joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18030b5a0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x20
mov rdi, r8
mov r14, rdx
mov r8, qword [rcx + 0x28]
mov rbx, rcx
test r8, r8
je 0x18030b6ec
mov r10, qword [rcx + 0x58]
mov r9, r10
mov qword [rsp + 0x48], rbp
imul r9, rdi
mov qword [rsp + 0x50], rsi
cmp r9, 0x40998
jbe 0x18030b5ec
xor edx, edx
mov eax, 0x40998
div r10
mov rsi, rax
jmp 0x18030b5ef
mov rsi, rdi
mov ecx, dword [rcx + 0x40]
sub rdi, rsi
sub ecx, 1
je 0x18030b68c
sub ecx, 1
je 0x18030b664
sub ecx, 1
je 0x18030b63c
cmp ecx, 1
jne 0x18030b635
mov r9, r8
lea rcx, [0x180686390]
mov r8, rsi
mov rdx, r10
call fcn.180132284
mov r9, rsi
mov r8, r14
mov rcx, rbx
mov rbp, rax
call fcn.18030ab10
jmp 0x18030b6b2
mov rbp, qword [rsp + 0x40]
jmp 0x18030b6b2
mov r9, r8
lea rcx, [0x180686390]
mov r8, rsi
mov rdx, r10
call fcn.180132284
mov r9, rsi
mov r8, r14
mov rcx, rbx
mov rbp, rax
call fcn.18030ad30
jmp 0x18030b6b2
mov r9, r8
lea rcx, [0x180686390]
mov r8, rsi
mov rdx, r10
call fcn.180132284
mov r9, rsi
mov r8, r14
mov rcx, rbx
mov rbp, rax
call fcn.18030afd0
jmp 0x18030b6b2
mov r9, r8
lea rcx, [0x180686390]
mov r8, rsi
mov rdx, r10
call fcn.180132284
mov r9, rsi
mov r8, r14
mov rcx, rbx
mov rbp, rax
call fcn.18030b260
test rdi, rdi
je 0x18030b6d6
mov rax, qword [rbx]
mov r8, rdi
mov rcx, rbx
mov r9, qword [rax + 0x30]
movsxd rax, dword [rbx + 0x38]
imul rax, rsi
lea rdx, [r14 + rax*4]
call r9
add rbp, rax
mov rsi, qword [rsp + 0x50]
mov rax, rbp
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop r14
pop rdi
pop rbx
ret
Function at 0x180317a70
Capabilities:
Log keystrokes via polling

Disassembly:
push r12
push r14
push r15
sub rsp, 0x30
mov eax, dword [rcx + 0x1ec]
xor r15b, r15b
sub eax, 1
mov r14, rcx
movsxd r12, eax
js 0x180317c7b
mov qword [rsp + 0x50], rbx
lea rbx, [rcx + 0x200]
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r13
lea r13, [r12 + r12*2]
shl r13, 2
nop word [rax + rax]
mov eax, dword [r14 + 0x1b0]
mov rdx, qword [r14 + 0x1f0]
mov rbp, qword [r14 + 0x1e0]
lea ecx, [rax + rax*2]
mov eax, dword [rdx + r12*4]
mov esi, dword [rbp + r13]
lea edi, [rax + rcx*4]
bt esi, 0x10
jae 0x180317aef
movzx esi, si
jmp 0x180317aff
movzx ecx, si
call qword [sym.imp.USER32.dll_VkKeyScanW]
cmp al, 0xff
je 0x180317aff
movzx esi, al
mov ecx, esi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
je 0x180317bb7
mov eax, dword [rbp + r13 + 4]
xor eax, dword [0x18067b530]
test al, 7
jne 0x180317bb7
mov r8d, dword [rbx + 0x20]
cmp edi, r8d
jg 0x180317b56
test edi, edi
js 0x180317b56
mov rdx, qword [rbx]
test rdx, rdx
jne 0x180317b3e
lea rdx, [rbx + 8]
mov eax, edi
mov ecx, edi
sar eax, 5
and ecx, 0x1f
cdqe
mov eax, dword [rdx + rax*4]
bt eax, ecx
jb 0x180317c54
mov eax, edi
mov ebp, edi
sar eax, 5
and ebp, 0x1f
test edi, edi
js 0x180317b93
movsxd rsi, eax
cmp edi, r8d
jle 0x180317b7b
lea rdx, [rsi + 1]
mov rcx, rbx
call fcn.180188e40
mov dword [rbx + 0x20], edi
mov rax, qword [rbx]
mov ecx, ebp
mov edx, 1
shl edx, cl
test rax, rax
jne 0x180317b90
lea rax, [rbx + 8]
or dword [rax + rsi*4], edx
movss xmm3, dword [r14 + 0x1b4]
mov r8d, edi
mov edx, dword [r14 + 0x1a8]
mov rcx, qword [r14 + 0x1a0]
call fcn.180207030
jmp 0x180317c51
cmp edi, dword [rbx + 0x20]
jg 0x180317c54
test edi, edi
js 0x180317c54
mov rdx, qword [rbx]
mov r9, rdx
test rdx, rdx
jne 0x180317bd7
lea r9, [rbx + 8]
mov ecx, edi
mov eax, edi
and ecx, 0x1f
sar eax, 5
mov r8d, 1
shl r8d, cl
movsxd rcx, eax
test dword [r9 + rcx*4], r8d
je 0x180317c54
not r8d
test rdx, rdx
jne 0x180317bff
lea rdx, [rbx + 8]
and dword [rdx + rcx*4], r8d
mov ecx, dword [rbx + 0x20]
cmp edi, ecx
jne 0x180317c38
mov r8, qword [rbx]
test r8, r8
jne 0x180317c16
lea r8, [rbx + 8]
sar ecx, 5
movsxd rax, ecx
test ecx, ecx
js 0x180317c30
mov edx, dword [r8 + rax*4]
test edx, edx
jne 0x180317c8a
dec ecx
sub rax, 1
jns 0x180317c20
mov ecx, 0xffffffff
mov dword [rbx + 0x20], ecx
mov edx, dword [r14 + 0x1a8]
xorps xmm3, xmm3
mov rcx, qword [r14 + 0x1a0]
mov r8d, edi
call fcn.180206e00
mov r15b, 1
sub r13, 0xc
sub r12, 1
jns 0x180317ac0
mov r13, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
movzx eax, r15b
add rsp, 0x30
pop r15
pop r14
pop r12
ret
bsr eax, edx
shl ecx, 5
add ecx, eax
jmp 0x180317c35
Function at 0x18034f580
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, r8d
mov r10, rdx
lea rbx, [0x180550e60]
cmp r8d, 8
jl 0x18034f652
mov r11d, r9d
shr r11, 3
mov eax, r11d
neg eax
lea r9d, [r9 + rax*8]
nop dword [rax]
movzx eax, byte [r10]
movzx r8d, byte [r10 + 1]
shl rax, 8
or r8, rax
movzx eax, byte [r10 + 2]
shl r8, 8
or r8, rax
movzx eax, byte [r10 + 3]
shl r8, 8
or r8, rax
mov eax, ecx
xor r8, rax
mov rax, r8
shr rax, 0x10
movzx ecx, al
mov rax, r8
shr rax, 8
movzx edx, al
movzx eax, byte [r10 + 6]
mov ecx, dword [rbx + rcx*4 + 0x1800]
xor ecx, dword [rbx + rdx*4 + 0x1400]
xor ecx, dword [rbx + rax*4 + 0x400]
movzx eax, byte [r10 + 5]
xor ecx, dword [rbx + rax*4 + 0x800]
movzx eax, byte [r10 + 4]
xor ecx, dword [rbx + rax*4 + 0xc00]
movzx eax, byte [r10 + 7]
add r10, 8
xor ecx, dword [rbx + rax*4]
mov rax, r8
shr rax, 0x18
xor ecx, dword [rbx + rax*4 + 0x1c00]
movzx eax, r8b
xor ecx, dword [rbx + rax*4 + 0x1000]
sub r11, 1
jne 0x18034f5b0
test r9d, r9d
je 0x18034f67d
nop word [rax + rax]
movzx eax, byte [r10]
lea r10, [r10 + 1]
mov edx, ecx
shr rdx, 0x18
xor rdx, rax
shl ecx, 8
xor ecx, dword [rbx + rdx*4]
sub r9d, 1
jne 0x18034f660
mov rbx, qword [rsp + 8]
mov eax, ecx
ret
Function at 0x180360370
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
call fcn.1803604e0
test eax, eax
je 0x1803604c4
mov rax, qword [rbx + 8]
cmp dword [rax + 0x1404], 0
jne 0x1803603c8
xor ecx, ecx
mov rdi, rax
call fcn.1801316b4
cmp qword [rdi + 0x50], rax
je 0x1803604c4
mov rax, qword [rdi + 0x10]
test rax, rax
je 0x1803603c8
mov r8, qword [rdi + 0x48]
xor edx, edx
mov rcx, rbx
call rax
cmp eax, 1
je 0x1803604c4
mov rax, qword [rbx]
xor edi, edi
mov dword [rax], edi
mov rax, qword [rbx + 8]
mov dword [rax + 0x1c8], edi
mov rcx, qword [rbx + 8]
mov rcx, qword [rcx + 0x298]
call fcn.180124068
mov rax, qword [rbx + 8]
mov qword [rax + 0x298], rdi
mov rax, qword [rbx + 8]
mov dword [rax + 0x1cc], edi
mov rax, qword [rbx]
mov rcx, qword [rbx + 8]
mov eax, dword [rax + 0x1c]
mov dword [rcx + 0x1400], eax
mov rax, qword [rbx + 8]
mov dword [rax + 0x1bc], edi
mov rax, qword [rbx + 8]
mov dword [rax + 0x1b8], edi
mov rax, qword [rbx + 8]
cmp dword [rax + 0x1404], edi
jne 0x180360443
lea rdx, [rax + 0x1410]
lea rcx, [rax + 0x1478]
call fcn.180362140
jmp 0x180360449
mov dword [rax + 0x1404], edi
mov rax, qword [rbx + 8]
mov dword [rax + 0x1450], 0x67452301
mov dword [rax + 0x1454], 0xefcdab89
mov dword [rax + 0x1458], 0x98badcfe
mov qword [rax + 0x145c], 0x10325476
mov dword [rax + 0x1464], edi
mov qword [rax + 0x1468], rdi
mov qword [rax + 0x1470], rdi
mov rax, qword [rbx + 8]
mov qword [rax + 0x22c0], rdi
mov rax, qword [rbx + 8]
mov dword [rax + 0x22d8], edi
mov rax, qword [rbx + 8]
mov qword [rax + 0x22c8], rdi
mov rax, qword [rbx + 8]
mov dword [rax + 0x22b8], edi
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x180362d90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 8
mov r10, r8
mov r11, rcx
test edx, edx
jle 0x180362fc3
mov r8, qword [rsp + 0x38]
dec r9d
mov qword [rsp + 0x10], rbx
add r8, 0xffffffffffffff08
mov qword [rsp + 0x18], rsi
lea rsi, [0x180000000]
mov qword [rsp], rdi
mov edi, dword [rsp + 0x30]
mov ebx, edx
nop dword [rax]
xor eax, eax
cmp r9d, 0x1f
ja case.default.0x180362de7
mov edx, dword [rsi + r9*4 + 0x362fc8]
add rdx, rsi
jmp rdx
movsxd rax, dword [r10 + 0x7c]
imul rax, qword [r8 - 8]
movsxd rcx, dword [r10 + 0x78]
imul rcx, qword [r8]
add rax, rcx
movsxd rcx, dword [r10 + 0x74]
imul rcx, qword [r8 + 8]
add rax, rcx
movsxd rcx, dword [r10 + 0x70]
imul rcx, qword [r8 + 0x10]
add rax, rcx
movsxd rcx, dword [r10 + 0x6c]
imul rcx, qword [r8 + 0x18]
add rax, rcx
movsxd rcx, dword [r10 + 0x68]
imul rcx, qword [r8 + 0x20]
add rax, rcx
movsxd rcx, dword [r10 + 0x64]
imul rcx, qword [r8 + 0x28]
add rax, rcx
movsxd rcx, dword [r10 + 0x60]
imul rcx, qword [r8 + 0x30]
add rax, rcx
movsxd rcx, dword [r10 + 0x5c]
imul rcx, qword [r8 + 0x38]
add rax, rcx
movsxd rcx, dword [r10 + 0x58]
imul rcx, qword [r8 + 0x40]
add rax, rcx
movsxd rcx, dword [r10 + 0x54]
imul rcx, qword [r8 + 0x48]
add rax, rcx
movsxd rcx, dword [r10 + 0x50]
imul rcx, qword [r8 + 0x50]
add rax, rcx
movsxd rcx, dword [r10 + 0x4c]
imul rcx, qword [r8 + 0x58]
add rax, rcx
movsxd rcx, dword [r10 + 0x48]
imul rcx, qword [r8 + 0x60]
add rax, rcx
movsxd rcx, dword [r10 + 0x44]
imul rcx, qword [r8 + 0x68]
add rax, rcx
movsxd rcx, dword [r10 + 0x40]
imul rcx, qword [r8 + 0x70]
add rax, rcx
movsxd rcx, dword [r10 + 0x3c]
imul rcx, qword [r8 + 0x78]
add rax, rcx
movsxd rcx, dword [r10 + 0x38]
imul rcx, qword [r8 + 0x80]
add rax, rcx
movsxd rcx, dword [r10 + 0x34]
imul rcx, qword [r8 + 0x88]
add rax, rcx
movsxd rcx, dword [r10 + 0x30]
imul rcx, qword [r8 + 0x90]
add rax, rcx
movsxd rcx, dword [r10 + 0x2c]
imul rcx, qword [r8 + 0x98]
add rax, rcx
movsxd rcx, dword [r10 + 0x28]
imul rcx, qword [r8 + 0xa0]
add rax, rcx
movsxd rcx, dword [r10 + 0x24]
imul rcx, qword [r8 + 0xa8]
add rax, rcx
movsxd rcx, dword [r10 + 0x20]
imul rcx, qword [r8 + 0xb0]
add rax, rcx
movsxd rcx, dword [r10 + 0x1c]
imul rcx, qword [r8 + 0xb8]
add rax, rcx
movsxd rcx, dword [r10 + 0x18]
imul rcx, qword [r8 + 0xc0]
add rax, rcx
movsxd rcx, dword [r10 + 0x14]
imul rcx, qword [r8 + 0xc8]
add rax, rcx
movsxd rcx, dword [r10 + 0x10]
imul rcx, qword [r8 + 0xd0]
add rax, rcx
movsxd rcx, dword [r10 + 0xc]
imul rcx, qword [r8 + 0xd8]
add rax, rcx
movsxd rcx, dword [r10 + 8]
imul rcx, qword [r8 + 0xe0]
add rax, rcx
movsxd rcx, dword [r10 + 4]
imul rcx, qword [r8 + 0xe8]
add rax, rcx
movsxd rcx, dword [r10]
imul rcx, qword [r8 + 0xf0]
add rax, rcx
mov ecx, edi
sar rax, cl
movsxd rcx, dword [r11]
add r11, 4
add rax, rcx
mov qword [r8 + 0xf8], rax
add r8, 8
sub rbx, 1
jne 0x180362dd0
mov rdi, qword [rsp]
mov rsi, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x10]
add rsp, 8
ret
Function at 0x180364600
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
xor r11d, r11d
mov r10, r8
mov ebx, edx
test edx, edx
jle 0x180364841
mov esi, dword [rsp + 0x30]
lea edi, [r9 - 1]
mov r9, qword [rsp + 0x38]
lea r8, [rcx - 0xf8]
lea rbp, [0x180000000]
mov r14d, 0xfffffffe
nop word [rax + rax]
xor eax, eax
cmp edi, 0x1f
ja case.default.0x180364665
mov edx, dword [rbp + rdi*4 + 0x364864]
add rdx, rbp
jmp rdx
movsxd rax, dword [r10 + 0x7c]
imul rax, qword [r8 - 8]
movsxd rcx, dword [r10 + 0x78]
imul rcx, qword [r8]
add rax, rcx
movsxd rcx, dword [r10 + 0x74]
imul rcx, qword [r8 + 8]
add rax, rcx
movsxd rcx, dword [r10 + 0x70]
imul rcx, qword [r8 + 0x10]
add rax, rcx
movsxd rcx, dword [r10 + 0x6c]
imul rcx, qword [r8 + 0x18]
add rax, rcx
movsxd rcx, dword [r10 + 0x68]
imul rcx, qword [r8 + 0x20]
add rax, rcx
movsxd rcx, dword [r10 + 0x64]
imul rcx, qword [r8 + 0x28]
add rax, rcx
movsxd rcx, dword [r10 + 0x60]
imul rcx, qword [r8 + 0x30]
add rax, rcx
movsxd rcx, dword [r10 + 0x5c]
imul rcx, qword [r8 + 0x38]
add rax, rcx
movsxd rcx, dword [r10 + 0x58]
imul rcx, qword [r8 + 0x40]
add rax, rcx
movsxd rcx, dword [r10 + 0x54]
imul rcx, qword [r8 + 0x48]
add rax, rcx
movsxd rcx, dword [r10 + 0x50]
imul rcx, qword [r8 + 0x50]
add rax, rcx
movsxd rcx, dword [r10 + 0x4c]
imul rcx, qword [r8 + 0x58]
add rax, rcx
movsxd rcx, dword [r10 + 0x48]
imul rcx, qword [r8 + 0x60]
add rax, rcx
movsxd rcx, dword [r10 + 0x44]
imul rcx, qword [r8 + 0x68]
add rax, rcx
movsxd rcx, dword [r10 + 0x40]
imul rcx, qword [r8 + 0x70]
add rax, rcx
movsxd rcx, dword [r10 + 0x3c]
imul rcx, qword [r8 + 0x78]
add rax, rcx
movsxd rcx, dword [r10 + 0x38]
imul rcx, qword [r8 + 0x80]
add rax, rcx
movsxd rcx, dword [r10 + 0x34]
imul rcx, qword [r8 + 0x88]
add rax, rcx
movsxd rcx, dword [r10 + 0x30]
imul rcx, qword [r8 + 0x90]
add rax, rcx
movsxd rcx, dword [r10 + 0x2c]
imul rcx, qword [r8 + 0x98]
add rax, rcx
movsxd rcx, dword [r10 + 0x28]
imul rcx, qword [r8 + 0xa0]
add rax, rcx
movsxd rcx, dword [r10 + 0x24]
imul rcx, qword [r8 + 0xa8]
add rax, rcx
movsxd rcx, dword [r10 + 0x20]
imul rcx, qword [r8 + 0xb0]
add rax, rcx
movsxd rcx, dword [r10 + 0x1c]
imul rcx, qword [r8 + 0xb8]
add rax, rcx
movsxd rcx, dword [r10 + 0x18]
imul rcx, qword [r8 + 0xc0]
add rax, rcx
movsxd rcx, dword [r10 + 0x14]
imul rcx, qword [r8 + 0xc8]
add rax, rcx
movsxd rcx, dword [r10 + 0x10]
imul rcx, qword [r8 + 0xd0]
add rax, rcx
movsxd rcx, dword [r10 + 0xc]
imul rcx, qword [r8 + 0xd8]
add rax, rcx
movsxd rcx, dword [r10 + 8]
imul rcx, qword [r8 + 0xe0]
add rax, rcx
movsxd rcx, dword [r10 + 4]
imul rcx, qword [r8 + 0xe8]
add rax, rcx
movsxd rcx, dword [r10]
imul rcx, qword [r8 + 0xf0]
add rax, rcx
mov ecx, esi
sar rax, cl
mov rcx, qword [r8 + 0xf8]
sub rcx, rax
lea rax, [rcx + 0x7fffffff]
cmp rax, r14
ja 0x18036485d
mov dword [r9], ecx
inc r11d
add r9, 4
add r8, 8
cmp r11d, ebx
jl 0x180364650
mov eax, 1
mov rbx, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
pop r14
ret
xor eax, eax
jmp 0x180364846
Function at 0x18036d9a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x14]
mov r14, rdx
mov rbx, rcx
test al, 7
jne 0x18036dafb
test eax, eax
je 0x18036d9fd
mov eax, dword [rcx + 0xc]
mov esi, 0x20
cmp dword [rcx + 0x10], eax
jne 0x18036d9e6
mov edx, esi
call fcn.18036dc10
test eax, eax
je 0x18036dafb
sub esi, dword [rbx + 0x14]
mov edx, dword [rbx + 8]
movzx ecx, sil
mov rax, qword [rbx]
shl edx, cl
mov ecx, dword [rbx + 0x10]
bswap edx
mov dword [rax + rcx*4], edx
mov eax, dword [rbx + 0x14]
mov ecx, dword [rbx + 0x10]
mov r9, qword [rbx]
lea rbx, [0x18059d360]
shr eax, 3
lea r10d, [rax + rcx*4]
xor eax, eax
cmp r10d, 8
jb 0x18036dac0
mov r11d, r10d
shr r11, 3
nop word [rax + rax]
movzx ecx, byte [r9]
add r10d, 0xfffffff8
movzx r8d, byte [r9 + 1]
shl rcx, 8
or r8, rcx
movzx ecx, ax
movzx eax, byte [r9 + 5]
xor r8, rcx
movzx ecx, byte [r9 + 6]
movzx edx, word [rbx + rcx*2 + 0x200]
xor dx, word [rbx + rax*2 + 0x400]
movzx eax, byte [r9 + 4]
xor dx, word [rbx + rax*2 + 0x600]
movzx eax, byte [r9 + 3]
xor dx, word [rbx + rax*2 + 0x800]
movzx eax, byte [r9 + 7]
xor dx, word [rbx + rax*2]
movzx eax, byte [r9 + 2]
add r9, 8
xor dx, word [rbx + rax*2 + 0xa00]
mov rax, r8
shr rax, 8
xor dx, word [rbx + rax*2 + 0xe00]
movzx eax, r8b
xor dx, word [rbx + rax*2 + 0xc00]
movzx eax, dx
sub r11, 1
jne 0x18036da30
test r10d, r10d
je 0x18036daf0
nop word [rax + rax]
movzx ecx, byte [r9]
lea r9, [r9 + 1]
movzx edx, ax
shr rdx, 8
xor rdx, rcx
shl ax, 8
xor ax, word [rbx + rdx*2]
add r10d, 0xffffffff
jne 0x18036dad0
mov word [r14], ax
mov eax, 1
jmp 0x18036dafd
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x18036ef60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov edx, dword [rcx + 0x20]
lea rbp, [0x18059d360]
mov edi, dword [rcx + 0x14]
mov r11, rcx
mov esi, edx
cmp edi, edx
jbe 0x18036effc
mov r8d, dword [rcx + 0x24]
test r8d, r8d
je 0x18036f004
mov rax, qword [rcx]
lea esi, [rdx + 1]
mov ebx, dword [rax + rdx*4]
mov edx, dword [rcx + 0x1c]
mov dword [rcx + 0x20], esi
cmp r8d, 0x20
jae 0x18036eff0
nop dword [rax]
nop dword [rax + rax]
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
movzx r9d, dl
sub ecx, r8d
shl r9d, 8
cmp ecx, 0x20
jae 0x18036efcf
mov eax, ebx
shr eax, cl
movzx r10d, al
jmp 0x18036efd2
xor r10d, r10d
mov ecx, edx
add r8d, 8
shr rcx, 8
mov eax, r10d
xor rcx, rax
movzx edx, word [rbp + rcx*2]
xor edx, r9d
cmp r8d, 0x20
jb 0x18036efb0
mov dword [r11 + 0x1c], edx
mov dword [r11 + 0x24], 0
cmp edi, esi
jbe 0x18036f11a
mov rax, qword [r11]
sub edi, esi
movzx ebx, word [r11 + 0x1c]
mov ecx, esi
mov qword [rsp + 0x10], r14
lea r14, [rax + rcx*4]
cmp edi, 2
jb 0x18036f0c7
mov esi, edi
shr rsi, 1
nop word [rax + rax]
mov ecx, dword [r14]
add edi, 0xfffffffe
mov r10d, dword [r14 + 4]
mov r9d, ecx
movzx eax, bx
mov r8d, ecx
shr ecx, 8
add r14, 8
movzx edx, cl
shr r9, 0x10
xor r9, rax
mov eax, r10d
shr eax, 0x10
movzx ebx, word [rbp + rdx*2 + 0xa00]
movzx ecx, al
mov eax, r10d
shr eax, 8
xor bx, word [rbp + rcx*2 + 0x400]
movzx ecx, al
movzx eax, r8b
xor bx, word [rbp + rcx*2 + 0x200]
xor bx, word [rbp + rax*2 + 0x800]
mov rax, r9
shr rax, 8
xor bx, word [rbp + rax*2 + 0xe00]
mov eax, r10d
shr rax, 0x18
xor bx, word [rbp + rax*2 + 0x600]
movzx eax, r9b
xor bx, word [rbp + rax*2 + 0xc00]
movzx eax, r10b
xor bx, word [rbp + rax*2]
sub rsi, 1
jne 0x18036f030
test edi, edi
je 0x18036f10e
mov ecx, dword [r14]
movzx eax, bx
mov edx, ecx
mov r8d, ecx
shr ecx, 8
shr r8, 0x10
xor r8, rax
movzx ecx, cl
movzx eax, dl
movzx ebx, word [rbp + rcx*2 + 0x200]
xor bx, word [rbp + rax*2]
mov rax, r8
shr rax, 8
xor bx, word [rbp + rax*2 + 0x600]
movzx eax, r8b
xor bx, word [rbp + rax*2 + 0x400]
mov r14, qword [rsp + 0x10]
movzx eax, bx
mov dword [r11 + 0x1c], eax
mov rbx, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov dword [r11 + 0x20], 0
pop rdi
ret
Function at 0x180374970
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rsi
sub rsp, 0x80
mov qword [rax + 8], rbx
mov rsi, r8
mov qword [rax + 0x10], rbp
mov rbp, r9
mov qword [rax + 0x20], r14
mov r14, rcx
mov ebx, edx
mov r8d, 2
cmp edx, 8
jle 0x1803749e8
mov r8, rsi
call fcn.180374460
mov r8d, 8
cmp ebx, 0x20
jle 0x1803749e8
mov qword [rsp + 0xa0], rdi
mov edi, 0x20
nop dword [rax]
mov r9, rsi
mov qword [rsp + 0x20], rbp
mov edx, ebx
mov rcx, r14
call fcn.180373d20
mov r8d, edi
lea edi, [rdi*4]
cmp edi, ebx
jl 0x1803749c0
mov rdi, qword [rsp + 0xa0]
mov r14, qword [rsp + 0xa8]
lea eax, [r8*4]
mov rbp, qword [rsp + 0x98]
cmp eax, ebx
mov rbx, qword [rsp + 0x90]
movsxd r9, r8d
jne 0x180374b5f
test r8d, r8d
jle 0x180374be8
movaps xmmword [rsp + 0x70], xmm6
lea r11, [r9*8]
movaps xmmword [rsp + 0x60], xmm7
lea rcx, [rsi + 8]
mov r10, r9
movaps xmmword [rsp + 0x50], xmm8
dec r8d
movaps xmmword [rsp + 0x40], xmm9
mov rdx, 0xfffffffffffffff8
shr r8d, 1
add rcx, r11
movaps xmmword [rsp + 0x30], xmm10
movsd xmm10, qword [0x1805cab60]
neg r10
add r9, r9
sub rdx, r11
inc r8d
nop dword [rax]
movsd xmm9, qword [rcx + rdx]
movsd xmm8, qword [rcx]
movaps xmm7, xmm9
movsd xmm6, qword [rcx + r10*8]
movsd xmm5, qword [r11 + rcx - 8]
xorps xmm6, xmm10
movsd xmm3, qword [rcx + r9*8 - 8]
subsd xmm6, xmm8
movsd xmm4, qword [r11 + rcx]
addsd xmm3, xmm5
addsd xmm7, qword [rcx - 8]
subsd xmm9, qword [rcx - 8]
subsd xmm8, qword [rcx + r10*8]
subsd xmm5, qword [rcx + r9*8 - 8]
movsd xmm2, qword [rcx + r9*8]
movaps xmm1, xmm6
addsd xmm2, xmm4
movaps xmm0, xmm3
subsd xmm4, qword [rcx + r9*8]
addsd xmm0, xmm7
subsd xmm7, xmm3
subsd xmm1, xmm2
addsd xmm2, xmm6
movsd qword [rcx + rdx], xmm0
movaps xmm0, xmm9
subsd xmm0, xmm4
addsd xmm4, xmm9
movsd qword [rcx + r10*8], xmm1
movaps xmm1, xmm8
movsd qword [r11 + rcx - 8], xmm7
subsd xmm1, xmm5
movsd qword [r11 + rcx], xmm2
addsd xmm5, xmm8
movsd qword [rcx - 8], xmm0
movsd qword [rcx], xmm1
movsd qword [rcx + r9*8 - 8], xmm4
movsd qword [rcx + r9*8], xmm5
add rcx, 0x10
sub r8, 1
jne 0x180374a70
movaps xmm10, xmmword [rsp + 0x30]
movaps xmm9, xmmword [rsp + 0x40]
movaps xmm8, xmmword [rsp + 0x50]
movaps xmm7, xmmword [rsp + 0x60]
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x80
pop rsi
ret
test r8d, r8d
jle 0x180374be8
movsd xmm5, qword [0x1805cab60]
lea rax, [r9*8]
lea rcx, [rsi + 8]
mov rdx, 0xfffffffffffffff8
add rcx, rax
sub rdx, rax
lea rax, [r9 - 1]
mov r8, r9
shr rax, 1
neg r8
inc rax
nop dword [rax]
movsd xmm4, qword [rcx + rdx]
movsd xmm3, qword [rcx - 8]
movaps xmm0, xmm4
movsd xmm1, qword [rcx + r8*8]
addsd xmm0, xmm3
movsd xmm2, qword [rcx]
subsd xmm4, xmm3
subsd xmm2, xmm1
xorps xmm1, xmm5
movsd qword [rcx + rdx], xmm0
subsd xmm1, qword [rcx]
movsd qword [rcx + r8*8], xmm1
movsd qword [rcx - 8], xmm4
movsd qword [rcx], xmm2
add rcx, 0x10
sub rax, 1
jne 0x180374ba0
add rsp, 0x80
pop rsi
ret
Function at 0x180375860
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xor r8d, r8d
movaps xmm4, xmm2
unpcklpd xmm4, xmm4
movaps xmm3, xmm2
mov r10, rdx
mov r11, rcx
test r9, r9
je 0x180119e42
cmp r9, 8
jb 0x180119d85
lea rax, [r9 - 1]
lea rax, [rdx + rax*8]
lea rcx, [r9 - 1]
lea rcx, [r11 + rcx*4]
cmp r11, rax
ja 0x180119d08
cmp rcx, rdx
jae 0x180119d85
mov rdx, r9
mov qword [rsp], rbx
and rdx, 0xfffffffffffffff8
lea rax, [r11 + 0x10]
lea rcx, [r10 + 0x20]
nop dword [rax + rax]
movups xmm0, xmmword [rcx - 0x20]
add r8, 8
lea rax, [rax + 0x20]
movups xmm1, xmmword [rcx - 0x10]
lea rcx, [rcx + 0x40]
mulpd xmm0, xmm4
mulpd xmm1, xmm4
cvtpd2ps xmm0, xmm0
movsd qword [rax - 0x30], xmm0
cvtpd2ps xmm0, xmm1
movaps xmm1, xmm4
movsd qword [rax - 0x28], xmm0
movups xmm0, xmmword [rcx - 0x40]
mulpd xmm1, xmm0
movups xmm0, xmmword [rcx - 0x30]
cvtpd2ps xmm2, xmm1
mulpd xmm0, xmm4
movsd qword [rax - 0x20], xmm2
cvtpd2ps xmm0, xmm0
movsd qword [rax - 0x18], xmm0
cmp r8, rdx
jb 0x180119d20
mov rbx, qword [rsp]
cmp r8, r9
jae 0x180119e42
mov rax, r9
sub rax, r8
cmp rax, 4
jb 0x180119e20
mov rdx, r9
lea rax, [r11 + 8]
sub rdx, r8
lea rcx, [r10 + 0x10]
sub rdx, 4
lea rax, [rax + r8*4]
shr rdx, 2
lea rcx, [rcx + r8*8]
inc rdx
lea r8, [r8 + rdx*4]
nop word [rax + rax]
lea rax, [rax + 0x10]
movaps xmm0, xmm3
mulsd xmm0, qword [rcx - 0x10]
movaps xmm1, xmm3
lea rcx, [rcx + 0x20]
movaps xmm2, xmm3
cvtsd2ss xmm0, xmm0
movss dword [rax - 0x18], xmm0
xorps xmm0, xmm0
mulsd xmm1, qword [rcx - 0x28]
cvtsd2ss xmm0, xmm1
movaps xmm1, xmm3
movss dword [rax - 0x14], xmm0
xorps xmm0, xmm0
mulsd xmm2, qword [rcx - 0x20]
cvtsd2ss xmm0, xmm2
movss dword [rax - 0x10], xmm0
xorps xmm0, xmm0
mulsd xmm1, qword [rcx - 0x18]
cvtsd2ss xmm0, xmm1
movss dword [rax - 0xc], xmm0
sub rdx, 1
jne 0x180119dc0
cmp r8, r9
jae 0x180119e42
lea rax, [r11 + r8*4]
movaps xmm0, xmm3
lea rax, [rax + 4]
mulsd xmm0, qword [r10 + r8*8]
inc r8
cvtsd2ss xmm0, xmm0
movss dword [rax - 4], xmm0
cmp r8, r9
jb 0x180119e24
add rsp, 8
ret
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov r11, qword [rcx + 0x40]
mov rbx, rcx
mov rax, qword [rcx + 8]
mov rdi, rdx
mov r10, r11
lea rcx, [r11 + rax*8]
mov rax, r8
cmp r11, rcx
je 0x1803758bf
movsd xmm2, qword [0x1805cab60]
nop
movss xmm0, dword [rax]
lea rax, [rax + 4]
cvtps2pd xmm0, xmm0
lea r9, [r9 + 4]
movsd qword [r10], xmm0
movss xmm1, dword [r9 - 4]
cvtps2pd xmm1, xmm1
xorps xmm1, xmm2
movsd qword [r10 + 8], xmm1
add r10, 0x10
cmp r10, rcx
jne 0x180375890
mov rax, qword [rbx + 8]
mov r9, r11
shr rax, 1
mov rcx, rbx
movss xmm0, dword [r8 + rax*4]
mov r8d, 0xffffffff
cvtps2pd xmm0, xmm0
movsd qword [r11 + 8], xmm0
mov rax, qword [rbx + 0x28]
mov edx, dword [rbx + 8]
mov qword [rsp + 0x28], rax
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x20], rax
call fcn.180375560
mov r9, qword [rbx + 8]
xorps xmm0, xmm0
test r9, r9
js 0x18037590e
cvtsi2sd xmm0, r9
jmp 0x180375926
mov rax, r9
mov rcx, r9
shr rcx, 1
and eax, 1
or rcx, rax
cvtsi2sd xmm0, rcx
addsd xmm0, xmm0
movsd xmm2, qword [0x1805c9fc0]
mov rcx, rdi
mov rdx, qword [rbx + 0x40]
divsd xmm2, xmm0
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp 0x180119cc0