joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180051540
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r13
push r14
mov eax, 0x90
call fcn.1800c7940
sub rsp, rax
mov rax, qword [0x18010db20]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor r14d, r14d
mov r12, rdx
mov rbp, rcx
lea rdx, [0x18010fa00]
lea rcx, [rsp + 0x50]
mov r13, r8
mov ebx, r14d
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], r14
mov byte [rsp + 0x70], 0x31
mov byte [rsp + 0x71], 0x32
mov byte [rsp + 0x72], 0x33
mov byte [rsp + 0x73], 0x34
mov byte [rsp + 0x74], 0x35
mov byte [rsp + 0x75], 0x36
mov byte [rsp + 0x76], 0x37
mov byte [rsp + 0x77], 0x38
mov byte [rsp + 0x78], 0x31
mov byte [rsp + 0x79], 0x32
mov byte [rsp + 0x7a], 0x33
mov byte [rsp + 0x7b], 0x34
mov byte [rsp + 0x7c], 0x35
mov byte [rsp + 0x7d], 0x36
mov byte [rsp + 0x7e], 0x37
mov byte [rsp + 0x7f], 0x38
call fcn.1800611a0
lea rdx, [0x18010fa50]
lea rcx, [rsp + 0x68]
call fcn.1800611a0
lea rdx, [0x18010faa0]
lea rcx, [rsp + 0x58]
call fcn.1800611a0
lea rdx, [0x18010faf0]
lea rcx, [rsp + 0x60]
call fcn.1800611a0
call fcn.1800531d0
mov rsi, rax
call fcn.1800531d0
mov rcx, qword [rsp + 0x50]
mov rdi, rax
test rcx, rcx
je 0x1800516f6
cmp qword [rsp + 0x68], rbx
je 0x1800516e7
cmp qword [rsp + 0x58], rbx
je 0x1800516e7
cmp qword [rsp + 0x60], rbx
je 0x1800516e7
test rsi, rsi
je 0x1800516e7
test rax, rax
je 0x1800516e7
lea edx, [r14 + 0x20]
mov r8, rsi
mov rcx, rbp
call fcn.180051180
mov ebx, eax
test eax, eax
je 0x1800516e2
lea edx, [r14 + 0x20]
mov r8, rdi
mov rcx, r12
call fcn.180051180
mov ebx, eax
test eax, eax
je 0x1800516e2
mov rax, qword [rsp + 0x60]
mov r9, qword [rsp + 0x68]
mov r8, qword [rsp + 0x50]
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x58]
lea edx, [r14 + 0x10]
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x20], rax
call fcn.180051250
mov ebx, eax
mov eax, 1
test ebx, ebx
cmovne ebx, eax
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1800516f6
call fcn.180053160
mov qword [rsp + 0x50], r14
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x18005170a
call fcn.180053160
mov qword [rsp + 0x68], r14
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x18005171e
call fcn.180053160
mov qword [rsp + 0x58], r14
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x180051732
call fcn.180053160
mov qword [rsp + 0x60], r14
test rsi, rsi
je 0x18005173f
mov rcx, rsi
call fcn.180053160
test rdi, rdi
je 0x18005174c
mov rcx, rdi
call fcn.180053160
mov eax, ebx
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.180037360
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x180066470
Capabilities:
Encode data using xor

Disassembly:
xor r9b, r9b
test r8, r8
je 0x180066493
sub rdx, rcx
nop dword [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
xor al, byte [rcx - 1]
or r9b, al
sub r8, 1
jne 0x180066480
movzx eax, r9b
ret

Function at 0x18006a770
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x60
call fcn.1800c7940
sub rsp, rax
mov rax, qword [0x18010db20]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xc0]
mov r14, qword [rsp + 0xd8]
mov rbp, rcx
mov rcx, qword [rsp + 0xc8]
mov ebx, dword [r14]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xd0]
mov r15, r9
mov esi, r8d
movzx r9d, byte [rax]
movzx r8d, byte [rax + 4]
lea rdi, [rax + 1]
mov qword [rsp + 0x48], rax
movzx eax, byte [rdi]
mov qword [rsp + 0x28], rcx
movzx ecx, byte [rdi + 6]
shl eax, 8
xor r13d, r13d
or r9d, eax
movzx eax, byte [rdi + 1]
shl ecx, 8
shl eax, 0x10
mov r12, rdx
mov qword [rsp + 0x40], r14
or r9d, eax
movzx eax, byte [rdi + 2]
mov qword [rsp + 0x30], rdi
shl eax, 0x18
or r9d, eax
movzx eax, byte [rdi + 4]
shl eax, 8
mov dword [rsp + 0x20], r9d
mov byte [rsp + 0x50], r9b
or r8d, eax
movzx eax, byte [rdi + 5]
or ecx, eax
mov eax, r9d
shr eax, 8
shl ecx, 0x10
mov byte [rsp + 0x51], al
or r8d, ecx
mov eax, r9d
shr eax, 0x10
mov dword [rsp + 0x24], r8d
mov byte [rsp + 0x54], r8b
mov byte [rsp + 0x52], al
mov eax, r9d
shr eax, 0x18
mov byte [rsp + 0x53], al
mov eax, r8d
shr eax, 8
mov byte [rsp + 0x55], al
mov eax, r8d
shr eax, 0x10
mov byte [rsp + 0x56], al
mov eax, r8d
shr eax, 0x18
mov byte [rsp + 0x57], al
test esi, esi
je 0x18006a973
mov r14, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x28]
dec esi
test ebx, ebx
jne 0x18006a902
lea rcx, [rsp + 0x20]
mov r9, rdi
mov r8, r14
mov rdx, r15
call fcn.18006ac70
mov r9d, dword [rsp + 0x20]
mov r8d, dword [rsp + 0x24]
movzx eax, r9b
mov byte [rsp + 0x50], al
mov eax, r9d
shr eax, 8
mov byte [rsp + 0x51], al
mov eax, r9d
shr eax, 0x10
mov byte [rsp + 0x52], al
mov eax, r9d
shr eax, 0x18
mov byte [rsp + 0x53], al
movzx eax, r8b
mov byte [rsp + 0x54], al
mov eax, r8d
shr eax, 8
mov byte [rsp + 0x55], al
mov eax, r8d
shr eax, 0x10
mov byte [rsp + 0x56], al
mov eax, r8d
shr eax, 0x18
inc r13d
mov byte [rsp + 0x57], al
movsxd rax, ebx
inc r12
inc rbp
movzx ecx, byte [rsp + rax + 0x50]
xor cl, byte [rbp - 1]
inc ebx
mov byte [r12 - 1], cl
and ebx, 7
test esi, esi
jne 0x18006a890
mov rdi, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
test r13d, r13d
je 0x18006a973
mov rax, qword [rsp + 0x48]
mov byte [rax], r9b
mov eax, r9d
shr eax, 8
mov byte [rdi], al
mov eax, r9d
shr r9d, 0x18
shr eax, 0x10
mov byte [rdi + 1], al
mov byte [rdi + 2], r9b
mov byte [rdi + 3], r8b
mov eax, r8d
shr eax, 8
mov byte [rdi + 4], al
mov eax, r8d
shr eax, 0x10
shr r8d, 0x18
mov byte [rdi + 5], al
mov byte [rdi + 6], r8b
mov dword [r14], ebx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180037360
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18006c530
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
mov eax, 0x130
call fcn.1800c7940
sub rsp, rax
mov rbx, rcx
mov rbp, rdx
lea rcx, [rsp + 0xa4]
xor edx, edx
mov r8d, 0x8c
mov dword [rsp + 0x20], 0x70e15
mov dword [rsp + 0x24], 0x1c232a31
mov dword [rsp + 0x28], 0x383f464d
mov dword [rsp + 0x2c], 0x545b6269
mov dword [rsp + 0x30], 0x70777e85
mov dword [rsp + 0x34], 0x8c939aa1
mov dword [rsp + 0x38], 0xa8afb6bd
mov dword [rsp + 0x3c], 0xc4cbd2d9
mov dword [rsp + 0x40], 0xe0e7eef5
mov dword [rsp + 0x44], 0xfc030a11
mov dword [rsp + 0x48], 0x181f262d
mov dword [rsp + 0x4c], 0x343b4249
mov dword [rsp + 0x50], 0x50575e65
mov dword [rsp + 0x54], 0x6c737a81
mov dword [rsp + 0x58], 0x888f969d
mov dword [rsp + 0x5c], 0xa4abb2b9
mov dword [rsp + 0x60], 0xc0c7ced5
mov dword [rsp + 0x64], 0xdce3eaf1
mov dword [rsp + 0x68], 0xf8ff060d
mov dword [rsp + 0x6c], 0x141b2229
mov dword [rsp + 0x70], 0x30373e45
mov dword [rsp + 0x74], 0x4c535a61
mov dword [rsp + 0x78], 0x686f767d
mov dword [rsp + 0x7c], 0x848b9299
mov dword [rsp + 0x80], 0xa0a7aeb5
mov dword [rsp + 0x84], 0xbcc3cad1
mov dword [rsp + 0x88], 0xd8dfe6ed
mov dword [rsp + 0x8c], 0xf4fb0209
mov dword [rsp + 0x90], 0x10171e25
mov dword [rsp + 0x94], 0x2c333a41
mov dword [rsp + 0x98], 0x484f565d
mov dword [rsp + 0x9c], 0x646b7279
call fcn.180037390
mov eax, dword [rbx + 4]
mov r11d, dword [rbx]
xor eax, 0x56aa3350
lea r12, [0x18011da20]
mov dword [rsp + 0xa4], eax
mov eax, dword [rbx + 8]
xor r11d, 0xa3b1bac6
xor eax, 0x677d9197
mov dword [rsp + 0xa0], r11d
mov dword [rsp + 0xa8], eax
mov eax, dword [rbx + 0xc]
xor eax, 0xb27022dc
xor esi, esi
mov dword [rsp + 0xac], eax
nop
mov ecx, dword [rsp + rsi + 0x20]
mov edx, 0x17
xor ecx, dword [rsp + rsi + 0xa4]
xor ecx, dword [rsp + rsi + 0xa8]
xor ecx, dword [rsp + rsi + 0xac]
movzx r9d, cl
shr ecx, 8
movzx r9d, byte [r9 + r12]
movzx r8d, cl
shr ecx, 8
movzx r8d, byte [r8 + r12]
mov eax, ecx
shr eax, 8
movzx eax, al
movzx edi, byte [rax + r12]
movzx eax, cl
movzx ecx, byte [rax + r12]
shl edi, 8
add edi, ecx
shl edi, 8
add edi, r8d
shl edi, 8
add edi, r9d
mov ecx, edi
call fcn.180059760
mov edx, 0xd
mov ecx, edi
mov ebx, eax
call fcn.180059760
add rsi, 4
xor ebx, eax
xor ebx, dword [rsp + rsi + 0x9c]
xor ebx, edi
cmp rsi, 0x80
mov dword [rsi + rbp - 4], ebx
mov dword [rsp + rsi + 0xac], ebx
jl 0x18006c6d0
lea r11, [rsp + 0x130]
mov eax, 1
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x180075690
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x28
call fcn.1800c7940
sub rsp, rax
add rsp, 0x28
jmp fcn.1800742a0
Function at 0x1800756b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov eax, 0x20
call fcn.1800c7940
sub rsp, rax
mov rbx, r8
call fcn.1800742a0
test eax, eax
js 0x180074afe
mov eax, dword [rbx + 0xf0]
xor r10d, r10d
shl eax, 2
movsxd r9, eax
test eax, eax
jle 0x180074949
lea rdx, [rbx + r9*4 + 8]
lea r8, [rbx + 8]
nop dword [rax + rax]
mov eax, dword [rdx - 8]
mov ecx, dword [r8 - 8]
add r10, 4
mov dword [r8 - 8], eax
mov eax, dword [rdx - 4]
mov dword [rdx - 8], ecx
mov ecx, dword [r8 - 4]
mov dword [r8 - 4], eax
mov eax, dword [rdx]
mov dword [rdx - 4], ecx
mov ecx, dword [r8]
mov dword [r8], eax
mov eax, dword [rdx + 4]
mov dword [rdx], ecx
mov ecx, dword [r8 + 4]
mov dword [r8 + 4], eax
sub r9, 4
mov dword [rdx + 4], ecx
sub rdx, 0x10
add r8, 0x10
cmp r10, r9
jl 0x180074900
mov r11d, 1
cmp dword [rbx + 0xf0], r11d
jle 0x180074afc
mov qword [rsp + 0x30], rdi
lea r10, [rbx + 2]
lea rdi, sym.SecEditCtlAdv.CMBCEnterprise.x64.dll_nqu__i6_jj.1___V_O0yryMZ5G6q_
nop dword [rax]
mov r8d, dword [r10 + 0xe]
add r10, 0x10
inc r11d
mov rax, r8
shr rax, 0x18
movzx edx, byte [rdi + rax*4 + 0xe72e0]
movzx eax, byte [r10 - 1]
movzx ecx, byte [rdi + rax*4 + 0xe72e0]
mov r9d, dword [rdi + rdx*4 + 0xe7ee0]
movzx eax, r8b
xor r9d, dword [rdi + rcx*4 + 0xe86e0]
movzx ecx, byte [rdi + rax*4 + 0xe72e0]
movzx eax, byte [r10]
xor r9d, dword [rdi + rcx*4 + 0xe8ae0]
movzx ecx, byte [rdi + rax*4 + 0xe72e0]
xor r9d, dword [rdi + rcx*4 + 0xe82e0]
mov dword [r10 - 2], r9d
mov r9d, dword [r10 + 2]
mov rax, r9
shr rax, 0x18
movzx edx, byte [rdi + rax*4 + 0xe72e0]
movzx eax, byte [r10 + 3]
movzx ecx, byte [rdi + rax*4 + 0xe72e0]
mov r8d, dword [rdi + rdx*4 + 0xe7ee0]
movzx eax, byte [r10 + 4]
xor r8d, dword [rdi + rcx*4 + 0xe86e0]
movzx ecx, byte [rdi + rax*4 + 0xe72e0]
movzx eax, r9b
xor r8d, dword [rdi + rcx*4 + 0xe82e0]
movzx ecx, byte [rdi + rax*4 + 0xe72e0]
mov r9d, dword [r10 + 6]
xor r8d, dword [rdi + rcx*4 + 0xe8ae0]
mov rax, r9
mov dword [r10 + 2], r8d
shr rax, 0x18
movzx edx, byte [rdi + rax*4 + 0xe72e0]
movzx eax, byte [r10 + 7]
movzx ecx, byte [rdi + rax*4 + 0xe72e0]
mov r8d, dword [rdi + rdx*4 + 0xe7ee0]
movzx eax, byte [r10 + 8]
xor r8d, dword [rdi + rcx*4 + 0xe86e0]
movzx ecx, byte [rdi + rax*4 + 0xe72e0]
movzx eax, r9b
xor r8d, dword [rdi + rcx*4 + 0xe82e0]
movzx ecx, byte [rdi + rax*4 + 0xe72e0]
movzx eax, byte [r10 + 0xb]
xor r8d, dword [rdi + rcx*4 + 0xe8ae0]
mov r9d, dword [r10 + 0xa]
mov dword [r10 + 6], r8d
movzx edx, byte [rdi + rax*4 + 0xe72e0]
movzx eax, byte [r10 + 0xc]
movzx ecx, byte [rdi + rax*4 + 0xe72e0]
mov r8d, dword [rdi + rdx*4 + 0xe86e0]
mov rax, r9
xor r8d, dword [rdi + rcx*4 + 0xe82e0]
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0xe72e0]
movzx eax, r9b
xor r8d, dword [rdi + rcx*4 + 0xe7ee0]
movzx ecx, byte [rdi + rax*4 + 0xe72e0]
xor r8d, dword [rdi + rcx*4 + 0xe8ae0]
mov dword [r10 + 0xa], r8d
cmp r11d, dword [rbx + 0xf0]
jl 0x180074970
mov rdi, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov eax, 0x28
call fcn.1800c7940
sub rsp, rax
add rsp, 0x28
jmp 0x1800748c0
Function at 0x1800756d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
mov eax, 0x20
call fcn.1800c7940
sub rsp, rax
mov r14, qword [rsp + 0x60]
mov r13, qword [rsp + 0x68]
mov r12, r9
mov rdi, r8
mov rbx, rdx
mov rbp, rcx
mov r10, r14
cmp r8, 0x10
jb 0x180075789
mov qword [rsp + 0x40], rsi
mov rsi, r8
shr rsi, 4
mov rax, rsi
imul rax, rax, 0xfffffffffffffff0
add rdi, rax
nop word [rax + rax]
mov r8, rbx
sub r10, rbp
mov rcx, rbp
sub r8, rbp
mov edx, 2
nop word [rax + rax]
mov rax, qword [r10 + rcx]
add rcx, 8
xor rax, qword [rcx - 8]
sub rdx, 1
mov qword [r8 + rcx - 8], rax
jne 0x180075750
mov r8, r12
mov rdx, rbx
mov rcx, rbx
call r13
mov r10, rbx
add rbx, 0x10
add rbp, 0x10
sub rsi, 1
jne 0x180075730
mov rsi, qword [rsp + 0x40]
test rdi, rdi
je 0x180075828
nop word [rax + rax]
mov rdx, r10
mov r9, rbx
xor r8d, r8d
sub rdx, rbp
sub r9, rbp
mov rcx, rbp
cmp r8, rdi
jae 0x1800757d1
movzx eax, byte [rcx + rdx]
inc r8
inc rcx
xor al, byte [rcx - 1]
mov byte [rcx + r9 - 1], al
cmp r8, 0x10
jb 0x1800757b2
jmp 0x180075801
cmp r8, 0x10
jae 0x180075801
mov edx, 0x10
sub r10, rbx
lea rcx, [r8 + rbx]
sub rdx, r8
nop word [rax + rax]
movzx eax, byte [r10 + rcx]
inc rcx
sub rdx, 1
mov byte [rcx - 1], al
jne 0x1800757f0
mov r8, r12
mov rdx, rbx
mov rcx, rbx
call r13
mov r10, rbx
cmp rdi, 0x10
jbe 0x180075828
add rbp, 0x10
add rbx, 0x10
sub rdi, 0x10
jne 0x1800757a0
mov rax, qword [r10]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov qword [r14], rax
mov rax, qword [r10 + 8]
mov qword [r14 + 8], rax
add rsp, 0x20
pop r14
pop r13
pop r12
ret
Function at 0x180075850
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r15
mov eax, 0x50
call fcn.1800c7940
sub rsp, rax
mov rax, qword [0x18010db20]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r13, qword [rsp + 0xb0]
mov rax, qword [rsp + 0xb8]
mov r15, r9
mov rdi, r8
mov rbp, rdx
mov rbx, rcx
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x20], rax
cmp rcx, rdx
je 0x180075931
mov rsi, r13
cmp r8, 0x10
jb 0x180075918
mov r12, r8
shr r12, 4
mov rax, r12
imul rax, rax, 0xfffffffffffffff0
add rdi, rax
mov qword [rsp + 0x28], rdi
mov rdi, qword [rsp + 0x20]
nop word [rax + rax]
mov r8, r15
mov rdx, rbp
mov rcx, rbx
call rdi
mov r11, rbp
sub rsi, rbp
mov ecx, 2
nop word [rax + rax]
mov rax, qword [rsi + r11]
add r11, 8
xor qword [r11 - 8], rax
sub rcx, 1
jne 0x1800758f0
mov rsi, rbx
add rbp, 0x10
add rbx, 0x10
sub r12, 1
jne 0x1800758d0
mov rdi, qword [rsp + 0x28]
mov rax, qword [rsi]
mov qword [r13], rax
mov rax, qword [rsi + 8]
mov qword [r13 + 8], rax
mov rax, qword [rsp + 0x20]
jmp 0x1800759ed
cmp r8, 0x10
jb 0x1800759ed
lea rax, [rsp + 0x38]
mov qword [rsp + 0xa0], r14
mov rsi, rdx
sub r13, rax
lea rax, [rsp + 0x38]
mov r14, r8
sub rsi, rax
shr r14, 4
lea rax, [rsp + 0x38]
mov r12, rcx
sub r12, rax
mov rax, r14
imul rax, rax, 0xfffffffffffffff0
add rdi, rax
mov rax, r14
shl rax, 4
add rbp, rax
mov qword [rsp + 0x28], rbp
mov rbp, qword [rsp + 0x20]
nop word [rax + rax]
lea rdx, [rsp + 0x38]
mov r8, r15
mov rcx, rbx
call rbp
xor r11d, r11d
lea rdx, [rsp + r11 + 0x38]
add r11, 8
mov rax, qword [r13 + rdx]
mov rcx, qword [r12 + rdx]
xor rax, qword [rdx]
mov qword [rsi + rdx], rax
mov qword [r13 + rdx], rcx
cmp r11, 0x10
jb 0x1800759a0
add rbx, 0x10
add r12, 0x10
add rsi, 0x10
sub r14, 1
jne 0x180075990
mov rbp, qword [rsp + 0x28]
mov rax, qword [rsp + 0x20]
mov r13, qword [rsp + 0x30]
mov r14, qword [rsp + 0xa0]
test rdi, rdi
je 0x180075ab0
lea rcx, [rsp + 0x38]
mov r12, r13
mov rsi, rbx
sub r12, rcx
lea rcx, [rsp + 0x38]
sub rbp, rcx
lea rcx, [rsp + 0x38]
sub rsi, rcx
nop word [rax + rax]
lea rdx, [rsp + 0x38]
mov r8, r15
mov rcx, rbx
call rax
xor r11d, r11d
cmp r11, rdi
jae 0x180075a63
movzx ecx, byte [rsp + r11 + 0x38]
lea rax, [rsi + r11]
lea rdx, [r12 + r11]
movzx r8d, byte [rsp + rax + 0x38]
xor cl, byte [rsp + rdx + 0x38]
lea rax, [r11 + rbp]
inc r11
mov byte [rsp + rax + 0x38], cl
mov byte [rsp + rdx + 0x38], r8b
cmp r11, 0x10
jb 0x180075a30
cmp rdi, 0x10
jbe 0x180075a82
mov rax, qword [rsp + 0x20]
add rbx, 0x10
add rsi, 0x10
add rbp, 0x10
sub rdi, 0x10
jne 0x180075a20
jmp 0x180075ab0
cmp r11, 0x10
jae 0x180075ab0
mov edx, 0x10
sub rbx, r13
lea rcx, [r13 + r11]
sub rdx, r11
nop dword [rax + rax]
movzx eax, byte [rbx + rcx]
inc rcx
sub rdx, 1
mov byte [rcx - 1], al
jne 0x180075aa0
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180037360
add rsp, 0x50
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180075ad0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rsi
push rdi
push r12
push r13
push r14
mov eax, 0x38
call fcn.1800c7940
sub rsp, rax
mov rsi, qword [rsp + 0x98]
mov r14, qword [rsp + 0x90]
mov qword [rsp + 0x28], r15
mov ebx, dword [rsi]
mov r10, r9
mov rdi, r8
mov r12, rdx
mov r13, rcx
test ebx, ebx
je 0x180075b37
test rdi, rdi
je 0x180075b37
mov eax, ebx
inc r12
inc r13
movzx ecx, byte [rax + r14]
dec rdi
xor cl, byte [r13 - 1]
inc ebx
and ebx, 0xf
mov byte [r12 - 1], cl
jne 0x180075b12
mov r9, qword [rsp + 0xa0]
movsxd r15, ebx
cmp rdi, 0x10
jb 0x180075c11
mov rsi, r12
mov rcx, rdi
mov qword [rsp + 0x30], rbp
shr rcx, 4
mov rbp, r13
sub rsi, r14
mov rax, rcx
sub rbp, r14
imul rax, rax, 0xfffffffffffffff0
add rdi, rax
mov rax, rcx
shl rax, 4
add r12, rax
add r13, rax
mov qword [rsp + 0x70], r13
mov r13, qword [rsp + 0x88]
mov qword [rsp + 0x78], r12
mov r12, rcx
mov r8, r13
mov rdx, r14
mov rcx, r14
call r9
cmp ebx, 0x10
jae 0x180075bd7
mov edx, 0xf
lea rcx, [r15 + r14]
sub edx, ebx
shr edx, 3
inc edx
nop word [rax + rax]
mov rax, qword [rcx + rbp]
add rcx, 8
xor rax, qword [rcx - 8]
sub rdx, 1
mov qword [rsi + rcx - 8], rax
jne 0x180075bc0
mov r9, qword [rsp + 0xa0]
add rsi, 0x10
add rbp, 0x10
xor ebx, ebx
xor r15d, r15d
sub r12, 1
jne 0x180075b90
mov r12, qword [rsp + 0x78]
mov r13, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x98]
mov r10, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x30]
mov r15, qword [rsp + 0x28]
test rdi, rdi
je 0x180075c56
mov r8, r10
mov rdx, r14
mov rcx, r14
call r9
movsxd rcx, ebx
sub r13, r14
add rcx, r14
sub r12, r14
add ebx, edi
nop word [rax + rax]
movzx eax, byte [rcx + r13]
inc rcx
xor al, byte [rcx - 1]
sub rdi, 1
mov byte [rcx + r12 - 1], al
jne 0x180075c40
mov dword [rsi], ebx
add rsp, 0x38
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x180075f70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
mov eax, 0x50
call fcn.1800c7940
sub rsp, rax
mov rax, qword [0x18010db20]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rsi, qword [rsp + 0x90]
mov r10, qword [rsp + 0xa0]
lea eax, [r8 - 1]
mov ebp, r8d
mov rdi, rdx
mov rbx, rcx
cmp eax, 0x7f
ja 0x180076130
mov rax, qword [rsi]
lea rcx, [rsp + 0x20]
mov r8, r9
mov qword [rcx], rax
mov rax, qword [rsi + 8]
mov rdx, rsi
mov qword [rcx + 8], rax
mov rcx, rsi
call r10
lea eax, [rbp + 7]
cdq
and edx, 7
add eax, edx
sar eax, 3
cmp dword [rsp + 0x98], 0
movsxd r9, eax
je 0x18007602a
test eax, eax
jle 0x18007606d
lea rdx, [rsp + 0x30]
mov rcx, rsi
sub rdx, rbx
sub rcx, rbx
sub rdi, rbx
nop word [rax + rax]
movzx eax, byte [rcx + rbx]
inc rbx
xor al, byte [rbx - 1]
sub r9, 1
mov byte [rdx + rbx - 1], al
mov byte [rdi + rbx - 1], al
jne 0x180076010
jmp 0x18007606d
xor r8d, r8d
test eax, eax
jle 0x18007606d
lea rax, [rsp + 0x30]
mov r10, rsi
sub rbx, rax
lea rax, [rsp + 0x30]
sub r10, rax
lea rax, [rsp + 0x30]
sub rdi, rax
nop dword [rax]
lea rdx, [rsp + r8 + 0x30]
inc r8
movzx ecx, byte [rbx + rdx]
movzx eax, byte [r10 + rdx]
xor al, cl
cmp r8, r9
mov byte [rdx], cl
mov byte [rdi + rdx], al
jl 0x180076050
mov eax, ebp
cdq
and edx, 7
add eax, edx
mov ecx, eax
and eax, 7
sub eax, edx
sar ecx, 3
mov r11d, eax
test eax, eax
jne 0x18007609f
movsxd rcx, ecx
mov rax, qword [rsp + rcx + 0x20]
mov qword [rsi], rax
mov rax, qword [rsp + rcx + 0x28]
mov qword [rsi + 8], rax
jmp 0x180076130
movsxd rax, ecx
mov r10d, 8
mov edi, 4
sub r10b, r11b
inc rsi
lea rbx, [rsp + rax + 0x21]
nop dword [rax + rax]
movzx r8d, byte [rbx]
movzx r9d, byte [rbx + 1]
movzx edx, byte [rbx - 1]
mov ecx, r11d
movzx eax, r8b
add rsi, 4
shl dl, cl
movzx ecx, r10b
add rbx, 4
shr al, cl
mov ecx, r11d
or dl, al
shl r8b, cl
movzx eax, r9b
mov byte [rsi - 5], dl
movzx edx, byte [rbx - 2]
movzx ecx, r10b
shr al, cl
mov ecx, r11d
or r8b, al
shl r9b, cl
movzx ecx, r10b
movzx eax, dl
mov byte [rsi - 4], r8b
shr al, cl
or r9b, al
movzx eax, byte [rbx - 1]
shr al, cl
mov ecx, r11d
mov byte [rsi - 3], r9b
shl dl, cl
or al, dl
sub rdi, 1
mov byte [rsi - 2], al
jne 0x1800760c0
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180037360
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x180076310
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
mov eax, 0x40
call fcn.1800c7940
sub rsp, rax
mov r14, qword [rsp + 0xb0]
mov r15, qword [rsp + 0xa8]
mov r10, r9
mov ebx, dword [r14]
mov rdi, r8
mov rsi, rdx
mov rbp, rcx
test ebx, ebx
je 0x180076372
nop
test rdi, rdi
je 0x180076372
mov eax, ebx
inc rsi
inc rbp
movzx ecx, byte [rax + r15]
dec rdi
xor cl, byte [rbp - 1]
inc ebx
and ebx, 0xf
mov byte [rsi - 1], cl
jne 0x180076350
mov r9, qword [rsp + 0xb8]
mov r12d, 0x10
mov qword [rsp + 0x38], r13
cmp rdi, r12
jb 0x18007648b
mov rcx, rdi
mov r13, rsi
mov r14, rbp
shr rcx, 4
sub r13, r15
sub r14, r15
mov rax, rcx
imul rax, rax, 0xfffffffffffffff0
add rdi, rax
mov rax, rcx
shl rax, 4
mov qword [rsp + 0x90], rdi
mov rdi, qword [rsp + 0xa0]
add rsi, rax
add rbp, rax
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x88], rsi
mov rbp, rcx
movsxd rsi, ebx
nop
mov r8, r10
mov rdx, r15
mov rcx, rdi
call r9
mov r11d, r12d
lea rcx, [rdi + 0x10]
nop word [rax + rax]
movzx eax, byte [rcx - 1]
dec rcx
dec r11d
add al, 1
mov byte [rcx], al
jne 0x180076415
test r11d, r11d
jne 0x180076400
cmp ebx, r12d
jae 0x180076447
mov edx, 0xf
lea rcx, [rsi + r15]
sub edx, ebx
shr edx, 3
inc edx
nop word [rax + rax]
mov rax, qword [r14 + rcx]
add rcx, 8
xor rax, qword [rcx - 8]
sub rdx, 1
mov qword [r13 + rcx - 8], rax
jne 0x180076430
mov r9, qword [rsp + 0xb8]
mov r10, qword [rsp + 0x98]
add r13, r12
add r14, r12
xor ebx, ebx
xor esi, esi
sub rbp, 1
jne 0x1800763e0
mov rdi, qword [rsp + 0x90]
mov rsi, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x80]
mov r14, qword [rsp + 0xb0]
test rdi, rdi
je 0x1800764f4
mov r13, qword [rsp + 0xa0]
mov r8, r10
mov rdx, r15
mov rcx, r13
call r9
lea rcx, [r13 + 0x10]
nop dword [rax + rax]
movzx eax, byte [rcx - 1]
dec rcx
dec r12d
add al, 1
mov byte [rcx], al
jne 0x1800764c5
test r12d, r12d
jne 0x1800764b0
movsxd rcx, ebx
sub rbp, r15
sub rsi, r15
add rcx, r15
add ebx, edi
nop word [rax + rax]
movzx eax, byte [rcx + rbp]
inc rcx
xor al, byte [rcx - 1]
sub rdi, 1
mov byte [rcx + rsi - 1], al
jne 0x1800764e0
mov dword [r14], ebx
mov r13, qword [rsp + 0x38]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret