joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1803a4cb0
Capabilities:
Set thread local storage value

Disassembly:
mov eax, 0x28
call fcn.180469830
sub rsp, rax
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x1803aad20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
mov eax, 0x20
call fcn.180469830
sub rsp, rax
mov rbx, rcx
mov rsi, rdx
mov rcx, rdx
call fcn.1803a0250
test eax, eax
je 0x1803aad5f
xor edx, edx
mov rcx, rbx
call fcn.1803a0700
mov eax, 1
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
mov qword [rsp + 0x30], rbp
mov ebp, dword [rsi + 8]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], r14
mov r14, qword [rsi]
lea eax, [rbp - 1]
movsxd rdi, eax
xor eax, eax
mov rcx, qword [r14 + rdi*8]
cmp rcx, 1
sete al
sub ebp, eax
cmp rsi, rbx
je 0x1803aada7
mov edx, ebp
mov rcx, rbx
call fcn.1803a0c70
test rax, rax
je 0x1803aae0d
mov eax, dword [rsi + 0x10]
mov dword [rbx + 0x10], eax
mov rcx, qword [r14 + rdi*8]
mov rax, qword [rbx]
mov rdx, rcx
xor rdx, 1
inc rdx
neg rdx
shl rdx, 0x3f
lea r8, [rax + rdi*8]
shr rcx, 1
je 0x1803aadc7
mov qword [r8], rcx
test rdi, rdi
jle 0x1803aadfe
sub r14, rax
nop
mov rcx, qword [r14 + r8 - 8]
lea r8, [r8 - 8]
mov rax, rcx
dec rdi
shr rax, 1
or rax, rdx
mov rdx, rcx
xor rdx, 1
mov qword [r8], rax
inc rdx
neg rdx
shl rdx, 0x3f
test rdi, rdi
jg 0x1803aadd0
mov dword [rbx + 8], ebp
test ebp, ebp
jne 0x1803aae08
mov dword [rbx + 0x10], ebp
mov eax, 1
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret

Function at 0x1803b0370
Capabilities:
Get thread local storage value

Disassembly:
mov eax, 0x28
call fcn.180469830
sub rsp, rax
lea rcx, [0x1806d3f18]
add rsp, 0x28
jmp fcn.1803a4b10
Function at 0x1803ba8a0
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
mov eax, 0x30
call fcn.180469830
sub rsp, rax
xor esi, esi
lea edx, [rax - 0x2f]
mov ebx, esi
mov rdi, rcx
call fcn.1803ad040
mov rdx, rax
mov rcx, rdi
mov rbp, rax
call fcn.1803aceb0
mov r14, rax
test rax, rax
je 0x1803ba94a
lea r9d, [rsi + 1]
mov dword [rsp + 0x20], 0xf0000040
xor r8d, r8d
lea rcx, [rsp + 0x58]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1803ba923
mov rcx, qword [rsp + 0x58]
mov r8, r14
mov edx, ebp
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rcx, qword [rsp + 0x58]
test eax, eax
cmovne rbx, rbp
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea r8, [rbx*8]
mov rdx, rbx
mov rcx, rdi
call fcn.1803acf40
mov rcx, rdi
call fcn.1803ad0f0
mov rbx, rax
test rax, rax
jne 0x1803ba9e6
mov edx, 1
mov rcx, rdi
call fcn.1803ad040
mov rdx, rax
mov rcx, rdi
mov rbp, rax
call fcn.1803aceb0
mov r14, rax
test rax, rax
je 0x1803ba9d4
mov r9d, 0x16
mov dword [rsp + 0x20], 0xf0000040
lea r8, str.Intel_Hardware_Cryptographic_Service_Provider
xor edx, edx
lea rcx, [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1803ba9b6
mov rcx, qword [rsp + 0x58]
mov r8, r14
mov edx, ebp
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rcx, qword [rsp + 0x58]
test eax, eax
cmovne rsi, rbp
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea r8, [rsi*8]
mov rdx, rsi
mov rcx, rdi
call fcn.1803acf40
mov rcx, rdi
call fcn.1803ad0f0
mov rbx, rax
test rbx, rbx
je 0x1803ba9de
mov rax, rbx
jmp 0x1803ba9e6
mov rcx, rdi
call fcn.1803ad0f0
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret

Function at 0x1803bb1c0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x38
call fcn.180469830
sub rsp, rax
mov r10, rdx
mov dword [rsp + 0x40], reloc.WS2_32.dll_recv
add rdx, 0xf
lea rax, [r8 + 0xf]
mov r11, rcx
cmp r10, rax
ja 0x1803bb1f0
xor r9d, r9d
cmp rdx, r8
jae 0x1803bb209
movdqu xmm1, xmmword [r10]
movdqu xmm0, xmmword [r8]
pxor xmm1, xmm0
movdqu xmmword [r10], xmm1
mov r9d, reloc.WS2_32.dll_recv
cmp r9, 0x10
jae 0x1803bb231
sub r8, r10
lea rax, [r9 + r10]
mov edx, reloc.WS2_32.dll_recv
sub rdx, r9
nop
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x1803bb220
mov rcx, qword [r11 + 8]
lea r8, [rsp + 0x40]
mov r9, r10
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
mov rdx, r10
call fcn.1803d9790
test eax, eax
je 0x1803bb262
cmp dword [rsp + 0x40], 0x10
jne 0x1803bb262
mov eax, 1
add rsp, 0x38
ret
xor eax, eax
add rsp, 0x38
ret
Function at 0x1803bb410
Capabilities:
Encode data using xor

Disassembly:
mov r10, rcx
test rdx, rdx
je 0x1803bb498
test r8, r8
je 0x1803bb498
mov rax, qword [rcx + 0x18]
cmp r8, rax
mov r9, rax
cmovb r9, r8
test r9, r9
je 0x1803bb456
add rcx, 0x20
mov r11, rdx
sub r11, r10
nop
movzx eax, byte [r11 + rcx - 0x20]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub r9, 1
jne 0x1803bb440
mov rax, qword [r10 + 0x18]
cmp r8, rax
jbe 0x1803bb498
sub r8, rax
mov eax, reloc.WS2_32.dll_recv
cmp r8, rax
cmova r8, rax
xor ecx, ecx
test r8, r8
je 0x1803bb498
nop dword [rax]
nop word [rax + rax]
mov rax, qword [r10 + 0x18]
add rax, rcx
movzx eax, byte [rax + rdx]
xor byte [r10 + rcx + 0x40], al
inc rcx
cmp rcx, r8
jb 0x1803bb480
ret

Function at 0x1803cb1d0
Capabilities:
Query environment variable

Disassembly:
push rbx
mov eax, 0x20
call fcn.180469830
sub rsp, rax
mov rbx, rcx
call fcn.1800818d0
test eax, eax
je 0x1803cb1f3
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]

Function at 0x1803efa20
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x38
call fcn.180469830
sub rsp, rax
cmp dword [rsp + 0x68], 0
je 0x1803efa49
lea rax, [0x1803ee090]
mov qword [rsp + 0x68], rax
add rsp, 0x38
jmp fcn.1803e65b0
lea rax, [0x1803ed250]
mov qword [rsp + 0x68], rax
add rsp, 0x38
jmp fcn.1803e6300
Function at 0x1803f7699
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x1803f788a
push rbx
mov eax, 0xd0
call fcn.180469830
sub rsp, rax
mov rax, qword [0x1806c4cd8]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xe8], rbp
mov rbx, rdx
mov qword [rsp + 0xf0], rsi
lea rbp, [r8 - 1]
mov qword [rsp + 0xf8], rdi
mov qword [rsp + 0xc8], r14
lea r14, [rcx + 0xc]
shr rbp, 3
mov qword [rsp + 0xc0], r15
inc rbp
lea r15, [rcx + 0x14]
nop word [rax + rax]
movzx eax, byte [rbx + 1]
mov rcx, r14
movzx edi, byte [rbx]
movzx esi, byte [rbx + 4]
lea rbx, [rbx + 8]
shl eax, 8
or edi, eax
movzx eax, byte [rbx - 6]
shl eax, 0x10
or edi, eax
movzx eax, byte [rbx - 5]
shl eax, 0x18
or edi, eax
movzx eax, byte [rbx - 3]
shl eax, 8
or esi, eax
mov dword [rsp + 0x20], edi
movzx eax, byte [rbx - 2]
shl eax, 0x10
or esi, eax
mov dword [rsp + 0x28], edi
movzx eax, byte [rbx - 1]
and byte [r14], 0xdf
and byte [r15], 0xbf
or byte [r14], 0x40
or byte [r15], 0x20
shl eax, 0x18
or esi, eax
mov dword [rsp + 0x24], esi
mov dword [rsp + 0x2c], esi
call fcn.1803de080
lea rdx, [rsp + 0x30]
mov rcx, r14
call fcn.1803dda20
mov r8d, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x28]
call fcn.1803da760
mov rcx, r15
call fcn.1803de080
lea rdx, [rsp + 0x30]
mov rcx, r15
call fcn.1803dda20
mov r8d, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.1803da760
mov r8d, dword [rsp + 0x20]
mov edx, dword [rsp + 0x24]
xor r8d, edi
xor edi, dword [rsp + 0x28]
xor edx, esi
xor esi, dword [rsp + 0x2c]
mov eax, edi
mov byte [r14], dil
shr eax, 8
mov byte [r14 + 1], al
mov eax, edi
shr eax, 0x10
mov byte [r14 + 2], al
mov eax, edx
shr eax, 8
shr edi, 0x18
mov byte [r14 + 3], dil
mov byte [r14 + 4], dl
mov byte [r14 + 5], al
mov eax, edx
shr eax, 0x10
mov byte [r14 + 6], al
mov eax, r8d
shr eax, 8
shr edx, 0x18
mov byte [r14 + 7], dl
mov byte [r15], r8b
mov byte [r15 + 1], al
mov eax, r8d
shr eax, 0x10
mov byte [r15 + 2], al
shr r8d, 0x18
mov byte [r15 + 3], r8b
mov byte [r15 + 4], sil
mov eax, esi
shr eax, 8
mov byte [r15 + 5], al
mov eax, esi
shr eax, 0x10
shr esi, 0x18
mov byte [r15 + 6], al
mov byte [r15 + 7], sil
sub rbp, 1
jne 0x1803f7700
mov r15, qword [rsp + 0xc0]
mov r14, qword [rsp + 0xc8]
mov rdi, qword [rsp + 0xf8]
mov rsi, qword [rsp + 0xf0]
mov rbp, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1804688c0
add rsp, 0xd0
pop rbx
ret
Function at 0x180425920
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, Ordinal_203
call fcn.180469830
sub rsp, rax
mov rax, qword [0x1806c4cd8]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov r12, qword [rsp + 0x130]
xor r14d, r14d
mov rax, qword [rcx]
mov rbp, r9
movsxd rdi, r8d
mov rsi, rdx
mov rbx, rcx
mov r15d, r14d
lea r13d, [r14 + 1]
test r9, r9
je 0x180425989
cmp r9, rax
je 0x180425981
test rdx, rdx
je 0x1804259fa
test r8d, r8d
js 0x1804259fa
mov r15d, r13d
mov qword [rcx], r9
jmp 0x180425991
test rax, rax
je 0x1804259fa
mov rbp, rax
mov rcx, rbp
call fcn.180092520
test al, 2
jne 0x1804259fa
test rsi, rsi
je 0x180425a62
mov rcx, rbp
mov r15d, r13d
call fcn.1803d0420
cmp eax, 0x90
jg 0x1804259fa
cmp eax, edi
jge 0x180425a20
mov rcx, qword [rbx + 8]
mov r8, r12
mov rdx, rbp
call fcn.18041bff0
test eax, eax
je 0x1804259fa
mov rcx, qword [rbx + 8]
mov r8, rdi
mov rdx, rsi
call fcn.18041c240
test eax, eax
je 0x1804259fa
mov rcx, qword [rbx + 8]
lea rsi, [rbx + 0x20]
mov r8, rsi
lea rdx, [rbx + 0x24]
call fcn.18041bf10
test eax, eax
jne 0x180425a3d
xor eax, eax
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1804688c0
add rsp, 0xc8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
cmp edi, 0x90
ja 0x1804259fa
mov r8, rdi
lea rcx, [rbx + 0x24]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
lea rsi, [rbx + 0x20]
mov dword [rsi], edi
mov ecx, dword [rsi]
cmp ecx, 0x90
je 0x180425a6b
mov eax, ecx
mov r8d, 0x90
sub r8d, ecx
xor edx, edx
lea rcx, [rbx + 0x24]
add rcx, rax
call sub.VCRUNTIME140.dll_memset
jmp 0x180425a6b
test r15d, r15d
je 0x180425b46
lea rcx, [rsp + 0x20]
mov rax, rbx
sub rax, rcx
mov rdx, r14
lea rdi, [rax + 0x24]
lea rsi, [rax + 0x25]
nop dword [rax]
nop word [rax + rax]
lea rcx, [rsp + 0x20]
add rcx, rdx
add rdx, 2
movzx eax, byte [rdi + rcx]
xor al, 0x36
mov byte [rcx], al
movzx eax, byte [rsi + rcx]
xor al, 0x36
mov byte [rcx + 1], al
cmp rdx, 0x90
jl 0x180425a90
mov rcx, qword [rbx + 0x10]
mov r8, r12
mov rdx, rbp
call fcn.18041bff0
test eax, eax
je 0x180425b59
mov rcx, rbp
call fcn.1803d0420
mov rcx, qword [rbx + 0x10]
lea rdx, [rsp + 0x20]
movsxd r8, eax
call fcn.18041c240
test eax, eax
je 0x180425b59
mov rdx, r14
nop dword [rax]
lea rcx, [rsp + 0x20]
add rcx, rdx
add rdx, 2
movzx eax, byte [rdi + rcx]
xor al, 0x5c
mov byte [rcx], al
movzx eax, byte [rsi + rcx]
xor al, 0x5c
mov byte [rcx + 1], al
cmp rdx, 0x90
jl 0x180425af0
mov rcx, qword [rbx + 0x18]
mov r8, r12
mov rdx, rbp
call fcn.18041bff0
test eax, eax
je 0x180425b59
mov rcx, rbp
call fcn.1803d0420
mov rcx, qword [rbx + 0x18]
lea rdx, [rsp + 0x20]
movsxd r8, eax
call fcn.18041c240
test eax, eax
je 0x180425b59
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rbx + 8]
call fcn.18041c270
test eax, eax
cmovne r14d, r13d
test r15d, r15d
je 0x180425b6d
mov edx, 0x90
lea rcx, [rsp + 0x20]
call fcn.180001c80
mov eax, r14d
jmp 0x1804259fc
Function at 0x1804ae7b0
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x60
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x18075d110]
test rax, rax
jne 0x1804ae90d
mov rax, qword [0x1806d5bb8]
test rax, rax
jne 0x1804ae7fd
lea ecx, [rax + 8]
call fcn.1804688ec
mov qword [rsp + 0x88], rax
mov rcx, rax
call fcn.1804aeae0
nop
mov qword [0x1806d5bb8], rax
mov qword [rsp + 0x80], rax
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov rax, qword [0x18075d110]
test rax, rax
jne 0x1804ae8fc
lea ecx, [rax + 0x40]
call fcn.1804688ec
mov rdi, rax
mov qword [rsp + 0x88], rax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [rdi], eax
cmp eax, 0xffffffff
je 0x1804ae91c
mov ecx, 0x30
call fcn.1804688ec
mov rbx, rax
mov qword [rsp + 0x90], rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [rbx + 0x28], 1
mov qword [rdi + 8], rbx
lea rcx, [rdi + 0x10]
xor eax, eax
mov qword [rcx], rax
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rax
mov qword [rdi + 0x28], rax
mov qword [rdi + 0x30], rax
mov qword [rdi + 0x38], rax
mov rax, qword [rcx + 0x10]
sub rax, qword [rcx]
sar rax, 2
movabs rsi, 0x7fffffffffffffff
cmp rax, 0x20
jae 0x1804ae8c5
movabs rax, 0x3fffffffffffffff
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x38], rsi
mov edx, 0x20
call fcn.180171940
mov rax, qword [rdi + 0x38]
sub rax, qword [rdi + 0x28]
sar rax, 3
cmp rax, 0x20
jae 0x1804ae8f5
movabs rax, 0x1fffffffffffffff
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rsi
lea rcx, [rdi + 0x28]
call fcn.1801718c0
nop
mov qword [0x18075d110], rdi
mov rcx, qword [rsp + 0x80]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [0x18075d110]
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret
lea rdx, str.tlsKey___TLS_OUT_OF_INDEXES
lea rcx, [rsp + 0x50]
call fcn.18014ce20
nop
mov dword [rsp + 0x20], 0x3c8
lea r9, str.e:zhanlue_rcimage_vendordependsopencvmodulescore_src_system.cpp
lea r8, str.cv::TlsAbstraction::TlsAbstraction
lea rdx, [rsp + 0x50]
mov ecx, 0xffffff29
call fcn.1804afa50
int3
Function at 0x1804cc0f0
Capabilities:
Encode data using xor

Disassembly:
movsxd r11, edx
xor r8d, r8d
mov r9, rcx
xorps xmm3, xmm3
lea eax, [r11 - 4]
movsxd r10, eax
test eax, eax
js 0x1804cc179
add rcx, 8
add r10, 4
shr r10, 2
lea r8d, [r10*4]
nop dword [rax + rax]
mov eax, dword [rcx - 8]
cdq
xor eax, edx
sub eax, edx
movd xmm1, eax
mov eax, dword [rcx - 4]
cdq
xor eax, edx
sub eax, edx
cvtdq2pd xmm1, xmm1
movd xmm0, eax
mov eax, dword [rcx]
cdq
xor eax, edx
sub eax, edx
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
movd xmm0, eax
mov eax, dword [rcx + 4]
add rcx, 0x10
cvtdq2pd xmm0, xmm0
cdq
xor eax, edx
sub eax, edx
addsd xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
addsd xmm3, xmm1
sub r10, 1
jne 0x1804cc120
mov ecx, r11d
sub ecx, r8d
cmp r8d, r11d
jge 0x1804cc207
cmp ecx, 4
jb 0x1804cc207
cmp dword [0x1806c4ce0], 2
jl 0x1804cc207
movsxd rdx, r8d
xorps xmm4, xmm4
xorps xmm5, xmm5
and ecx, 0x80000003
jge 0x1804cc1ae
dec ecx
or ecx, 0xfffffffc
inc ecx
mov eax, r11d
sub eax, ecx
movsxd rcx, eax
nop word [rax + rax]
movq xmm0, qword [r9 + rdx*4]
add r8d, 4
pabsd xmm1, xmm0
movq xmm0, qword [r9 + rdx*4 + 8]
cvtdq2pd xmm2, xmm1
add rdx, 4
pabsd xmm1, xmm0
addpd xmm4, xmm2
cvtdq2pd xmm2, xmm1
addpd xmm5, xmm2
cmp rdx, rcx
jl 0x1804cc1c0
addpd xmm4, xmm5
movaps xmm0, xmm4
unpckhpd xmm0, xmm4
addsd xmm4, xmm0
addsd xmm3, xmm4
movsxd rcx, r8d
mov r10, r11
cmp rcx, r11
jge 0x1804cc2c5
mov rax, r11
sub rax, rcx
cmp rax, 4
jl 0x1804cc2a3
mov r8, r10
lea r11, [r9 + 8]
sub r8, rcx
lea r11, [r11 + rcx*4]
sub r8, 4
shr r8, 2
inc r8
lea rcx, [rcx + r8*4]
mov eax, dword [r11 - 8]
cdq
xor eax, edx
sub eax, edx
movd xmm1, eax
mov eax, dword [r11 - 4]
cdq
xor eax, edx
sub eax, edx
cvtdq2pd xmm1, xmm1
movd xmm0, eax
mov eax, dword [r11]
addsd xmm1, xmm3
cdq
xor eax, edx
sub eax, edx
cvtdq2pd xmm0, xmm0
movaps xmm3, xmm1
addsd xmm3, xmm0
movd xmm0, eax
mov eax, dword [r11 + 4]
add r11, 0x10
cvtdq2pd xmm0, xmm0
cdq
xor eax, edx
sub eax, edx
addsd xmm3, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm3, xmm0
sub r8, 1
jne 0x1804cc243
cmp rcx, r10
jge 0x1804cc2c5
mov eax, dword [r9 + rcx*4]
inc rcx
cdq
xor eax, edx
sub eax, edx
movd xmm1, eax
cvtdq2pd xmm1, xmm1
addsd xmm3, xmm1
cmp rcx, r10
jl 0x1804cc2a8
movaps xmm0, xmm3
ret
Function at 0x1804cc7c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r15
xor r9d, r9d
movsxd rbp, r8d
mov qword [rsp + 0x18], r14
mov rsi, rdx
mov r15, rcx
mov r11d, r9d
mov r10d, r9d
lea eax, [rbp - 4]
movsxd r14, eax
test eax, eax
js 0x1804cc874
mov rbx, rcx
lea rdi, [rdx + 6]
sub rbx, rdx
add r14, 4
shr r14, 2
lea r10d, [r14*4]
movsx eax, word [rdi - 6]
movsx ecx, word [rbx + rdi - 6]
lea rdi, [rdi + 8]
sub ecx, eax
mov eax, ecx
movsx ecx, word [rbx + rdi - 0xc]
cdq
mov r8d, eax
movsx eax, word [rdi - 0xc]
sub ecx, eax
xor r8d, edx
sub r8d, edx
mov eax, ecx
movsx ecx, word [rbx + rdi - 0xa]
cdq
xor eax, edx
sub eax, edx
add r8d, eax
movsx eax, word [rdi - 0xa]
sub ecx, eax
mov eax, ecx
movsx ecx, word [rbx + rdi - 8]
cdq
xor eax, edx
sub eax, edx
add r8d, eax
movsx eax, word [rdi - 8]
sub ecx, eax
mov eax, ecx
cdq
xor eax, edx
sub eax, edx
add r11d, eax
add r11d, r8d
sub r14, 1
jne 0x1804cc811
mov r14, qword [rsp + 0x18]
mov ecx, ebp
sub ecx, r10d
cmp r10d, ebp
jge 0x1804cc952
cmp ecx, 8
jb 0x1804cc952
cmp dword [0x1806c4ce0], 2
jl 0x1804cc952
movsxd rdx, r10d
xorps xmm4, xmm4
xorps xmm3, xmm3
and ecx, 0x80000007
jge 0x1804cc8b5
dec ecx
or ecx, 0xfffffff8
inc ecx
mov eax, ebp
sub eax, ecx
mov rcx, r15
movsxd r8, eax
sub rcx, rsi
lea rax, [rsi + 8]
lea rax, [rax + rdx*2]
nop word [rax + rax]
movq xmm0, qword [rcx + rax - 8]
add r10d, 8
movq xmm1, qword [rax - 8]
lea rax, [rax + 0x10]
pmovsxwd xmm2, xmm0
pmovsxwd xmm0, xmm1
psubd xmm2, xmm0
add rdx, 8
movq xmm0, qword [rcx + rax - 0x10]
pabsd xmm1, xmm2
paddd xmm1, xmm4
movdqa xmm4, xmm1
movq xmm1, qword [rax - 0x10]
pmovsxwd xmm2, xmm0
pmovsxwd xmm0, xmm1
psubd xmm2, xmm0
pabsd xmm1, xmm2
paddd xmm1, xmm3
movdqa xmm3, xmm1
cmp rdx, r8
jl 0x1804cc8d0
paddd xmm3, xmm4
movdqa xmm0, xmm3
psrldq xmm0, 8
paddd xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
paddd xmm3, xmm0
movd eax, xmm3
add r11d, eax
movsxd r10, r10d
mov ebx, r9d
cmp r10, rbp
jge 0x1804cc9f6
mov rax, rbp
sub rax, r10
cmp rax, 2
jl 0x1804cc9c3
mov r8, rbp
lea rcx, [rsi + 2]
sub r8, r10
lea rcx, [rcx + r10*2]
sub r8, 2
mov rdi, r15
shr r8, 1
sub rdi, rsi
inc r8
lea r10, [r10 + r8*2]
nop
movsx eax, word [rcx - 2]
movsx edx, word [rdi + rcx - 2]
lea rcx, [rcx + 4]
sub edx, eax
mov eax, edx
cdq
xor eax, edx
sub eax, edx
movsx edx, word [rdi + rcx - 4]
add r9d, eax
movsx eax, word [rcx - 4]
sub edx, eax
mov eax, edx
cdq
xor eax, edx
sub eax, edx
add ebx, eax
sub r8, 1
jne 0x1804cc990
cmp r10, rbp
jge 0x1804cc9dc
movsx eax, word [r15 + r10*2]
movsx ecx, word [rsi + r10*2]
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
add r11d, eax
lea eax, [rbx + r9]
add eax, r11d
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
pop r15
pop rdi
ret
mov rbx, qword [rsp + 0x20]
mov eax, r11d
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
pop r15
pop rdi
ret
Function at 0x1804cca20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
xor r9d, r9d
mov qword [rsp + 0x10], rsi
movsxd rsi, edx
mov r8, rcx
mov r11d, r9d
mov r10d, r9d
lea eax, [rsi - 4]
movsxd rbx, eax
test eax, eax
js 0x1804cca9a
add rbx, 4
lea rdi, [rcx + 4]
shr rbx, 2
lea r10d, [rbx*4]
nop dword [rax + rax]
movsx eax, word [rdi - 4]
lea rdi, [rdi + 8]
cdq
mov ecx, eax
movsx eax, word [rdi - 0xa]
xor ecx, edx
sub ecx, edx
cdq
xor eax, edx
sub eax, edx
add ecx, eax
movsx eax, word [rdi - 6]
cdq
xor eax, edx
sub eax, edx
add ecx, eax
movsx eax, word [rdi - 8]
cdq
xor eax, edx
sub eax, edx
add r11d, eax
add r11d, ecx
sub rbx, 1
jne 0x1804cca60
mov ecx, esi
sub ecx, r10d
cmp r10d, esi
jge 0x1804ccb43
cmp ecx, 8
jb 0x1804ccb43
cmp dword [0x1806c4ce0], 2
jl 0x1804ccb43
movsxd rdx, r10d
xorps xmm4, xmm4
xorps xmm3, xmm3
and ecx, 0x80000007
jge 0x1804ccad6
dec ecx
or ecx, 0xfffffff8
inc ecx
mov eax, esi
sub eax, ecx
movsxd rcx, eax
nop dword [rax]
movq xmm0, qword [r8 + rdx*2]
add r10d, 8
pmovsxwd xmm1, xmm0
movq xmm0, qword [r8 + rdx*2 + 8]
pabsd xmm2, xmm1
paddd xmm2, xmm4
add rdx, 8
movdqa xmm4, xmm2
pmovsxwd xmm1, xmm0
pabsd xmm2, xmm1
paddd xmm2, xmm3
movdqa xmm3, xmm2
cmp rdx, rcx
jl 0x1804ccae0
paddd xmm3, xmm4
movdqa xmm0, xmm3
psrldq xmm0, 8
paddd xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
paddd xmm3, xmm0
movd eax, xmm3
add r11d, eax
movsxd rcx, r10d
mov ebx, r9d
mov r10, rsi
mov rsi, qword [rsp + 0x10]
cmp rcx, r10
jge 0x1804ccbb3
mov rax, r10
sub rax, rcx
cmp rax, 2
jl 0x1804ccb93
lea rdi, [r10 - 1]
nop word [rax + rax]
movsx eax, word [r8 + rcx*2]
cdq
xor eax, edx
sub eax, edx
add r9d, eax
movsx eax, word [r8 + rcx*2 + 2]
cdq
add rcx, 2
xor eax, edx
sub eax, edx
add ebx, eax
cmp rcx, rdi
jl 0x1804ccb70
cmp rcx, r10
jge 0x1804ccba5
movsx eax, word [r8 + rcx*2]
cdq
xor eax, edx
sub eax, edx
add r11d, eax
lea eax, [rbx + r9]
add eax, r11d
mov rbx, qword [rsp + 0x18]
pop rdi
ret
mov rbx, qword [rsp + 0x18]
mov eax, r11d
pop rdi
ret
Function at 0x1804cd0c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r15
xor r9d, r9d
movsxd rbp, r8d
mov qword [rsp + 0x18], r14
mov rsi, rdx
mov r15, rcx
mov r11d, r9d
mov r10d, r9d
lea eax, [rbp - 4]
movsxd r14, eax
test eax, eax
js 0x1804cd174
mov rbx, rcx
lea rdi, [rdx + 6]
sub rbx, rdx
add r14, 4
shr r14, 2
lea r10d, [r14*4]
movzx eax, word [rdi - 6]
movzx ecx, word [rbx + rdi - 6]
lea rdi, [rdi + 8]
sub ecx, eax
mov eax, ecx
movzx ecx, word [rbx + rdi - 0xc]
cdq
mov r8d, eax
movzx eax, word [rdi - 0xc]
sub ecx, eax
xor r8d, edx
sub r8d, edx
mov eax, ecx
movzx ecx, word [rbx + rdi - 0xa]
cdq
xor eax, edx
sub eax, edx
add r8d, eax
movzx eax, word [rdi - 0xa]
sub ecx, eax
mov eax, ecx
movzx ecx, word [rbx + rdi - 8]
cdq
xor eax, edx
sub eax, edx
add r8d, eax
movzx eax, word [rdi - 8]
sub ecx, eax
mov eax, ecx
cdq
xor eax, edx
sub eax, edx
add r11d, eax
add r11d, r8d
sub r14, 1
jne 0x1804cd111
mov r14, qword [rsp + 0x18]
mov ecx, ebp
sub ecx, r10d
cmp r10d, ebp
jge 0x1804cd252
cmp ecx, 8
jb 0x1804cd252
cmp dword [0x1806c4ce0], 2
jl 0x1804cd252
movsxd rdx, r10d
xorps xmm4, xmm4
xorps xmm3, xmm3
and ecx, 0x80000007
jge 0x1804cd1b5
dec ecx
or ecx, 0xfffffff8
inc ecx
mov eax, ebp
sub eax, ecx
mov rcx, r15
movsxd r8, eax
sub rcx, rsi
lea rax, [rsi + 8]
lea rax, [rax + rdx*2]
nop word [rax + rax]
movq xmm0, qword [rcx + rax - 8]
add r10d, 8
movq xmm1, qword [rax - 8]
lea rax, [rax + 0x10]
pmovzxwd xmm2, xmm0
pmovzxwd xmm0, xmm1
psubd xmm2, xmm0
add rdx, 8
movq xmm0, qword [rcx + rax - 0x10]
pabsd xmm1, xmm2
paddd xmm1, xmm4
movdqa xmm4, xmm1
movq xmm1, qword [rax - 0x10]
pmovzxwd xmm2, xmm0
pmovzxwd xmm0, xmm1
psubd xmm2, xmm0
pabsd xmm1, xmm2
paddd xmm1, xmm3
movdqa xmm3, xmm1
cmp rdx, r8
jl 0x1804cd1d0
paddd xmm3, xmm4
movdqa xmm0, xmm3
psrldq xmm0, 8
paddd xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
paddd xmm3, xmm0
movd eax, xmm3
add r11d, eax
movsxd r10, r10d
mov ebx, r9d
cmp r10, rbp
jge 0x1804cd2f6
mov rax, rbp
sub rax, r10
cmp rax, 2
jl 0x1804cd2c3
mov r8, rbp
lea rcx, [rsi + 2]
sub r8, r10
lea rcx, [rcx + r10*2]
sub r8, 2
mov rdi, r15
shr r8, 1
sub rdi, rsi
inc r8
lea r10, [r10 + r8*2]
nop
movzx eax, word [rcx - 2]
movzx edx, word [rdi + rcx - 2]
lea rcx, [rcx + 4]
sub edx, eax
mov eax, edx
cdq
xor eax, edx
sub eax, edx
movzx edx, word [rdi + rcx - 4]
add r9d, eax
movzx eax, word [rcx - 4]
sub edx, eax
mov eax, edx
cdq
xor eax, edx
sub eax, edx
add ebx, eax
sub r8, 1
jne 0x1804cd290
cmp r10, rbp
jge 0x1804cd2dc
movzx eax, word [r15 + r10*2]
movzx ecx, word [rsi + r10*2]
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
add r11d, eax
lea eax, [rbx + r9]
add eax, r11d
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
pop r15
pop rdi
ret
mov rbx, qword [rsp + 0x20]
mov eax, r11d
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
pop r15
pop rdi
ret