joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180670058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1806701df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x180670089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18067006f
add dl, dl
jne 0x180670096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1806700f6
xor eax, eax
add dl, dl
jne 0x1806700a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1806701ad
add dl, dl
jne 0x1806700b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1806700c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1806700d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1806700dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1806700ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x18067007e
mov eax, 1
add dl, dl
jne 0x180670106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180670113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1806700fb
sub eax, ebx
mov ebx, 1
jne 0x18067014c
mov ecx, 1
add dl, dl
jne 0x18067012e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x18067013b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180670123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18067007e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x180670168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180670175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18067015d
cmp eax, 0x7d00
jae 0x18067019b
cmp eax, 0x500
jb 0x180670196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18067007e
cmp eax, 0x7f
ja 0x18067019e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18067007e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1806701d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x18067007e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14000f880
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
cmp qword [rcx], rdx
je 0x14000f903
mov rdi, rdx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
add rax, 1
cmp rax, 2
jb 0x14000f8ce
call fcn.140014640
mov r8, qword [rsp + 0x38]
mov rcx, qword [rsi]
mov rdx, rsi
mov r9, rax
call fcn.1400146c0
mov rcx, qword [rsi]
call fcn.140014650
mov qword [rsi], 0
lea rax, [rdi + 1]
cmp rax, 2
jb case.default.0x14000f8fc
mov qword [rsi], rdi
call fcn.140014640
mov r8, qword [rsp + 0x38]
mov rcx, rdi
mov rdx, rsi
mov r9, rax
call fcn.140014680
mov ecx, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
sbb ch, dl
pop rax
sbb ch, byte [rax - 0x47]
pop rdi
add eax, 0x549f188
scasd eax, dword [rdi]
sub edi, esp
movabs eax, dword [0xfaa88df1dca39fdd]
jle 0x1400c3eb1
jle 0x1400c3eb1
cmp eax, 0xc3c3edfb
jnp 0x1400c3e52
mov bh, 0xe1
invalid
sbb dword [rbp + 0x1441bcd6], edx
fimul word [rbx + 0x694b20d1]
insb byte [rdi], dx
mov ss, word [rdi - 0x31c05ef8]
invalid
invalid
invalid
invalid
movabs eax, dword [0x95cd7a17c437ce3f]
invalid
and byte [rax - 0x47], bh
out 0x2a, al
out 0x3b, al
invalid

Function at 0x140010e90
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x230
mov r14, rcx
mov rax, qword [0x140065020]
xor rax, rsp
mov qword [rsp + 0x228], rax
lea rdi, [rsp + 0x20]
mov word [rdi], 0
xor ebx, ebx
lea r15, str.PROGRAMFILES
mov rsi, qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rcx, qword [rbx + r15]
mov word [rsp + 0x20], 0
mov r8d, 0x104
mov rdx, rdi
call rsi
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x140010eff
mov edx, eax
mov rcx, rdi
mov r8, r14
call fcn.140010e20
test al, al
jne 0x140010f0d
add rbx, 8
cmp rbx, 0x18
jne 0x140010ecd
xor esi, esi
jmp 0x140010f10
mov sil, 1
mov rcx, qword [rsp + 0x228]
xor rcx, rsp
call fcn.14002a340
mov eax, esi
add rsp, 0x230
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x4e9ea0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x4e9ead
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x4e9ebd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x4e9ea5
lea eax, [rcx + 1]
jmp 0x4e9ecb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x4e9ede
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x4e9ec4
sub eax, 3
jb 0x4e9efe
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x4e9f4d
sar eax, 1
movsxd rbp, eax
jb 0x4e9f34
jmp 0x4e9f0c
add ebx, ebx
jne 0x4e9f0a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x4e9f34
inc ecx
add ebx, ebx
jne 0x4e9f1a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x4e9f34
call r11
adc ecx, ecx
add ebx, ebx
jne 0x4e9f2d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x4e9f1c
add ecx, 2
jmp 0x4e9f39
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.004e9e62
jmp 0x4e9ead
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0xa9400
mov dl, 0x11
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x4e9f9d
cmp rsi, rcx
jae 0x4e9fa5
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x4e9f84
cmp al, 0x8f
ja 0x4e9f84
cmp byte [rsi - 2], 0xf
je 0x4e9f8a
sub al, 0xe8
cmp al, 1
ja 0x4e9f6e
cmp rsi, rcx
jae 0x4e9fa5
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x4e9f74
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x4e9fa5
lodsb al, byte [rsi]
jmp 0x4e9f84
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0xe4000]
mov eax, dword [rdi]
or eax, eax
je 0x4ea002
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xea000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x4e9fb2
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x4e9ffc
mov qword [rbx], rax
add rbx, 8
jmp 0x4e9fd2
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.004ea085], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.004ea085
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x4ea075
sub rsp, 0xffffffffffffff80
jmp 0x4014d0
Function at 0x140009038
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, r8
mov r9, rcx
xor ecx, ecx
movabs r8, 0xcbf29ce484222325
mov rsi, rdx
movzx eax, byte [rbx + rcx + 0x10]
movabs rdx, 0x100000001b3
xor r8, rax
inc rcx
imul r8, rdx
cmp rcx, 4
jb 0x14000905c
mov rdx, qword [r9 + 0x30]
mov rcx, qword [r9 + 0x18]
and rdx, r8
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rbx
jne 0x1400090b3
cmp qword [rcx + rdx*8], rbx
jne 0x1400090a8
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
jmp 0x1400090ac
mov rax, qword [rbx + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1400090c0
cmp qword [rcx + rdx*8], rbx
jne 0x1400090c0
mov rax, qword [rbx]
mov qword [rcx + rdx*8], rax
mov rax, qword [rbx + 8]
mov rdi, qword [rbx]
mov qword [rax], rdi
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r9 + 0x10]
mov rdx, qword [rbx + 0x30]
cmp rdx, 8
jb 0x1400090f5
mov rcx, qword [rbx + 0x18]
inc rdx
mov r8d, 2
call fcn.1400020a4
mov edx, 1
mov rcx, rbx
lea r8d, [rdx + 0x37]
call fcn.1400020a4
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov qword [rsi], rdi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14000b51c
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_1.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x1400148a0], eax
call fcn.14000b2a4
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_UnhandledExceptionFilter]
cmp dword [0x1400148a0], 0
jne case.default.0x14000b572
mov ecx, 1
call fcn.14000b2a4
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_TerminateProcess]
jne 0x140020951
push rax
push rcx
in eax, 0x1d
sbb ecx, dword [rsi + 0x6574813e]
add dword [rdx + rbp*4 + 0x3e3da225], eax
invalid
jp 0x140020951
fimul word [rbp - 0x1ce5a937]
loope 0x140020a47
push rsp
sub ebx, dword [rcx]
invalid
in eax, dx
add eax, 0xdf767550
push 9
xchg edi, eax
fstp dword [rax + 0x7f]
adc ah, byte [rdi + riz*4 - 0x12b0af92]
push rax
push 0x63dd0eb2
fcmovnbe st(0), st(3)
iretd
Function at 0x18000aec0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rsi, r9
mov rbx, r8
mov rdi, rcx
mov rax, qword [rdx]
test rax, rax
je 0x18000af15
cmp eax, 1
jne 0x18000af7b
mov r9, qword [rdx + 8]
mov rcx, rdi
mov rdx, rbx
mov r8, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
jmp fcn.180034f30
movzx eax, byte [0x1800a4291]
mov r14d, 8
mov ecx, 0x18
mov edx, 8
call fcn.1800458d0
test rax, rax
je 0x18000b05d
mov r12, rax
test rsi, rsi
je 0x18000b02d
lea r15, [rsi*8]
movzx eax, byte [0x1800a4291]
mov edx, 8
mov rcx, r15
call fcn.1800458d0
test rax, rax
je 0x18000b06e
mov r14, rax
cmp rsi, 4
jae 0x18000af9e
xor eax, eax
jmp 0x18000affa
movq xmm3, qword [rdx + 8]
movq xmm0, qword [rdx + 0x10]
movq qword [rsp + 0x20], xmm0
mov rcx, rdi
mov rdx, rbx
mov r8, rsi
call fcn.18003d8e0
jmp 0x18000b04e
mov rax, rsi
and rax, 0xfffffffffffffffc
xor ecx, ecx
movdqa xmm0, xmmword [0x180083790]
nop
movdqu xmm1, xmmword [rbx + rcx*8]
movdqu xmm2, xmmword [rbx + rcx*8 + 0x10]
pshufd xmm3, xmm1, 0xf5
psrad xmm3, 0x1f
por xmm3, xmm0
pshufd xmm4, xmm2, 0xf5
psrad xmm4, 0x1f
por xmm4, xmm0
pxor xmm3, xmm1
pxor xmm4, xmm2
movdqu xmmword [r14 + rcx*8], xmm3
movdqu xmmword [r14 + rcx*8 + 0x10], xmm4
add rcx, 4
cmp rax, rcx
jne 0x18000afb0
cmp rax, rsi
je 0x18000b02d
movabs rcx, 0x8000000000000000
nop word cs:[rax + rax]
mov rdx, qword [rbx + rax*8]
mov r8, rdx
sar r8, 0x3f
or r8, rcx
xor r8, rdx
mov qword [r14 + rax*8], r8
inc rax
cmp rsi, rax
jne 0x18000b010
mov qword [r12], r14
mov qword [r12 + 8], rsi
mov qword [r12 + 0x10], rsi
mov qword [rdi], r12
mov qword [rdi + 8], 1
mov qword [rdi + 0x10], 1
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
mov ecx, 8
mov edx, 0x18
call fcn.180082720
ud2
mov qword [rbp - 0x10], r12
mov ecx, 8
mov rdx, r15
call fcn.180082720
ud2
Function at 0x18000b0d0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, r9
mov rbx, r8
mov rdi, rcx
mov eax, dword [rdx]
test rax, rax
je 0x18000b11c
cmp eax, 1
jne 0x18000b172
mov r9d, dword [rdx + 4]
mov rcx, rdi
mov rdx, rbx
mov r8, rsi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
jmp fcn.180034c90
movzx eax, byte [0x1800a4291]
mov ecx, 0x18
mov edx, 8
call fcn.1800458d0
test rax, rax
je 0x18000b21e
mov r15, rax
test rsi, rsi
je 0x18000b192
lea r14, [rsi*4]
movzx eax, byte [0x1800a4291]
mov edx, 4
mov rcx, r14
call fcn.1800458d0
test rax, rax
je 0x18000b22f
cmp rsi, 8
jae 0x18000b199
xor ecx, ecx
jmp 0x18000b1d6
movss xmm3, dword [rdx + 4]
movss xmm0, dword [rdx + 8]
movss dword [rsp + 0x20], xmm0
mov rcx, rdi
mov rdx, rbx
mov r8, rsi
call fcn.18003cf30
jmp 0x18000b211
mov eax, 4
jmp 0x18000b1f3
mov rcx, rsi
and rcx, 0xfffffffffffffff8
xor edx, edx
movaps xmm0, xmmword [0x1800837a0]
nop dword [rax]
movups xmm1, xmmword [rbx + rdx*4]
movups xmm2, xmmword [rbx + rdx*4 + 0x10]
xorps xmm1, xmm0
xorps xmm2, xmm0
movups xmmword [rax + rdx*4], xmm1
movups xmmword [rax + rdx*4 + 0x10], xmm2
add rdx, 8
cmp rcx, rdx
jne 0x18000b1b0
cmp rcx, rsi
je 0x18000b1f3
mov edx, 0x80000000
nop dword [rax + rax]
mov r8d, dword [rbx + rcx*4]
xor r8d, edx
mov dword [rax + rcx*4], r8d
inc rcx
cmp rsi, rcx
jne 0x18000b1e0
mov qword [r15], rax
mov qword [r15 + 8], rsi
mov qword [r15 + 0x10], rsi
mov qword [rdi], r15
mov qword [rdi + 8], 1
mov qword [rdi + 0x10], 1
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
mov ecx, 8
mov edx, 0x18
call fcn.180082720
ud2
mov qword [rbp - 8], r15
mov ecx, 4
mov rdx, r14
call fcn.180082720
ud2
Function at 0x18000b570
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rsi, r9
mov rbx, r8
mov rdi, rcx
mov rax, qword [rdx]
test rax, rax
je 0x18000b5c5
cmp eax, 1
jne 0x18000b628
mov r9, qword [rdx + 8]
mov rcx, rdi
mov rdx, rbx
mov r8, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
jmp fcn.1800349f0
movzx eax, byte [0x1800a4291]
mov r14d, 8
mov ecx, 0x18
mov edx, 8
call fcn.1800458d0
test rax, rax
je 0x18000b6e3
mov r12, rax
test rsi, rsi
je 0x18000b6b3
lea r15, [rsi*8]
movzx eax, byte [0x1800a4291]
mov edx, 8
mov rcx, r15
call fcn.1800458d0
test rax, rax
je 0x18000b6f4
mov r14, rax
cmp rsi, 4
jae 0x18000b64b
xor eax, eax
jmp 0x18000b688
movsd xmm3, qword [rdx + 8]
movsd xmm0, qword [rdx + 0x10]
movsd qword [rsp + 0x20], xmm0
mov rcx, rdi
mov rdx, rbx
mov r8, rsi
call fcn.18003cf30
jmp 0x18000b6d4
mov rax, rsi
and rax, 0xfffffffffffffffc
xor ecx, ecx
movaps xmm0, xmmword [0x180083790]
nop dword [rax + rax]
movups xmm1, xmmword [rbx + rcx*8]
movups xmm2, xmmword [rbx + rcx*8 + 0x10]
xorps xmm1, xmm0
xorps xmm2, xmm0
movups xmmword [r14 + rcx*8], xmm1
movups xmmword [r14 + rcx*8 + 0x10], xmm2
add rcx, 4
cmp rax, rcx
jne 0x18000b660
cmp rax, rsi
je 0x18000b6b3
movabs rcx, 0x8000000000000000
nop word cs:[rax + rax]
mov rdx, qword [rbx + rax*8]
xor rdx, rcx
mov qword [r14 + rax*8], rdx
inc rax
cmp rsi, rax
jne 0x18000b6a0
mov qword [r12], r14
mov qword [r12 + 8], rsi
mov qword [r12 + 0x10], rsi
mov qword [rdi], r12
mov qword [rdi + 8], 1
mov qword [rdi + 0x10], 1
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
mov ecx, 8
mov edx, 0x18
call fcn.180082720
ud2
mov qword [rbp - 0x10], r12
mov ecx, 8
mov rdx, r15
call fcn.180082720
ud2
Function at 0x18000b750
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, r9
mov rbx, r8
mov rdi, rcx
mov eax, dword [rdx]
test rax, rax
je 0x18000b79c
cmp eax, 1
jne 0x18000b7f5
mov r9d, dword [rdx + 4]
mov rcx, rdi
mov rdx, rbx
mov r8, rsi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
jmp fcn.180034750
movzx eax, byte [0x1800a4291]
mov ecx, 0x18
mov edx, 8
call fcn.1800458d0
test rax, rax
je 0x18000b8db
mov r15, rax
test rsi, rsi
je 0x18000b818
lea r14, [rsi*4]
movzx eax, byte [0x1800a4291]
mov edx, 4
mov rcx, r14
call fcn.1800458d0
test rax, rax
je 0x18000b8ec
cmp rsi, 8
jae 0x18000b822
xor ecx, ecx
jmp 0x18000b890
movd xmm3, dword [rdx + 4]
movd xmm0, dword [rdx + 8]
movd dword [rsp + 0x20], xmm0
mov rcx, rdi
mov rdx, rbx
mov r8, rsi
call fcn.18003cf50
jmp 0x18000b8ce
mov eax, 4
jmp 0x18000b8b0
mov rcx, rsi
and rcx, 0xfffffffffffffff8
xor edx, edx
movdqa xmm0, xmmword [0x1800837a0]
nop word cs:[rax + rax]
movdqu xmm1, xmmword [rbx + rdx*4]
movdqu xmm2, xmmword [rbx + rdx*4 + 0x10]
movdqa xmm3, xmm1
psrad xmm3, 0x1f
por xmm3, xmm0
movdqa xmm4, xmm2
psrad xmm4, 0x1f
por xmm4, xmm0
pxor xmm3, xmm1
pxor xmm4, xmm2
movdqu xmmword [rax + rdx*4], xmm3
movdqu xmmword [rax + rdx*4 + 0x10], xmm4
add rdx, 8
cmp rcx, rdx
jne 0x18000b840
cmp rcx, rsi
je 0x18000b8b0
nop word cs:[rax + rax]
mov edx, dword [rbx + rcx*4]
mov r8d, edx
sar r8d, 0x1f
or r8d, 0x80000000
xor r8d, edx
mov dword [rax + rcx*4], r8d
inc rcx
cmp rsi, rcx
jne 0x18000b890
mov qword [r15], rax
mov qword [r15 + 8], rsi
mov qword [r15 + 0x10], rsi
mov qword [rdi], r15
mov qword [rdi + 8], 1
mov qword [rdi + 0x10], 1
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
mov ecx, 8
mov edx, 0x18
call fcn.180082720
ud2
mov qword [rbp - 8], r15
mov ecx, 4
mov rdx, r14
call fcn.180082720
ud2
Function at 0x18002c900
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x858
movdqa xmmword [rsp + 0x840], xmm7
movdqa xmmword [rsp + 0x830], xmm6
mov r14, r9
mov rbx, r8
mov rdi, rdx
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x30]
mov r8d, 0x800
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rax, qword [rdi + 0x30]
test rax, rax
je 0x18002ca41
cmp r14, 0x100
mov edx, 0x100
cmovb rdx, r14
test rdx, rdx
je 0x18002ca41
mov r8, qword [rdi]
mov r9d, edx
and r9d, 0x1fe
xor r10d, r10d
jmp 0x18002c98c
inc r10
cmp r10, rax
je 0x18002ca41
mov ecx, r10d
not ecx
add ecx, eax
and ecx, 0x3f
mov r11d, 1
shl r11, cl
cmp rdx, 1
jne 0x18002c9b0
xor r14d, r14d
jmp 0x18002ca11
xor r15d, r15d
nop word cs:[rax + rax]
mov r14, qword [rbx + r15*8]
mov r12, qword [rsp + r15*8 + 0x30]
mov r13, qword [rsp + r15*8 + 0x38]
lea rbp, [r12 + r11]
xor esi, esi
cmp r14, qword [r8 + rbp*8]
setae sil
shl rsi, cl
add rsi, r12
mov qword [rsp + r15*8 + 0x30], rsi
lea r14, [r15 + 2]
mov rsi, qword [rbx + r15*8 + 8]
lea r12, [r11 + r13]
xor ebp, ebp
cmp rsi, qword [r8 + r12*8]
setae bpl
shl rbp, cl
add rbp, r13
mov qword [rsp + r15*8 + 0x38], rbp
mov r15, r14
cmp r9, r14
jne 0x18002c9c0
test dl, 1
je 0x18002c980
mov r15, qword [rbx + r14*8]
mov r12, qword [rsp + r14*8 + 0x30]
add r11, r12
xor r13d, r13d
cmp r15, qword [r8 + r11*8]
setae r13b
shl r13, cl
add r13, r12
mov qword [rsp + r14*8 + 0x30], r13
jmp 0x18002c980
mov rax, qword [rdi + 0x28]
xor ecx, ecx
sub rax, 1
cmovae rcx, rax
movq xmm0, rcx
pshufd xmm0, xmm0, 0x44
mov eax, 2
movdqa xmm1, xmmword [0x1800837a0]
movdqa xmm2, xmm0
pxor xmm2, xmm1
nop
movdqu xmm4, xmmword [rsp + rax*8 + 0x20]
movdqu xmm3, xmmword [rsp + rax*8 + 0x30]
movdqa xmm5, xmm4
pxor xmm5, xmm1
movdqa xmm6, xmm2
pcmpgtd xmm6, xmm5
pshufd xmm7, xmm6, 0xa0
pcmpeqd xmm5, xmm2
pshufd xmm5, xmm5, 0xf5
pand xmm5, xmm7
pshufd xmm6, xmm6, 0xf5
por xmm6, xmm5
pand xmm4, xmm6
pandn xmm6, xmm0
por xmm6, xmm4
movdqa xmm4, xmm3
pxor xmm4, xmm1
movdqa xmm5, xmm2
pcmpgtd xmm5, xmm4
pshufd xmm7, xmm5, 0xa0
pcmpeqd xmm4, xmm2
pshufd xmm4, xmm4, 0xf5
pand xmm4, xmm7
pshufd xmm5, xmm5, 0xf5
por xmm5, xmm4
pand xmm3, xmm5
pandn xmm5, xmm0
por xmm5, xmm3
movdqu xmmword [rsp + rax*8 + 0x20], xmm6
movdqu xmmword [rsp + rax*8 + 0x30], xmm5
add rax, 4
cmp rax, 0x102
jne 0x18002ca70
lea rdx, [rsp + 0x30]
mov r8d, 0x800
mov rcx, qword [rsp + 0x28]
call sub.VCRUNTIME140.dll_memcpy
movaps xmm6, xmmword [rsp + 0x830]
movaps xmm7, xmmword [rsp + 0x840]
add rsp, 0x858
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x18002cb40
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x858
movdqa xmmword [rsp + 0x840], xmm7
movdqa xmmword [rsp + 0x830], xmm6
mov r14, r9
mov rbx, r8
mov rdi, rdx
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x30]
mov r8d, 0x800
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rax, qword [rdi + 0x30]
test rax, rax
je 0x18002cc81
cmp r14, 0x100
mov edx, 0x100
cmovb rdx, r14
test rdx, rdx
je 0x18002cc81
mov r8, qword [rdi]
mov r9d, edx
and r9d, 0x1fe
xor r10d, r10d
jmp 0x18002cbcc
inc r10
cmp r10, rax
je 0x18002cc81
mov ecx, r10d
not ecx
add ecx, eax
and ecx, 0x3f
mov r11d, 1
shl r11, cl
cmp rdx, 1
jne 0x18002cbf0
xor r14d, r14d
jmp 0x18002cc51
xor r15d, r15d
nop word cs:[rax + rax]
mov ebp, dword [rbx + r15*4]
mov r14, qword [rsp + r15*8 + 0x30]
mov r12, qword [rsp + r15*8 + 0x38]
lea r13, [r14 + r11]
xor esi, esi
cmp ebp, dword [r8 + r13*4]
setae sil
shl rsi, cl
add rsi, r14
mov qword [rsp + r15*8 + 0x30], rsi
lea r14, [r15 + 2]
mov esi, dword [rbx + r15*4 + 4]
lea r13, [r12 + r11]
xor ebp, ebp
cmp esi, dword [r8 + r13*4]
setae bpl
shl rbp, cl
add rbp, r12
mov qword [rsp + r15*8 + 0x38], rbp
mov r15, r14
cmp r9, r14
jne 0x18002cc00
test dl, 1
je 0x18002cbc0
mov ebp, dword [rbx + r14*4]
mov r15, qword [rsp + r14*8 + 0x30]
add r11, r15
xor r12d, r12d
cmp ebp, dword [r8 + r11*4]
setae r12b
shl r12, cl
add r12, r15
mov qword [rsp + r14*8 + 0x30], r12
jmp 0x18002cbc0
mov rax, qword [rdi + 0x28]
xor ecx, ecx
sub rax, 1
cmovae rcx, rax
movq xmm0, rcx
pshufd xmm0, xmm0, 0x44
mov eax, 2
movdqa xmm1, xmmword [0x1800837a0]
movdqa xmm2, xmm0
pxor xmm2, xmm1
nop
movdqu xmm4, xmmword [rsp + rax*8 + 0x20]
movdqu xmm3, xmmword [rsp + rax*8 + 0x30]
movdqa xmm5, xmm4
pxor xmm5, xmm1
movdqa xmm6, xmm2
pcmpgtd xmm6, xmm5
pshufd xmm7, xmm6, 0xa0
pcmpeqd xmm5, xmm2
pshufd xmm5, xmm5, 0xf5
pand xmm5, xmm7
pshufd xmm6, xmm6, 0xf5
por xmm6, xmm5
pand xmm4, xmm6
pandn xmm6, xmm0
por xmm6, xmm4
movdqa xmm4, xmm3
pxor xmm4, xmm1
movdqa xmm5, xmm2
pcmpgtd xmm5, xmm4
pshufd xmm7, xmm5, 0xa0
pcmpeqd xmm4, xmm2
pshufd xmm4, xmm4, 0xf5
pand xmm4, xmm7
pshufd xmm5, xmm5, 0xf5
por xmm5, xmm4
pand xmm3, xmm5
pandn xmm5, xmm0
por xmm5, xmm3
movdqu xmmword [rsp + rax*8 + 0x20], xmm6
movdqu xmmword [rsp + rax*8 + 0x30], xmm5
add rax, 4
cmp rax, 0x102
jne 0x18002ccb0
lea rdx, [rsp + 0x30]
mov r8d, 0x800
mov rcx, qword [rsp + 0x28]
call sub.VCRUNTIME140.dll_memcpy
movaps xmm6, xmmword [rsp + 0x830]
movaps xmm7, xmmword [rsp + 0x840]
add rsp, 0x858
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret