joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180028520
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp], 0xfffffffffffffffe
mov r15, rdx
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], 0
mov qword [rdx + 0x18], 0xf
mov rbx, qword [rcx + 0x38]
mov r14, qword [rcx + 0x40]
cmp rbx, r14
je 0x180028722
movabs r12, 0x6f079fd142b48925
lea rsi, [0x180052ffe]
lea rdi, [rbp - 0x18]
mov qword [rbp - 8], r15
jmp 0x1800285a9
mov byte [rdx + rax], r9b
mov byte [rdx + rax + 1], 0
inc rbx
cmp rbx, r14
mov r15, qword [rbp - 8]
je 0x180028722
movzx r9d, byte [rbx]
cmp r9d, 0x1f
ja 0x1800286b0
mov byte [rbp - 0x10], 0
mov qword [rbp - 0x18], 0
cmp byte [0x180053007], 0
jne 0x180028663
mov rax, qword [0x180050c58]
movabs rcx, 0x6f079fd142b48913
add rcx, rax
add rax, r12
xor edx, edx
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r11d, r8d
not r11b
movzx r10d, byte [rcx + rdx]
mov r15d, r8d
xor r15b, 0x99
and r15b, r11b
and r8b, 0x22
mov r13d, r10d
and r13b, 0x22
and r15b, 0xdd
and r11b, 0x44
or r11b, 0x1b
xor r11b, r15b
mov r15d, r11d
xor r15b, 0x39
and r11b, 0x44
or r8b, 0x99
and r8b, r15b
or r8b, r11b
and r10b, 0xdd
or r10b, 2
xor r10b, r13b
xor r10b, r8b
xor r10b, 0xdf
mov byte [rdx + rsi], r10b
inc rdx
cmp rdx, 9
jne 0x1800285f0
mov byte [0x180053007], 1
mov r15, qword [rbp - 8]
mov edx, 9
mov rcx, rdi
mov r8, rsi
call fcn.180033b50
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rcx, qword [r15 + 0x10]
mov rdx, qword [r15 + 0x18]
mov r8, rdx
sub r8, rcx
cmp r8, rax
jae 0x1800286e0
mov qword [rsp + 0x20], rax
mov rcx, r15
mov rdx, rax
mov r9, rdi
call fcn.1800127a0
jmp 0x180028599
mov rax, qword [r15 + 0x10]
mov rcx, qword [r15 + 0x18]
cmp rax, rcx
jae 0x180028710
lea rdx, [rax + 1]
mov qword [r15 + 0x10], rdx
mov rdx, r15
cmp rcx, 0x10
jb 0x180028590
mov rdx, qword [r15]
jmp 0x180028590
mov r13, rax
add r13, rcx
mov qword [r15 + 0x10], r13
cmp rdx, 0x10
jb 0x1800286f7
mov rdx, qword [rbp - 8]
mov r15, qword [rdx]
add rcx, r15
mov rdx, rdi
mov r8, rax
call sub.VCRUNTIME140.dll_memmove
mov byte [r15 + r13], 0
jmp 0x180028599
mov edx, 1
mov rcx, r15
call fcn.1800130c0
jmp 0x180028599
mov rax, r15
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x180031b20
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x70
lea rbp, [rsp + 0x70]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rbx, rdx
mov rsi, rcx
mov rdx, qword [rdx + 8]
lea rdi, [rbp - 0x48]
mov rcx, rdi
call fcn.18002d020
mov rdx, qword [rbx + 0x10]
inc rdx
lea rcx, [rbp - 0x28]
call fcn.18002d020
mov rax, qword [0x180050e90]
cmp byte [0x180052eed], 0
jne 0x180031bfe
movabs rcx, 0xca53513561a5674f
add rcx, rax
movabs rdx, 0xca53513561a5676b
add rdx, rax
xor r8d, r8d
lea r9, [0x180052ee3]
nop word cs:[rax + rax]
movzx r11d, byte [rcx + r8]
mov r10d, r11d
and r10b, 0x2b
mov ebx, r10d
xor bl, 0x2b
mov r14d, r11d
xor r14b, 0xd4
or r14b, bl
xor r10b, r14b
mov ebx, r10d
xor bl, 0xd4
or r11b, 0xd4
and r11b, r14b
or r11b, bl
xor r10b, 0x2b
mov ebx, r10d
xor bl, r11b
or r10b, r11b
not r10b
or r10b, bl
xor r10b, byte [rdx + r8]
xor r10b, 0x2b
mov byte [r8 + r9], r10b
inc r8
cmp r8, 0xa
jne 0x180031ba0
mov byte [0x180052eed], 1
cmp byte [0x180052ee2], 0
jne 0x180031ca1
movabs rcx, 0xca53513561a56714
add rcx, rax
movabs rdx, 0xca53513561a56728
add rdx, rax
xor eax, eax
lea r8, [0x180052ed8]
nop
movzx r9d, byte [rdx + rax]
movzx r10d, byte [rcx + rax]
mov r11d, r9d
and r11b, 0xbb
add r11b, 0x80
and r11b, r9b
mov ebx, r9d
and bl, 0x80
or bl, 0x53
mov r14d, r9d
and r14b, 0x44
xor r14b, bl
xor r14b, r11b
xor r14b, 0x17
mov r11d, r9d
xor r11b, 0xbb
xor r9b, 0x44
or r9b, r11b
not r9b
or r9b, r14b
mov r11d, r10d
xor r11b, 0x44
xor r10b, 0xbb
or r10b, r11b
not r10b
or r10b, r11b
xor r10b, r9b
mov byte [rax + r8], r10b
inc rax
cmp rax, 0xa
jne 0x180031c30
mov byte [0x180052ee2], 1
movabs r9, 0xca53513561a538e2
mov rdx, qword [0x180050e98]
add rdx, r9
add r9, qword [0x180050ea0]
mov qword [rsp + 0x20], rdi
lea r8, [rbp - 0x28]
mov rcx, rsi
call fcn.180032090
mov rax, qword [rbp - 0x10]
cmp rax, 0x10
jb 0x180031d1e
mov rcx, qword [rbp - 0x28]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x180031d19
mov r8, qword [rcx - 8]
sub rcx, r8
movabs rdx, 0x5537c683897700f8
add rdx, rcx
shr rdx, 5
movabs rcx, 0x2a9be341c4bb808
cmp rdx, rcx
jne 0x180031d7d
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.18003c9c4
mov rax, qword [rbp - 0x30]
cmp rax, 0x10
jb 0x180031d6f
mov rcx, qword [rbp - 0x48]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x180031d6a
mov r8, qword [rcx - 8]
sub rcx, r8
movabs rdx, 0x5537c683897700f8
add rdx, rcx
shr rdx, 5
movabs rcx, 0x2a9be341c4bb808
cmp rdx, rcx
jne 0x180031d7d
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.18003c9c4
mov rax, rsi
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x180038170
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
sub rsp, 0x18
movdqa xmmword [rsp], xmm6
cmp byte [0x180051ec0], 0
jne 0x1800382f6
lea rdx, [rcx + 0x21]
lea rax, [0x180051eb0]
cmp rdx, rax
jbe 0x180038232
lea rdx, [0x180051ec0]
cmp rcx, rdx
jae 0x180038232
xor edx, edx
nop
movzx r8d, byte [rcx + rdx]
movzx r9d, byte [rcx + rdx + 0x11]
mov r11d, r9d
not r11b
mov r10d, r9d
and r10b, 0x82
mov ebx, r9d
and bl, 0x25
mov esi, r11d
and sil, 0x40
or sil, bl
mov ebx, r9d
and bl, 0x18
xor sil, 0xa7
or r10b, 0x65
and r10b, sil
or r10b, bl
xor r10b, 0x18
and r11b, 8
mov ebx, r9d
and bl, 0xf7
or bl, r11b
xor bl, 0x75
xor r9b, 0x82
or r9b, bl
not r9b
or r9b, r10b
xor r8b, 0x7d
mov r10d, r8d
xor r10b, r8b
xor r10b, r9b
and r10b, r9b
xor r10b, r8b
mov byte [rdx + rax], r10b
inc rdx
cmp rdx, 0x10
jne 0x1800381b0
jmp 0x1800382ef
movdqu xmm0, xmmword [rcx]
movdqu xmm2, xmmword [rcx + 0x11]
movdqa xmm3, xmmword [0x180042e80]
movdqa xmm1, xmm2
pand xmm1, xmm3
movdqa xmm4, xmmword [str.________________________________]
pand xmm4, xmm2
movdqa xmm5, xmm2
pandn xmm5, xmmword [0x180042ea0]
por xmm5, xmm4
movdqa xmm4, xmmword [0x180042920]
movdqa xmm6, xmm2
pand xmm6, xmm4
pxor xmm5, xmmword [0x180042eb0]
por xmm1, xmmword [str.eeeeeeeeeeeeeeee]
pand xmm1, xmm5
por xmm1, xmm6
pxor xmm1, xmm4
movdqa xmm4, xmm2
pandn xmm4, xmmword [0x180042ba0]
movdqa xmm5, xmmword [0x180042ed0]
pand xmm5, xmm2
por xmm5, xmm4
pxor xmm5, xmmword [str.uuuuuuuuuuuuuuuussssssssssssssss]
pxor xmm2, xmm3
por xmm2, xmm5
pcmpeqd xmm3, xmm3
pxor xmm3, xmm2
por xmm3, xmm1
pxor xmm0, xmmword [0x180042ef0]
movdqa xmm1, xmm3
pandn xmm1, xmm0
pxor xmm0, xmm3
pand xmm0, xmm3
por xmm0, xmm1
movdqa xmmword [0x180051eb0], xmm0
mov byte [0x180051ec0], 1
movaps xmm6, xmmword [rsp]
add rsp, 0x18
pop rbx
pop rsi
ret
Function at 0x180038310
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
movdqa xmmword [rsp + 0x40], xmm10
movdqa xmmword [rsp + 0x30], xmm9
movdqa xmmword [rsp + 0x20], xmm8
movdqa xmmword [rsp + 0x10], xmm7
movdqa xmmword [rsp], xmm6
cmp byte [0x180051f10], 0
jne 0x180038509
lea rdx, [rcx + 0x21]
lea rax, [0x180051f00]
cmp rdx, rax
jbe 0x180038414
lea rdx, [0x180051f10]
cmp rcx, rdx
jae 0x180038414
xor edx, edx
nop dword [rax + rax]
movzx esi, byte [rcx + rdx]
movzx r8d, byte [rcx + rdx + 0x11]
mov ebx, r8d
not bl
mov r10d, esi
not r10b
mov r11d, esi
or r11b, 0x8c
mov r9d, r11d
not r9b
xor sil, 0x8c
and r10b, 0x73
or r10b, sil
or bl, 0x73
mov esi, ebx
and sil, 0xa3
mov edi, r8d
and dil, 0xc
or dil, sil
mov esi, r8d
and sil, 0x73
xor dil, sil
xor dil, 0xd0
mov ebp, r8d
and bpl, 4
and bl, 0xe8
or bl, bpl
xor bl, sil
xor bl, 0x9b
xor r8b, 0x8c
or r8b, bl
not r8b
or r8b, dil
mov ebx, r10d
not bl
and bl, r9b
and r11b, 0x2f
and r9b, 0x50
or r9b, r11b
xor r9b, r10b
xor r9b, 0xd0
or r9b, bl
xor r9b, r8b
mov byte [rdx + rax], r9b
inc rdx
cmp rdx, 0x10
jne 0x180038370
jmp 0x180038502
movdqu xmm0, xmmword [rcx]
movdqu xmm1, xmmword [rcx + 0x11]
movdqa xmm5, xmmword [0x180042b40]
movdqa xmm4, xmm1
pand xmm4, xmm5
movdqa xmm2, xmm0
por xmm2, xmm5
pcmpeqd xmm6, xmm6
movdqa xmm3, xmm2
pxor xmm3, xmm6
movdqa xmm7, xmm0
pxor xmm7, xmm5
movdqa xmm8, xmmword [0x180042f00]
pandn xmm0, xmm8
por xmm0, xmm7
movdqa xmm7, xmm4
pandn xmm7, xmmword [0x180042f10]
movdqa xmm9, xmmword [str._f_f_f_f_f_f_f_f_f_f_f_f_f_f_f_f]
pand xmm9, xmm1
por xmm9, xmm7
pand xmm8, xmm1
movdqa xmm7, xmmword [0x180042f30]
movdqa xmm10, xmmword [0x180042b70]
pandn xmm4, xmmword [0x180042f40]
pand xmm10, xmm1
por xmm4, xmm10
pxor xmm4, xmm8
pxor xmm8, xmm7
pxor xmm8, xmm9
pxor xmm4, xmmword [0x180042f50]
pxor xmm1, xmm5
por xmm1, xmm4
pxor xmm1, xmm6
por xmm1, xmm8
movdqa xmm4, xmm0
pandn xmm4, xmm3
movdqa xmm3, xmmword [str.________________PPPPPPPPPPPPPPPP]
pand xmm3, xmm2
pandn xmm2, xmmword [0x180042f70]
por xmm2, xmm3
pxor xmm0, xmm7
pxor xmm0, xmm2
por xmm0, xmm4
pxor xmm0, xmm1
movdqa xmmword [0x180051f00], xmm0
mov byte [0x180051f10], 1
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x180038530
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
cmp byte [0x180051f29], 0
jne 0x180038663
xor r8d, r8d
movabs r9, 0x642c8590b21642c9
lea r10, [0x180051f11]
nop dword [rax]
mov rax, r8
mul r9
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
imul rdx, rax, 0xffffffffffffffe9
lea r11, [rcx + r8]
movzx eax, byte [rcx + r8 + 0x17]
movzx ebx, byte [rdx + r11]
mov esi, eax
or sil, 7
mov edi, esi
not dil
mov r11d, ebx
mov edx, ebx
xor dl, 5
and dl, bl
and sil, 0xda
mov ebp, edi
and bpl, 0x20
or bpl, sil
mov esi, ebp
xor sil, 0x25
xor bpl, 0x8f
and bpl, sil
mov esi, eax
or sil, 0x57
mov r14d, esi
and r14b, 0xc6
and dil, 0x28
or dil, r14b
not sil
and sil, bpl
and bpl, 0xf9
xor bpl, dil
mov edi, ebx
mov r14d, edx
not dl
mov r15d, ebx
or dl, bl
not bl
xor r11b, 0x28
and r11b, bl
xor bpl, 0xc2
or sil, bpl
and al, 7
xor al, sil
and dil, 0x50
and bl, 0x80
or bl, dil
xor bl, 0x85
and r11b, 0xf8
or r11b, bl
and r14b, 7
and r15b, 5
or r14b, 0x70
xor r14b, r15b
xor r14b, 0xa5
not dl
and dl, 5
or dl, r14b
xor dl, r14b
not dl
and dl, r11b
xor dl, r14b
mov r11d, edx
and r11b, 0xc
and dl, 0xf3
xor dl, al
or r11b, 2
xor r11b, dl
xor r11b, 0x57
mov byte [r8 + r10], r11b
inc r8
cmp r8, 0x18
jne 0x180038560
mov byte [0x180051f29], 1
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x180038670
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
movdqa xmmword [rsp], xmm6
cmp byte [0x180051f7b], 0
jne 0x1800388fa
lea rdx, [rcx + 0x3e]
lea rax, [0x180051f5c]
cmp rdx, rax
jbe 0x1800386a9
lea rdx, [0x180051f7b]
cmp rcx, rdx
jae 0x1800386a9
xor edx, edx
jmp 0x1800388b0
movd xmm3, dword [rcx + 0x1f]
movd xmm1, dword [rcx]
pcmpeqd xmm0, xmm0
movdqa xmm4, xmm3
pxor xmm4, xmm0
pandn xmm3, xmm1
por xmm4, xmm1
movdqa xmm1, xmmword [0x180042f80]
movdqa xmm5, xmm3
pxor xmm5, xmm1
movdqa xmm2, xmmword [str.VVVV]
movdqa xmm6, xmm4
pxor xmm6, xmm2
pxor xmm3, xmm2
pand xmm3, xmm6
pxor xmm4, xmm1
pand xmm4, xmm5
por xmm4, xmm3
movd dword [0x180051f5c], xmm4
movd xmm3, dword [rcx + 0x23]
movd xmm4, dword [rcx + 4]
movdqa xmm5, xmm3
pxor xmm5, xmm0
pandn xmm3, xmm4
por xmm5, xmm4
movdqa xmm4, xmm3
pxor xmm4, xmm1
movdqa xmm6, xmm5
pxor xmm6, xmm2
pxor xmm3, xmm2
pand xmm3, xmm6
pxor xmm5, xmm1
pand xmm5, xmm4
por xmm5, xmm3
movd dword [0x180051f60], xmm5
movd xmm3, dword [rcx + 0x27]
movd xmm4, dword [rcx + 8]
movdqa xmm5, xmm3
pxor xmm5, xmm0
pandn xmm3, xmm4
por xmm5, xmm4
movdqa xmm4, xmm3
pxor xmm4, xmm1
movdqa xmm6, xmm5
pxor xmm6, xmm2
pxor xmm3, xmm2
pand xmm3, xmm6
pxor xmm5, xmm1
pand xmm5, xmm4
por xmm5, xmm3
movd dword [0x180051f64], xmm5
movd xmm3, dword [rcx + 0x2b]
movd xmm4, dword [rcx + 0xc]
movdqa xmm5, xmm3
pxor xmm5, xmm0
pandn xmm3, xmm4
por xmm5, xmm4
movdqa xmm4, xmm3
pxor xmm4, xmm1
movdqa xmm6, xmm5
pxor xmm6, xmm2
pxor xmm3, xmm2
pand xmm3, xmm6
pxor xmm5, xmm1
pand xmm5, xmm4
por xmm5, xmm3
movd dword [0x180051f68], xmm5
movd xmm3, dword [rcx + 0x2f]
movd xmm4, dword [rcx + 0x10]
movdqa xmm5, xmm3
pxor xmm5, xmm0
pandn xmm3, xmm4
por xmm5, xmm4
movdqa xmm4, xmm3
pxor xmm4, xmm1
movdqa xmm6, xmm5
pxor xmm6, xmm2
pxor xmm3, xmm2
pand xmm3, xmm6
pxor xmm5, xmm1
pand xmm5, xmm4
por xmm5, xmm3
movd dword [0x180051f6c], xmm5
movd xmm3, dword [rcx + 0x33]
movd xmm4, dword [rcx + 0x14]
movdqa xmm5, xmm3
pxor xmm5, xmm0
pandn xmm3, xmm4
por xmm5, xmm4
movdqa xmm4, xmm3
pxor xmm4, xmm1
movdqa xmm6, xmm5
pxor xmm6, xmm2
pxor xmm3, xmm2
pand xmm3, xmm6
pxor xmm5, xmm1
pand xmm5, xmm4
por xmm5, xmm3
movd dword [0x180051f70], xmm5
movd xmm3, dword [rcx + 0x37]
movd xmm4, dword [rcx + 0x18]
pxor xmm0, xmm3
pandn xmm3, xmm4
por xmm0, xmm4
movdqa xmm4, xmm3
pxor xmm4, xmm1
movdqa xmm5, xmm0
pxor xmm5, xmm2
pxor xmm3, xmm2
pand xmm3, xmm5
pxor xmm0, xmm1
pand xmm0, xmm4
por xmm0, xmm3
movd dword [0x180051f74], xmm0
mov edx, 0x1c
nop word [rax + rax]
movzx r8d, byte [rcx + rdx]
movzx r9d, byte [rcx + rdx + 0x1f]
not r9b
mov r10d, r8d
and r10b, r9b
or r9b, r8b
mov r8d, r10d
xor r8b, 0xa9
mov r11d, r9d
xor r11b, 0x56
xor r10b, 0x56
and r10b, r11b
xor r9b, 0xa9
and r9b, r8b
or r9b, r10b
mov byte [rdx + rax], r9b
inc rdx
cmp rdx, 0x1f
jne 0x1800388b0
mov byte [0x180051f7b], 1
movaps xmm6, xmmword [rsp]
add rsp, 0x18
ret
Function at 0x180038940
Capabilities:
Encode data using xor

Disassembly:
cmp byte [0x180051fba], 0
jne 0x180038ad1
lea rdx, [rcx + 0x32]
lea rax, [0x180051fa4]
cmp rdx, rax
jbe 0x180038970
lea rdx, [0x180051fba]
cmp rcx, rdx
jae 0x180038970
xor edx, edx
jmp 0x180038a60
movss xmm0, dword [rcx + 0x1c]
movss xmm2, dword [rcx]
movaps xmm3, xmm0
andnps xmm3, xmm2
andnps xmm2, xmm0
movaps xmm0, xmmword [0x180042970]
movaps xmm4, xmm2
andps xmm4, xmm0
movaps xmm1, xmmword [str.wwww]
andps xmm2, xmm1
xorps xmm2, xmm3
xorps xmm2, xmm4
movss dword [0x180051fa4], xmm2
movss xmm2, dword [rcx + 0x20]
movss xmm3, dword [rcx + 4]
movaps xmm4, xmm2
andnps xmm4, xmm3
andnps xmm3, xmm2
movaps xmm2, xmm3
andps xmm2, xmm0
andps xmm3, xmm1
xorps xmm3, xmm4
xorps xmm3, xmm2
movss dword [0x180051fa8], xmm3
movss xmm2, dword [rcx + 0x24]
movss xmm3, dword [rcx + 8]
movaps xmm4, xmm2
andnps xmm4, xmm3
andnps xmm3, xmm2
movaps xmm2, xmm3
andps xmm2, xmm0
andps xmm3, xmm1
xorps xmm3, xmm4
xorps xmm3, xmm2
movss dword [0x180051fac], xmm3
movss xmm2, dword [rcx + 0x28]
movss xmm3, dword [rcx + 0xc]
movaps xmm4, xmm2
andnps xmm4, xmm3
andnps xmm3, xmm2
movaps xmm2, xmm3
andps xmm2, xmm0
andps xmm3, xmm1
xorps xmm3, xmm4
xorps xmm3, xmm2
movss dword [0x180051fb0], xmm3
movss xmm2, dword [rcx + 0x2c]
movss xmm3, dword [rcx + 0x10]
movaps xmm4, xmm2
andnps xmm4, xmm3
andnps xmm3, xmm2
andps xmm0, xmm3
andps xmm3, xmm1
xorps xmm3, xmm4
xorps xmm3, xmm0
movss dword [0x180051fb4], xmm3
mov edx, 0x14
nop word cs:[rax + rax]
movzx r8d, byte [rcx + rdx]
movzx r9d, byte [rcx + rdx + 0x1c]
mov r10d, r9d
not r10b
and r10b, r8b
not r8b
and r8b, r9b
mov r9d, r8d
and r9b, 0x88
and r8b, 0x77
xor r8b, r10b
xor r8b, r9b
mov byte [rdx + rax], r8b
movzx r8d, byte [rcx + rdx + 1]
movzx r9d, byte [rcx + rdx + 0x1d]
mov r10d, r9d
not r10b
and r10b, r8b
not r8b
and r8b, r9b
mov r9d, r8d
and r9b, 0x88
and r8b, 0x77
xor r8b, r10b
xor r8b, r9b
mov byte [rdx + rax + 1], r8b
add rdx, 2
cmp rdx, 0x16
jne 0x180038a60
mov byte [0x180051fba], 1
ret
Function at 0x180039320
Capabilities:
Encode data using xor

Disassembly:
cmp byte [0x180052100], 0
jne 0x1800393f8
lea rdx, [rcx + 0x22]
lea rax, [0x1800520f0]
cmp rdx, rax
jbe 0x180039398
lea rdx, [0x180052100]
cmp rcx, rdx
jae 0x180039398
xor edx, edx
nop dword [rax + rax]
movzx r8d, byte [rcx + rdx]
movzx r9d, byte [rcx + rdx + 0x12]
mov r10d, r8d
not r10b
or r10b, r9b
not r9b
or r9b, r8b
mov r8d, r10d
xor r8b, 0x61
mov r11d, r9d
xor r11b, 0x61
xor r10b, 0x9e
and r10b, r11b
xor r9b, 0x9e
and r9b, r8b
or r9b, r10b
mov byte [rdx + rax], r9b
inc rdx
cmp rdx, 0x10
jne 0x180039350
jmp 0x1800393f1
movdqu xmm0, xmmword [rcx]
movdqu xmm1, xmmword [rcx + 0x12]
pcmpeqd xmm2, xmm2
movdqa xmm3, xmm1
pxor xmm3, xmm2
pxor xmm2, xmm0
por xmm2, xmm1
por xmm3, xmm0
movdqa xmm0, xmmword [str.aaaaaaaaaaaaaaaa]
movdqa xmm1, xmm2
pxor xmm1, xmm0
pxor xmm0, xmm3
movdqa xmm4, xmmword [0x180043190]
pxor xmm2, xmm4
pand xmm2, xmm0
pxor xmm3, xmm4
pand xmm3, xmm1
por xmm3, xmm2
movdqa xmmword [0x1800520f0], xmm3
mov byte [0x180052100], 1
ret

Function at 0x18003a3e0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
cmp byte [0x180052bf5], 0
jne 0x18003a4c4
xor r8d, r8d
movabs r9, 0xf0f0f0f0f0f0f0f1
lea r10, [0x180052bcf]
nop word cs:[rax + rax]
mov rax, r8
mul r9
mov rax, rdx
shr rax, 4
and rdx, 0xfffffffffffffff0
add rdx, rax
lea r11, [rcx + r8]
sub r11, rdx
movzx ebx, byte [rcx + r8 + 0x11]
mov eax, ebx
not al
movzx edx, byte [r11]
or al, 0xcc
mov esi, ebx
and sil, 0xc
or sil, 0xa2
mov r11d, ebx
and r11b, 0xc0
or r11b, 0x11
xor r11b, sil
mov esi, r11d
xor sil, 0xac
and bl, 2
mov edi, eax
and dil, 0xd1
or dil, bl
or dil, 8
and al, 0x2c
xor al, dil
mov ebx, eax
xor bl, 0x24
xor r11b, 0x53
and r11b, bl
xor al, 0xd9
and al, sil
or al, r11b
mov r11d, edx
and r11b, 0x88
or r11b, 0x42
mov ebx, edx
and bl, 0x77
xor bl, r11b
xor bl, 0x8e
mov r11d, edx
xor r11b, 0x33
xor dl, 0xcc
or dl, r11b
not dl
or dl, bl
xor dl, al
mov byte [r8 + r10], dl
inc r8
cmp r8, 0x26
jne 0x18003a410
mov byte [0x180052bf5], 1
pop rbx
pop rdi
pop rsi
ret

Function at 0x18003a4d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [0x180052c1f], 0
jne 0x18003a53b
xor r8d, r8d
movabs r9, 0xd79435e50d79435f
lea r10, [0x180052bf6]
nop dword [rax]
mov rax, r8
mul r9
shr rdx, 4
imul rax, rdx, 0xffffffffffffffed
lea rdx, [rcx + r8]
movzx r11d, byte [rcx + r8 + 0x13]
movzx eax, byte [rax + rdx]
mov edx, eax
not dl
or dl, r11b
not r11b
or r11b, al
mov eax, r11d
and al, 0xc3
xor al, dl
and r11b, 0x3c
xor r11b, al
mov byte [r8 + r10], r11b
inc r8
cmp r8, 0x29
jne 0x18003a4f0
mov byte [0x180052c1f], 1
ret
Function at 0x18003a9f0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
cmp byte [0x180052dd8], 0
jne 0x18003ab11
xor r8d, r8d
movabs r9, 0xe38e38e38e38e38f
lea r10, [0x180052da7]
nop dword [rax]
mov rax, r8
mul r9
shr rdx, 3
and rdx, 0xfffffffffffffffe
lea rax, [rdx + rdx*8]
lea rdx, [rcx + r8]
sub rdx, rax
movzx eax, byte [rcx + r8 + 0x12]
movzx r11d, byte [rdx]
mov esi, r11d
not sil
mov edx, r11d
and dl, 0x78
mov ebx, eax
xor bl, 0x87
mov ebp, r11d
and bpl, 0x87
mov edi, r11d
or dil, 0x78
xor bpl, 0xac
and bpl, dil
mov r14d, r11d
xor r14b, 0x28
and r14b, dl
not dl
and sil, bpl
and bpl, 0x8f
mov r15d, r11d
or r15b, 0x33
and r15b, 0xb7
xor r15b, bpl
xor r15b, 0x97
and sil, 0x84
or sil, r15b
mov r15d, r11d
and r15b, 0x20
mov ebp, edx
and bpl, 0xb
or bpl, r15b
or bpl, 0x14
xor bpl, r14b
and r14b, 0x28
mov r15d, ebp
and r15b, 0x38
xor r15b, 0x30
and bpl, 0x43
or bpl, r14b
or bpl, r15b
xor bpl, sil
xor r11b, 0x78
xor dl, dil
or dl, r11b
mov r11d, eax
xor r11b, 0xcf
and r11b, bl
not bpl
and bpl, dl
and al, 0x48
mov edx, r11d
and dl, 0xec
xor dl, al
and r11b, 0x13
or r11b, dl
xor r11b, bpl
not r11b
mov byte [r8 + r10], r11b
inc r8
cmp r8, 0x31
jne 0x18003aa20
mov byte [0x180052dd8], 1
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x18003ab50
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
cmp byte [0x180052e67], 0
jne 0x18003ac2d
xor r8d, r8d
movabs r9, 0x8618618618618619
lea r10, [0x180052e4e]
nop word [rax + rax]
mov rax, r8
mul r9
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
imul rax, rax, 0xffffffffffffffeb
lea rdx, [rcx + r8]
movzx eax, byte [rax + rdx]
mov edx, eax
not dl
mov ebx, edx
and bl, 0xa9
mov r11d, eax
xor r11b, 0x56
or bl, r11b
mov r14d, eax
and r14b, 0x80
mov edi, edx
mov esi, eax
mov ebp, ebx
and dl, 0x29
or dl, r14b
or dl, 6
xor dl, bl
or al, 0x56
and al, bl
not bl
and dil, 0x28
and sil, 0x81
or sil, dil
mov edi, ebx
and dil, 0x29
and r11b, 0x44
or r11b, dil
and bpl, 0x82
and bl, 0x10
or bl, bpl
or r11b, 0x82
or bl, 0x29
xor bl, r11b
xor bl, sil
xor bl, 0xec
xor dl, 0x79
or al, dl
not al
or al, bl
xor al, byte [rcx + r8 + 0x15]
xor al, 0xa9
mov byte [r8 + r10], al
inc r8
cmp r8, 0x19
jne 0x18003ab80
mov byte [0x180052e67], 1
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x18003acf0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
cmp byte [0x180053059], 0
jne 0x18003adbd
xor r8d, r8d
movabs r9, 0x2e8ba2e8ba2e8ba3
lea r10, [0x18005303c]
nop dword [rax]
mov rax, r8
mul r9
shr rdx, 2
imul rax, rdx, 0xffffffffffffffea
lea r11, [rcx + r8]
movzx ebx, byte [rcx + r8 + 0x16]
mov edx, ebx
and dl, 0xc
mov esi, edx
xor sil, 0xc
mov edi, ebx
and dil, 0xf3
mov r14d, ebx
xor r14b, 8
and r14b, sil
mov r15d, ebx
xor r15b, 0x70
and r15b, dil
mov ebp, esi
or bpl, 0x8a
xor bpl, r14b
mov r14d, ebp
xor r14b, 0xfa
and bl, 0x70
or bl, 0x83
xor bl, r15b
mov r15d, ebx
xor r15b, 0x87
or bpl, 1
and bpl, r15b
or bl, 8
and bl, r14b
or dl, 0xc2
or sil, dil
xor dl, dil
xor dl, 0x31
and dl, sil
or dl, bl
or dl, bpl
xor dl, byte [rax + r11]
xor dl, 0xc
mov byte [r8 + r10], dl
inc r8
cmp r8, 0x1d
jne 0x18003ad20
mov byte [0x180053059], 1
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x18003d55c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x18003d596
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x18003d59b
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x18003d5e4
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x180045490]
cmp byte [rcx + rax], 0
je 0x18003d5e4
dec r8
sub rdx, 1
jne 0x18003d5ca
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x140013320
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov eax, dword [rcx]
xor r9d, r9d
mov rsi, r8
mov r11, rdx
mov r10, rcx
mov ebx, r9d
mov edi, r9d
test eax, eax
jle 0x14001336b
mov rdx, r8
nop word [rax + rax]
movzx eax, byte [rdx]
lea rdi, [rdi + 1]
mov rcx, qword [r11]
lea rdx, [rdx + 4]
inc ebx
xor byte [rcx + rdi - 1], al
mov eax, dword [r10]
cmp ebx, eax
jl 0x140013350
mov r8d, r9d
mov rbx, r9
test eax, eax
jle 0x14001339e
lea rdx, [rsi + 1]
nop dword [rax]
movzx eax, byte [rdx]
lea rbx, [rbx + 1]
mov rcx, qword [r11 + 8]
lea rdx, [rdx + 4]
inc r8d
xor byte [rcx + rbx - 1], al
mov eax, dword [r10]
cmp r8d, eax
jl 0x140013380
mov r8d, r9d
mov rbx, r9
test eax, eax
jle 0x1400133ce
lea rdx, [rsi + 2]
nop dword [rax]
movzx eax, byte [rdx]
lea rbx, [rbx + 1]
mov rcx, qword [r11 + 0x10]
lea rdx, [rdx + 4]
inc r8d
xor byte [rcx + rbx - 1], al
mov eax, dword [r10]
cmp r8d, eax
jl 0x1400133b0
mov r8, r9
test eax, eax
jle 0x1400133fc
lea rdx, [rsi + 3]
nop dword [rax]
movzx eax, byte [rdx]
lea r8, [r8 + 1]
mov rcx, qword [r11 + 0x18]
lea rdx, [rdx + 4]
inc r9d
xor byte [rcx + r8 - 1], al
cmp r9d, dword [r10]
jl 0x1400133e0
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret