joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c6000
Capabilities:
Encode data using xor

Disassembly:
call fcn.004c7f36
call fcn.004c7f54
call fcn.004c7e05
call fcn.004c7e4f
call fcn.004c7e7e
call fcn.004c7a3e
call fcn.004c7a85
lea rax, [rsp + 0x10]
mov qword [0x004c946c], rax
call fcn.004c7ac5
call fcn.004c7f36
call fcn.004c7fc1
mov r10, qword [0x004c932c]
add r10, 0x77
sub rsp, 0x30
push rsp
mov r9, rsp
mov r8d, 0x40
mov rdx, r10
movabs rcx, section.vmprotec
sub rsp, 0x30
call rsi
add rsp, 0x30
mov rdx, qword [0x004c932c]
mov rdi, qword [0x004c922c]
movabs rsi, section.vmprotec
xor rcx, rcx
mov rbx, qword [rdi]
add rbx, 0xc
xor rbx, 0xc0ffee
mov qword [rsi], rbx
inc rdi
inc rsi
dec rdx
cmp rdx, rcx
jne 0x4c6089
movabs rbx, 0x6578652e3054
push rbx
mov byte [rsp + 8], 0
lea rbx, [rsp]
mov qword [0x004c936c], rbx
call fcn.004c7c65
movabs rdi, 0x636f6c6c616d
push rdi
lea rdx, [rsp]
mov rcx, r15
sub rsp, 0x30
call r14
add rsp, 0x30
mov rcx, qword [0x004c92ec]
sub rsp, 0x30
call rax
mov qword [0x004c92ac], rax
mov rdi, rax
add rsp, 0x30
add rsp, 8
mov rcx, qword [0x004c92ec]
mov rdx, qword [0x004c92ac]
mov rdi, qword [0x004c926c]
mov rsi, qword [rdi]
mov qword [rdx], rsi
inc rdi
inc rdx
dec rcx
cmp rcx, 0
jne 0x4c6119
mov rdx, qword [0x004c92ac]
movabs rdi, section.vmprotec
add rdx, 0x400
mov rcx, qword [0x004c932c]
mov rsi, qword [rdi]
mov qword [rdx], rsi
inc rdi
inc rdx
dec rcx
cmp rcx, 0
jne 0x4c614d
movabs rax, 0x6e65706f66
push rax
lea rdx, [rsp]
mov rcx, r15
sub rsp, 0x30
call r14
add rsp, 0x30
add rsp, 8
movabs rbx, 0x6578652e307854
push rbx
lea rcx, [rsp]
mov ebx, 0x2b6277
push rbx
lea rdx, [rsp]
sub rsp, 0x30
call rax
mov rsi, rax
add rsp, 0x30
movabs rax, 0x657469727766
push rax
lea rdx, [rsp]
mov rcx, r15
sub rsp, 0x30
call r14
add rsp, 0x30
add rsp, 8
mov rbx, qword [0x004c92ac]
mov edx, dword [rbx + 0x3c]
add rbx, rdx
add rbx, 0x28
mov dword [rbx], 0xc7000
xor r8, r8
mov r8, qword [0x004c92ec]
mov edx, r8d
mov r9, rsi
mov r8d, 1
mov rcx, qword [0x004c92ac]
sub rsp, 0x30
call rax
add rsp, 0x30
add rsp, 8
movabs rax, 0x65736f6c6366
push rax
lea rdx, [rsp]
mov rcx, r15
sub rsp, 0x30
call r14
add rsp, 0x30
add rsp, 8
sub rsp, 0x30
mov rcx, rsi
call r12
add rsp, 0x30
add rsp, 8

Function at 0x4c7f36
Capabilities:
Access peb ldr_data

Disassembly:
xor rcx, rcx
mov rax, qword gs:[rcx + 0x60]
mov rax, qword [rax + 0x18]
mov rsi, qword [rax + 0x20]
lodsq rax, qword [rsi]
xchg rsi, rax
lodsq rax, qword [rsi]
mov rbx, qword [rax + 0x20]
mov r8, rbx
ret
Function at 0x18000a4b0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x18000a4d8
xor eax, eax
lea r8, [0x180004ce0]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x38
ret

Function at 0x18000a980
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov r14, r8
mov rbp, rdx
mov rdi, rcx
mov rbx, r8
je 0x18000aa18
test r8, r8
jle 0x18000aa10
nop word [rax + rax]
mov rcx, rdi
call fcn.18000d4f0
test rax, rax
jle 0x18000a9ee
mov rcx, qword [rdi + 0x40]
cmp rbx, rax
mov rsi, rbx
mov rdx, rbp
cmovge rsi, rax
mov r8, rsi
mov rcx, qword [rcx]
call fcn.180029ba0
mov rax, qword [rdi + 0x58]
sub rbx, rsi
sub dword [rax], esi
mov rcx, qword [rdi + 0x40]
movsxd rax, esi
add qword [rcx], rax
jmp 0x18000aa08
mov rax, qword [rdi]
mov rcx, rdi
movzx edx, byte [rbp]
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x18000aa10
dec rbx
mov esi, 1
add rbp, rsi
test rbx, rbx
jg 0x18000a9b0
sub r14, rbx
mov rax, r14
jmp 0x18000aa96
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], r15
mov r9, qword [rax]
test r9, r9
je 0x18000aa31
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x18000aa33
xor ecx, ecx
movsxd rsi, ecx
test r14, r14
jle 0x18000aa8b
test ecx, ecx
jle 0x18000aa6c
cmp r14, rsi
mov rcx, r9
cmovl rsi, r14
mov r8, rsi
call fcn.180029ba0
mov rax, qword [rdi + 0x58]
add rbp, rsi
sub r14, rsi
sub dword [rax], esi
mov rcx, qword [rdi + 0x40]
movsxd rax, esi
add qword [rcx], rax
test r14, r14
jle 0x18000aa8b
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x18000aa8b
mov r8, r14
mov edx, 1
mov rcx, rbp
call fcn.18003a388
sub r14, rax
mov r15, qword [rsp + 0x40]
sub rbx, r14
mov rax, rbx
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x18000aab0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x18000aad2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x18000ab4c
mov rdi, r14
mov rcx, rbx
call fcn.18000d510
test rax, rax
jle 0x18000ab24
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.180029ba0
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x18000ab3c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x18000ab44
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x18000aae6
sub r14, rdi
jmp 0x18000ac2f
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x18000ab63
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x18000ab65
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x18000ab97
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.180029ba0
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x18000ac2c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x18000abd2
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x18000ac0d
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.18003a66c
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x18000ac2c
cmp rbp, rax
ja 0x18000abe0
test rbp, rbp
je 0x18000ac2c
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.18003a66c
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
Function at 0x18000b050
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x18007a1d8]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x18000b07d
xor eax, eax
jmp 0x18000b1c3
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x18000b0b7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x18000b0b7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x18000b1c3
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x18000b1b6
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x18000b0fa
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x18000b109
movsx ecx, dil
jmp 0x18000b15d
lea r8, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x51]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x48]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x50]
call qword [rax + 0x38]
test eax, eax
je 0x18000b177
sub eax, 1
je 0x18000b177
cmp eax, 2
jne 0x18000b1b6
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call fcn.18003911c
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x18000b1bb
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x18000b1a4
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call fcn.18003a388
cmp rsi, rax
jne 0x18000b1b6
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x18000b1bb
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.180027820
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x180021380
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r10, rdx
test r9, r9
je 0x1800214d4
cmp r9, 4
jb 0x1800213ca
mov rdx, r9
shr rdx, 2
imul rax, rdx, 0xfffffffffffffffc
add r9, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, dword [r10]
add r10, 4
xor eax, dword [r8]
add r8, 4
mov dword [rcx], eax
add rcx, 4
sub rdx, 1
jne 0x1800213b0
xor r11d, r11d
test r9, r9
je 0x1800214d4
cmp r9, 0x40
jb 0x1800214b3
lea rdx, [rcx - 1]
lea rax, [r8 - 1]
add rdx, r9
add rax, r9
cmp rcx, rax
ja 0x1800213fc
cmp rdx, r8
jae 0x1800214b3
lea rax, [r10 - 1]
add rax, r9
cmp rcx, rax
ja 0x180021411
cmp rdx, r10
jae 0x1800214b3
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov rsi, r9
and rsi, 0xffffffffffffffc0
mov qword [rsp], rdi
mov rdx, r10
lea rax, [r8 + 0x10]
sub rdx, r8
mov rbx, rcx
sub rbx, r8
nop word [rax + rax]
movdqu xmm0, xmmword [rax - 0x10]
add r11, 0x40
movdqu xmm1, xmmword [rdx + rax - 0x10]
movdqu xmm2, xmmword [rdx + rax]
lea rax, [rax + 0x40]
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmmword [rbx + rax - 0x50], xmm1
pxor xmm2, xmm0
movdqu xmm0, xmmword [rax - 0x30]
movdqu xmm1, xmmword [rdx + rax - 0x30]
movdqu xmmword [rbx + rax - 0x40], xmm2
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm2, xmmword [rdx + rax - 0x20]
movdqu xmmword [rbx + rax - 0x30], xmm1
pxor xmm2, xmm0
movdqu xmmword [rbx + rax - 0x20], xmm2
cmp r11, rsi
jb 0x180021440
mov rsi, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x10]
mov rdi, qword [rsp]
cmp r11, r9
jae 0x1800214d4
sub r10, r8
lea rdx, [r11 + r8]
sub rcx, r8
sub r9, r11
movzx eax, byte [rdx + r10]
xor al, byte [rdx]
mov byte [rdx + rcx], al
lea rdx, [rdx + 1]
sub r9, 1
jne 0x1800214c0
add rsp, 8
ret
Function at 0x1408ea108
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1408ea28f
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1408ea139
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1408ea11f
add dl, dl
jne 0x1408ea146
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1408ea1a6
xor eax, eax
add dl, dl
jne 0x1408ea155
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1408ea25d
add dl, dl
jne 0x1408ea166
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408ea173
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408ea180
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408ea18d
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1408ea19a
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1408ea12e
mov eax, 1
add dl, dl
jne 0x1408ea1b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408ea1c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1408ea1ab
sub eax, ebx
mov ebx, 1
jne 0x1408ea1fc
mov ecx, 1
add dl, dl
jne 0x1408ea1de
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1408ea1eb
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1408ea1d3
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1408ea12e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1408ea218
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1408ea225
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1408ea20d
cmp eax, 0x7d00
jae 0x1408ea24b
cmp eax, 0x500
jb 0x1408ea246
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1408ea12e
cmp eax, 0x7f
ja 0x1408ea24e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1408ea12e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1408ea282
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1408ea12e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001fc4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000200e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000200e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000200e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000200e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000200e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002010
xor al, al
add rsp, 0x28
ret
Function at 0x1800016c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rax, qword [0x18001a870]
mov rbx, rcx
xor ecx, ecx
mov qword [rsp + 0x20], rcx
test rax, rax
jne 0x1800018c5
cmp dword [0x180016050], 2
movups xmm0, xmmword [str.qWKNk_JP]
mov eax, dword [0x180013b58]
movups xmm1, xmmword [0x180013b38]
mov dword [rsp + 0x58], eax
movups xmmword [rsp + 0x28], xmm0
movups xmm0, xmmword [0x180013b48]
movups xmmword [rsp + 0x38], xmm1
movups xmmword [rsp + 0x48], xmm0
jl 0x180001863
movdqa xmm5, xmmword [0x180013d50]
lea rdx, [rsp + 0x28]
movdqa xmm4, xmmword [0x180013f00]
movaps xmmword [rsp + 0x80], xmm6
movdqa xmm6, xmmword [str.3333]
movaps xmmword [rsp + 0x70], xmm7
movdqa xmm7, xmmword [0x180013d70]
nop
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 0x10]
paddd xmm2, xmm5
add ecx, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm7
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rdx - 0x10]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
xorps xmm3, xmm0
movq qword [rdx - 0x10], xmm3
paddd xmm2, xmm5
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
mov eax, ecx
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm7
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rdx - 8]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
xorps xmm3, xmm0
movq qword [rdx - 8], xmm3
cmp ecx, 0x18
jl 0x180001760
movaps xmm7, xmmword [rsp + 0x70]
movaps xmm6, xmmword [rsp + 0x80]
cmp eax, 0x1a
jge 0x1800018a3
movsxd rax, ecx
lea r8, [rsp + 0x28]
lea r8, [r8 + rax*2]
nop
mov eax, 0xa0a0a0a1
lea r8, [r8 + 2]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul edx, eax, 0x33
movzx eax, cx
inc ecx
sub ax, dx
add ax, 0x37
xor word [r8 - 2], ax
cmp ecx, 0x1a
jl 0x180001870
mov rax, qword [0x180016940]
lea r8, [rsp + 0x28]
add rax, 0x12933d0
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call rax
mov qword [0x18001a870], rax
mov r9, qword [rbx]
lea r8, [rsp + 0x20]
mov rdx, rax
mov rcx, rbx
call qword [r9 + 0x260]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.180010a30
add rsp, 0x90
pop rbx
ret
Function at 0x180001900
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0xc0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rax, qword [0x18001a8c8]
xor ecx, ecx
mov rdi, qword [0x18001a728]
mov rbx, rdx
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rcx
test rax, rax
jne 0x180001b45
cmp dword [0x180016050], 2
movups xmm0, xmmword [str.pYT_KPGl4_66h]
movups xmm1, xmmword [0x180013ab0]
movups xmmword [rsp + 0x40], xmm0
movups xmm0, xmmword [0x180013ac0]
movups xmmword [rsp + 0x50], xmm1
movups xmm1, xmmword [0x180013ad0]
movups xmmword [rsp + 0x60], xmm0
movsd xmm0, qword [0x180013ae0]
movups xmmword [rsp + 0x70], xmm1
movsd qword [r11 - 0x48], xmm0
jl 0x180001ad6
movdqa xmm5, xmmword [0x180013d50]
lea rdx, [rsp + 0x40]
movdqa xmm4, xmmword [0x180013f00]
movaps xmmword [r11 - 0x18], xmm6
movdqa xmm6, xmmword [str.3333]
movaps xmmword [r11 - 0x28], xmm7
movdqa xmm7, xmmword [0x180013d70]
nop dword [rax + rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 0x10]
paddd xmm2, xmm5
add ecx, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm7
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rdx - 0x10]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
xorps xmm3, xmm0
movq qword [rdx - 0x10], xmm3
paddd xmm2, xmm5
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
mov eax, ecx
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm7
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rdx - 8]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
xorps xmm3, xmm0
movq qword [rdx - 8], xmm3
cmp ecx, 0x20
jl 0x1800019d0
movaps xmm7, xmmword [rsp + 0xa0]
movaps xmm6, xmmword [rsp + 0xb0]
cmp eax, 0x24
jge 0x180001b23
movsxd rax, ecx
lea r8, [rsp + 0x40]
lea r8, [r8 + rax*2]
nop dword [rax]
nop word [rax + rax]
mov eax, 0xa0a0a0a1
lea r8, [r8 + 2]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul edx, eax, 0x33
movzx eax, cx
inc ecx
sub ax, dx
add ax, 0x37
xor word [r8 - 2], ax
cmp ecx, 0x24
jl 0x180001af0
mov rax, qword [0x180016940]
lea r8, [rsp + 0x40]
add rax, 0x12933d0
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call rax
mov qword [0x18001a8c8], rax
mov r9, qword [rdi]
lea r8, [rsp + 0x20]
mov rdx, rax
mov rcx, rdi
call qword [r9 + 0x260]
movups xmm0, xmmword [rsp + 0x30]
mov rax, rbx
movups xmmword [rbx], xmm0
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.180010a30
mov rbx, qword [rsp + 0xd0]
add rsp, 0xc0
pop rdi
ret
Function at 0x180001b90
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0xc0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rax, qword [0x18001a840]
xor ecx, ecx
mov rdi, qword [0x18001a6e8]
mov rbx, rdx
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rcx
test rax, rax
jne 0x180001dd5
cmp dword [0x180016050], 2
movups xmm0, xmmword [0x1800138c0]
movups xmm1, xmmword [0x1800138d0]
mov eax, dword [0x180013900]
movups xmmword [rsp + 0x40], xmm0
movups xmm0, xmmword [0x1800138e0]
movups xmmword [rsp + 0x50], xmm1
movups xmm1, xmmword [str._:41]
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm1
mov dword [r11 - 0x48], eax
jl 0x180001d66
movdqa xmm5, xmmword [0x180013d50]
lea rdx, [rsp + 0x40]
movdqa xmm4, xmmword [0x180013f00]
movaps xmmword [r11 - 0x18], xmm6
movdqa xmm6, xmmword [str.3333]
movaps xmmword [r11 - 0x28], xmm7
movdqa xmm7, xmmword [0x180013d70]
nop dword [rax]
nop word [rax + rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 0x10]
paddd xmm2, xmm5
add ecx, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm7
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rdx - 0x10]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
xorps xmm3, xmm0
movq qword [rdx - 0x10], xmm3
paddd xmm2, xmm5
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
mov eax, ecx
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm7
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rdx - 8]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
xorps xmm3, xmm0
movq qword [rdx - 8], xmm3
cmp ecx, 0x20
jl 0x180001c60
movaps xmm7, xmmword [rsp + 0xa0]
movaps xmm6, xmmword [rsp + 0xb0]
cmp eax, 0x22
jge 0x180001db3
movsxd rax, ecx
lea r8, [rsp + 0x40]
lea r8, [r8 + rax*2]
nop dword [rax]
nop word [rax + rax]
mov eax, 0xa0a0a0a1
lea r8, [r8 + 2]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul edx, eax, 0x33
movzx eax, cx
inc ecx
sub ax, dx
add ax, 0x37
xor word [r8 - 2], ax
cmp ecx, 0x22
jl 0x180001d80
mov rax, qword [0x180016940]
lea r8, [rsp + 0x40]
add rax, 0x12933d0
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call rax
mov qword [0x18001a840], rax
mov r9, qword [rdi]
lea r8, [rsp + 0x20]
mov rdx, rax
mov rcx, rdi
call qword [r9 + 0x260]
movups xmm0, xmmword [rsp + 0x28]
mov rax, rbx
movups xmmword [rbx], xmm0
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.180010a30
mov rbx, qword [rsp + 0xd0]
add rsp, 0xc0
pop rdi
ret