joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800d3010
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0xa8
mov rax, qword [0x180129540]
xor rax, rsp
mov qword [rsp + 0x80], rax
movups xmm0, xmmword [str.eqCEQXT]
mov eax, dword [0x1800f6750]
xor r9d, r9d
cmp dword [0x180129500], 2
mov ecx, r9d
movups xmm1, xmmword [0x1800f6728]
mov dword [rsp + 0x78], eax
movups xmmword [rsp + 0x40], xmm0
movups xmm0, xmmword [0x1800f6738]
movups xmmword [rsp + 0x50], xmm1
movups xmmword [rsp + 0x60], xmm0
movsd xmm0, qword [0x1800f6748]
movsd qword [rsp + 0x70], xmm0
jl 0x1800d31bc
movdqa xmm0, xmmword [0x1800f5f30]
lea rdx, [rsp + 0x44]
movdqa xmm5, xmmword [0x1800e4760]
movdqa xmm4, xmmword [0x1800f1690]
movdqa xmmword [rsp + 0x20], xmm0
mov r8d, dword [rsp + 0x20]
movaps xmmword [rsp + 0x90], xmm6
movdqa xmm6, xmmword [str.2222]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x1800e4780]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1800e4780]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x38
jl 0x1800d30b0
movaps xmm6, xmmword [rsp + 0x90]
cmp ecx, 0x3c
jge 0x1800d31fd
movsxd rax, ecx
lea r8, [rsp + 0x40]
add r8, rax
nop word [rax + rax]
mov eax, 0x51eb851f
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x32
movzx eax, cl
inc ecx
sub al, dl
add al, 0x34
xor byte [r8 - 1], al
cmp ecx, 0x3c
jl 0x1800d31d0
xorps xmm0, xmm0
mov qword [rsp + 0x30], r9
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x38], r9
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], r9b
jne 0x1800d3220
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.180004e30
lea rcx, [rsp + 0x20]
call fcn.1800d0660
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1800d8e20
add rsp, 0xa8
ret
Function at 0x1800d3260
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0xa8
mov rax, qword [0x180129540]
xor rax, rsp
mov qword [rsp + 0x80], rax
movups xmm0, xmmword [0x1800f66d8]
mov eax, dword [0x1800f6710]
xor r9d, r9d
cmp dword [0x180129500], 2
mov ecx, r9d
movups xmm1, xmmword [0x1800f66e8]
mov dword [rsp + 0x78], eax
movups xmmword [rsp + 0x40], xmm0
movups xmm0, xmmword [0x1800f66f8]
movups xmmword [rsp + 0x50], xmm1
movups xmmword [rsp + 0x60], xmm0
movsd xmm0, qword [0x1800f6708]
movsd qword [rsp + 0x70], xmm0
jl 0x1800d340c
movdqa xmm0, xmmword [0x1800f5f30]
lea rdx, [rsp + 0x44]
movdqa xmm5, xmmword [0x1800e4760]
movdqa xmm4, xmmword [0x1800f1690]
movdqa xmmword [rsp + 0x20], xmm0
mov r8d, dword [rsp + 0x20]
movaps xmmword [rsp + 0x90], xmm6
movdqa xmm6, xmmword [str.2222]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x1800e4780]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1800e4780]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x38
jl 0x1800d3300
movaps xmm6, xmmword [rsp + 0x90]
cmp ecx, 0x3c
jge 0x1800d344d
movsxd rax, ecx
lea r8, [rsp + 0x40]
add r8, rax
nop word [rax + rax]
mov eax, 0x51eb851f
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x32
movzx eax, cl
inc ecx
sub al, dl
add al, 0x34
xor byte [r8 - 1], al
cmp ecx, 0x3c
jl 0x1800d3420
xorps xmm0, xmm0
mov qword [rsp + 0x30], r9
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x38], r9
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], r9b
jne 0x1800d3470
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.180004e30
lea rcx, [rsp + 0x20]
call fcn.1800d0660
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1800d8e20
add rsp, 0xa8
ret
Function at 0x1800d34b0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0xa8
mov rax, qword [0x180129540]
xor rax, rsp
mov qword [rsp + 0x80], rax
movups xmm0, xmmword [0x1800f6698]
mov eax, dword [0x1800f66d0]
xor r9d, r9d
cmp dword [0x180129500], 2
mov ecx, r9d
movups xmm1, xmmword [0x1800f66a8]
mov dword [rsp + 0x78], eax
movups xmmword [rsp + 0x40], xmm0
movups xmm0, xmmword [0x1800f66b8]
movups xmmword [rsp + 0x50], xmm1
movups xmmword [rsp + 0x60], xmm0
movsd xmm0, qword [0x1800f66c8]
movsd qword [rsp + 0x70], xmm0
jl 0x1800d365c
movdqa xmm0, xmmword [0x1800f5f30]
lea rdx, [rsp + 0x44]
movdqa xmm5, xmmword [0x1800e4760]
movdqa xmm4, xmmword [0x1800f1690]
movdqa xmmword [rsp + 0x20], xmm0
mov r8d, dword [rsp + 0x20]
movaps xmmword [rsp + 0x90], xmm6
movdqa xmm6, xmmword [str.2222]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x1800e4780]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1800e4780]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x38
jl 0x1800d3550
movaps xmm6, xmmword [rsp + 0x90]
cmp ecx, 0x3c
jge 0x1800d369d
movsxd rax, ecx
lea r8, [rsp + 0x40]
add r8, rax
nop word [rax + rax]
mov eax, 0x51eb851f
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x32
movzx eax, cl
inc ecx
sub al, dl
add al, 0x34
xor byte [r8 - 1], al
cmp ecx, 0x3c
jl 0x1800d3670
xorps xmm0, xmm0
mov qword [rsp + 0x30], r9
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x38], r9
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], r9b
jne 0x1800d36c0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.180004e30
lea rcx, [rsp + 0x20]
call fcn.1800d0660
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1800d8e20
add rsp, 0xa8
ret
Function at 0x1800d3700
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0xa8
mov rax, qword [0x180129540]
xor rax, rsp
mov qword [rsp + 0x80], rax
movups xmm0, xmmword [0x1800f6658]
mov eax, dword [0x1800f6690]
xor r9d, r9d
cmp dword [0x180129500], 2
mov ecx, r9d
movups xmm1, xmmword [0x1800f6668]
mov dword [rsp + 0x78], eax
movups xmmword [rsp + 0x40], xmm0
movups xmm0, xmmword [0x1800f6678]
movups xmmword [rsp + 0x50], xmm1
movups xmmword [rsp + 0x60], xmm0
movsd xmm0, qword [0x1800f6688]
movsd qword [rsp + 0x70], xmm0
jl 0x1800d38ac
movdqa xmm0, xmmword [0x1800f5f30]
lea rdx, [rsp + 0x44]
movdqa xmm5, xmmword [0x1800e4760]
movdqa xmm4, xmmword [0x1800f1690]
movdqa xmmword [rsp + 0x20], xmm0
mov r8d, dword [rsp + 0x20]
movaps xmmword [rsp + 0x90], xmm6
movdqa xmm6, xmmword [str.2222]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x1800e4780]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1800e4780]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x38
jl 0x1800d37a0
movaps xmm6, xmmword [rsp + 0x90]
cmp ecx, 0x3c
jge 0x1800d38ed
movsxd rax, ecx
lea r8, [rsp + 0x40]
add r8, rax
nop word [rax + rax]
mov eax, 0x51eb851f
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x32
movzx eax, cl
inc ecx
sub al, dl
add al, 0x34
xor byte [r8 - 1], al
cmp ecx, 0x3c
jl 0x1800d38c0
xorps xmm0, xmm0
mov qword [rsp + 0x30], r9
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x38], r9
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], r9b
jne 0x1800d3910
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.180004e30
lea rcx, [rsp + 0x20]
call fcn.1800d0660
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1800d8e20
add rsp, 0xa8
ret
Function at 0x1800d3950
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0xa8
mov rax, qword [0x180129540]
xor rax, rsp
mov qword [rsp + 0x80], rax
movups xmm0, xmmword [0x1800f6618]
mov eax, dword [0x1800f6650]
xor r9d, r9d
cmp dword [0x180129500], 2
mov ecx, r9d
movups xmm1, xmmword [0x1800f6628]
mov dword [rsp + 0x78], eax
movups xmmword [rsp + 0x40], xmm0
movups xmm0, xmmword [0x1800f6638]
movups xmmword [rsp + 0x50], xmm1
movups xmmword [rsp + 0x60], xmm0
movsd xmm0, qword [0x1800f6648]
movsd qword [rsp + 0x70], xmm0
jl 0x1800d3afc
movdqa xmm0, xmmword [0x1800f5f30]
lea rdx, [rsp + 0x44]
movdqa xmm5, xmmword [0x1800e4760]
movdqa xmm4, xmmword [0x1800f1690]
movdqa xmmword [rsp + 0x20], xmm0
mov r8d, dword [rsp + 0x20]
movaps xmmword [rsp + 0x90], xmm6
movdqa xmm6, xmmword [str.2222]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x1800e4780]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1800e4780]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x38
jl 0x1800d39f0
movaps xmm6, xmmword [rsp + 0x90]
cmp ecx, 0x3c
jge 0x1800d3b3d
movsxd rax, ecx
lea r8, [rsp + 0x40]
add r8, rax
nop word [rax + rax]
mov eax, 0x51eb851f
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x32
movzx eax, cl
inc ecx
sub al, dl
add al, 0x34
xor byte [r8 - 1], al
cmp ecx, 0x3c
jl 0x1800d3b10
xorps xmm0, xmm0
mov qword [rsp + 0x30], r9
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x38], r9
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], r9b
jne 0x1800d3b60
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.180004e30
lea rcx, [rsp + 0x20]
call fcn.1800d0660
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1800d8e20
add rsp, 0xa8
ret
Function at 0x1800d3ba0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0xa8
mov rax, qword [0x180129540]
xor rax, rsp
mov qword [rsp + 0x80], rax
movups xmm0, xmmword [0x1800f65d8]
mov eax, dword [0x1800f6610]
xor r9d, r9d
cmp dword [0x180129500], 2
mov ecx, r9d
movups xmm1, xmmword [0x1800f65e8]
mov dword [rsp + 0x78], eax
movups xmmword [rsp + 0x40], xmm0
movups xmm0, xmmword [0x1800f65f8]
movups xmmword [rsp + 0x50], xmm1
movups xmmword [rsp + 0x60], xmm0
movsd xmm0, qword [0x1800f6608]
movsd qword [rsp + 0x70], xmm0
jl 0x1800d3d4c
movdqa xmm0, xmmword [0x1800f5f30]
lea rdx, [rsp + 0x44]
movdqa xmm5, xmmword [0x1800e4760]
movdqa xmm4, xmmword [0x1800f1690]
movdqa xmmword [rsp + 0x20], xmm0
mov r8d, dword [rsp + 0x20]
movaps xmmword [rsp + 0x90], xmm6
movdqa xmm6, xmmword [str.2222]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x1800e4780]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1800e4780]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x38
jl 0x1800d3c40
movaps xmm6, xmmword [rsp + 0x90]
cmp ecx, 0x3c
jge 0x1800d3d8d
movsxd rax, ecx
lea r8, [rsp + 0x40]
add r8, rax
nop word [rax + rax]
mov eax, 0x51eb851f
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x32
movzx eax, cl
inc ecx
sub al, dl
add al, 0x34
xor byte [r8 - 1], al
cmp ecx, 0x3c
jl 0x1800d3d60
xorps xmm0, xmm0
mov qword [rsp + 0x30], r9
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x38], r9
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], r9b
jne 0x1800d3db0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.180004e30
lea rcx, [rsp + 0x20]
call fcn.1800d0660
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1800d8e20
add rsp, 0xa8
ret
Function at 0x1800d47d0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
sub rax, 0x10000
mov rcx, rax
call fcn.1800d49f0
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x20], rax
jbe 0x1800d48d7
mov rax, qword [0x1801294e0]
cmp qword [rsp + 0x20], rax
jb 0x1800d4834
mov rax, qword [0x1801294e8]
cmp qword [rsp + 0x20], rax
ja 0x1800d4834
mov rax, qword [rsp + 0x20]
sub rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x1800d47f6
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x1800d4863
jmp 0x1800d48d7
cmp dword [rsp + 0x50], 0x10000
jne 0x1800d48ba
cmp qword [rsp + 0x48], 0x10000
jb 0x1800d48ba
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1800d48a8
mov rax, qword [rsp + 0x28]
jmp 0x1800d48d9
mov rax, qword [rsp + 0x20]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x1800d48d2
mov rax, qword [rsp + 0x38]
sub rax, 0x10000
mov rcx, rax
call fcn.1800d49f0
mov qword [rsp + 0x20], rax
jmp 0x1800d47f6
xor eax, eax
add rsp, 0x68
ret

Function at 0x1800d48e0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.1800d4a30
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x20], rax
jae 0x1800d49e3
mov rax, qword [0x1801294e0]
cmp qword [rsp + 0x20], rax
jb 0x1800d493b
mov rax, qword [0x1801294e8]
cmp qword [rsp + 0x20], rax
ja 0x1800d493b
mov rax, qword [rsp + 0x20]
add rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x1800d48fd
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x1800d496a
jmp 0x1800d49e3
cmp dword [rsp + 0x50], 0x10000
jne 0x1800d49c1
cmp qword [rsp + 0x48], 0x10000
jb 0x1800d49c1
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1800d49af
mov rax, qword [rsp + 0x28]
jmp 0x1800d49e5
mov rax, qword [rsp + 0x20]
add rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x1800d49de
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.1800d4a30
mov qword [rsp + 0x20], rax
jmp 0x1800d48fd
xor eax, eax
add rsp, 0x68
ret
Function at 0x1800d4a80
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.1800d5010
mov qword [rsp + 0x28], 0
cmp qword [0x18012c140], 0
jne 0x1800d4ac8
cmp qword [0x18012c138], 0
je 0x1800d4ac8
mov rax, qword [0x18012c138]
mov qword [0x18012c140], rax
cmp qword [0x18012c140], 0
je 0x1800d4b6e
mov rax, qword [0x18012c140]
cmp qword [rax + 0x10], 0
je 0x1800d4b6e
mov rax, qword [0x18012c140]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x1800d4b6e
mov rax, qword [0x18012c140]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x1800d4b6e
mov rax, qword [0x18012c140]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x28], rax
jb 0x1800d4b34
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x28], rax
jbe 0x1800d4b3b
xor eax, eax
jmp 0x1800d4ce9
mov rax, qword [0x18012c140]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x48]
mov qword [rax + 0x10], rcx
mov r8d, 0x60
mov edx, 0xcc
mov rcx, qword [rsp + 0x28]
call sub.VCRUNTIME140.dll_memset
mov rax, qword [rsp + 0x28]
jmp 0x1800d4ce9
mov rax, qword [0x18012c138]
mov qword [0x18012c140], rax
jmp 0x1800d4b90
mov rax, qword [0x18012c140]
mov rax, qword [rax + 8]
mov qword [0x18012c140], rax
cmp qword [0x18012c140], 0
je 0x1800d4bdd
cmp qword [0x18012c140], 0
je 0x1800d4bdb
mov rax, qword [0x18012c140]
cmp qword [rax + 0x10], 0
je 0x1800d4bdb
mov rax, qword [0x18012c140]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x1800d4bdb
mov rax, qword [0x18012c140]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x1800d4bdb
jmp 0x1800d4b0c
jmp 0x1800d4b7e
mov rcx, qword [rsp + 0x60]
call fcn.1800d6c40
and eax, 0xffff
mov eax, eax
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.1800d4cf0
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x1800d4ce7
mov rax, qword [rsp + 0x48]
mov qword [0x18012c140], rax
mov rax, qword [0x18012c140]
mov dword [rax], 0x52727464
mov rax, qword [0x18012c140]
mov qword [rax + 0x10], 0
mov rax, qword [0x18012c140]
mov rcx, qword [0x18012c138]
mov qword [rax + 8], rcx
mov rax, qword [0x18012c140]
mov qword [0x18012c138], rax
mov qword [rsp + 0x40], 0
mov rax, qword [0x18012c140]
add rax, 0x60
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x2a8
jmp 0x1800d4c98
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 1
jle 0x1800d4cd2
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
mov qword [rcx + rax + 0x48], rdx
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x1800d4c8e
mov rax, qword [0x18012c140]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x10], rcx
jmp 0x1800d4b0c
xor eax, eax
add rsp, 0x58
ret
Function at 0x1800d878c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1800d87c6
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1800d87cb
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1800d8814
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x180113950]
cmp byte [rcx + rax], 0
je 0x1800d8814
dec r8
sub rdx, 1
jne 0x1800d87fa
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret