joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800b1b30
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [0x180251a30]
mov rbx, rcx
xor ecx, ecx
mov dword [rax + 0x5c3c], ecx
test rbx, rbx
je 0x1800b1b9f
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x38], rdi
call fcn.1800b1bb0
lea rdx, [0x1801b5e2c]
mov rcx, rbx
mov rdi, rax
call fcn.1800a69f0
mov rbx, rax
test rax, rax
je 0x1800b1b9a
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret

Function at 0x1800b5990
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [0x180251a30]
cmp byte [rbx + 0x5c38], 0
jne 0x1800b5b08
cmp dword [rbx + 0x5c60], 0
je 0x1800b59cd
mov r8d, 0x2efd
lea rdx, str.C:Users_aaaDownloads20240322_1515_caa5bbcd6d9a1ffc980233d6b40ee2e0Nuke.pl_masterImGuiimgui.cpp
lea rcx, str.g.SettingsWindows.empty__
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x1800b5b01
lea rdx, [0x1801b5e28]
mov qword [rsp + 0x40], rdi
call fcn.1800a69f0
mov rdi, rax
test rax, rax
je 0x1800b5afc
mov qword [rsp + 0x30], rbp
mov rcx, rax
mov qword [rsp + 0x38], rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x1800b5ae9
xor edx, edx
mov rcx, rdi
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1800b5ae9
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x1800b5ae9
xor r8d, r8d
mov edx, ebp
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1800b5ae9
cmp rsi, 0xffffffffffffffff
je 0x1800b5ae9
mov rax, qword [0x180251a30]
test rax, rax
je 0x1800b5a73
inc dword [rax + 0xf0]
mov rdx, qword [0x180251a40]
mov rcx, rsi
call qword [0x1801e2318]
mov rbp, rax
test rax, rax
je 0x1800b5ae9
mov r9, rdi
mov r8, rsi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rdi
cmp rax, rsi
je 0x1800b5aaf
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x1800b5ac5
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x1800b5ac5
mov rdx, rsi
mov rcx, rbp
call fcn.1800a8760
mov rax, qword [0x180251a30]
test rax, rax
je 0x1800b5ad7
dec dword [rax + 0xf0]
mov rdx, qword [0x180251a40]
mov rcx, rbp
call qword [0x1801e2320]
jmp 0x1800b5af2
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
mov byte [rbx + 0x5c38], 1
movss xmm0, dword [rbx + 0x5c3c]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x1800b5b59
subss xmm0, dword [rbx + 0x18]
comiss xmm1, xmm0
movss dword [rbx + 0x5c3c], xmm0
jb 0x1800b5b59
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x1800b5b48
call fcn.1800b1b30
mov dword [rbx + 0x5c3c], 0
add rsp, 0x20
pop rbx
ret
mov byte [rbx + 0xd6], 1
mov dword [rbx + 0x5c3c], 0
add rsp, 0x20
pop rbx
ret
Function at 0x1800d43f0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x18024d000]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdx, qword [0x180251eb8]
test rdx, rdx
jne 0x1800d44b4
mov edx, 3
lea rcx, str.48_8B_15_________4C_8B_02_4C_89_06_40_84_FF_74___48_8B_CD_E8_________48_8B_C6_48_8B_4C_24___48_33_CC_E8_________48_8B_5C_24___48_8B_6C_24___48_8B_74_24___48_83_C4___5F_C3_B9_________E8_________CC_E8_________CC_CC_CC_CC_CC_CC_CC_CC_CC_CC_CC_48_89_5C_24___48_89_6C_24___56
call fcn.1800e7dd0
mov qword [0x180251eb8], rax
lea r8, [rsp + 0x20]
mov byte [rsp + 0x20], 0x11
mov r9, rax
mov byte [rsp + 0x21], 0x3f
xor eax, eax
mov byte [rsp + 0x22], 0x3d
xor edx, edx
mov byte [rsp + 0x23], 0x30
mov byte [rsp + 0x24], 0x38
mov byte [rsp + 0x25], 0x23
mov byte [rsp + 0x26], 0x62
mov byte [rsp + 0x27], 0x79
mov byte [rsp + 0x28], 0x7f
mov byte [rsp + 0x29], 0x37
mov byte [rsp + 0x2a], 0x30
mov byte [rsp + 0x2b], 5
mov byte [rsp + 0x2c], al
movzx eax, byte [rsp + 0x20]
nop
movzx eax, byte [r8]
lea ecx, [rdx + 0x52]
xor cl, al
lea r8, [r8 + 1]
movsxd rax, edx
inc edx
mov byte [rsp + rax + 0x20], cl
cmp edx, 0xc
jb 0x1800d4480
mov rdx, r9
mov byte [rsp + 0x2c], 0
lea rcx, [rsp + 0x20]
call fcn.1800e5ab0
mov rdx, qword [0x180251eb8]
mov rax, qword [0x180251e70]
mov rcx, qword [0x180251aa0]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0x58
mov rbx, qword [rax]
add rbx, rdx
call fcn.1800e0180
test al, al
jne 0x1800d450a
mov qword [0x180251d10], 0
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1800eb8d0
add rsp, 0x50
pop rbx
ret
lea rcx, [rsp + 0x30]
nop
mov rdx, qword [rcx]
lea rax, [rcx + 8]
lea r8, [rsp + 0x48]
mov rcx, rax
cmp rax, r8
je 0x1800d452a
mov rbx, qword [rdx + rbx]
jmp 0x1800d4510
mov rax, qword [rdx + rbx]
mov qword [0x180251d10], rax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1800eb8d0
add rsp, 0x50
pop rbx
ret
Function at 0x1800d56a0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x18024d000]
xor rax, rsp
mov qword [rbp - 8], rax
mov rdi, rdx
mov qword [rcx], rdx
mov rbx, rcx
mov edx, 8
mov rcx, rdi
mov rsi, r8
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
je 0x1800d5790
mov byte [rbp - 0x28], 0x1b
lea r9, [rbp - 0x28]
mov byte [rbp - 0x27], 0x3d
xor eax, eax
mov byte [rbp - 0x26], 0x22
xor ecx, ecx
mov byte [rbp - 0x25], 0x34
mov byte [rbp - 0x24], 0x3a
mov byte [rbp - 0x23], 0x3e
mov byte [rbp - 0x22], 0x3c
mov byte [rbp - 0x21], 0x79
mov byte [rbp - 0x20], 0x3c
mov byte [rbp - 0x1f], 0x2e
mov byte [rbp - 0x1e], 0x32
mov byte [rbp - 0x1d], 0x3e
mov byte [rbp - 0x1c], 0x2a
mov byte [rbp - 0x1b], 0x36
mov byte [rbp - 0x1a], 0xf
mov byte [rbp - 0x19], 0xf
mov byte [rbp - 0x18], 0x42
mov byte [rbp - 0x17], 0x13
mov byte [rbp - 0x16], 0xb
mov byte [rbp - 0x15], 0xc
mov byte [rbp - 0x14], 8
mov byte [rbp - 0x13], 0x13
mov byte [rbp - 0x12], 0xd
mov byte [rbp - 0x11], 0x1b
mov byte [rbp - 0x10], 0x4b
mov byte [rbp - 0xf], al
movzx eax, byte [rbp - 0x28]
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [r9]
lea r8d, [rcx + 0x52]
xor r8b, dl
lea r9, [r9 + 1]
movsxd rdx, ecx
inc ecx
mov byte [rbp + rdx - 0x28], r8b
cmp ecx, 0x19
jb 0x1800d5760
lea rcx, [rbp - 0x28]
mov byte [rbp - 0xf], 0
call fcn.1800e5ab0
jmp 0x1800d583b
lea r8, [rbx + 8]
mov rdx, rsi
mov rcx, rdi
call fcn.1800e9178
mov r9d, eax
test eax, eax
jne 0x1800d57b0
cmp rdi, 0xa
jg 0x1800d583b
mov byte [rbp - 0x40], 0x1f
lea r8, [rbp - 0x40]
mov byte [rbp - 0x3f], 0x1b
xor eax, eax
mov byte [rbp - 0x3e], 0xb
xor ecx, ecx
mov byte [rbp - 0x3d], 0x16
mov byte [rbp - 0x3c], 0x24
mov byte [rbp - 0x3b], 0x32
mov byte [rbp - 0x3a], 0x39
mov byte [rbp - 0x39], 0x2d
mov byte [rbp - 0x38], 0x3f
mov byte [rbp - 0x37], 0x13
mov byte [rbp - 0x36], 0x33
mov byte [rbp - 0x35], 0x32
mov byte [rbp - 0x34], 0x35
mov byte [rbp - 0x33], 0x7f
mov byte [rbp - 0x32], 0x5d
mov byte [rbp - 0x31], 0x41
mov byte [rbp - 0x30], 0x47
mov byte [rbp - 0x2f], 0xa
mov byte [rbp - 0x2e], al
movzx eax, byte [rbp - 0x40]
nop word [rax + rax]
movzx eax, byte [r8]
lea edx, [rcx + 0x52]
xor dl, al
lea r8, [r8 + 1]
movsxd rax, ecx
inc ecx
mov byte [rbp + rax - 0x40], dl
cmp ecx, 0x12
jb 0x1800d5810
mov edx, r9d
mov byte [rbp - 0x2e], 0
lea rcx, [rbp - 0x40]
call fcn.1800e5ab0
mov rax, rbx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1800eb8d0
mov rbx, qword [rsp + 0x98]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800d5860
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x18024d000]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, rdx
mov qword [rcx], rdx
mov rbx, rcx
mov edx, 8
mov rcx, rax
mov rdi, r8
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
je 0x1800d5950
mov byte [rbp - 0x28], 0x1b
lea r9, [rbp - 0x28]
mov byte [rbp - 0x27], 0x3d
xor eax, eax
mov byte [rbp - 0x26], 0x22
xor ecx, ecx
mov byte [rbp - 0x25], 0x34
mov byte [rbp - 0x24], 0x3a
mov byte [rbp - 0x23], 0x3e
mov byte [rbp - 0x22], 0x3c
mov byte [rbp - 0x21], 0x79
mov byte [rbp - 0x20], 0x3c
mov byte [rbp - 0x1f], 0x2e
mov byte [rbp - 0x1e], 0x32
mov byte [rbp - 0x1d], 0x3e
mov byte [rbp - 0x1c], 0x2a
mov byte [rbp - 0x1b], 0x36
mov byte [rbp - 0x1a], 0xf
mov byte [rbp - 0x19], 0xf
mov byte [rbp - 0x18], 0x42
mov byte [rbp - 0x17], 0x13
mov byte [rbp - 0x16], 0xb
mov byte [rbp - 0x15], 0xc
mov byte [rbp - 0x14], 8
mov byte [rbp - 0x13], 0x13
mov byte [rbp - 0x12], 0xd
mov byte [rbp - 0x11], 0x1b
mov byte [rbp - 0x10], 0x4b
mov byte [rbp - 0xf], al
movzx eax, byte [rbp - 0x28]
nop word [rax + rax]
movzx edx, byte [r9]
lea r8d, [rcx + 0x52]
xor r8b, dl
lea r9, [r9 + 1]
movsxd rdx, ecx
inc ecx
mov byte [rbp + rdx - 0x28], r8b
cmp ecx, 0x19
jb 0x1800d5920
lea rcx, [rbp - 0x28]
mov byte [rbp - 0xf], 0
call fcn.1800e5ab0
jmp 0x1800d59fb
mov rcx, qword [rbx]
lea r8, [rbx + 8]
mov rdx, rdi
call fcn.1800e9178
mov r9d, eax
test eax, eax
jne 0x1800d5970
cmp qword [rbx], 0xa
jg 0x1800d59fb
mov byte [rbp - 0x40], 0x1f
lea r8, [rbp - 0x40]
mov byte [rbp - 0x3f], 0x1b
xor eax, eax
mov byte [rbp - 0x3e], 0xb
xor ecx, ecx
mov byte [rbp - 0x3d], 0x16
mov byte [rbp - 0x3c], 0x24
mov byte [rbp - 0x3b], 0x32
mov byte [rbp - 0x3a], 0x39
mov byte [rbp - 0x39], 0x2d
mov byte [rbp - 0x38], 0x3f
mov byte [rbp - 0x37], 0x13
mov byte [rbp - 0x36], 0x33
mov byte [rbp - 0x35], 0x32
mov byte [rbp - 0x34], 0x35
mov byte [rbp - 0x33], 0x7f
mov byte [rbp - 0x32], 0x5d
mov byte [rbp - 0x31], 0x41
mov byte [rbp - 0x30], 0x47
mov byte [rbp - 0x2f], 0xa
mov byte [rbp - 0x2e], al
movzx eax, byte [rbp - 0x40]
nop word [rax + rax]
movzx eax, byte [r8]
lea edx, [rcx + 0x52]
xor dl, al
lea r8, [r8 + 1]
movsxd rax, ecx
inc ecx
mov byte [rbp + rax - 0x40], dl
cmp ecx, 0x12
jb 0x1800d59d0
mov edx, r9d
mov byte [rbp - 0x2e], 0
lea rcx, [rbp - 0x40]
call fcn.1800e5ab0
mov rax, rbx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1800eb8d0
mov rbx, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x88]
add rsp, 0x60
pop rbp
ret
Function at 0x1800de480
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
add rcx, 0x10
xor edx, edx
jmp fcn.1800d64c0

Function at 0x1800dee10
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x18024d000]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rcx, qword [rcx]
test rcx, rcx
je 0x1800deeed
test dl, dl
je 0x1800dee3e
call fcn.1800e948c
jmp 0x1800dee43
call fcn.1800e949c
mov r9d, eax
test eax, eax
je 0x1800defc8
mov byte [rbp - 0x50], 0x1f
lea r8, [rbp - 0x50]
mov byte [rbp - 0x4f], 0x1b
xor eax, eax
mov byte [rbp - 0x4e], 0xb
xor edx, edx
mov byte [rbp - 0x4d], 0x10
mov byte [rbp - 0x4c], 0x38
mov byte [rbp - 0x4b], 0x36
mov byte [rbp - 0x4a], 0x3a
mov byte [rbp - 0x49], 0x35
mov byte [rbp - 0x48], 0x3f
mov byte [rbp - 0x47], 0x13
mov byte [rbp - 0x46], 0x33
mov byte [rbp - 0x45], 0x32
mov byte [rbp - 0x44], 0x35
mov byte [rbp - 0x43], 0x7f
mov byte [rbp - 0x42], 0x5d
mov byte [rbp - 0x41], 0x41
mov byte [rbp - 0x40], 0x47
mov byte [rbp - 0x3f], 0xa
mov byte [rbp - 0x3e], al
movzx eax, byte [rbp - 0x50]
nop word [rax + rax]
movzx eax, byte [r8]
lea ecx, [rdx + 0x52]
xor cl, al
lea r8, [r8 + 1]
movsxd rax, edx
inc edx
mov byte [rbp + rax - 0x50], cl
cmp edx, 0x12
jb 0x1800deeb0
mov edx, r9d
mov byte [rbp - 0x3e], 0
lea rcx, [rbp - 0x50]
call fcn.1800e5ab0
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1800eb8d0
add rsp, 0x70
pop rbp
ret
mov byte [rbp - 0x38], 0x37
lea r8, [rbp - 0x38]
mov byte [rbp - 0x37], 0x3d
xor eax, eax
mov byte [rbp - 0x36], 0x35
xor edx, edx
mov byte [rbp - 0x35], 0x37
mov byte [rbp - 0x34], 0x3a
mov byte [rbp - 0x33], 0x32
mov byte [rbp - 0x32], 0x10
mov byte [rbp - 0x31], 0x36
mov byte [rbp - 0x30], 0x35
mov byte [rbp - 0x2f], 0x30
mov byte [rbp - 0x2e], 0x74
mov byte [rbp - 0x2d], 0x74
mov byte [rbp - 0x2c], 0x7e
mov byte [rbp - 0x2b], 0x3c
mov byte [rbp - 0x2a], 1
mov byte [rbp - 0x29], 0xd
mov byte [rbp - 0x28], 0xe
mov byte [rbp - 0x27], 6
mov byte [rbp - 0x26], 0
mov byte [rbp - 0x25], 0x45
mov byte [rbp - 0x24], 0x11
mov byte [rbp - 0x23], 0xe
mov byte [rbp - 0x22], 0x1c
mov byte [rbp - 0x21], 1
mov byte [rbp - 0x20], 0x4a
mov byte [rbp - 0x1f], 5
mov byte [rbp - 0x1e], 0x19
mov byte [rbp - 0x1d], 1
mov byte [rbp - 0x1c], 2
mov byte [rbp - 0x1b], 0x1f
mov byte [rbp - 0x1a], 4
mov byte [rbp - 0x19], 3
mov byte [rbp - 0x18], 0x52
mov byte [rbp - 0x17], 0x15
mov byte [rbp - 0x16], 1
mov byte [rbp - 0x15], 0x1b
mov byte [rbp - 0x14], 0x15
mov byte [rbp - 0x13], 0x56
mov byte [rbp - 0x12], al
movzx eax, byte [rbp - 0x38]
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r8]
lea ecx, [rdx + 0x52]
xor cl, al
lea r8, [r8 + 1]
movsxd rax, edx
inc edx
mov byte [rbp + rax - 0x38], cl
cmp edx, 0x26
jb 0x1800defa0
lea rcx, [rbp - 0x38]
mov byte [rbp - 0x12], 0
call fcn.1800e5ab0
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1800eb8d0
add rsp, 0x70
pop rbp
ret
Function at 0x1800e08c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x70
mov rdi, rdx
mov rbx, rcx
xor eax, eax
mov qword [rcx], rax
mov qword [rcx + 8], rax
mov r8d, dword [0x180252a58]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + r8*8]
mov eax, dword [rcx + rax]
cmp dword [0x180252508], eax
jg 0x1800e0a12
cmp qword [0x180252510], 0
jne 0x1800e0935
lea rdx, str.48_8D_0D_________FF_50___48_8B_D8_48_8B_50___48_85_D2_0F_84_________8B_42___85_C0_0F_84_________8D_48___F0_0F_B1_4A___74___85_C0_0F_84_________EB___48_8B_03_48_8B_5B___48_89_44_24___48_89_5C_24___48_8D_54_24___48_8D_0D_________E8_________BE
lea rcx, [0x1800f77b8]
call fcn.1800e6c00
movsxd rcx, dword [rax + 3]
add rax, 7
add rax, rcx
mov qword [0x180252510], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm0
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.180002840
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.180009520
movabs rcx, 0xcbf29ce484222325
mov qword [rsp + 0x40], rcx
cmp qword [rsp + 0x58], 0
jbe 0x1800e09bb
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 0x10
cmovae rdx, qword [rsp + 0x48]
movzx eax, byte [rdx]
movabs r8, 0x100000001b3
nop dword [rax]
nop word [rax + rax]
imul rcx, r8
movsx rax, al
xor rcx, rax
mov qword [rsp + 0x40], rcx
lea rdx, [rdx + 1]
movzx eax, byte [rdx]
test al, al
jne 0x1800e09a0
lea r8, [rsp + 0x40]
mov rdx, qword [0x180252510]
mov rcx, rbx
call qword [0x180252500]
nop
mov rax, qword [rsp + 0x60]
cmp rax, 0x10
jb 0x1800e0a01
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1800e0a01
inc rax
cmp rax, 0x1000
jb 0x1800e09fa
mov rcx, qword [rcx - 8]
mov qword [rsp + 0x48], rcx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
nop
mov rax, rbx
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
lea rcx, [0x180252508]
call fcn.1800eba9c
cmp dword [0x180252508], 0xffffffff
jne 0x1800e0906
lea rdx, str.48_89_5C_24___48_89_74_24___48_89_4C_24___57_48_83_EC___4C_8B_CA
lea rcx, [0x1800f77b8]
call fcn.1800e6c00
mov qword [0x180252500], rax
lea rcx, [0x180252508]
call fcn.1800eba30
jmp 0x1800e0906
Function at 0x1800e2e10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x18024d000]
xor rax, rsp
mov qword [rbp - 0x10], rax
movzx edi, dl
mov rbx, rcx
mov qword [rbp - 0x40], rcx
lea rax, vtable.ByteTag.0
mov qword [rcx], rax
mov rax, qword [0x180252698]
test rax, rax
jne 0x1800e2f5f
lea rdx, str.48_8D_15_________48_89_10_88_48___48_89_03_48_8B_C3_48_8B_5C_24__
lea rcx, [0x1800f77b8]
call fcn.1800e6c00
mov rcx, rax
movsxd rax, dword [rax + 3]
add rax, 7
add rax, rcx
mov qword [0x180252698], rax
jne 0x1800e2f5f
mov byte [rbp - 0x38], 0xfe
mov byte [rbp - 0x37], 0xc4
mov byte [rbp - 0x36], 0xca
mov byte [rbp - 0x35], 0xda
mov byte [rbp - 0x34], 0x94
mov byte [rbp - 0x33], 0xa0
mov byte [rbp - 0x32], 0xa5
mov byte [rbp - 0x31], 0x95
mov byte [rbp - 0x30], 0xb0
mov byte [rbp - 0x2f], 0xa4
mov byte [rbp - 0x2e], 0xa4
mov byte [rbp - 0x2d], 0xab
mov byte [rbp - 0x2c], 0xad
mov byte [rbp - 0x2b], 0xe9
mov byte [rbp - 0x2a], 0xb9
mov byte [rbp - 0x29], 0xa2
mov byte [rbp - 0x28], 0xab
mov byte [rbp - 0x27], 0xa3
mov byte [rbp - 0x26], 0xaf
mov byte [rbp - 0x25], 0xbb
mov byte [rbp - 0x24], 0xa5
mov byte [rbp - 0x23], 0xa3
mov byte [rbp - 0x22], 0xb7
mov byte [rbp - 0x21], 0xf3
mov byte [rbp - 0x20], 0xba
mov byte [rbp - 0x1f], 0xba
mov byte [rbp - 0x1e], 0xa2
mov byte [rbp - 0x1d], 0xf7
mov byte [rbp - 0x1c], 0xaf
mov byte [rbp - 0x1b], 0xb6
mov byte [rbp - 0x1a], 0xa8
mov byte [rbp - 0x19], 0xb0
mov byte [rbp - 0x18], 0xb5
mov byte [rbp - 0x17], 0xb3
mov byte [rbp - 0x16], 0xb9
mov byte [rbp - 0x15], 0xfe
mov byte [rbp - 0x14], 0xc1
mov byte [rbp - 0x13], 0xc0
xor eax, eax
mov byte [rbp - 0x12], al
movzx eax, byte [rbp - 0x38]
xor edx, edx
lea r8, [rbp - 0x38]
nop dword [rax]
lea ecx, [rdx - 0x44]
movzx eax, byte [r8]
xor cl, al
movsxd rax, edx
mov byte [rbp + rax - 0x38], cl
inc edx
lea r8, [r8 + 1]
cmp edx, 0x26
jb 0x1800e2f30
mov byte [rbp - 0x12], 0
lea rcx, [rbp - 0x38]
call fcn.1800e5ab0
mov rax, qword [0x180252698]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx], rax
mov byte [rbx + 8], dil
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1800eb8d0
mov rbx, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x60
pop rbp
ret
Function at 0x1800e3020
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
movaps xmmword [rsp + 0x60], xmm6
mov rax, qword [0x18024d000]
xor rax, rsp
mov qword [rbp - 0x18], rax
movaps xmm6, xmm1
mov rbx, rcx
mov qword [rbp - 0x50], rcx
lea rax, vtable.DoubleTag.0
mov qword [rcx], rax
mov rax, qword [0x180252690]
test rax, rax
jne 0x1800e317f
lea rdx, str.48_8D_0D_________F2_0F_11_40___48_89_08_48_89_03_48_8B_C3_48_8B_5C_24___48_83_C4_30
lea rcx, [0x1800f77b8]
call fcn.1800e6c00
mov rcx, rax
movsxd rax, dword [rax + 3]
add rax, 7
add rax, rcx
mov qword [0x180252690], rax
jne 0x1800e317f
mov byte [rbp - 0x48], 0xf8
mov byte [rbp - 0x47], 0xd2
mov byte [rbp - 0x46], 0xcb
mov byte [rbp - 0x45], 0xdd
mov byte [rbp - 0x44], 0xac
mov byte [rbp - 0x43], 0xa4
mov byte [rbp - 0x42], 0x96
mov byte [rbp - 0x41], 0xa2
mov byte [rbp - 0x40], 0xa3
mov byte [rbp - 0x3f], 0x93
mov byte [rbp - 0x3e], 0xb2
mov byte [rbp - 0x3d], 0xa6
mov byte [rbp - 0x3c], 0xaa
mov byte [rbp - 0x3b], 0xa5
mov byte [rbp - 0x3a], 0xaf
mov byte [rbp - 0x39], 0xeb
mov byte [rbp - 0x38], 0xbf
mov byte [rbp - 0x37], 0xa4
mov byte [rbp - 0x36], 0xa9
mov byte [rbp - 0x35], 0xa1
mov byte [rbp - 0x34], 0xb1
mov byte [rbp - 0x33], 0xa5
mov byte [rbp - 0x32], 0xa7
mov byte [rbp - 0x31], 0xa1
mov byte [rbp - 0x30], 0xb1
mov byte [rbp - 0x2f], 0xf5
mov byte [rbp - 0x2e], 0xb8
mov byte [rbp - 0x2d], 0xb8
mov byte [rbp - 0x2c], 0xac
mov byte [rbp - 0x2b], 0xf9
mov byte [rbp - 0x2a], 0xad
mov byte [rbp - 0x29], 0xb4
mov byte [rbp - 0x28], 0xae
mov byte [rbp - 0x27], 0xb6
mov byte [rbp - 0x26], 0xb7
mov byte [rbp - 0x25], 0xb1
mov byte [rbp - 0x24], 0x87
mov byte [rbp - 0x23], 0xc0
mov byte [rbp - 0x22], 0xc3
mov byte [rbp - 0x21], 0xc2
xor eax, eax
mov byte [rbp - 0x20], al
movzx eax, byte [rbp - 0x48]
xor edx, edx
lea r8, [rbp - 0x48]
nop dword [rax]
nop word [rax + rax]
lea ecx, [rdx - 0x44]
movzx eax, byte [r8]
xor cl, al
movsxd rax, edx
mov byte [rbp + rax - 0x48], cl
inc edx
lea r8, [r8 + 1]
cmp edx, 0x28
jb 0x1800e3150
mov byte [rbp - 0x20], 0
lea rcx, [rbp - 0x48]
call fcn.1800e5ab0
mov rax, qword [0x180252690]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx], rax
movsd qword [rbx + 8], xmm6
mov rax, rbx
mov rcx, qword [rbp - 0x18]
xor rcx, rsp
call fcn.1800eb8d0
mov rbx, qword [rsp + 0x88]
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x70
pop rbp
ret
Function at 0x1800e31b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
movaps xmmword [rsp + 0x60], xmm6
mov rax, qword [0x18024d000]
xor rax, rsp
mov qword [rbp - 0x20], rax
movaps xmm6, xmm1
mov rbx, rcx
mov qword [rbp - 0x50], rcx
lea rax, vtable.FloatTag.0
mov qword [rcx], rax
mov rax, qword [0x180252688]
test rax, rax
jne 0x1800e32ff
lea rdx, str.48_8D_05_________48_89_06_8B_47_08_89_46_08_48_8B_03_C6_40_28_05
lea rcx, [0x1800f77b8]
call fcn.1800e6c00
mov rcx, rax
movsxd rax, dword [rax + 3]
add rax, 7
add rax, rcx
mov qword [0x180252688], rax
jne 0x1800e32ff
mov byte [rbp - 0x48], 0xfa
mov byte [rbp - 0x47], 0xd1
mov byte [rbp - 0x46], 0xd1
mov byte [rbp - 0x45], 0xde
mov byte [rbp - 0x44], 0xb4
mov byte [rbp - 0x43], 0x95
mov byte [rbp - 0x42], 0xa3
mov byte [rbp - 0x41], 0xa4
mov byte [rbp - 0x40], 0x92
mov byte [rbp - 0x3f], 0xb1
mov byte [rbp - 0x3e], 0xa7
mov byte [rbp - 0x3d], 0xa5
mov byte [rbp - 0x3c], 0xa4
mov byte [rbp - 0x3b], 0xac
mov byte [rbp - 0x3a], 0xea
mov byte [rbp - 0x39], 0xb8
mov byte [rbp - 0x38], 0xa5
mov byte [rbp - 0x37], 0xaa
mov byte [rbp - 0x36], 0xa0
mov byte [rbp - 0x35], 0xae
mov byte [rbp - 0x34], 0xa4
mov byte [rbp - 0x33], 0xa4
mov byte [rbp - 0x32], 0xa0
mov byte [rbp - 0x31], 0xb6
mov byte [rbp - 0x30], 0xf4
mov byte [rbp - 0x2f], 0xbb
mov byte [rbp - 0x2e], 0xb9
mov byte [rbp - 0x2d], 0xa3
mov byte [rbp - 0x2c], 0xf8
mov byte [rbp - 0x2b], 0xae
mov byte [rbp - 0x2a], 0xb5
mov byte [rbp - 0x29], 0xa9
mov byte [rbp - 0x28], 0xb7
mov byte [rbp - 0x27], 0xb4
mov byte [rbp - 0x26], 0xb0
mov byte [rbp - 0x25], 0xb8
mov byte [rbp - 0x24], 0xc1
mov byte [rbp - 0x23], 0xc0
mov byte [rbp - 0x22], 0xc3
xor eax, eax
mov byte [rbp - 0x21], al
movzx eax, byte [rbp - 0x48]
xor edx, edx
lea r8, [rbp - 0x48]
nop dword [rax]
lea ecx, [rdx - 0x44]
movzx eax, byte [r8]
xor cl, al
movsxd rax, edx
mov byte [rbp + rax - 0x48], cl
inc edx
lea r8, [r8 + 1]
cmp edx, 0x27
jb 0x1800e32d0
mov byte [rbp - 0x21], 0
lea rcx, [rbp - 0x48]
call fcn.1800e5ab0
mov rax, qword [0x180252688]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx], rax
movss dword [rbx + 8], xmm6
mov rax, rbx
mov rcx, qword [rbp - 0x20]
xor rcx, rsp
call fcn.1800eb8d0
mov rbx, qword [rsp + 0x88]
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x70
pop rbp
ret