joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180016760
Capabilities:
Encode data using xor

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
mov rax, qword [0x1800f3188]
xor rax, rsp
mov qword [rbp + 0x47], rax
cmp edx, 1
jne 0x1800168f8
lea ecx, [rdx + 3]
mov dword [rbp + 7], 0xb1ee2170
lea rdx, [0x1800c3780]
mov dword [rbp + 0xb], 0xdfe5a1ef
mov dword [rbp + 0xf], 0x9c7eb88f
xor eax, eax
mov dword [rbp + 0x13], 0xc5ebc1da
mov dword [rbp + 0x17], 0xbef4e7f3
mov dword [rbp + 0x1b], 0x4ef9e2fb
mov dword [rbp + 0x1f], 0xbebcddf1
mov dword [rbp + 0x23], 0xe2fa7ddb
mov dword [rbp + 0x27], 0xfdf3fee9
mov dword [rbp + 0x2b], 0x76f7cfa7
mov dword [rbp + 0x2f], 0xddd9dbbf
mov dword [rbp + 0x33], 0xc49f8a7d
mov dword [rbp + 0x37], 0x29923ff3
mov dword [rbp + 0x3b], 0xc4e34af3
mov dword [rbp + 0x3f], 0xbbc0848e
mov dword [rbp + 0x43], 0xee3ebe8c
mov dword [rbp - 0x39], 0x9ed91678
mov dword [rbp - 0x35], 0x858288de
mov dword [rbp - 0x31], 0xb45399d3
mov dword [rbp - 0x2d], 0xc5ebc1da
mov dword [rbp - 0x29], 0xbef4e7f3
mov dword [rbp - 0x25], 0x4ef9e2fb
mov dword [rbp - 0x21], 0xbebcddf1
mov dword [rbp - 0x1d], 0xe2fa7ddb
mov dword [rbp - 0x19], 0xfdf3fee9
mov dword [rbp - 0x15], 0x76f7cfa7
mov dword [rbp - 0x11], 0xddd9dbbf
mov dword [rbp - 0xd], 0xc49f8a7d
mov dword [rbp - 9], 0x29923ff3
mov dword [rbp - 5], 0xc4e34af3
mov dword [rbp - 1], 0xbbc0848e
mov dword [rbp + 3], 0xee3ebe8c
movdqu xmm1, xmmword [rax + rdx]
movdqu xmm0, xmmword [rbp + rax - 0x39]
lea rax, [rax + 0x10]
pxor xmm0, xmm1
movdqu xmmword [rbp + rax - 0x49], xmm0
movdqu xmm0, xmmword [rbp + rax - 9]
pxor xmm0, xmm1
movdqu xmmword [rbp + rax - 9], xmm0
sub rcx, 1
jne 0x180016871
lea rcx, [rbp - 0x39]
Function at 0x180016920
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
mov rax, qword [0x1800f3188]
xor rax, rsp
mov qword [rbp + 0x47], rax
xor edi, edi
lea rsi, [0x1800c3780]
cmp qword [0x1800f3d30], rdi
jne 0x180016ad1
mov dword [rbp + 7], 0xb1ee2170
lea ecx, [rdi + 4]
mov dword [rbp + 0xb], 0xdfe5a1ef
mov eax, edi
mov dword [rbp + 0xf], 0x9c7eb88f
mov dword [rbp + 0x13], 0xc5ebc1da
mov dword [rbp + 0x17], 0xbef4e7f3
mov dword [rbp + 0x1b], 0x4ef9e2fb
mov dword [rbp + 0x1f], 0xbebcddf1
mov dword [rbp + 0x23], 0xe2fa7ddb
mov dword [rbp + 0x27], 0xfdf3fee9
mov dword [rbp + 0x2b], 0x76f7cfa7
mov dword [rbp + 0x2f], 0xddd9dbbf
mov dword [rbp + 0x33], 0xc49f8a7d
mov dword [rbp + 0x37], 0x29923ff3
mov dword [rbp + 0x3b], 0xc4e34af3
mov dword [rbp + 0x3f], 0xbbc0848e
mov dword [rbp + 0x43], 0xee3ebe8c
mov dword [rbp - 0x39], 0x9ed91678
mov dword [rbp - 0x35], 0x858288de
mov dword [rbp - 0x31], 0xb45399d3
mov dword [rbp - 0x2d], 0xc5ebc1da
mov dword [rbp - 0x29], 0xbef4e7f3
mov dword [rbp - 0x25], 0x4ef9e2fb
mov dword [rbp - 0x21], 0xbebcddf1
mov dword [rbp - 0x1d], 0xe2fa7ddb
mov dword [rbp - 0x19], 0xfdf3fee9
mov dword [rbp - 0x15], 0x76f7cfa7
mov dword [rbp - 0x11], 0xddd9dbbf
mov dword [rbp - 0xd], 0xc49f8a7d
mov dword [rbp - 9], 0x29923ff3
mov dword [rbp - 5], 0xc4e34af3
mov dword [rbp - 1], 0xbbc0848e
mov dword [rbp + 3], 0xee3ebe8c
movdqu xmm1, xmmword [rax + rsi]
movdqu xmm0, xmmword [rbp + rax - 0x39]
lea rax, [rax + 0x10]
pxor xmm0, xmm1
movdqu xmmword [rbp + rax - 0x49], xmm0
movdqu xmm0, xmmword [rbp + rax - 9]
pxor xmm1, xmm0
movdqu xmmword [rbp + rax - 9], xmm1
sub rcx, 1
jne 0x180016a40
lea rcx, [rbp - 0x39]
Function at 0x1800174a0
Capabilities:
Create process on windows
Encode data using xor

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x1800f3188]
xor rax, rsp
mov qword [rbp + 0x70], rax
xor edi, edi
mov rsi, rcx
test rcx, rcx
je 0x1800177a2
cmp byte [rcx], dil
je 0x1800177a2
movups xmm0, xmmword [str.cmd__c]
mov qword [r11 + 0x10], rbx
lea r9d, [rdi - 1]
mov r8, rcx
mov qword [r11 + 0x18], r14
mov dword [rsp + 0x28], edi
xor edx, edx
mov ecx, 0xfde9
mov qword [r11 + 0x20], r15
movups xmmword [rbp + 0x60], xmm0
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xorps xmm0, xmm0
xor ecx, ecx
mov qword [rbp - 0x30], rcx
mov rbx, 0xffffffffffffffff
mov qword [rsp + 0x60], rcx
lea rcx, [rbp + 0x60]
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
inc rbx
cmp word [rcx + rbx*2], di
jne 0x180017542
lea r15d, [rax + 0x10]
add r15d, ebx
lea ecx, [r15 + r15]
call fcn.1800a411c
mov r14, rax
test rax, rax
jne 0x180017571
call fcn.1800a41dc
mov edi, dword [rax]
neg edi
jmp 0x180017786
lea rax, [rbp + 0x60]
mov r10, r14
sub r10, rax
lea rdx, [rbp + 0x60]
nop
movzx eax, word [rdx]
mov word [r10 + rdx], ax
lea rdx, [rdx + 2]
test ax, ax
jne 0x180017580
mov eax, ebx
sub r15d, ebx
mov dword [rsp + 0x28], r15d
mov r9d, 0xffffffff
mov r8, rsi
mov ecx, 0xfde9
lea rdx, [r14 + rax*2]
mov qword [rsp + 0x20], rdx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor eax, eax
Function at 0x18001ad80
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push r12
push r13
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xc0
mov rax, qword [0x1800f3188]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rdx, qword [rcx + 0x10]
mov r15, rcx
mov dword [rbp - 0x19], 0xa4f93a65
mov dword [rbp - 0x15], 0xe7dda5ee
mov dword [rbp - 0x11], 0x9d6bb28f
movzx eax, word [rdx + 0x14]
lea r12, [rdx + 0x18]
add r12, rax
mov dword [rbp - 0xd], 0xc5ebb5b9
xor r13d, r13d
mov dword [rbp - 9], 0xbef4e7f3
mov dword [rbp - 5], 0x4ef9e2fb
lea rdx, [0x1800c3780]
mov dword [rbp - 1], 0xbebcddf1
mov eax, r13d
mov dword [rbp + 3], 0xe2fa7ddb
lea ecx, [r13 + 4]
mov dword [rbp + 7], 0xfdf3fee9
mov dword [rbp + 0xb], 0x76f7cfa7
mov dword [rbp + 0xf], 0xddd9dbbf
mov dword [rbp + 0x13], 0xc49f8a7d
mov dword [rbp + 0x17], 0x29923ff3
mov dword [rbp + 0x1b], 0xc4e34af3
mov dword [rbp + 0x1f], 0xbbc0848e
mov dword [rbp + 0x23], 0xee3ebe8c
mov dword [rbp - 0x59], 0x9ed91678
mov dword [rbp - 0x55], 0x858288de
mov dword [rbp - 0x51], 0xb45399d3
mov dword [rbp - 0x4d], 0xc5ebc1da
mov dword [rbp - 0x49], 0xbef4e7f3
mov dword [rbp - 0x45], 0x4ef9e2fb
mov dword [rbp - 0x41], 0xbebcddf1
mov dword [rbp - 0x3d], 0xe2fa7ddb
mov dword [rbp - 0x39], 0xfdf3fee9
mov dword [rbp - 0x35], 0x76f7cfa7
mov dword [rbp - 0x31], 0xddd9dbbf
mov dword [rbp - 0x2d], 0xc49f8a7d
mov dword [rbp - 0x29], 0x29923ff3
mov dword [rbp - 0x25], 0xc4e34af3
mov dword [rbp - 0x21], 0xbbc0848e
mov dword [rbp - 0x1d], 0xee3ebe8c
nop word [rax + rax]
movdqu xmm1, xmmword [rax + rdx]
movdqu xmm0, xmmword [rbp + rax - 0x59]
lea rax, [rax + 0x10]
pxor xmm0, xmm1
movdqu xmmword [rbp + rax - 0x69], xmm0
movdqu xmm0, xmmword [rbp + rax - 0x29]
pxor xmm0, xmm1
movdqu xmmword [rbp + rax - 0x29], xmm0
sub rcx, 1
jne 0x18001aeb0
lea rcx, [rbp - 0x59]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x18001aefd
lea rcx, [rbp - 0x59]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x18001af26
lea rdx, [rbp - 0x19]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18001af26
mov rcx, qword [r15 + 0x10]
lea r9, [rbp - 0x69]
mov r8d, 2
mov edx, dword [rcx + 0x54]
mov rcx, qword [r15 + 0x38]
call rax
mov r8, qword [r15 + 0x10]
mov esi, r13d
movzx r10d, word [r8 + 6]
cmp r13w, r10w
jae 0x18001b1b2
mov qword [rsp + 0x100], rdi
mov r11d, 0x40
mov qword [rsp + 0x108], r14
mov qword [rsp + 0xf8], rbx
nop word [rax + rax]
Function at 0x18001b5b0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x18001b72c
mov rcx, qword [rcx + 0x20]
mov eax, 0x5a4d
mov qword [rbx + 8], rcx
cmp word [rcx], ax
jne 0x18001b72c
movsxd rax, dword [rcx + 0x3c]
cmp eax, 0x3ff
ja 0x18001b72c
add rcx, rax
mov qword [rbx + 0x10], rcx
cmp dword [rcx], 0x4550
jne 0x18001b72c
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x10]
mov qword [rbx + 0x28], rcx
mov rcx, rbx
call fcn.18001b1e0
test eax, eax
je 0x18001b72c
mov rcx, qword [rbx + 0x38]
call fcn.18001b740
test eax, eax
je 0x18001b72c
mov rax, qword [rbx + 0x10]
mov rsi, qword [rbx + 0x38]
mov rcx, qword [rax + 0x30]
cmp rsi, rcx
je 0x18001b71c
cmp dword [rax + 0xb4], 0
je 0x18001b72c
movsxd rax, dword [rsi + 0x3c]
mov r10, rsi
mov qword [rsp + 0x30], rdi
sub r10, rcx
mov edi, dword [rax + rsi + 0xb0]
add rdi, rsi
mov eax, dword [rdi + 4]
test eax, eax
je 0x18001b717
nop word [rax + rax]
mov r9d, dword [rdi]
lea rbx, [rdi + 8]
mov r11d, eax
add r9, rsi
sub r11, 8
shr r11, 1
test r11d, r11d
je 0x18001b709
nop dword [rax]
movzx r8d, word [rbx]
dec r11d
mov eax, r8d
movzx edx, r8w
shr eax, 0xc
sub eax, 1
je 0x18001b6eb
sub eax, 1
je 0x18001b6de
sub eax, 1
je 0x18001b6d2
cmp eax, 7
jne 0x18001b6fd
and r8d, 0xfff
add qword [r8 + r9], r10
jmp 0x18001b6fd
and edx, 0xfff
add dword [rdx + r9], r10d
jmp 0x18001b6fd
and edx, 0xfff
add word [rdx + r9], r10w
jmp 0x18001b6fd
and edx, 0xfff
mov rax, r10
shr rax, 0x10
add word [rdx + r9], ax
add rbx, 2
test r11d, r11d
jne 0x18001b6a0
mov eax, dword [rdi + 4]
add rdi, rax
mov eax, dword [rdi + 4]
test eax, eax
jne 0x18001b680
mov rdi, qword [rsp + 0x30]
mov eax, 1
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
mov rbx, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rsi
ret
Function at 0x18001bb80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov rbx, rdx
mov r9, rcx
test rcx, rcx
je 0x18001bc1c
movsxd rax, dword [rcx + 0x3c]
mov r8d, dword [rax + rcx + 0x88]
test r8, r8
je 0x18001bc1c
add r8, rcx
mov edi, dword [r8 + 0x20]
mov ebp, dword [r8 + 0x24]
add rdi, rcx
mov esi, dword [r8 + 0x1c]
add rbp, rcx
add rsi, rcx
test ebx, 0xffff0000
jne 0x18001bbdc
movzx eax, bx
mov eax, dword [rsi + rax*4 - 4]
add rax, rcx
jmp 0x18001bc1e
mov r10d, dword [r8 + 0x18]
test r10d, r10d
je 0x18001bc1c
nop word [rax + rax]
dec r10d
mov r8, rbx
mov eax, dword [rdi + r10*4]
add rax, r9
sub r8, rax
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x18001bc13
inc rax
test ecx, ecx
jne 0x18001bc00
test edx, edx
je 0x18001bc33
test r10d, r10d
jne 0x18001bbf0
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
movzx eax, word [rbp + r10*2]
mov eax, dword [rsi + rax*4]
add rax, r9
jmp 0x18001bc1e
Function at 0x18001bce0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
mov rax, qword [0x1800f3188]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rbx, rcx
test rcx, rcx
jne 0x18001bd0f
xor eax, eax
jmp 0x18001bea2
movsxd rax, dword [rcx + 0x3c]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0xc8], rdi
mov r9d, dword [rax + rcx + 0x28]
add r9, rbx
call r9
test eax, eax
je 0x18001be93
xor edi, edi
mov dword [rbp + 7], 0xa4f93a65
mov dword [rbp + 0xb], 0xf1dda5ee
lea rdx, [0x1800c3780]
mov dword [rbp + 0xf], 0xf87ab88f
mov eax, edi
mov dword [rbp + 0x13], 0xc5ebc1da
lea ecx, [rdi + 4]
mov dword [rbp + 0x17], 0xbef4e7f3
mov dword [rbp + 0x1b], 0x4ef9e2fb
mov dword [rbp + 0x1f], 0xbebcddf1
mov dword [rbp + 0x23], 0xe2fa7ddb
mov dword [rbp + 0x27], 0xfdf3fee9
mov dword [rbp + 0x2b], 0x76f7cfa7
mov dword [rbp + 0x2f], 0xddd9dbbf
mov dword [rbp + 0x33], 0xc49f8a7d
mov dword [rbp + 0x37], 0x29923ff3
mov dword [rbp + 0x3b], 0xc4e34af3
mov dword [rbp + 0x3f], 0xbbc0848e
mov dword [rbp + 0x43], 0xee3ebe8c
mov dword [rbp - 0x39], 0x9ed91678
mov dword [rbp - 0x35], 0x858288de
mov dword [rbp - 0x31], 0xb45399d3
mov dword [rbp - 0x2d], 0xc5ebc1da
mov dword [rbp - 0x29], 0xbef4e7f3
mov dword [rbp - 0x25], 0x4ef9e2fb
mov dword [rbp - 0x21], 0xbebcddf1
mov dword [rbp - 0x1d], 0xe2fa7ddb
mov dword [rbp - 0x19], 0xfdf3fee9
mov dword [rbp - 0x15], 0x76f7cfa7
mov dword [rbp - 0x11], 0xddd9dbbf
mov dword [rbp - 0xd], 0xc49f8a7d
mov dword [rbp - 9], 0x29923ff3
mov dword [rbp - 5], 0xc4e34af3
mov dword [rbp - 1], 0xbbc0848e
mov dword [rbp + 3], 0xee3ebe8c
movdqu xmm0, xmmword [rbp + rax - 0x39]
movdqu xmm2, xmmword [rax + rdx]
lea rax, [rax + 0x10]
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmm0, xmmword [rbp + rax - 9]
movdqu xmmword [rbp + rax - 0x49], xmm1
pxor xmm0, xmm2
movdqu xmmword [rbp + rax - 9], xmm0
sub rcx, 1
jne 0x18001be21
lea rcx, [rbp - 0x39]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x18001be72
lea rcx, [rbp - 0x39]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x18001be98
lea rdx, [rbp + 7]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18001be98
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call rax
jmp 0x18001be98
mov edi, 0xfffffff2
mov eax, edi
mov rdi, qword [rsp + 0xc8]
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1800a1bf0
mov rbx, qword [rsp + 0xd0]
add rsp, 0xb0
pop rbp
ret
Function at 0x18001ccd0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push r12
push r14
push r15
sub rsp, 0x20
mov ebp, r8d
mov r12, r9
mov rbx, rdx
mov r15, rcx
mov r14, r9
test r8b, 0xf
jne 0x18001cdcf
mov qword [rsp + 0x40], rsi
mov esi, ebp
cmp dword [rsp + 0x60], ebp
jae 0x18001cd14
mov ecx, ebp
call fcn.1800a411c
mov r14, rax
mov r8, rsi
mov rdx, rbx
mov rcx, r14
call fcn.1800a2a90
mov rbx, r14
test ebp, ebp
je 0x18001cd96
mov qword [rsp + 0x48], rdi
mov rdi, r15
sub rdi, r14
add rdi, 0xb0
dec rsi
shr rsi, 4
inc rsi
nop word [rax + rax]
movups xmm0, xmmword [rbx]
mov rdx, r15
mov rcx, rbx
call fcn.18001d200
mov ecx, reloc.WS2_32.dll_recv
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdi + rbx]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x18001cd70
sub rdi, 0x10
movups xmmword [r15 + 0xb0], xmm0
sub rsi, 1
jne 0x18001cd50
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
lea eax, [rbp - 1]
movzx eax, byte [rax + r14]
mov ebx, ebp
sub ebx, eax
cmp ebx, ebp
jae 0x18001cdcf
lea eax, [rbp - 0x10]
cmp ebx, eax
jb 0x18001cdcf
cmp dword [rsp + 0x60], ebx
jb 0x18001cdcf
cmp r14, r12
je 0x18001cdcb
mov r8d, ebx
mov rdx, r14
mov rcx, r12
call fcn.1800a2a90
mov eax, ebx
jmp 0x18001cdd4
mov eax, 0xfffffff2
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x18001cdf0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov esi, r8d
mov r14d, r8d
and esi, 0xfffffff0
mov rdi, r9
add esi, 0x10
mov rbp, rcx
cmp dword [rsp + 0x50], esi
jae 0x18001ce27
mov eax, 0xfffffff2
jmp 0x18001cebb
mov r8, r14
mov qword [rsp + 0x30], rbx
mov rcx, rdi
call fcn.1800a2a90
mov eax, esi
lea rcx, [r14 + rdi]
sub eax, r14d
mov edx, eax
mov r8d, eax
call fcn.1800a3140
mov ebx, esi
lea r8, [rbp + 0xb0]
test esi, esi
je 0x18001cea9
dec rbx
shr rbx, 4
inc rbx
nop dword [rax]
nop word [rax + rax]
mov rax, rdi
sub r8, rdi
mov edx, reloc.WS2_32.dll_recv
nop dword [rax + rax]
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x18001ce80
mov rdx, rbp
mov rcx, rdi
call fcn.18001cf00
mov r8, rdi
add rdi, 0x10
sub rbx, 1
jne 0x18001ce70
movups xmm0, xmmword [r8]
mov rbx, qword [rsp + 0x30]
mov eax, esi
movups xmmword [rbp + 0xb0], xmm0
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x18001d200
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
sub rsi, rcx
mov r9d, 4
nop dword [rax]
mov r8d, 4
nop word [rax + rax]
movzx eax, byte [rsi + rcx + 0xa0]
xor byte [rcx], al
inc rcx
sub r8, 1
jne 0x18001d240
sub r9, 1
jne 0x18001d230
mov bpl, 9
lea rdi, [rsi + 0x90]
lea r14, [0x1800c3f90]
nop word [rax + rax]
movzx eax, byte [rbx + 9]
mov r8, rbx
movzx ecx, byte [rbx + 0xd]
mov r9d, 4
mov byte [rbx + 0xd], al
movzx eax, byte [rbx + 5]
mov byte [rbx + 9], al
movzx eax, byte [rbx + 1]
mov byte [rbx + 5], al
movzx eax, byte [rbx + 0xa]
mov byte [rbx + 1], cl
movzx ecx, byte [rbx + 2]
mov byte [rbx + 2], al
movzx eax, byte [rbx + 0xe]
mov byte [rbx + 0xa], cl
movzx ecx, byte [rbx + 6]
mov byte [rbx + 6], al
movzx eax, byte [rbx + 7]
mov byte [rbx + 0xe], cl
movzx ecx, byte [rbx + 3]
mov byte [rbx + 3], al
movzx eax, byte [rbx + 0xb]
mov byte [rbx + 7], al
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0xb], al
mov byte [rbx + 0xf], cl
nop dword [rax]
mov rcx, r8
mov edx, 4
nop dword [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 4]
movzx eax, byte [rax + r14]
mov byte [rcx - 4], al
sub rdx, 1
jne 0x18001d2e0
inc r8
sub r9, 1
jne 0x18001d2d0
mov rax, rbx
lea r8d, [rdx + 4]
nop word [rax + rax]
mov edx, 4
nop word [rax + rax]
movzx ecx, byte [rdi + rax]
xor byte [rax], cl
inc rax
sub rdx, 1
jne 0x18001d320
sub r8, 1
jne 0x18001d310
mov rcx, rbx
call fcn.18001d420
sub rdi, 0x10
add bpl, 0xff
jne 0x18001d270
movzx eax, byte [rbx + 9]
mov r8, rbx
movzx ecx, byte [rbx + 0xd]
mov r9d, 4
mov byte [rbx + 0xd], al
movzx eax, byte [rbx + 5]
mov byte [rbx + 9], al
movzx eax, byte [rbx + 1]
mov byte [rbx + 5], al
movzx eax, byte [rbx + 0xa]
mov byte [rbx + 1], cl
movzx ecx, byte [rbx + 2]
mov byte [rbx + 2], al
movzx eax, byte [rbx + 0xe]
mov byte [rbx + 0xa], cl
movzx ecx, byte [rbx + 6]
mov byte [rbx + 6], al
movzx eax, byte [rbx + 7]
mov byte [rbx + 0xe], cl
movzx ecx, byte [rbx + 3]
mov byte [rbx + 3], al
movzx eax, byte [rbx + 0xb]
mov byte [rbx + 7], al
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0xb], al
mov byte [rbx + 0xf], cl
nop dword [rax + rax]
mov rcx, r8
mov edx, 4
nop dword [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 4]
movzx eax, byte [rax + r14]
mov byte [rcx - 4], al
sub rdx, 1
jne 0x18001d3c0
inc r8
sub r9, 1
jne 0x18001d3b0
lea edx, [r9 + 4]
mov ecx, 4
nop word [rax + rax]
movzx eax, byte [rbx + rsi]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x18001d3f0
sub rdx, 1
jne 0x18001d3e2
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x18001d420
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
lea rbp, [rcx + 2]
mov qword [rsp + 0x20], 4
mov qword [rsp + 0x18], rbp
nop word [rax + rax]
movzx r9d, byte [rbp - 1]
movzx edx, byte [rbp - 2]
movzx ebx, r9b
movzx r8d, byte [rbp]
movzx eax, dl
shr al, 7
add bl, bl
movzx ecx, byte [rbp + 1]
movzx eax, al
imul eax, eax, 0x1b
mov byte [rsp + 0x78], r9b
mov byte [rsp + 0x88], dl
add dl, dl
mov byte [rsp + 0x80], r8b
xor dl, al
mov dword [rsp + 8], eax
movzx eax, dl
movzx esi, dl
shr al, 7
add sil, sil
movzx eax, al
imul eax, eax, 0x1b
xor sil, al
mov dword [rsp + 4], eax
movzx eax, r9b
movzx r9d, r8b
shr al, 7
add r9b, r9b
movzx eax, al
imul r15d, eax, 0x1b
xor bl, r15b
movzx eax, bl
movzx r10d, bl
shr al, 7
add r10b, r10b
movzx eax, al
imul eax, eax, 0x1b
xor r10b, al
mov dword [rsp + 0x10], eax
movzx eax, r8b
shr al, 7
movzx eax, al
imul r12d, eax, 0x1b
xor r9b, r12b
mov dword [rsp + 0xc], r12d
movzx eax, r9b
movzx r8d, r9b
shr al, 7
xor r9b, dl
movzx eax, al
add r8b, r8b
imul ebp, eax, 0x1b
movzx eax, cl
shr al, 7
add cl, cl
movzx eax, al
imul eax, eax, 0x1b
xor r8b, bpl
xor cl, al
mov dword [rsp + 0x14], eax
movzx eax, cl
movzx r13d, cl
shr al, 7
add r13b, r13b
movzx eax, al
imul r14d, eax, 0x1b
xor r13b, r14b
xor r9b, r13b
movzx eax, r13b
shr al, 7
xor r9b, r8b
movzx eax, al
xor r9b, r10b
imul edi, eax, 0x1b
xor r9b, sil
movzx eax, r8b
mov byte [rsp], r9b
shr al, 7
movzx eax, al
imul r11d, eax, 0x1b
movzx eax, r10b
shr al, 7
xor r13b, cl
movzx eax, al
xor r13b, r8b
imul r9d, eax, 0x1b
xor r13b, r10b
mov r12, qword [rsp + 0x18]
xor r13b, bl
movzx ebx, byte [rsp + 0x80]
xor r13b, sil
mov rcx, qword [rsp + 0x18]
movzx eax, sil
shr al, 7
movzx esi, byte [rsp + 0x78]
mov r8d, dword [rsp + 0x10]
movzx r10d, byte [rcx + 1]
movzx eax, al
imul edx, eax, 0x1b
movzx eax, byte [rsp]
xor al, byte [rsp + 0x78]
xor al, byte [rsp + 0x88]
add al, al
xor al, dl
xor al, r9b
xor al, r11b
xor al, dil
xor al, bpl
xor al, r15b
xor al, byte [rsp + 4]
xor al, byte [rsp + 8]
xor al, byte [r12 + 1]
xor al, byte [rsp + 0x80]
xor al, byte [rsp + 0x78]
mov byte [r12 - 2], al
movzx eax, r13b
mov r12d, dword [rsp + 0xc]
xor al, bl
xor al, sil
xor r13b, r10b
add al, al
xor al, dl
xor al, r9b
xor al, r11b
xor al, dil
xor al, r14b
xor al, r12b
xor al, r8b
xor al, r15b
movzx r15d, byte [rsp + 0x88]
xor r13b, r15b
xor al, r10b
add r13b, r13b
xor al, bl
xor r13b, dl
xor al, r15b
mov byte [rcx - 1], al
xor r13b, r9b
mov eax, dword [rsp + 0x14]
xor r13b, r11b
movzx ecx, byte [rsp]
xor r13b, dil
xor cl, r10b
xor r13b, r14b
xor cl, bl
xor r13b, al
add cl, cl
xor r13b, r8b
xor cl, dl
xor cl, r9b
xor cl, r11b
xor cl, dil
xor cl, al
xor cl, bpl
mov rbp, qword [rsp + 0x18]
xor cl, r12b
xor cl, byte [rsp + 4]
xor cl, r10b
xor cl, sil
xor cl, r15b
xor r13b, byte [rsp + 8]
mov byte [rbp], cl
xor r13b, bl
xor r13b, sil
xor r13b, r15b
mov byte [rbp + 1], r13b
add rbp, 4
sub qword [rsp + 0x20], 1
mov qword [rsp + 0x18], rbp
jne 0x18001d450
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret