul ecx, eax
test cl, 1
mov ecx, 0x36d3
mov eax, 0x6995
cmove eax, ecx
cmp dword [0x1800e733c], 0xa
cmovl eax, ecx
mov edx, 0x2e15
mov r11b, 1
xor r10d, r10d
mov r8d, 0x601c
lea rcx, [0x180059d40]
mov r9d, 0x69b3
mov esi, dword [rsp + 0x20]
xor esi, r8d
mov edi, dword [rsp + 0x18]
xor edi, eax
mov ebx, dword [rsp + 0x1c]
cmp edx, 0x7793
jg 0x18003d6f6
cmp edx, 0x28d2
je 0x18003d75a
cmp edx, 0x2e15
jne 0x18003d6dc
jmp 0x18003d71f
cmp edx, 0x7794
je 0x18003d71b
cmp edx, 0x7e1d
jne 0x18003d6dc
mov edx, ebx
xor edx, 0x52f6
test r10b, r10b
cmove ebx, edx
mov r10b, 1
mov edx, edi
jmp 0x18003d6dc
mov edx, esi
jmp 0x18003d6dc
mov dword [rsp + 0x1c], ebx
mov dl, byte [rsp + 0xf]
test r11b, 1
je 0x18003d742
xor ebx, ebx
movsxd rdi, dword [rbx + rcx]
xor byte [rsp + rdi*4 + 0x10], 0x26
add rbx, 4
cmp rbx, 0xc
jne 0x18003d72f
test dl, 1
mov edx, 0x603a
cmovne edx, r9d
xor edx, dword [rsp + 0x10]
xor r11d, r11d
jmp 0x18003d6cb
mov dword [rsp + 0x1c], ebx
xor eax, eax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x18003d768
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
xorps xmm0, xmm0
movaps xmmword [rsp + 0x10], xmm0
mov dword [rsp + 0x20], 0
cmp dword [0x1800e7340], 9
mov eax, dword [0x1800e7344]
setg cl
lea edx, [rax + 1]
imul edx, eax
and dl, cl
mov byte [rsp + 0xf], dl
xor eax, eax
lea rcx, [0x180059d4c]
movsxd rdx, dword [rax + rcx]
xor dword [rsp + rdx*4 + 0x10], 0x1e27
add rax, 4
cmp rax, 0x10
jne 0x18003d7a4
mov eax, dword [0x1800e7348]
lea ecx, [rax + 1]
imul ecx, eax
test cl, 1
mov ecx, 0x36d3
mov eax, 0x6995
cmove eax, ecx
cmp dword [0x1800e734c], 0xa
cmovl eax, ecx
mov edx, 0x2e15
mov r11b, 1
xor r10d, r10d
mov r8d, 0x601c
lea rcx, [0x180059d40]
mov r9d, 0x69b3
mov esi, dword [rsp + 0x20]
xor esi, r8d
mov edi, dword [rsp + 0x18]
xor edi, eax
mov ebx, dword [rsp + 0x1c]
cmp edx, 0x7793
jg 0x18003d829
cmp edx, 0x28d2
je 0x18003d88d
cmp edx, 0x2e15
jne 0x18003d80f
jmp 0x18003d852
cmp edx, 0x7794
je 0x18003d84e
cmp edx, 0x7e1d
jne 0x18003d80f
mov edx, ebx
xor edx, 0x52f6
test r10b, r10b
cmove ebx, edx
mov r10b, 1
mov edx, edi
jmp 0x18003d80f
mov edx, esi
jmp 0x18003d80f
mov dword [rsp + 0x1c], ebx
mov dl, byte [rsp + 0xf]
test r11b, 1
je 0x18003d875
xor ebx, ebx
movsxd rdi, dword [rbx + rcx]
xor byte [rsp + rdi*4 + 0x10], 0x26
add rbx, 4
cmp rbx, 0xc
jne 0x18003d862
test dl, 1
mov edx, 0x603a
cmovne edx, r9d
xor edx, dword [rsp + 0x10]
xor r11d, r11d
jmp 0x18003d7fe
mov dword [rsp + 0x1c], ebx
xor eax, eax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret

Function at 0x18003d89b
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
xorps xmm0, xmm0
movaps xmmword [rsp + 0x10], xmm0
mov dword [rsp + 0x20], 0
mov eax, dword [0x1800e7350]
cmp dword [0x1800e7354], 9
setg cl
mov edx, 0xb63e7163
sub edx, eax
imul edx, eax
and dl, cl
mov byte [rsp + 0xf], dl
xor eax, eax
lea rcx, [0x180059d4c]
movsxd rdx, dword [rax + rcx]
xor dword [rsp + rdx*4 + 0x10], 0x1e27
add rax, 4
cmp rax, 0x10
jne 0x18003d8db
mov eax, dword [0x1800e7358]
lea ecx, [rax + 1]
imul ecx, eax
test cl, 1
mov ecx, 0x36d3
mov eax, 0x6995
cmove eax, ecx
cmp dword [0x1800e735c], 0xa
cmovl eax, ecx
mov edx, 0x2e15
mov r11b, 1
xor r10d, r10d
mov r8d, 0x601c
lea rcx, [0x180059d40]
mov r9d, 0x69b3
mov esi, dword [rsp + 0x20]
xor esi, r8d
mov edi, dword [rsp + 0x18]
xor edi, eax
mov ebx, dword [rsp + 0x1c]
cmp edx, 0x7793
jg 0x18003d960
cmp edx, 0x28d2
je 0x18003d9c4
cmp edx, 0x2e15
jne 0x18003d946
jmp 0x18003d989
cmp edx, 0x7794
je 0x18003d985
cmp edx, 0x7e1d
jne 0x18003d946
mov edx, ebx
xor edx, 0x52f6
test r10b, r10b
cmove ebx, edx
mov r10b, 1
mov edx, edi
jmp 0x18003d946
mov edx, esi
jmp 0x18003d946
mov dword [rsp + 0x1c], ebx
mov dl, byte [rsp + 0xf]
test r11b, 1
je 0x18003d9ac
xor ebx, ebx
movsxd rdi, dword [rbx + rcx]
xor byte [rsp + rdi*4 + 0x10], 0x26
add rbx, 4
cmp rbx, 0xc
jne 0x18003d999
test dl, 1
mov edx, 0x603a
cmovne edx, r9d
xor edx, dword [rsp + 0x10]
xor r11d, r11d
jmp 0x18003d935
mov dword [rsp + 0x1c], ebx
xor eax, eax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x18003d9d2
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
xorps xmm0, xmm0
movaps xmmword [rsp + 0x10], xmm0
mov dword [rsp + 0x20], 0
cmp dword [0x1800e7360], 0xa
mov eax, dword [0x1800e7364]
setl cl
lea edx, [rax + 1]
imul edx, eax
test dl, 1
sete al
mov edx, ecx
and dl, al
mov byte [rsp + 0xe], dl
xor cl, al
mov byte [rsp + 0xf], cl
xor eax, eax
lea rcx, [0x180059d4c]
movsxd rdx, dword [rax + rcx]
xor dword [rsp + rdx*4 + 0x10], 0x1e27
add rax, 4
cmp rax, 0x10
jne 0x18003da1c
mov eax, dword [0x1800e7368]
lea ecx, [rax + 1]
imul ecx, eax
test cl, 1
mov eax, 0x6995
mov ecx, 0x36d3
cmove eax, ecx
cmp dword [0x1800e736c], 9
cmovle eax, ecx
mov edx, 0x2e15
mov r11b, 1
xor r10d, r10d
mov r8d, 0x601c
lea rcx, [0x180059d40]
mov r9d, 0x603a
mov esi, dword [rsp + 0x20]
xor esi, r8d
mov edi, dword [rsp + 0x18]
xor edi, eax
mov ebx, dword [rsp + 0x1c]
cmp edx, 0x7793
jg 0x18003daa1
cmp edx, 0x28d2
je 0x18003db09
cmp edx, 0x2e15
jne 0x18003da87
jmp 0x18003daca
cmp edx, 0x7794
je 0x18003dac6
cmp edx, 0x7e1d
jne 0x18003da87
mov edx, ebx
xor edx, 0x52f6
test r10b, r10b
cmove ebx, edx
mov r10b, 1
mov edx, edi
jmp 0x18003da87
mov edx, esi
jmp 0x18003da87
mov dword [rsp + 0x1c], ebx
mov dl, byte [rsp + 0xe]
or dl, byte [rsp + 0xf]
test r11b, 1
je 0x18003daf1
xor ebx, ebx
movsxd rdi, dword [rbx + rcx]
xor byte [rsp + rdi*4 + 0x10], 0x26
add rbx, 4
cmp rbx, 0xc
jne 0x18003dade
test dl, 1
mov edx, 0x69b3
cmovne edx, r9d
xor edx, dword [rsp + 0x10]
xor r11d, r11d
jmp 0x18003da76
mov dword [rsp + 0x1c], ebx
xor eax, eax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x18003db17
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
xorps xmm0, xmm0
movaps xmmword [rsp + 0x10], xmm0
mov dword [rsp + 0x20], 0
cmp dword [0x1800e7370], 9
mov eax, dword [0x1800e7374]
setg cl
lea edx, [rax + 1]
imul edx, eax
and dl, cl
mov byte [rsp + 0xf], dl
xor eax, eax
lea rcx, [0x180059d4c]
movsxd rdx, dword [rax + rcx]
xor dword [rsp + rdx*4 + 0x10], 0x1e27
add rax, 4
cmp rax, 0x10
jne 0x18003db53
mov eax, dword [0x1800e7378]
cmp dword [0x1800e737c], 0xa
setl cl
lea edx, [rax + 1]
imul edx, eax
and edx, 1
sete al
or dl, cl
xor dl, al
xor cl, al
test dl, dl
mov eax, 0x6995
mov edx, 0x36d3
cmove eax, edx
test cl, cl
cmovne eax, edx
mov edx, 0x2e15
mov r11b, 1
xor r10d, r10d
mov r8d, 0x601c
lea rcx, [0x180059d40]
mov r9d, 0x69b3
mov esi, dword [rsp + 0x20]
xor esi, r8d
mov edi, dword [rsp + 0x18]
xor edi, eax
mov ebx, dword [rsp + 0x1c]
cmp edx, 0x7793
jg 0x18003dbe8
cmp edx, 0x28d2
je 0x18003dc4c
cmp edx, 0x2e15
jne 0x18003dbce
jmp 0x18003dc11
cmp edx, 0x7794
je 0x18003dc0d
cmp edx, 0x7e1d
jne 0x18003dbce
mov edx, ebx
xor edx, 0x52f6
test r10b, r10b
cmove ebx, edx
mov r10b, 1
mov edx, edi
jmp 0x18003dbce
mov edx, esi
jmp 0x18003dbce
mov dword [rsp + 0x1c], ebx
mov dl, byte [rsp + 0xf]
test r11b, 1
je 0x18003dc34
xor ebx, ebx
movsxd rdi, dword [rbx + rcx]
xor byte [rsp + rdi*4 + 0x10], 0x26
add rbx, 4
cmp rbx, 0xc
jne 0x18003dc21
test dl, 1
mov edx, 0x603a
cmovne edx, r9d
xor edx, dword [rsp + 0x10]
xor r11d, r11d
jmp 0x18003dbbd
mov dword [rsp + 0x1c], ebx
xor eax, eax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x180041d75
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
movaps xmmword [rbp - 0x10], xmm6
xorps xmm0, xmm0
movaps xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x20], 0
cmp dword [0x1800e4d98], 9
mov eax, dword [0x1800e4d9c]
setg cl
lea edx, [rax + 1]
imul edx, eax
and dl, cl
mov byte [rbp - 0x11], dl
xor eax, eax
lea rcx, [0x18005ac20]
movsxd rdx, dword [rax + rcx]
xor dword [rbp + rdx*4 - 0x30], 0x1e27
add rax, 4
cmp rax, 0x10
jne 0x180041dc0
mov eax, 0x2e15
mov r15b, 1
xor esi, esi
mov ecx, 0x601c
lea rbx, [0x18005ac14]
xorps xmm6, xmm6
mov r14d, dword [rbp - 0x20]
xor r14d, ecx
mov r13d, dword [rbp - 0x28]
mov r12d, dword [rbp - 0x24]
cmp eax, 0x7793
jg 0x180041e1c
cmp eax, 0x28d2
je 0x180041f6d
cmp eax, 0x2e15
jne 0x180041dfe
jmp 0x180041f2c
cmp eax, 0x7794
je 0x180041ec9
cmp eax, 0x7e1d
jne 0x180041dfe
mov eax, 0x30
call fcn.1800506c0
sub rsp, rax
mov rdi, rsp
sub rsp, 0x20
call fcn.1800213a4
mov rcx, rax
mov edx, 0x59b8ecc
call fcn.18001ea27
add rsp, 0x20
movups xmmword [rdi], xmm6
movups xmmword [rdi + 0x10], xmm6
mov dword [rdi + 0x20], 0
sub rsp, 0x20
mov rcx, rax
lea rdx, [0x180040626]
mov r8d, 2
mov r9, rdi
call fcn.18003ebc1
add rsp, 0x20
mov dword [rbp - 0x18], eax
mov eax, dword [0x1800e4dbc]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, r12d
xor eax, 0x52f6
test sil, sil
cmove r12d, eax
test cl, 1
mov eax, 0x6995
mov ecx, 0x36d3
cmove eax, ecx
cmp dword [0x1800e4db8], 0xa
cmovl eax, ecx
xor eax, r13d
mov sil, 1
jmp 0x180041dfe
mov eax, 0x30
call fcn.1800506c0
sub rsp, rax
mov rdi, rsp
sub rsp, 0x20
call fcn.1800213a4
mov rcx, rax
mov edx, 0x59b8ecc
call fcn.18001ea27
add rsp, 0x20
movups xmmword [rdi], xmm6
movups xmmword [rdi + 0x10], xmm6
mov dword [rdi + 0x20], 0
sub rsp, 0x20
mov rcx, rax
lea rdx, [0x180040626]
mov r8d, 2
mov r9, rdi
call fcn.18003ebc1
add rsp, 0x20
mov dword [rbp - 0x18], eax
mov eax, r14d
jmp 0x180041dfe
mov dword [rbp - 0x24], r12d
mov al, byte [rbp - 0x11]
test r15b, 1
je 0x180041f4e
xor ecx, ecx
movsxd rdx, dword [rcx + rbx]
xor byte [rbp + rdx*4 - 0x30], 0x26
add rcx, 4
cmp rcx, 0xc
jne 0x180041f3b
test al, 1
mov eax, 0x603a
mov ecx, 0x69b3
cmovne eax, ecx
xor eax, dword [rbp - 0x30]
xor r15d, r15d
mov ecx, 0x601c
jmp 0x180041def
mov dword [rbp - 0x24], r12d
mov eax, dword [rbp - 0x18]
movaps xmm6, xmmword [rbp - 0x10]
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x180044e89
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
xorps xmm0, xmm0
movaps xmmword [rsp + 0x10], xmm0
mov dword [rsp + 0x20], 0
mov eax, dword [0x1800e4c68]
cmp dword [0x1800e4c6c], 9
setg bl
lea ebp, [rax + 1]
imul ebp, eax
and bpl, bl
mov byte [rsp + 0xf], bpl
mov al, byte [rsp + 0xf]
xor eax, eax
lea rbp, [0x18005ac54]
movsxd rbx, dword [rax + rbp]
xor dword [rsp + rbx*4 + 0x10], 0x1e27
add rax, 4
cmp rax, 0x10
jne 0x180044ed2
mov ebx, 0x2e15
mov r15b, 1
xor r14d, r14d
mov r8d, 0x601c
lea rax, [0x18005ac48]
mov r9d, 0x69b3
movabs r10, 0x20000000c
mov r11d, 0x36d3
mov ebp, dword [rsp + 0x20]
xor ebp, r8d
mov r12d, dword [rsp + 0x18]
mov esi, dword [rsp + 0x1c]
cmp ebx, 0x7793
jg 0x180044f44
cmp ebx, 0x28d2
je 0x180044fea
cmp ebx, 0x2e15
jne 0x180044f26
jmp 0x180044faf
cmp ebx, 0x7794
je 0x180044f9b
cmp ebx, 0x7e1d
jne 0x180044f26
mov qword [rdx], r10
mov word [rdx + 8], 0x101
mov qword [rcx + 0x28], rdx
mov ebx, dword [0x1800e4c0c]
lea edi, [rbx + 1]
imul edi, ebx
mov ebx, esi
xor ebx, 0x52f6
test r14b, r14b
cmove esi, ebx
test dil, 1
mov ebx, 0x6995
cmove ebx, r11d
cmp dword [0x1800e4c08], 0xa
cmovl ebx, r11d
xor ebx, r12d
mov r14b, 1
jmp 0x180044f26
mov qword [rdx], r10
mov word [rdx + 8], 0x101
mov qword [rcx + 0x28], rdx
mov ebx, ebp
jmp 0x180044f26
mov dword [rsp + 0x1c], esi
mov bl, byte [rsp + 0xf]
test r15b, 1
je 0x180044fd2
xor esi, esi
movsxd rdi, dword [rsi + rax]
xor byte [rsp + rdi*4 + 0x10], 0x26
add rsi, 4
cmp rsi, 0xc
jne 0x180044fbf
test bl, 1
mov ebx, 0x603a
cmovne ebx, r9d
xor ebx, dword [rsp + 0x10]
xor r15d, r15d
jmp 0x180044f16
mov dword [rsp + 0x1c], esi
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x417f60
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4180eb
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00436800
xorps xmm15, xmm15
mov r14, qword [0x009675e0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x417fc5
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x417fd4
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x417ff3
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x418003
cmp rbx, 0x1000
jae 0x417fcb
jmp 0x41806d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x418015
xor edx, edx
jmp 0x418064
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00436800
xorps xmm15, xmm15
mov r14, qword [0x009675e0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x417ff9
jmp 0x417fe8
call fcn.0046d400
xorps xmm15, xmm15
mov r14, qword [0x009675e0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.0043ad40
lea rax, [0x006c0a5c]
mov ebx, 0x18
nop dword [rax]
call fcn.0043b5c0
mov rax, qword [rsp + 0x38]
call fcn.0043b300
lea rax, [0x006c1349]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.0043b5c0
mov rax, qword [rsp + 0x30]
call fcn.0043b300
call fcn.0043af80
call fcn.0043ada0
lea rax, [0x006c5893]
mov ebx, 0x21
call fcn.004392a0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00469ca0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00417f60