joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18010d9c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x18019a338]
mov rbx, rdx
test rax, rax
jne 0x18010dabb
mov dword [rbp - 0x50], 0x62
mov eax, dword [rbp - 0x50]
xor al, 0x56
mov byte [rbp - 0x4c], al
mov eax, dword [rbp - 0x50]
inc al
xor al, 0x69
mov byte [rbp - 0x4b], al
mov eax, dword [rbp - 0x50]
add al, 2
xor al, 0x72
mov byte [rbp - 0x4a], al
mov eax, dword [rbp - 0x50]
add al, 3
xor al, 0x74
mov byte [rbp - 0x49], al
mov eax, dword [rbp - 0x50]
add al, 4
xor al, 0x75
mov byte [rbp - 0x48], al
mov eax, dword [rbp - 0x50]
add al, 5
xor al, 0x61
mov byte [rbp - 0x47], al
mov eax, dword [rbp - 0x50]
add al, 6
xor al, 0x6c
mov byte [rbp - 0x46], al
mov eax, dword [rbp - 0x50]
add al, 7
xor al, 0x51
mov byte [rbp - 0x45], al
mov eax, dword [rbp - 0x50]
add al, 8
xor al, 0x75
mov byte [rbp - 0x44], al
mov eax, dword [rbp - 0x50]
add al, 9
xor al, 0x65
mov byte [rbp - 0x43], al
mov eax, dword [rbp - 0x50]
add al, 0xa
xor al, 0x72
mov byte [rbp - 0x42], al
mov eax, dword [rbp - 0x50]
add al, 0xb
xor al, 0x79
mov byte [rbp - 0x41], al
xor eax, eax
mov byte [rbp - 0x40], al
xor edx, edx
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
add cl, dl
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x18010da67
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x18019a338], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x18019a338]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x18010dae4
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x18010db10
cmp dword [rbp - 0x18], 0x10000
je 0x18010db10
cmp qword [rbp - 0x20], 0x1000
jb 0x18010db10
cmp dword [rbp - 0x10], 0x1000000
je 0x18010db0c
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x18010db12
mov al, 1
jmp 0x18010db12
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x18010f404
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x18019a248]
mov rbx, rdx
test rax, rax
jne 0x18010f4ff
mov dword [rbp - 0x50], 0x62
mov eax, dword [rbp - 0x50]
xor al, 0x56
mov byte [rbp - 0x4c], al
mov eax, dword [rbp - 0x50]
inc al
xor al, 0x69
mov byte [rbp - 0x4b], al
mov eax, dword [rbp - 0x50]
add al, 2
xor al, 0x72
mov byte [rbp - 0x4a], al
mov eax, dword [rbp - 0x50]
add al, 3
xor al, 0x74
mov byte [rbp - 0x49], al
mov eax, dword [rbp - 0x50]
add al, 4
xor al, 0x75
mov byte [rbp - 0x48], al
mov eax, dword [rbp - 0x50]
add al, 5
xor al, 0x61
mov byte [rbp - 0x47], al
mov eax, dword [rbp - 0x50]
add al, 6
xor al, 0x6c
mov byte [rbp - 0x46], al
mov eax, dword [rbp - 0x50]
add al, 7
xor al, 0x51
mov byte [rbp - 0x45], al
mov eax, dword [rbp - 0x50]
add al, 8
xor al, 0x75
mov byte [rbp - 0x44], al
mov eax, dword [rbp - 0x50]
add al, 9
xor al, 0x65
mov byte [rbp - 0x43], al
mov eax, dword [rbp - 0x50]
add al, 0xa
xor al, 0x72
mov byte [rbp - 0x42], al
mov eax, dword [rbp - 0x50]
add al, 0xb
xor al, 0x79
mov byte [rbp - 0x41], al
xor eax, eax
mov byte [rbp - 0x40], al
xor edx, edx
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
add cl, dl
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x18010f4ab
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x18019a248], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x18019a248]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x18010f528
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x18010f554
cmp dword [rbp - 0x18], 0x10000
je 0x18010f554
cmp qword [rbp - 0x20], 0x1000
jb 0x18010f554
cmp dword [rbp - 0x10], 0x1000000
je 0x18010f550
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x18010f556
mov al, 1
jmp 0x18010f556
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x180110e48
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x180199f80]
mov rbx, rdx
test rax, rax
jne 0x180110f43
mov dword [rbp - 0x50], 0x62
mov eax, dword [rbp - 0x50]
xor al, 0x56
mov byte [rbp - 0x4c], al
mov eax, dword [rbp - 0x50]
inc al
xor al, 0x69
mov byte [rbp - 0x4b], al
mov eax, dword [rbp - 0x50]
add al, 2
xor al, 0x72
mov byte [rbp - 0x4a], al
mov eax, dword [rbp - 0x50]
add al, 3
xor al, 0x74
mov byte [rbp - 0x49], al
mov eax, dword [rbp - 0x50]
add al, 4
xor al, 0x75
mov byte [rbp - 0x48], al
mov eax, dword [rbp - 0x50]
add al, 5
xor al, 0x61
mov byte [rbp - 0x47], al
mov eax, dword [rbp - 0x50]
add al, 6
xor al, 0x6c
mov byte [rbp - 0x46], al
mov eax, dword [rbp - 0x50]
add al, 7
xor al, 0x51
mov byte [rbp - 0x45], al
mov eax, dword [rbp - 0x50]
add al, 8
xor al, 0x75
mov byte [rbp - 0x44], al
mov eax, dword [rbp - 0x50]
add al, 9
xor al, 0x65
mov byte [rbp - 0x43], al
mov eax, dword [rbp - 0x50]
add al, 0xa
xor al, 0x72
mov byte [rbp - 0x42], al
mov eax, dword [rbp - 0x50]
add al, 0xb
xor al, 0x79
mov byte [rbp - 0x41], al
xor eax, eax
mov byte [rbp - 0x40], al
xor edx, edx
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
add cl, dl
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x180110eef
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x180199f80], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x180199f80]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x180110f6c
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x180110f98
cmp dword [rbp - 0x18], 0x10000
je 0x180110f98
cmp qword [rbp - 0x20], 0x1000
jb 0x180110f98
cmp dword [rbp - 0x10], 0x1000000
je 0x180110f94
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x180110f9a
mov al, 1
jmp 0x180110f9a
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x18011288c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x18019a3c0]
mov rbx, rdx
test rax, rax
jne 0x180112987
mov dword [rbp - 0x50], 0x62
mov eax, dword [rbp - 0x50]
xor al, 0x56
mov byte [rbp - 0x4c], al
mov eax, dword [rbp - 0x50]
inc al
xor al, 0x69
mov byte [rbp - 0x4b], al
mov eax, dword [rbp - 0x50]
add al, 2
xor al, 0x72
mov byte [rbp - 0x4a], al
mov eax, dword [rbp - 0x50]
add al, 3
xor al, 0x74
mov byte [rbp - 0x49], al
mov eax, dword [rbp - 0x50]
add al, 4
xor al, 0x75
mov byte [rbp - 0x48], al
mov eax, dword [rbp - 0x50]
add al, 5
xor al, 0x61
mov byte [rbp - 0x47], al
mov eax, dword [rbp - 0x50]
add al, 6
xor al, 0x6c
mov byte [rbp - 0x46], al
mov eax, dword [rbp - 0x50]
add al, 7
xor al, 0x51
mov byte [rbp - 0x45], al
mov eax, dword [rbp - 0x50]
add al, 8
xor al, 0x75
mov byte [rbp - 0x44], al
mov eax, dword [rbp - 0x50]
add al, 9
xor al, 0x65
mov byte [rbp - 0x43], al
mov eax, dword [rbp - 0x50]
add al, 0xa
xor al, 0x72
mov byte [rbp - 0x42], al
mov eax, dword [rbp - 0x50]
add al, 0xb
xor al, 0x79
mov byte [rbp - 0x41], al
xor eax, eax
mov byte [rbp - 0x40], al
xor edx, edx
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
add cl, dl
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x180112933
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x18019a3c0], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x18019a3c0]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x1801129b0
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x1801129dc
cmp dword [rbp - 0x18], 0x10000
je 0x1801129dc
cmp qword [rbp - 0x20], 0x1000
jb 0x1801129dc
cmp dword [rbp - 0x10], 0x1000000
je 0x1801129d8
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x1801129de
mov al, 1
jmp 0x1801129de
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x1801130d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x18019a1c0]
mov rbx, rdx
test rax, rax
jne 0x1801131cb
mov dword [rbp - 0x50], 0x62
mov eax, dword [rbp - 0x50]
xor al, 0x56
mov byte [rbp - 0x4c], al
mov eax, dword [rbp - 0x50]
inc al
xor al, 0x69
mov byte [rbp - 0x4b], al
mov eax, dword [rbp - 0x50]
add al, 2
xor al, 0x72
mov byte [rbp - 0x4a], al
mov eax, dword [rbp - 0x50]
add al, 3
xor al, 0x74
mov byte [rbp - 0x49], al
mov eax, dword [rbp - 0x50]
add al, 4
xor al, 0x75
mov byte [rbp - 0x48], al
mov eax, dword [rbp - 0x50]
add al, 5
xor al, 0x61
mov byte [rbp - 0x47], al
mov eax, dword [rbp - 0x50]
add al, 6
xor al, 0x6c
mov byte [rbp - 0x46], al
mov eax, dword [rbp - 0x50]
add al, 7
xor al, 0x51
mov byte [rbp - 0x45], al
mov eax, dword [rbp - 0x50]
add al, 8
xor al, 0x75
mov byte [rbp - 0x44], al
mov eax, dword [rbp - 0x50]
add al, 9
xor al, 0x65
mov byte [rbp - 0x43], al
mov eax, dword [rbp - 0x50]
add al, 0xa
xor al, 0x72
mov byte [rbp - 0x42], al
mov eax, dword [rbp - 0x50]
add al, 0xb
xor al, 0x79
mov byte [rbp - 0x41], al
xor eax, eax
mov byte [rbp - 0x40], al
xor edx, edx
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
add cl, dl
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x180113177
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x18019a1c0], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x18019a1c0]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x1801131f4
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x180113220
cmp dword [rbp - 0x18], 0x10000
je 0x180113220
cmp qword [rbp - 0x20], 0x1000
jb 0x180113220
cmp dword [rbp - 0x10], 0x1000000
je 0x18011321c
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x180113222
mov al, 1
jmp 0x180113222
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x180113914
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x18019a3d8]
mov rbx, rdx
test rax, rax
jne 0x180113a0f
mov dword [rbp - 0x50], 0x62
mov eax, dword [rbp - 0x50]
xor al, 0x56
mov byte [rbp - 0x4c], al
mov eax, dword [rbp - 0x50]
inc al
xor al, 0x69
mov byte [rbp - 0x4b], al
mov eax, dword [rbp - 0x50]
add al, 2
xor al, 0x72
mov byte [rbp - 0x4a], al
mov eax, dword [rbp - 0x50]
add al, 3
xor al, 0x74
mov byte [rbp - 0x49], al
mov eax, dword [rbp - 0x50]
add al, 4
xor al, 0x75
mov byte [rbp - 0x48], al
mov eax, dword [rbp - 0x50]
add al, 5
xor al, 0x61
mov byte [rbp - 0x47], al
mov eax, dword [rbp - 0x50]
add al, 6
xor al, 0x6c
mov byte [rbp - 0x46], al
mov eax, dword [rbp - 0x50]
add al, 7
xor al, 0x51
mov byte [rbp - 0x45], al
mov eax, dword [rbp - 0x50]
add al, 8
xor al, 0x75
mov byte [rbp - 0x44], al
mov eax, dword [rbp - 0x50]
add al, 9
xor al, 0x65
mov byte [rbp - 0x43], al
mov eax, dword [rbp - 0x50]
add al, 0xa
xor al, 0x72
mov byte [rbp - 0x42], al
mov eax, dword [rbp - 0x50]
add al, 0xb
xor al, 0x79
mov byte [rbp - 0x41], al
xor eax, eax
mov byte [rbp - 0x40], al
xor edx, edx
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
add cl, dl
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x1801139bb
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x18019a3d8], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x18019a3d8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x180113a38
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x180113a64
cmp dword [rbp - 0x18], 0x10000
je 0x180113a64
cmp qword [rbp - 0x20], 0x1000
jb 0x180113a64
cmp dword [rbp - 0x10], 0x1000000
je 0x180113a60
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x180113a66
mov al, 1
jmp 0x180113a66
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x180114158
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x18019a290]
mov rbx, rdx
test rax, rax
jne 0x180114253
mov dword [rbp - 0x50], 0x62
mov eax, dword [rbp - 0x50]
xor al, 0x56
mov byte [rbp - 0x4c], al
mov eax, dword [rbp - 0x50]
inc al
xor al, 0x69
mov byte [rbp - 0x4b], al
mov eax, dword [rbp - 0x50]
add al, 2
xor al, 0x72
mov byte [rbp - 0x4a], al
mov eax, dword [rbp - 0x50]
add al, 3
xor al, 0x74
mov byte [rbp - 0x49], al
mov eax, dword [rbp - 0x50]
add al, 4
xor al, 0x75
mov byte [rbp - 0x48], al
mov eax, dword [rbp - 0x50]
add al, 5
xor al, 0x61
mov byte [rbp - 0x47], al
mov eax, dword [rbp - 0x50]
add al, 6
xor al, 0x6c
mov byte [rbp - 0x46], al
mov eax, dword [rbp - 0x50]
add al, 7
xor al, 0x51
mov byte [rbp - 0x45], al
mov eax, dword [rbp - 0x50]
add al, 8
xor al, 0x75
mov byte [rbp - 0x44], al
mov eax, dword [rbp - 0x50]
add al, 9
xor al, 0x65
mov byte [rbp - 0x43], al
mov eax, dword [rbp - 0x50]
add al, 0xa
xor al, 0x72
mov byte [rbp - 0x42], al
mov eax, dword [rbp - 0x50]
add al, 0xb
xor al, 0x79
mov byte [rbp - 0x41], al
xor eax, eax
mov byte [rbp - 0x40], al
xor edx, edx
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
add cl, dl
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x1801141ff
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x18019a290], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x18019a290]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x18011427c
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x1801142a8
cmp dword [rbp - 0x18], 0x10000
je 0x1801142a8
cmp qword [rbp - 0x20], 0x1000
jb 0x1801142a8
cmp dword [rbp - 0x10], 0x1000000
je 0x1801142a4
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x1801142aa
mov al, 1
jmp 0x1801142aa
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x180115b9c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x18019a3a0]
mov rbx, rdx
test rax, rax
jne 0x180115c97
mov dword [rbp - 0x50], 0x62
mov eax, dword [rbp - 0x50]
xor al, 0x56
mov byte [rbp - 0x4c], al
mov eax, dword [rbp - 0x50]
inc al
xor al, 0x69
mov byte [rbp - 0x4b], al
mov eax, dword [rbp - 0x50]
add al, 2
xor al, 0x72
mov byte [rbp - 0x4a], al
mov eax, dword [rbp - 0x50]
add al, 3
xor al, 0x74
mov byte [rbp - 0x49], al
mov eax, dword [rbp - 0x50]
add al, 4
xor al, 0x75
mov byte [rbp - 0x48], al
mov eax, dword [rbp - 0x50]
add al, 5
xor al, 0x61
mov byte [rbp - 0x47], al
mov eax, dword [rbp - 0x50]
add al, 6
xor al, 0x6c
mov byte [rbp - 0x46], al
mov eax, dword [rbp - 0x50]
add al, 7
xor al, 0x51
mov byte [rbp - 0x45], al
mov eax, dword [rbp - 0x50]
add al, 8
xor al, 0x75
mov byte [rbp - 0x44], al
mov eax, dword [rbp - 0x50]
add al, 9
xor al, 0x65
mov byte [rbp - 0x43], al
mov eax, dword [rbp - 0x50]
add al, 0xa
xor al, 0x72
mov byte [rbp - 0x42], al
mov eax, dword [rbp - 0x50]
add al, 0xb
xor al, 0x79
mov byte [rbp - 0x41], al
xor eax, eax
mov byte [rbp - 0x40], al
xor edx, edx
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
add cl, dl
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x180115c43
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x18019a3a0], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x18019a3a0]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x180115cc0
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x180115cec
cmp dword [rbp - 0x18], 0x10000
je 0x180115cec
cmp qword [rbp - 0x20], 0x1000
jb 0x180115cec
cmp dword [rbp - 0x10], 0x1000000
je 0x180115ce8
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x180115cee
mov al, 1
jmp 0x180115cee
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x1801175e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x18019a0c0]
mov rbx, rdx
test rax, rax
jne 0x1801176db
mov dword [rbp - 0x50], 0x62
mov eax, dword [rbp - 0x50]
xor al, 0x56
mov byte [rbp - 0x4c], al
mov eax, dword [rbp - 0x50]
inc al
xor al, 0x69
mov byte [rbp - 0x4b], al
mov eax, dword [rbp - 0x50]
add al, 2
xor al, 0x72
mov byte [rbp - 0x4a], al
mov eax, dword [rbp - 0x50]
add al, 3
xor al, 0x74
mov byte [rbp - 0x49], al
mov eax, dword [rbp - 0x50]
add al, 4
xor al, 0x75
mov byte [rbp - 0x48], al
mov eax, dword [rbp - 0x50]
add al, 5
xor al, 0x61
mov byte [rbp - 0x47], al
mov eax, dword [rbp - 0x50]
add al, 6
xor al, 0x6c
mov byte [rbp - 0x46], al
mov eax, dword [rbp - 0x50]
add al, 7
xor al, 0x51
mov byte [rbp - 0x45], al
mov eax, dword [rbp - 0x50]
add al, 8
xor al, 0x75
mov byte [rbp - 0x44], al
mov eax, dword [rbp - 0x50]
add al, 9
xor al, 0x65
mov byte [rbp - 0x43], al
mov eax, dword [rbp - 0x50]
add al, 0xa
xor al, 0x72
mov byte [rbp - 0x42], al
mov eax, dword [rbp - 0x50]
add al, 0xb
xor al, 0x79
mov byte [rbp - 0x41], al
xor eax, eax
mov byte [rbp - 0x40], al
xor edx, edx
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
add cl, dl
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x180117687
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x18019a0c0], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x18019a0c0]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x180117704
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x180117730
cmp dword [rbp - 0x18], 0x10000
je 0x180117730
cmp qword [rbp - 0x20], 0x1000
jb 0x180117730
cmp dword [rbp - 0x10], 0x1000000
je 0x18011772c
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x180117732
mov al, 1
jmp 0x180117732
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x180119024
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x18019a000]
mov rbx, rdx
test rax, rax
jne 0x18011911f
mov dword [rbp - 0x50], 0x62
mov eax, dword [rbp - 0x50]
xor al, 0x56
mov byte [rbp - 0x4c], al
mov eax, dword [rbp - 0x50]
inc al
xor al, 0x69
mov byte [rbp - 0x4b], al
mov eax, dword [rbp - 0x50]
add al, 2
xor al, 0x72
mov byte [rbp - 0x4a], al
mov eax, dword [rbp - 0x50]
add al, 3
xor al, 0x74
mov byte [rbp - 0x49], al
mov eax, dword [rbp - 0x50]
add al, 4
xor al, 0x75
mov byte [rbp - 0x48], al
mov eax, dword [rbp - 0x50]
add al, 5
xor al, 0x61
mov byte [rbp - 0x47], al
mov eax, dword [rbp - 0x50]
add al, 6
xor al, 0x6c
mov byte [rbp - 0x46], al
mov eax, dword [rbp - 0x50]
add al, 7
xor al, 0x51
mov byte [rbp - 0x45], al
mov eax, dword [rbp - 0x50]
add al, 8
xor al, 0x75
mov byte [rbp - 0x44], al
mov eax, dword [rbp - 0x50]
add al, 9
xor al, 0x65
mov byte [rbp - 0x43], al
mov eax, dword [rbp - 0x50]
add al, 0xa
xor al, 0x72
mov byte [rbp - 0x42], al
mov eax, dword [rbp - 0x50]
add al, 0xb
xor al, 0x79
mov byte [rbp - 0x41], al
xor eax, eax
mov byte [rbp - 0x40], al
xor edx, edx
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
add cl, dl
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x1801190cb
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x18019a000], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x18019a000]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x180119148
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x180119174
cmp dword [rbp - 0x18], 0x10000
je 0x180119174
cmp qword [rbp - 0x20], 0x1000
jb 0x180119174
cmp dword [rbp - 0x10], 0x1000000
je 0x180119170
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x180119176
mov al, 1
jmp 0x180119176
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret