joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000ab00
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov rax, qword [0x1800456c0]
xor rax, rsp
mov qword [rsp + 0x80], rax
cmp edx, 0xffffffff
je 0x18000ac2d
mov esi, edx
mov rdi, rcx
mov rax, qword [rcx + 0x40]
cmp qword [rax], 0
je 0x18000ab5d
mov rax, qword [rdi + 0x58]
mov ecx, dword [rax]
test ecx, ecx
jle 0x18000ab5d
dec ecx
mov dword [rax], ecx
mov rax, qword [rdi + 0x40]
mov rcx, qword [rax]
lea rdx, [rcx + 1]
mov qword [rax], rdx
mov byte [rcx], sil
jmp 0x18000ac72
cmp qword [rdi + 0x80], 0
je 0x18000ac31
mov rax, qword [rdi + 0x18]
lea rcx, [rdi + 0x70]
cmp qword [rax], rcx
jne 0x18000ab97
mov ecx, dword [rdi + 0x90]
mov rdx, qword [rdi + 0x88]
mov qword [rax], rdx
mov rax, qword [rdi + 0x38]
mov qword [rax], rdx
sub ecx, edx
mov rax, qword [rdi + 0x50]
mov dword [rax], ecx
mov rcx, qword [rdi + 0x68]
test rcx, rcx
je 0x18000ac38
mov byte [rsp + 0x5f], sil
lea rax, [rsp + 0x80]
lea r9, [rsp + 0x60]
lea rdx, [rdi + 0x74]
mov r10, qword [rcx]
lea r8, [rsp + 0x48]
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rax
lea r14, [rsp + 0x60]
mov qword [rsp + 0x28], r14
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea rbx, [rsp + 0x5f]
mov r8, rbx
call qword [r10 + 0x38]
mov ebp, 0xffffffff
cmp eax, 2
jae 0x18000ac51
mov r15, qword [rsp + 0x48]
sub r15, r14
je 0x18000ac1d
mov r9, qword [rdi + 0x80]
mov edx, 1
mov rcx, r14
mov r8, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp r15, rax
jne 0x18000ac70
mov byte [rdi + 0x71], 1
cmp qword [rsp + 0x50], rbx
mov eax, 0xffffffff
jmp 0x18000ac6b
xor esi, esi
jmp 0x18000ac72
mov esi, 0xffffffff
jmp 0x18000ac72
mov rdx, qword [rdi + 0x80]
movsx ecx, sil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, 0xffffffff
cmove esi, eax
jmp 0x18000ac72
cmp eax, 3
jne 0x18000ac70
mov rdx, qword [rdi + 0x80]
movsx ecx, byte [rsp + 0x5f]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, 0xffffffff
cmove esi, eax
mov ebp, esi
mov esi, ebp
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.180033100
mov eax, esi
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x18000b0e0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
test r8, r8
jle 0x18000b123
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x68], 0
je 0x18000b12a
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
xor esi, esi
jmp 0x18000b249
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x18000b17d
mov rax, qword [rbx + 0x50]
movsxd r15, dword [rax]
test r15, r15
je 0x18000b17d
cmp r15, rsi
cmovae r15, rsi
mov rcx, rdi
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
add rdi, r15
mov r14, rsi
sub r14, r15
mov rax, qword [rbx + 0x50]
sub dword [rax], r15d
mov rax, qword [rbx + 0x38]
movsxd rcx, r15d
add qword [rax], rcx
cmp qword [rbx + 0x80], 0
jne 0x18000b18e
jmp 0x18000b246
mov r14, rsi
cmp qword [rbx + 0x80], 0
je 0x18000b246
mov rax, qword [rbx + 0x18]
lea rcx, [rbx + 0x70]
cmp qword [rax], rcx
jne 0x18000b1ba
mov ecx, dword [rbx + 0x90]
mov rdx, qword [rbx + 0x88]
mov qword [rax], rdx
mov rax, qword [rbx + 0x38]
mov qword [rax], rdx
sub ecx, edx
mov rax, qword [rbx + 0x50]
mov dword [rax], ecx
movabs r15, 0x928b4350f10ed56b
mov r12, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
movabs r13, 0x6d74bcaf0ef12a95
nop word cs:[rax + rax]
cmp r14, 0x1000
jb 0x18000b221
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rdi
call r12
add rdi, rax
add r14, r15
mov rcx, r14
sub rcx, rax
lea r14, [rcx + r13]
cmp rax, 0xfff
je 0x18000b1e0
add rsi, r15
sub rsi, rcx
jmp 0x18000b249
test r14, r14
je 0x18000b243
mov r9, qword [rbx + 0x80]
mov edx, 1
mov rcx, rdi
mov r8, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub r14, rax
jmp 0x18000b246
xor r14d, r14d
sub rsi, r14
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x18000b260
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x68], 0
je 0x18000b296
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rbx + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x18000b2e3
test rsi, rsi
jle 0x18000b2e3
mov rax, qword [rbx + 0x58]
mov r15d, dword [rax]
test r15d, r15d
jle 0x18000b2e3
cmp r15, rsi
cmovae r15, rsi
mov rdx, rdi
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
add rdi, r15
mov r14, rsi
sub r14, r15
mov rax, qword [rbx + 0x58]
sub dword [rax], r15d
mov rax, qword [rbx + 0x40]
add qword [rax], r15
test r14, r14
jg 0x18000b2eb
jmp 0x18000b30b
mov r14, rsi
test r14, r14
jle 0x18000b30b
mov r9, qword [rbx + 0x80]
test r9, r9
je 0x18000b30b
mov edx, 1
mov rcx, rdi
mov r8, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub r14, rax
sub rsi, r14
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x18000b700
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rax, qword [0x1800456c0]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dil, 1
cmp qword [rcx + 0x68], 0
je 0x18000b7aa
mov rsi, rcx
cmp byte [rcx + 0x71], 0
je 0x18000b7aa
mov rax, qword [rsi]
mov rcx, rsi
mov edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x18000b7a8
mov rcx, qword [rsi + 0x68]
lea r9, [rsp + 0x50]
lea rdx, [rsi + 0x74]
mov rax, qword [rcx]
lea r8, [rsp + 0x28]
mov qword [rsp + 0x20], r8
lea rdi, [rsp + 0x30]
mov r8, rdi
call qword [rax + 0x40]
cmp eax, 3
je 0x18000b7c1
cmp eax, 1
je 0x18000b777
test eax, eax
jne 0x18000b7a8
mov byte [rsi + 0x71], 0
mov rbx, qword [rsp + 0x28]
sub rbx, rdi
je 0x18000b79e
mov r9, qword [rsi + 0x80]
mov edx, 1
mov rcx, rdi
mov r8, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x18000b7a8
cmp byte [rsi + 0x71], 0
sete dil
jmp 0x18000b7aa
xor edi, edi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180033100
mov eax, edi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
mov byte [rsi + 0x71], 0
mov dil, 1
jmp 0x18000b7aa

Function at 0x18000dee0
Capabilities:
Encode data using xor

Disassembly:
push rsi
mov eax, 0x84222325
sub r8, rdx
je 0x18000df60
xor ecx, ecx
nop dword [rax]
movzx r9d, byte [rdx + rcx]
mov r10d, r9d
not r10d
mov r11d, r9d
and r11d, 0x21
mov esi, r10d
and esi, 0xa4c337de
or esi, r11d
xor esi, eax
xor esi, 0x5b3cc821
mov r11d, eax
and r11d, r10d
or r11d, esi
and r10d, 0xf03c8825
and r9d, 0xffffffda
lea esi, [r10 + r9]
add r9d, r10d
add r9d, 0x8406600
xor r9d, eax
xor r9d, 0xf87cee25
xor esi, 0xfc377da
and esi, r9d
not r11d
or r11d, esi
imul eax, r11d, 0x1b3
inc rcx
cmp r8, rcx
jne 0x18000def0
pop rsi
ret
Function at 0x180017a50
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov rax, qword [rcx + 0x28]
test rax, rax
jne 0x180017c08
cmp byte [0x1800459c2], 0
jne 0x180017bf7
mov rdx, qword [0x180044590]
movabs rax, 0xbd48b80e3a0dbe6
add rax, rdx
movabs rcx, 0xbd48b80e3a0dc03
add rcx, rdx
movabs r9, 0xbd48b80e3a0dc15
add r9, rdx
lea r8, [0x1800459b0]
cmp r9, r8
jbe 0x180017b0d
lea r9, [0x1800459c2]
cmp rax, r9
jae 0x180017b0d
xor edx, edx
nop word cs:[rax + rax]
movzx r9d, byte [rcx + rdx]
movzx r10d, byte [rax + rdx]
mov r11d, r10d
and r11b, 0x92
or r11b, 0x25
mov ebx, r10d
and bl, 0x6d
xor bl, r11b
xor bl, 0xda
mov r11d, ebx
xor r11b, r9b
or bl, r9b
not bl
or bl, r11b
not r10b
or r10b, r9b
and r10b, bl
not r10b
mov byte [rdx + r8], r10b
inc rdx
cmp rdx, 0x12
jne 0x180017ac0
jmp 0x180017bf0
movdqu xmm1, xmmword [rcx]
movdqu xmm2, xmmword [rax]
movdqa xmm0, xmmword [0x180038190]
pand xmm0, xmm2
por xmm0, xmmword [str.________________mmmmmmmmmmmmmmmm]
movdqa xmm3, xmmword [0x180038330]
pand xmm3, xmm2
pxor xmm3, xmm0
pxor xmm3, xmmword [0x180038340]
movdqa xmm4, xmm3
pxor xmm4, xmm1
por xmm3, xmm1
pcmpeqd xmm0, xmm0
pxor xmm3, xmm0
por xmm3, xmm4
pxor xmm2, xmm0
por xmm2, xmm1
pand xmm2, xmm3
pxor xmm2, xmm0
movdqa xmmword [0x1800459b0], xmm2
movabs rax, 0xbd48b80e3a0dc13
movzx eax, word [rdx + rax]
movabs rcx, 0xbd48b80e3a0dbf6
movzx ecx, word [rdx + rcx]
movd xmm1, ecx
movdqa xmm2, xmmword [0x180038210]
pand xmm2, xmm1
por xmm2, xmmword [0x180038350]
movdqa xmm3, xmmword [0x180038360]
pand xmm3, xmm1
pxor xmm3, xmm2
pxor xmm3, xmmword [0x180038370]
movd xmm2, eax
movdqa xmm4, xmm3
pxor xmm4, xmm2
por xmm3, xmm2
pxor xmm3, xmm0
por xmm3, xmm4
pxor xmm1, xmm0
por xmm1, xmm2
pand xmm1, xmm3
pxor xmm1, xmm0
movd eax, xmm1
mov word [0x1800459c0], ax
mov byte [0x1800459c2], 1
movabs rax, 0xbd48b80e3a0d3c3
add rax, qword [0x180044598]
pop rbx
ret
Function at 0x180020f00
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp], 0xfffffffffffffffe
mov r12, rdx
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], 0
mov qword [rdx + 0x18], 0xf
mov rbx, qword [rcx + 0x38]
mov r14, qword [rcx + 0x40]
cmp rbx, r14
je 0x180021142
lea rsi, [0x180046aae]
lea rdi, [rbp - 0x18]
mov qword [rbp - 8], r12
jmp 0x180020f79
mov byte [rdx + rax], r9b
mov byte [rdx + rax + 1], 0
inc rbx
cmp rbx, r14
mov r12, qword [rbp - 8]
je 0x180021142
movzx r9d, byte [rbx]
cmp r9d, 0x1f
ja 0x1800210c0
mov byte [rbp - 0x10], 0
mov qword [rbp - 0x18], 0
cmp byte [0x180046ab7], 0
jne 0x180021076
mov rax, qword [0x180044a58]
movabs rcx, 0x952d254258a0afbb
add rcx, rax
movabs rdx, 0x952d254258a0afd9
add rax, rdx
xor edx, edx
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
mov r15d, r8d
not r15b
movzx r10d, byte [rcx + rdx]
mov r11d, r8d
and r11b, 5
mov r13d, r8d
and r13b, 0xfa
mov r12d, r8d
or r12b, 5
xor r13b, 0x71
and r13b, r12b
and r15b, 0x70
or r15b, r13b
mov r13d, r8d
and r13b, 1
mov r12d, r8d
xor r12b, 1
and r12b, r11b
or r13b, 0x70
xor r13b, r12b
or r12b, 0x8a
xor r13b, r12b
and r13b, r15b
xor r13b, r12b
mov r15d, r8d
or r15b, 1
and r15b, 0xfb
xor r15b, r11b
xor r15b, 0xfb
xor r8b, 5
or r8b, r15b
not r8b
or r8b, r13b
xor r10b, 0xfa
mov r11d, r10d
xor r11b, r10b
xor r11b, r8b
and r11b, r8b
xor r11b, r10b
mov byte [rdx + rsi], r11b
inc rdx
cmp rdx, 9
jne 0x180020fd0
mov byte [0x180046ab7], 1
mov r12, qword [rbp - 8]
mov edx, 9
mov rcx, rdi
mov r8, rsi
call fcn.18002c110
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rcx, qword [r12 + 0x10]
mov rdx, qword [r12 + 0x18]
mov r8, rdx
sub r8, rcx
cmp r8, rax
jae 0x1800210f0
mov qword [rsp + 0x20], rax
mov rcx, r12
mov rdx, rax
mov r9, rdi
call fcn.180015470
jmp 0x180020f69
mov rax, qword [r12 + 0x10]
mov rcx, qword [r12 + 0x18]
cmp rax, rcx
jae 0x180021130
lea rdx, [rax + 1]
mov qword [r12 + 0x10], rdx
mov rdx, r12
cmp rcx, 0x10
jb 0x180020f60
mov rdx, qword [r12]
jmp 0x180020f60
mov r15, rax
add r15, rcx
mov qword [r12 + 0x10], r15
mov r13, r12
cmp rdx, 0x10
jb 0x180021108
mov r13, qword [r12]
add rcx, r13
mov rdx, rdi
mov r8, rax
call sub.VCRUNTIME140.dll_memmove
mov byte [r13 + r15], 0
jmp 0x180020f69
mov edx, 1
mov rcx, r12
call fcn.18000b7d0
jmp 0x180020f69
mov rax, r12
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x18002fa70
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
cmp byte [0x180045819], 0
jne 0x18002fb6a
xor eax, eax
lea rdx, [0x180045813]
nop dword [rax]
movzx r8d, byte [rcx + rax]
movzx r9d, byte [rcx + rax + 0x1c]
mov esi, r9d
not sil
mov r11d, r9d
xor r11b, 8
and r11b, r9b
mov edi, r11d
not dil
and sil, 0x11
mov r10d, r9d
and r10b, 0x80
or r10b, sil
or sil, 0x24
mov ebx, r9d
and bl, 0x46
xor bl, sil
xor bl, 0x7b
mov esi, r9d
and sil, 8
or r9b, dil
or dil, 0x11
and dil, 0x19
and r11b, 0x20
or r11b, dil
or sil, 0x80
xor sil, r11b
not r9b
and r9b, 8
or r9b, sil
xor r10b, 0xa0
and r10b, sil
not r9b
and r9b, bl
or r9b, r10b
mov r10d, r8d
and r10b, 0xd7
or r10b, 0x20
mov r11d, r8d
and r11b, 0x28
xor r11b, r10b
mov r10d, r11d
xor r10b, 8
xor r11b, 0x89
and r11b, r10b
mov r10d, r9d
xor r10b, 0x7e
and r8b, 0x81
xor r8b, r11b
mov r11d, r8d
xor r11b, 0x81
xor r9b, 0x81
and r9b, r11b
xor r8b, 0x7e
and r8b, r10b
or r8b, r9b
mov byte [rax + rdx], r8b
inc rax
cmp rax, 6
jne 0x18002fa90
mov byte [0x180045819], 1
pop rbx
pop rdi
pop rsi
ret

Function at 0x18002fc50
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
sub rsp, 0x28
movdqa xmmword [rsp + 0x10], xmm7
movdqa xmmword [rsp], xmm6
cmp byte [0x1800459e0], 0
jne 0x18002fe20
lea rdx, [rcx + 0x22]
lea rax, [0x1800459d0]
cmp rdx, rax
jbe 0x18002fd3c
lea rdx, [0x1800459e0]
cmp rcx, rdx
jae 0x18002fd3c
xor edx, edx
nop word cs:[rax + rax]
movzx r10d, byte [rcx + rdx]
movzx r9d, byte [rcx + rdx + 0x12]
mov r8d, r10d
not r8b
mov r11d, r8d
and r11b, 0x82
mov ebx, r10d
and bl, 4
mov esi, r10d
and sil, 0x38
or r11b, 0x28
xor r11b, sil
and r8b, 0x41
or r8b, bl
or r8b, r11b
mov r11d, r8d
and r11b, 0xed
xor r11b, 0xe9
xor r8b, 6
or r8b, r11b
and r10b, 0xed
mov r11d, r10d
not r11b
mov ebx, r9d
xor bl, 0x12
xor r10b, r11b
and r10b, r8b
or r8b, r11b
xor r10b, r11b
and r8b, 0xfd
xor r8b, r10b
xor r9b, 0xed
mov r10d, r8d
xor r10b, 2
or r10b, bl
xor r8b, 0xfd
or r8b, r9b
and r8b, r10b
not r8b
mov byte [rdx + rax], r8b
inc rdx
cmp rdx, 0x10
jne 0x18002fca0
jmp 0x18002fe19
movdqu xmm1, xmmword [rcx]
movdqa xmm2, xmm1
pandn xmm2, xmmword [0x180038750]
movdqu xmm0, xmmword [rcx + 0x12]
movdqa xmm4, xmmword [0x180038520]
pand xmm4, xmm1
movdqa xmm3, xmmword [str.8888888888888888]
pand xmm3, xmm1
por xmm2, xmmword [0x180038560]
pxor xmm2, xmm3
movdqa xmm3, xmm1
pandn xmm3, xmmword [0x1800381c0]
por xmm3, xmm4
por xmm3, xmm2
movdqa xmm4, xmmword [0x180038770]
movdqa xmm5, xmm3
pand xmm5, xmm4
pxor xmm5, xmmword [0x180038780]
pxor xmm3, xmmword [0x1800385e0]
pcmpeqd xmm2, xmm2
por xmm3, xmm5
pand xmm1, xmm4
movdqa xmm5, xmm3
pand xmm5, xmm1
pxor xmm1, xmm2
movdqa xmm6, xmmword [0x180038790]
pxor xmm6, xmm0
movdqa xmm7, xmm3
por xmm7, xmm1
pandn xmm3, xmm1
por xmm3, xmm5
movdqa xmm1, xmmword [0x1800387a0]
pand xmm7, xmm1
pxor xmm7, xmm3
pxor xmm0, xmm4
movdqa xmm3, xmmword [0x1800387b0]
pxor xmm3, xmm7
por xmm3, xmm6
pxor xmm7, xmm1
por xmm7, xmm0
pand xmm7, xmm3
pxor xmm7, xmm2
movdqa xmmword [0x1800459d0], xmm7
mov byte [0x1800459e0], 1
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x18002fe60
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
movdqa xmmword [rsp], xmm6
cmp byte [0x180045a30], 0
jne 0x18002ffd0
lea rdx, [rcx + 0x30]
lea rax, [0x180045a18]
cmp rdx, rax
jbe 0x18002fee8
lea rdx, [0x180045a30]
cmp rcx, rdx
jae 0x18002fee8
xor edx, edx
nop word cs:[rax + rax]
movzx r8d, byte [rcx + rdx]
movzx r9d, byte [rcx + rdx + 0x18]
not r8b
mov r10d, r9d
or r10b, r8b
and r8b, r9b
mov r9d, r10d
xor r9b, 0xb
mov r11d, r8d
xor r11b, 0xf4
xor r10b, 0xf4
and r10b, r11b
xor r8b, 0xb
and r8b, r9b
or r8b, r10b
mov byte [rdx + rax], r8b
inc rdx
cmp rdx, 0x18
jne 0x18002fea0
jmp 0x18002ffc9
movq xmm1, qword [rcx + 0x18]
movq xmm3, qword [rcx]
pcmpeqd xmm0, xmm0
movdqa xmm4, xmm3
pxor xmm4, xmm0
por xmm4, xmm1
pandn xmm3, xmm1
movdqa xmm1, xmmword [str._v_v_v_v_v_v_v_v]
movdqa xmm5, xmm4
pxor xmm5, xmm1
movdqa xmm2, xmmword [0x1800387d0]
movdqa xmm6, xmm3
pxor xmm6, xmm2
pxor xmm4, xmm2
pand xmm4, xmm6
pxor xmm3, xmm1
pand xmm3, xmm5
por xmm3, xmm4
movq qword [0x180045a18], xmm3
movq xmm3, qword [rcx + 0x20]
movq xmm4, qword [rcx + 8]
movdqa xmm5, xmm4
pxor xmm5, xmm0
por xmm5, xmm3
pandn xmm4, xmm3
movdqa xmm3, xmm5
pxor xmm3, xmm1
movdqa xmm6, xmm4
pxor xmm6, xmm2
pxor xmm5, xmm2
pand xmm5, xmm6
pxor xmm4, xmm1
pand xmm4, xmm3
por xmm4, xmm5
movq qword [0x180045a20], xmm4
movq xmm3, qword [rcx + 0x28]
movq xmm4, qword [rcx + 0x10]
pxor xmm0, xmm4
por xmm0, xmm3
pandn xmm4, xmm3
movdqa xmm3, xmm0
pxor xmm3, xmm1
movdqa xmm5, xmm4
pxor xmm5, xmm2
pxor xmm0, xmm2
pand xmm0, xmm5
pxor xmm4, xmm1
pand xmm4, xmm3
por xmm4, xmm0
movq qword [0x180045a28], xmm4
mov byte [0x180045a30], 1
movaps xmm6, xmmword [rsp]
add rsp, 0x18
ret
Function at 0x18002ffe0
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
movdqa xmmword [rsp + 0x40], xmm10
movdqa xmmword [rsp + 0x30], xmm9
movdqa xmmword [rsp + 0x20], xmm8
movdqa xmmword [rsp + 0x10], xmm7
movdqa xmmword [rsp], xmm6
cmp byte [0x180045a51], 0
jne 0x1800301af
lea rdx, [rcx + 0x2d]
lea rax, [0x180045a40]
cmp rdx, rax
jbe 0x18003003a
lea rdx, [0x180045a51]
cmp rcx, rdx
jae 0x18003003a
xor edx, edx
jmp 0x180030120
movdqu xmm1, xmmword [rcx]
movdqu xmm0, xmmword [rcx + 0x1c]
movdqa xmm3, xmmword [0x1800387e0]
movdqa xmm5, xmm0
por xmm5, xmm3
pcmpeqd xmm2, xmm2
movdqa xmm7, xmm5
pxor xmm7, xmm2
movdqa xmm6, xmm0
pand xmm6, xmm3
movdqa xmm4, xmmword [0x1800387f0]
movdqa xmm8, xmm0
pxor xmm8, xmm4
pand xmm8, xmm6
movdqa xmm9, xmmword [0x1800384e0]
por xmm9, xmm0
pand xmm9, xmmword [str.________________]
por xmm7, xmm4
pand xmm4, xmm0
movdqa xmm10, xmmword [0x180038560]
pxor xmm9, xmmword [0x180038810]
por xmm10, xmm8
pand xmm9, xmm10
por xmm4, xmmword [0x180038820]
pxor xmm4, xmm8
pand xmm4, xmm7
por xmm4, xmm9
movdqa xmm7, xmm5
pandn xmm7, xmmword [str.hhhhhhhhhhhhhhhh]
movdqa xmm8, xmmword [0x180038840]
pand xmm5, xmm8
por xmm5, xmm7
pxor xmm6, xmm8
pxor xmm6, xmm5
pxor xmm0, xmm3
por xmm0, xmm6
pxor xmm0, xmm2
por xmm0, xmm4
pxor xmm0, xmm1
pxor xmm0, xmmword [str.llllllllllllllll]
movdqa xmmword [0x180045a40], xmm0
mov edx, 0x10
nop
movzx r8d, byte [rcx + rdx + 0x1c]
mov r9d, r8d
or r9b, 0x93
mov r11d, r9d
not r11b
mov r10d, r8d
and r10b, 0x93
mov esi, r8d
xor sil, 3
and sil, r10b
mov edi, r8d
or dil, 1
and dil, 0x29
lea ebp, [r11 + 3]
mov ebx, r8d
and bl, 3
lea r14d, [rsi + 0x28]
xor dil, 0xb9
and dil, r14b
or bl, 0xd4
xor bl, sil
and bl, bpl
or bl, dil
and r11b, 0x68
and r9b, 0x95
or r9b, r11b
xor r9b, r10b
xor r9b, 0x95
xor r8b, 0x93
or r8b, r9b
not r8b
or r8b, bl
xor r8b, byte [rcx + rdx]
xor r8b, 0x6c
mov byte [rdx + rax], r8b
inc rdx
cmp rdx, 0x11
jne 0x180030120
mov byte [0x180045a51], 1
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x1800301e0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
cmp byte [0x180045a68], 0
jne 0x180030253
xor r8d, r8d
movabs r9, 0x8618618618618619
lea r10, [0x180045a52]
nop dword [rax]
mov rax, r8
mul r9
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
imul rax, rax, 0xffffffffffffffeb
lea rdx, [rcx + r8]
movzx r11d, byte [rcx + r8 + 0x15]
movzx eax, byte [rax + rdx]
mov edx, eax
xor dl, 0xa3
xor al, r11b
xor r11b, 0x5c
and al, dl
or r11b, dl
not r11b
or r11b, al
mov byte [r8 + r10], r11b
inc r8
cmp r8, 0x16
jne 0x180030200
mov byte [0x180045a68], 1
ret
Function at 0x180030260
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
cmp byte [0x180045b01], 0
jne 0x1800302d5
xor r8d, r8d
movabs r9, 0x47ae147ae147ae15
lea r10, [0x180045ae6]
nop dword [rax]
mov rax, r8
mul r9
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
imul rax, rax, 0xffffffffffffffe7
lea rdx, [rcx + r8]
movzx r11d, byte [rcx + r8 + 0x19]
movzx eax, byte [rax + rdx]
mov edx, eax
not dl
or dl, r11b
not r11b
or r11b, al
mov eax, edx
and al, 0xdd
xor al, r11b
and dl, 0x22
xor dl, al
mov byte [r8 + r10], dl
inc r8
cmp r8, 0x1b
jne 0x180030280
mov byte [0x180045b01], 1
ret

Function at 0x1800302e0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
cmp byte [0x180045b1c], 0
jne 0x180030383
xor r8d, r8d
movabs r9, 0xd79435e50d79435f
lea r10, [0x180045b02]
nop word cs:[rax + rax]
mov rax, r8
mul r9
shr rdx, 4
imul rax, rdx, 0xffffffffffffffed
lea rdx, [rcx + r8]
movzx r11d, byte [rcx + r8 + 0x13]
movzx edx, byte [rax + rdx]
not r11b
mov eax, edx
and al, r11b
mov ebx, edx
or bl, r11b
mov esi, eax
not sil
mov edi, eax
and dil, 0x61
mov ebp, esi
and bpl, 0xe
or bpl, dil
or bpl, 0x10
and al, 0x90
xor al, bl
xor al, bpl
xor r11b, dl
xor sil, bl
or sil, r11b
xor al, 0x1e
mov edx, eax
xor dl, sil
or al, sil
not al
or al, dl
mov byte [r8 + r10], al
inc r8
cmp r8, 0x1a
jne 0x180030310
mov byte [0x180045b1c], 1
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x1800307a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [0x1800466a5], 0
jne 0x18003080a
xor r8d, r8d
movabs r9, 0x4924924924924925
lea r10, [0x18004667f]
nop dword [rax]
mov rax, r8
shr rax, 2
mul r9
shr rdx, 1
imul rax, rdx, 0xffffffffffffffe4
lea rdx, [rcx + r8]
movzx r11d, byte [rcx + r8 + 0x1c]
movzx eax, byte [rax + rdx]
mov edx, eax
xor dl, 0xe
xor al, r11b
xor r11b, 0xf1
and al, dl
or r11b, dl
not r11b
or r11b, al
mov byte [r8 + r10], r11b
inc r8
cmp r8, 0x26
jne 0x1800307c0
mov byte [0x1800466a5], 1
ret

Function at 0x180030e80
Capabilities:
Encode data using xor

Disassembly:
cmp byte [0x18004683c], 0
jne 0x180030ef1
xor eax, eax
lea rdx, [0x180046824]
nop word cs:[rax + rax]
movzx r8d, byte [rcx + rax + 0x10]
mov r9d, eax
and r9d, 0xf
movzx r9d, byte [rcx + r9]
not r8b
mov r10d, r9d
and r10b, r8b
or r8b, r9b
mov r9d, r10d
xor r9b, 0x55
mov r11d, r8d
xor r11b, 0xaa
xor r10b, 0xaa
and r10b, r11b
xor r8b, 0x55
and r8b, r9b
or r8b, r10b
mov byte [rax + rdx], r8b
inc rax
cmp rax, 0x18
jne 0x180030ea0
mov byte [0x18004683c], 1
ret

Function at 0x180030f00
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
cmp byte [0x18004687c], 0
jne 0x180030ff1
xor r8d, r8d
movabs r9, 0x4924924924924925
lea r10, [0x18004684b]
nop word cs:[rax + rax]
mov rax, r8
shr rax, 2
mul r9
shr rdx, 1
imul rax, rdx, 0xffffffffffffffe4
lea r11, [rcx + r8]
movzx edx, byte [rcx + r8 + 0x1c]
movzx eax, byte [rax + r11]
mov r11d, eax
not r11b
mov ebx, eax
xor bl, 0x40
and bl, r11b
mov r11d, eax
xor r11b, 0x91
and r11b, al
and bl, 0x42
mov esi, r11d
and sil, 0xbd
mov edi, eax
and dil, 2
xor dil, bl
or bl, 0x91
mov ebp, eax
and bpl, 0x91
xor bpl, sil
xor bpl, 0x93
and r11b, 0x91
or r11b, bpl
xor dil, 0x2e
and dil, bpl
not r11b
and r11b, bl
or r11b, dil
mov ebx, eax
xor bl, 0xbd
xor al, 0x42
or al, bl
not al
or al, r11b
mov r11d, edx
and r11b, 0x42
or r11b, 0xc
and dl, 0xbd
xor dl, r11b
mov r11d, edx
xor r11b, 0xf3
mov ebx, eax
xor bl, 0xbd
xor dl, 0xc
and dl, bl
xor al, 0x42
and al, r11b
or al, dl
mov byte [r8 + r10], al
inc r8
cmp r8, 0x31
jne 0x180030f30
mov byte [0x18004687c], 1
pop rbx
pop rbp
pop rdi
pop rsi
ret