joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000ad7a
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xd0
mov rdx, qword [0x1800121d0]
test rdx, rdx
jne 0x18000adf6
lea rdx, [rsp + 0x42]
movaps xmm0, xmmword [0x18000f850]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x18000f860]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x18000f870]
movaps xmmword [rdx + 0x1e], xmm0
movaps xmm0, xmmword [0x18000f880]
movaps xmmword [rdx + 0x2e], xmm0
mov word [rdx + 0x7a], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0x64
inc rax
cmp rax, 0x3e
jne 0x18000adca
mov word [rsp + 0xbc], 0
lea rcx, [rsp + 0x30]
call fcn.180009616
mov rdx, rax
mov qword [0x1800121d0], rax
mov rcx, qword [0x1800121d8]
test rcx, rcx
jne 0x18000ae77
lea rdx, [rsp + 0x42]
movaps xmm0, xmmword [0x18000f890]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x18000f8a0]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x18000f8b0]
movaps xmmword [rdx + 0x1e], xmm0
movaps xmm0, xmmword [0x18000f8c0]
movaps xmmword [rdx + 0x2e], xmm0
mov word [rdx + 0x3e], 0x4a
mov word [rdx + 0x7e], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0x4a
inc rax
cmp rax, 0x40
jne 0x18000ae44
mov word [rsp + 0xc0], 0
lea rcx, [rsp + 0x30]
call fcn.180009616
mov rcx, rax
mov qword [0x1800121d8], rax
mov rdx, qword [0x1800121d0]
mov rax, qword [0x180011e00]
lea rsi, [rsp + 0x40]
mov qword [rsi], rax
mov dword [rsi + 8], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x268]
lea r8, [rsp + 0x30]
mov qword [r8], rax
mov qword [r8 + 8], 0
mov qword [rsp + 0x20], r8
mov r8, rsi
xor r9d, r9d
call fcn.18000dbe0
mov rax, qword [rsi + 0x10]
add rsp, 0xd0
pop rsi
ret
Function at 0x18000aec4
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xe0
mov rsi, r9
mov rdi, r8
mov rbx, rdx
mov rdx, qword [0x1800121e0]
test rdx, rdx
jne 0x18000af62
lea rdx, [rsp + 0x42]
movaps xmm0, xmmword [0x18000f8d0]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x18000f8e0]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x18000f8f0]
movaps xmmword [rdx + 0x1e], xmm0
movaps xmm0, xmmword [0x18000f900]
movaps xmmword [rdx + 0x2e], xmm0
movabs rax, 0xb000b00190014
mov qword [rdx + 0x3e], rax
mov word [rdx + 0x46], pe_nt_image_headers64
mov word [rdx + 0x8e], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0x78
inc rax
cmp rax, 0x48
jne 0x18000af36
mov word [rsp + 0xd0], 0
lea rcx, [rsp + 0x30]
call fcn.180009616
mov rdx, rax
mov qword [0x1800121e0], rax
mov rcx, qword [0x1800121e8]
test rcx, rcx
jne 0x18000afe3
lea rdx, [rsp + 0x42]
movaps xmm0, xmmword [0x18000f910]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x18000f920]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x18000f930]
movaps xmmword [rdx + 0x1e], xmm0
movaps xmm0, xmmword [0x18000f940]
movaps xmmword [rdx + 0x2e], xmm0
mov word [rdx + 0x3e], 0x54
mov word [rdx + 0x7e], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0x54
inc rax
cmp rax, 0x40
jne 0x18000afb0
mov word [rsp + 0xc0], 0
lea rcx, [rsp + 0x30]
call fcn.180009616
mov rcx, rax
mov qword [0x1800121e8], rax
mov rdx, qword [0x1800121e0]
xorps xmm0, xmm0
lea r8, [rsp + 0x40]
movups xmmword [r8 + 0x10], xmm0
mov qword [r8], rbx
mov qword [r8 + 8], rdi
mov rax, qword [rcx]
mov rax, qword [rax + 0x268]
lea r9, [rsp + 0x30]
mov qword [r9], rax
mov qword [r9 + 8], 0
mov qword [rsp + 0x20], r9
xor r9d, r9d
call fcn.18000dbe0
test rsi, rsi
je 0x18000b02e
lea rax, [rsp + 0x50]
movups xmm0, xmmword [rax]
movups xmmword [rsi], xmm0
add rsp, 0xe0
pop rbx
pop rdi
pop rsi
ret

Function at 0x18000b0dc
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xb0
movaps xmmword [rsp + 0xa0], xmm6
movaps xmm6, xmm1
mov rdx, qword [0x180012200]
test rdx, rdx
jne 0x18000b158
lea rdx, [rsp + 0x42]
movaps xmm0, xmmword [0x18000f950]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x18000f960]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x18000f970]
movaps xmmword [rdx + 0x1e], xmm0
mov word [rdx + 0x5a], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0x23
inc rax
cmp rax, 0x2e
jne 0x18000b12c
mov word [rsp + 0x9c], 0
lea rcx, [rsp + 0x30]
call fcn.180009616
mov rdx, rax
mov qword [0x180012200], rax
cmp byte [0x180012210], 1
jne 0x18000b1b1
mov rcx, qword [0x180012208]
lea rsi, [rsp + 0x30]
movsd qword [rsi], xmm6
mov rax, qword [rcx]
mov rax, qword [rax + 0x268]
lea r8, [rsp + 0x40]
mov qword [r8], rax
mov qword [r8 + 8], 0
mov qword [rsp + 0x20], r8
mov r8, rsi
xor r9d, r9d
call fcn.18000dbe0
movsd xmm0, qword [rsi + 8]
movaps xmm6, xmmword [rsp + 0xa0]
add rsp, 0xb0
pop rsi
ret
mov byte [0x180012210], 1
lea rdx, str.Engine.Default__KismetMathLibrary
lea rcx, [rsp + 0x40]
call fcn.180009616
mov rcx, rax
mov qword [0x180012208], rax
mov rdx, qword [0x180012200]
jmp 0x18000b168
Function at 0x18000b1dc
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xd0
movaps xmmword [rsp + 0xc0], xmm7
movaps xmmword [rsp + 0xb0], xmm6
movaps xmm6, xmm2
movaps xmm7, xmm1
mov rdx, qword [0x180012218]
test rdx, rdx
jne 0x18000b269
lea rdx, [rsp + 0x42]
movaps xmm0, xmmword [0x18000f980]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x18000f990]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x18000f9a0]
movaps xmmword [rdx + 0x1e], xmm0
mov word [rdx + 0x2e], 0x47
mov word [rdx + 0x5e], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0x47
inc rax
cmp rax, 0x30
jne 0x18000b23d
mov word [rsp + 0xa0], 0
lea rcx, [rsp + 0x30]
call fcn.180009616
mov rdx, rax
mov qword [0x180012218], rax
cmp byte [0x180012228], 1
jne 0x18000b2cf
mov rcx, qword [0x180012220]
lea rsi, [rsp + 0x40]
movsd qword [rsi], xmm7
movsd qword [rsi + 8], xmm6
mov rax, qword [rcx]
mov rax, qword [rax + 0x268]
lea r8, [rsp + 0x30]
mov qword [r8], rax
mov qword [r8 + 8], 0
mov qword [rsp + 0x20], r8
mov r8, rsi
xor r9d, r9d
call fcn.18000dbe0
movsd xmm0, qword [rsi + 0x10]
movaps xmm6, xmmword [rsp + 0xb0]
movaps xmm7, xmmword [rsp + 0xc0]
add rsp, 0xd0
pop rsi
ret
mov byte [0x180012228], 1
lea rdx, str.Engine.Default__KismetMathLibrary
lea rcx, [rsp + 0x40]
call fcn.180009616
mov rcx, rax
mov qword [0x180012220], rax
mov rdx, qword [0x180012218]
jmp 0x18000b279

Function at 0x18000b2fe
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xc0
movaps xmmword [rsp + 0xb0], xmm6
movaps xmm6, xmm1
mov rdx, qword [0x180012230]
test rdx, rdx
jne 0x18000b380
lea rdx, [rsp + 0x42]
movaps xmm0, xmmword [0x18000f9b0]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x18000f9c0]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x18000f9d0]
movaps xmmword [rdx + 0x1e], xmm0
mov word [rdx + 0x2e], 0x69
mov word [rdx + 0x5e], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0x69
inc rax
cmp rax, 0x30
jne 0x18000b354
mov word [rsp + 0xa0], 0
lea rcx, [rsp + 0x30]
call fcn.180009616
mov rdx, rax
mov qword [0x180012230], rax
cmp byte [0x180012240], 1
jne 0x18000b3d7
mov rcx, qword [0x180012238]
lea rsi, [rsp + 0x30]
movsd qword [rsi], xmm6
mov rax, qword [rcx]
mov rax, qword [rax + 0x268]
lea r8, [rsp + 0x40]
mov qword [r8], rax
mov qword [r8 + 8], 0
mov qword [rsp + 0x20], r8
mov r8, rsi
xor r9d, r9d
call fcn.18000dbe0
mov eax, dword [rsi + 8]
movaps xmm6, xmmword [rsp + 0xb0]
add rsp, 0xc0
pop rsi
ret
mov byte [0x180012240], 1
lea rdx, str.Engine.Default__KismetMathLibrary
lea rcx, [rsp + 0x40]
call fcn.180009616
mov rcx, rax
mov qword [0x180012238], rax
mov rdx, qword [0x180012230]
jmp 0x18000b390
Function at 0x18000b530
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xb0
movaps xmmword [rsp + 0xa0], xmm6
movaps xmm6, xmm1
mov rdx, qword [0x180012260]
test rdx, rdx
jne 0x18000b5ac
lea rdx, [rsp + 0x42]
movaps xmm0, xmmword [0x18000fa20]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x18000fa30]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x18000fa40]
movaps xmmword [rdx + 0x1e], xmm0
mov word [rdx + 0x5a], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0x64
inc rax
cmp rax, 0x2e
jne 0x18000b580
mov word [rsp + 0x9c], 0
lea rcx, [rsp + 0x30]
call fcn.180009616
mov rdx, rax
mov qword [0x180012260], rax
cmp byte [0x180012270], 1
jne 0x18000b605
mov rcx, qword [0x180012268]
lea rsi, [rsp + 0x30]
movsd qword [rsi], xmm6
mov rax, qword [rcx]
mov rax, qword [rax + 0x268]
lea r8, [rsp + 0x40]
mov qword [r8], rax
mov qword [r8 + 8], 0
mov qword [rsp + 0x20], r8
mov r8, rsi
xor r9d, r9d
call fcn.18000dbe0
movsd xmm0, qword [rsi + 8]
movaps xmm6, xmmword [rsp + 0xa0]
add rsp, 0xb0
pop rsi
ret
mov byte [0x180012270], 1
lea rdx, str.Engine.Default__KismetMathLibrary
lea rcx, [rsp + 0x40]
call fcn.180009616
mov rcx, rax
mov qword [0x180012268], rax
mov rdx, qword [0x180012260]
jmp 0x18000b5bc

Function at 0x18000b630
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xd8
mov rdi, r9
mov rbx, r8
mov rsi, rdx
mov rdx, qword [0x180012278]
test rdx, rdx
jne 0x18000b6d5
lea rdx, [rsp + 0x42]
movaps xmm0, xmmword [0x18000fa50]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x18000fa60]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x18000fa70]
movaps xmmword [rdx + 0x1e], xmm0
movaps xmm0, xmmword [str.____v_]
movaps xmmword [rdx + 0x2e], xmm0
movabs rax, 0x250023003e002b
mov qword [rdx + 0x3e], rax
mov dword [rdx + 0x46], 0x4a0024
mov word [rdx + 0x92], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0x4a
inc rax
cmp rax, 0x4a
jne 0x18000b6a9
mov word [rsp + 0xd4], 0
lea rcx, [rsp + 0x30]
call fcn.180009616
mov rdx, rax
mov qword [0x180012278], rax
cmp byte [0x180012288], 1
jne 0x18000b75d
mov rcx, qword [0x180012280]
mov rax, qword [rbx + 0x10]
lea r14, [rsp + 0x40]
mov qword [r14 + 0x10], rax
movups xmm0, xmmword [rbx]
movaps xmmword [r14], xmm0
xor eax, eax
mov qword [r14 + 0x40], rax
xorps xmm0, xmm0
movaps xmmword [r14 + 0x30], xmm0
movups xmm0, xmmword [rdi]
movups xmmword [r14 + 0x18], xmm0
mov r8, qword [rdi + 0x10]
mov qword [r14 + 0x28], r8
mov r8, qword [rcx]
mov r8, qword [r8 + 0x268]
lea r9, [rsp + 0x30]
mov qword [r9], r8
mov qword [r9 + 8], rax
mov qword [rsp + 0x20], r9
mov r8, r14
xor r9d, r9d
call fcn.18000dbe0
mov rax, qword [r14 + 0x40]
mov qword [rsi + 0x10], rax
movaps xmm0, xmmword [r14 + 0x30]
movups xmmword [rsi], xmm0
mov rax, rsi
add rsp, 0xd8
pop rbx
pop rdi
pop rsi
pop r14
ret
mov byte [0x180012288], 1
lea rdx, str.Engine.Default__KismetMathLibrary
lea rcx, [rsp + 0x40]
call fcn.180009616
mov rcx, rax
mov qword [0x180012280], rax
mov rdx, qword [0x180012278]
jmp 0x18000b6e5
Function at 0x18000b78c
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xb0
movaps xmmword [rsp + 0xa0], xmm6
movaps xmm6, xmm1
mov rdx, qword [0x180012290]
test rdx, rdx
jne 0x18000b818
lea rdx, [rsp + 0x42]
movaps xmm0, xmmword [0x18000fa90]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x18000faa0]
movaps xmmword [rdx + 0xe], xmm0
movabs rax, 0x3b00560001000a
mov qword [rdx + 0x1e], rax
mov dword [rdx + 0x26], 0xb0017
mov word [rdx + 0x2a], pe_nt_image_headers64
mov word [rdx + 0x56], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0x78
inc rax
cmp rax, 0x2c
jne 0x18000b7ec
mov word [rsp + 0x98], 0
lea rcx, [rsp + 0x30]
call fcn.180009616
mov rdx, rax
mov qword [0x180012290], rax
cmp byte [0x1800122a0], 1
jne 0x18000b871
mov rcx, qword [0x180012298]
lea rsi, [rsp + 0x30]
movsd qword [rsi], xmm6
mov rax, qword [rcx]
mov rax, qword [rax + 0x268]
lea r8, [rsp + 0x40]
mov qword [r8], rax
mov qword [r8 + 8], 0
mov qword [rsp + 0x20], r8
mov r8, rsi
xor r9d, r9d
call fcn.18000dbe0
movsd xmm0, qword [rsi + 8]
movaps xmm6, xmmword [rsp + 0xa0]
add rsp, 0xb0
pop rsi
ret
mov byte [0x1800122a0], 1
lea rdx, str.Engine.Default__KismetMathLibrary
lea rcx, [rsp + 0x40]
call fcn.180009616
mov rcx, rax
mov qword [0x180012298], rax
mov rdx, qword [0x180012290]
jmp 0x18000b828

Function at 0x18000b89c
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xb0
movaps xmmword [rsp + 0xa0], xmm6
movaps xmm6, xmm1
mov rdx, qword [0x1800122a8]
test rdx, rdx
jne 0x18000b928
lea rdx, [rsp + 0x42]
movaps xmm0, xmmword [0x18000fab0]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x18000fac0]
movaps xmmword [rdx + 0xe], xmm0
movabs rax, 0x7007a002d0026
mov qword [rdx + 0x1e], rax
mov dword [rdx + 0x26], 0x3a003d
mov word [rdx + 0x2a], 0x54
mov word [rdx + 0x56], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0x54
inc rax
cmp rax, 0x2c
jne 0x18000b8fc
mov word [rsp + 0x98], 0
lea rcx, [rsp + 0x30]
call fcn.180009616
mov rdx, rax
mov qword [0x1800122a8], rax
cmp byte [0x1800122b8], 1
jne 0x18000b981
mov rcx, qword [0x1800122b0]
lea rsi, [rsp + 0x30]
movsd qword [rsi], xmm6
mov rax, qword [rcx]
mov rax, qword [rax + 0x268]
lea r8, [rsp + 0x40]
mov qword [r8], rax
mov qword [r8 + 8], 0
mov qword [rsp + 0x20], r8
mov r8, rsi
xor r9d, r9d
call fcn.18000dbe0
movsd xmm0, qword [rsi + 8]
movaps xmm6, xmmword [rsp + 0xa0]
add rsp, 0xb0
pop rsi
ret
mov byte [0x1800122b8], 1
lea rdx, str.Engine.Default__KismetMathLibrary
lea rcx, [rsp + 0x40]
call fcn.180009616
mov rcx, rax
mov qword [0x1800122b0], rax
mov rdx, qword [0x1800122a8]
jmp 0x18000b938
Function at 0x18000b9ac
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1c0
mov rsi, r8
mov rdi, rdx
mov rbx, qword [0x1800122c0]
test rbx, rbx
jne 0x18000ba4b
lea rdx, [rsp + 0x42]
movaps xmm0, xmmword [0x18000fad0]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x18000fae0]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x18000faf0]
movaps xmmword [rdx + 0x1e], xmm0
movaps xmm0, xmmword [0x18000fb00]
movaps xmmword [rdx + 0x2e], xmm0
movabs rax, 0x7a007300780071
mov qword [rdx + 0x3e], rax
mov word [rdx + 0x46], 0x1f
mov word [rdx + 0x8e], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0x1f
inc rax
cmp rax, 0x48
jne 0x18000ba1f
mov word [rsp + 0xd0], 0
lea rcx, [rsp + 0x30]
call fcn.180009616
mov rbx, rax
mov qword [0x1800122c0], rax
cmp byte [0x1800122d0], 1
jne 0x18000bb2f
mov r14, qword [0x1800122c8]
lea r15, [rsp + 0xb0]
mov r8d, 0x90
mov rcx, r15
xor edx, edx
call fcn.18000c13c
xorps xmm0, xmm0
movups xmmword [r15 + 0xc4], xmm0
mov rax, qword [0x180011e00]
mov qword [r15 - 0x70], rax
movups xmm1, xmmword [rdi]
movups xmmword [r15 - 0x68], xmm1
mov rax, qword [rdi + 0x10]
mov qword [r15 - 0x58], rax
mov rax, qword [rsi + 0x10]
mov qword [r15 - 0x40], rax
movups xmm1, xmmword [rsi]
movups xmmword [r15 - 0x50], xmm1
mov word [r15 - 0x38], 0x102
movups xmmword [r15 - 0x30], xmm0
mov byte [r15 - 0x20], 0
mov byte [r15 + 0xd8], 1
movups xmmword [r15 + 0xdc], xmm0
movups xmmword [r15 + 0xec], xmm0
mov dword [r15 + 0xfc], 0
mov rax, qword [r14]
mov rax, qword [rax + 0x268]
lea rcx, [rsp + 0x30]
mov qword [rcx], rax
mov qword [rcx + 8], 0
mov qword [rsp + 0x20], rcx
lea rsi, [rsp + 0x40]
mov rcx, r14
mov rdx, rbx
mov r8, rsi
xor r9d, r9d
call fcn.18000dbe0
cmp byte [rsi + 0x178], 0
sete al
add rsp, 0x1c0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov byte [0x1800122d0], 1
lea rdx, str.Engine.Default__KismetSystemLibrary
lea rcx, [rsp + 0x40]
call fcn.180009616
mov r14, rax
mov qword [0x1800122c8], rax
mov rbx, qword [0x1800122c0]
jmp 0x18000ba5f
Function at 0x18000bb60
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x100
mov rdi, r8
mov rsi, rdx
mov rdx, qword [0x1800122d8]
test rdx, rdx
jne 0x18000bc0b
lea rdx, [rsp + 0x42]
movaps xmm0, xmmword [0x18000fbe0]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x18000fbf0]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x18000fc00]
movaps xmmword [rdx + 0x1e], xmm0
movaps xmm0, xmmword [0x18000fc10]
movaps xmmword [rdx + 0x2e], xmm0
movaps xmm0, xmmword [0x18000fc20]
movaps xmmword [rdx + 0x3e], xmm0
movabs rax, 0x6f0063004c006d
mov qword [rdx + 0x4e], rax
mov dword [rdx + 0x56], 0x20067
mov word [rdx + 0xb2], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 2
inc rax
cmp rax, 0x5a
jne 0x18000bbdf
mov word [rsp + 0xf4], 0
lea rcx, [rsp + 0x30]
call fcn.180009616
mov rdx, rax
mov qword [0x1800122d8], rax
mov rcx, qword [0x1800122e0]
test rcx, rcx
jne 0x18000bca1
lea rdx, [rsp + 0x42]
movaps xmm0, xmmword [0x18000fc30]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x18000fc40]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x18000fc50]
movaps xmmword [rdx + 0x1e], xmm0
movaps xmm0, xmmword [str.60__]
movaps xmmword [rdx + 0x2e], xmm0
movabs rax, 0x3b003000230030
mov qword [rdx + 0x3e], rax
mov word [rdx + 0x46], 0x42
mov word [rdx + 0x8e], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0x42
inc rax
cmp rax, 0x48
jne 0x18000bc6e
mov word [rsp + 0xd0], 0
lea rcx, [rsp + 0x30]
call fcn.180009616
mov rcx, rax
mov qword [0x1800122e0], rax
mov rdx, qword [0x1800122d8]
xor eax, eax
lea rbx, [rsp + 0x40]
mov qword [rbx + 0x10], rax
movups xmm0, xmmword [rdi]
movaps xmmword [rbx], xmm0
mov r8, qword [rcx]
mov r8, qword [r8 + 0x268]
lea r9, [rsp + 0x30]
mov qword [r9], r8
mov qword [r9 + 8], rax
mov qword [rsp + 0x20], r9
mov r8, rbx
xor r9d, r9d
call fcn.18000dbe0
mov rax, qword [rbx + 0x10]
mov qword [rsi], rax
mov rax, rsi
add rsp, 0x100
pop rbx
pop rdi
pop rsi
ret
Function at 0x18000be0a
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xe0
mov rdi, r9
mov rbx, r8
mov rsi, rdx
mov rdx, qword [0x1800122f8]
test rdx, rdx
jne 0x18000beab
lea rdx, [rsp + 0x42]
movaps xmm0, xmmword [str._cA_EMZAFOdAJZIZQ]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x18000fcc0]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x18000fcd0]
movaps xmmword [rdx + 0x1e], xmm0
movaps xmm0, xmmword [0x18000fce0]
movaps xmmword [rdx + 0x2e], xmm0
movabs rax, 0x5c004600610077
mov qword [rdx + 0x3e], rax
mov word [rdx + 0x46], 0x28
mov word [rdx + 0x8e], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0x28
inc rax
cmp rax, 0x48
jne 0x18000be7f
mov word [rsp + 0xd0], 0
lea rcx, [rsp + 0x30]
call fcn.180009616
mov rdx, rax
mov qword [0x1800122f8], rax
mov r14, qword [rsp + 0x138]
mov ebp, dword [rsp + 0x130]
mov rcx, qword [0x180012300]
test rcx, rcx
jne 0x18000bf50
lea rdx, [rsp + 0x42]
movaps xmm0, xmmword [0x18000f100]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x18000fcf0]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x18000fd00]
movaps xmmword [rdx + 0x1e], xmm0
movaps xmm0, xmmword [0x18000fd10]
movaps xmmword [rdx + 0x2e], xmm0
movabs rax, 0x120019000a0019
mov qword [rdx + 0x3e], rax
mov word [rdx + 0x46], 0x6b
mov word [rdx + 0x8e], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0x6b
inc rax
cmp rax, 0x48
jne 0x18000bf1d
mov word [rsp + 0xd0], 0
lea rcx, [rsp + 0x30]
call fcn.180009616
mov rcx, rax
mov qword [0x180012300], rax
mov rdx, qword [0x1800122f8]
movups xmm0, xmmword [rbx]
lea rbx, [rsp + 0x40]
movaps xmmword [rbx], xmm0
movups xmm0, xmmword [rdi]
movaps xmmword [rbx + 0x10], xmm0
mov dword [rbx + 0x20], ebp
xorps xmm0, xmm0
movups xmmword [rbx + 0x38], xmm0
movups xmm0, xmmword [r14]
movups xmmword [rbx + 0x28], xmm0
mov rax, qword [rcx]
mov rax, qword [rax + 0x268]
lea r8, [rsp + 0x30]
mov qword [r8], rax
mov qword [r8 + 8], 0
mov qword [rsp + 0x20], r8
mov r8, rbx
xor r9d, r9d
call fcn.18000dbe0
movups xmm0, xmmword [rbx + 0x38]
movups xmmword [rsi], xmm0
mov rax, rsi
add rsp, 0xe0
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x18000bfb6
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xe0
mov rdi, r9
mov rbx, r8
mov rsi, rdx
mov rdx, qword [0x180012308]
test rdx, rdx
jne 0x18000c04d
lea rdx, [rsp + 0x42]
movaps xmm0, xmmword [0x18000fd20]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x18000fd30]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x18000fd40]
movaps xmmword [rdx + 0x1e], xmm0
movaps xmm0, xmmword [0x18000fd50]
movaps xmmword [rdx + 0x2e], xmm0
mov dword [rdx + 0x3e], 0x2c002a
mov word [rdx + 0x42], 0x5e
mov word [rdx + 0x86], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0x5e
inc rax
cmp rax, 0x44
jne 0x18000c021
mov word [rsp + 0xc8], 0
lea rcx, [rsp + 0x30]
call fcn.180009616
mov rdx, rax
mov qword [0x180012308], rax
mov rcx, qword [0x180012310]
test rcx, rcx
jne 0x18000c0e3
lea rdx, [rsp + 0x42]
movaps xmm0, xmmword [0x18000f160]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x18000fd60]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x18000fd70]
movaps xmmword [rdx + 0x1e], xmm0
movaps xmm0, xmmword [0x18000fd80]
movaps xmmword [rdx + 0x2e], xmm0
movabs rax, 0x47004c005f004c
mov qword [rdx + 0x3e], rax
mov word [rdx + 0x46], 0x3e
mov word [rdx + 0x8e], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0x3e
inc rax
cmp rax, 0x48
jne 0x18000c0b0
mov word [rsp + 0xd0], 0
lea rcx, [rsp + 0x30]
call fcn.180009616
mov rcx, rax
mov qword [0x180012310], rax
mov rdx, qword [0x180012308]
movups xmm0, xmmword [rbx]
lea rbx, [rsp + 0x40]
movaps xmmword [rbx], xmm0
xorps xmm0, xmm0
movaps xmmword [rbx + 0x20], xmm0
movups xmm0, xmmword [rdi]
movaps xmmword [rbx + 0x10], xmm0
mov rax, qword [rcx]
mov rax, qword [rax + 0x268]
lea r8, [rsp + 0x30]
mov qword [r8], rax
mov qword [r8 + 8], 0
mov qword [rsp + 0x20], r8
mov r8, rbx
xor r9d, r9d
call fcn.18000dbe0
movaps xmm0, xmmword [rbx + 0x20]
movups xmmword [rsi], xmm0
mov rax, rsi
add rsp, 0xe0
pop rbx
pop rdi
pop rsi
ret

Function at 0x18000c8ea
Capabilities:
Access peb ldr_data

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rcx
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rbx, qword [rax + 0x18]
add rbx, 0x20
xor esi, esi
mov r14, rbx
mov r14, qword [r14]
cmp r14, rbx
je 0x18000c934
test rdi, rdi
je 0x18000c930
mov rdx, qword [r14 + 0x50]
mov rcx, rdi
xor r8d, r8d
call fcn.18000ca4d
test al, al
je 0x18000c910
mov rsi, qword [r14 + 0x20]
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x18000c941
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
movsxd rax, dword [rcx + 0x3c]
mov r14d, dword [rcx + rax + 0x88]
cmp dword [rcx + r14 + 0x18], 0
je 0x18000c9a7
mov rbx, rdx
mov rsi, rcx
xor edi, edi
xor r15d, r15d
mov eax, dword [rsi + r14 + 0x20]
mov ecx, dword [rsi + r14 + 0x24]
add rcx, rsi
movzx r12d, word [rcx + r15*2]
add rax, rsi
mov edx, dword [rax + r15*4]
add rdx, rsi
mov rcx, rbx
mov r8b, 1
call fcn.18000cab0
test al, al
jne 0x18000c9ab
inc r15
mov eax, dword [rsi + r14 + 0x18]
cmp r15, rax
jb 0x18000c96d
jmp 0x18000c9ba
xor edi, edi
jmp 0x18000c9ba
mov eax, dword [rsi + r14 + 0x1c]
add rax, rsi
mov edi, dword [rax + r12*4]
add rdi, rsi
mov rax, rdi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x18000c9cb
Capabilities:
Enumerate pe sections

Disassembly:
push rsi
push rdi
push rbx
movzx eax, word [rcx]
cmp eax, 0x5a4d
jne 0x18000ca32
movsxd rax, dword [rcx + 0x3c]
movzx r10d, word [rax + rcx + 6]
test r10, r10
je 0x18000ca32
add rax, rcx
movzx r9d, word [rax + 0x14]
add r9, rax
add r9, 0x18
xor eax, eax
xor r11d, r11d
mov bl, byte [r9]
test bl, bl
je 0x18000ca36
mov esi, 1
movzx edi, byte [rdx + rsi - 1]
test edi, edi
je 0x18000ca36
movzx ebx, bl
cmp edi, ebx
jne 0x18000ca24
mov bl, byte [r9 + rsi]
inc rsi
test bl, bl
jne 0x18000ca07
jmp 0x18000ca36
inc r11
add r9, 0x28
cmp r11, r10
jne 0x18000c9fb
jmp 0x18000ca49
xor eax, eax
jmp 0x18000ca49
test r8, r8
je 0x18000ca42
mov eax, dword [r9 + 8]
mov qword [r8], rax
mov eax, dword [r9 + 0xc]
add rax, rcx
pop rbx
pop rdi
pop rsi
ret