joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18007c640
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x20], 0x369736b4
mov word [rbp - 0xc], bx
mov ecx, ebx
mov dword [rbp - 0x1c], 0x36b936d7
mov edx, 0x36e3
mov dword [rbp - 0x18], 0x36da36d4
mov dword [rbp - 0x14], 0x368e36c7
mov dword [rbp - 0x10], 0x36803687
mov byte [rbp - 0xa], 1
nop word [rax + rax]
lea eax, [rdx + rcx]
xor word [rbp + rcx*2 - 0x20], ax
inc rcx
cmp rcx, 0xa
jb 0x18007c690
lea rdx, [rbp - 0x20]
mov byte [rbp - 0xa], bl
call fcn.18007bee0
mov rcx, rbx
test rax, rax
jne 0x18007c760
mov dword [rbp - 0x20], 0x315f1f3c
mov dword [rbp - 0x1c], 0x165f425c
mov dword [rbp - 0x18], 0x100181f
nop
lea eax, [rcx + 0x6b]
xor byte [rbp + rcx - 0x20], al
inc rcx
cmp rcx, 0xa
jb 0x18007c6d0
lea rdx, [rbp - 0x20]
mov byte [rbp - 0x15], bl
call fcn.18007be40
test al, al
je 0x18007c752
mov dword [rbp + 0x10], 0x21803
mov rcx, rbx
mov word [rbp + 0x14], 0x1c
mov byte [rbp + 0x16], 1
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx + 0x6b]
xor byte [rbp + rcx + 0x10], al
inc rcx
cmp rcx, 5
jb 0x18007c710
mov byte [rbp + 0x16], bl
mov dword [rbp - 0x20], 0x315f1f3c
mov dword [rbp - 0x1c], 0x165f425c
mov dword [rbp - 0x18], 0x100181f
nop dword [rax + rax]
lea eax, [rbx + 0x6b]
xor byte [rbp + rbx - 0x20], al
inc rbx
cmp rbx, 0xa
jb 0x18007c740
jmp 0x18007c7c0
movzx eax, bx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret
mov dword [rbp + 0x10], 0x21803
mov word [rbp + 0x14], 0x1c
mov byte [rbp + 0x16], 1
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x6b]
xor byte [rbp + rcx + 0x10], al
inc rcx
cmp rcx, 5
jb 0x18007c780
mov byte [rbp + 0x16], bl
mov dword [rbp - 0x20], 0x315f1f3c
mov dword [rbp - 0x1c], 0x165f425c
mov dword [rbp - 0x18], 0x100181f
nop dword [rax + rax]
lea eax, [rbx + 0x6b]
xor byte [rbp + rbx - 0x20], al
inc rbx
cmp rbx, 0xa
jb 0x18007c7b0
lea rdx, [rbp + 0x10]
mov byte [rbp - 0x15], 0
lea rcx, [rbp - 0x20]
call fcn.18001bdc0
mov ecx, 0x15b3
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
jmp rax
Function at 0x18007c9a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1801ab040]
xor rax, rsp
mov qword [rbp - 8], rax
mov r15, rdx
call fcn.18007c7f0
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
xor ebx, ebx
mov qword [rbp - 0x18], rbx
mov qword [rbp - 0x10], rbx
mov rsi, 0xffffffffffffffff
mov r8, rsi
nop dword [rax]
inc r8
cmp byte [rax + r8], bl
jne 0x18007c9f0
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.18000eea0
nop
mov word [rbp - 0x50], 0x5c
mov byte [rbp - 0x4e], 0
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x28]
call fcn.18007d070
lea rdi, [rax + 1]
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov rdx, rbx
mov qword [rbp - 0x38], rbx
mov ecx, 0xf
mov qword [rbp - 0x30], rcx
mov byte [rbp - 0x48], bl
movsxd r14, edi
cmp r14, qword [rbp - 0x18]
jae 0x18007cab8
nop dword [rax]
nop dword [rax + rax]
lea rax, [rbp - 0x28]
cmp qword [rbp - 0x10], 0xf
cmova rax, qword [rbp - 0x28]
movzx r9d, byte [r14 + rax]
cmp rdx, rcx
jae 0x18007ca88
lea rax, [rdx + 1]
mov qword [rbp - 0x38], rax
lea rax, [rbp - 0x48]
cmp rcx, 0xf
cmova rax, qword [rbp - 0x48]
mov byte [rax + rdx], r9b
mov byte [rax + rdx + 1], 0
jmp 0x18007ca91
lea rcx, [rbp - 0x48]
call fcn.18000efa0
inc edi
inc r14
movsxd rax, edi
cmp rax, qword [rbp - 0x18]
jae 0x18007caa9
mov rcx, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x38]
jmp 0x18007ca50
cmp qword [rbp - 0x38], 0
jne 0x18007cb34
mov rcx, qword [rbp - 0x30]
mov dword [rbp - 0x50], 0xb030325
mov word [rbp - 0x4c], 0x100
nop word [rax + rax]
lea eax, [rbx + 0x6b]
xor byte [rbp + rbx - 0x50], al
inc rbx
cmp rbx, 4
jb 0x18007cad0
mov byte [rbp - 0x4b], 0
lea rax, [rbp - 0x50]
mov rdi, rsi
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x18007caf0
cmp rdi, rcx
ja 0x18007cb24
lea rbx, [rbp - 0x48]
cmp rcx, 0xf
cmova rbx, qword [rbp - 0x48]
mov qword [rbp - 0x38], rdi
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rdi], 0
jmp 0x18007cb34
lea r9, [rbp - 0x50]
mov rdx, rdi
lea rcx, [rbp - 0x48]
call fcn.180017770
inc rsi
cmp byte [r15 + rsi], 0
jne 0x18007cb34
mov r8, rsi
mov rdx, r15
lea rcx, [rbp - 0x48]
call fcn.18000df10
lea rbx, [rbp - 0x48]
cmp qword [rbp - 0x30], 0xf
cmova rbx, qword [rbp - 0x48]
lea rcx, [rbp - 0x48]
call fcn.18000e640
nop
lea rcx, [rbp - 0x28]
call fcn.18000e640
mov rax, rbx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1800cac00
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x18007ce80
Capabilities:
Create http request
Encode data using xor
Read data from internet
Receive data

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x2680]
mov eax, 0x2780
call fcn.1800cc020
sub rsp, rax
mov rax, qword [0x1801ab040]
xor rax, rsp
mov qword [rbp + 0x2670], rax
mov rbx, r8
mov rdi, rdx
mov qword [rsp + 0x48], rdx
xor esi, esi
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x30], 0x1c081f3e
mov dword [rsp + 0x34], 0x17163142
mov dword [rsp + 0x38], 0x100001d
mov eax, esi
nop dword [rax]
lea ecx, [rax + 0x6b]
xor byte [rsp + rax + 0x30], cl
inc rax
cmp rax, 0xa
jb 0x18007cee0
mov byte [rsp + 0x3b], sil
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
lea rcx, [rsp + 0x30]
call qword [sym.imp.WININET.dll_InternetOpenA]
mov r15, rax
cmp qword [rbx + 0x18], 0xf
jbe 0x18007cf1b
mov rbx, qword [rbx]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, r15
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov r14, rax
test rax, rax
jne 0x18007cf4b
mov rcx, r15
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], 0xf
mov byte [rdi], sil
mov dword [rsp + 0x40], 1
lea r9, [rsp + 0x50]
mov r8d, 0x270f
lea rdx, [rsp + 0x60]
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x18007d002
mov eax, dword [rsp + 0x50]
test eax, eax
je 0x18007d002
mov esi, eax
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
mov rax, rdx
sub rax, rcx
cmp rsi, rax
ja 0x18007cfd0
lea rax, [rcx + rsi]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0xf
jbe 0x18007cfb6
mov rax, qword [rdi]
lea rbx, [rax + rcx]
mov r8, rsi
lea rdx, [rsp + 0x60]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rsi], 0
jmp 0x18007cfe5
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x60]
mov rdx, rsi
mov rcx, rdi
call fcn.18000ecf0
lea r9, [rsp + 0x50]
mov r8d, 0x270f
lea rdx, [rsp + 0x60]
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x18007cf85
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r15
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rax, rdi
mov rcx, qword [rbp + 0x2670]
xor rcx, rsp
call fcn.1800cac00
mov rbx, qword [rsp + 0x27b0]
add rsp, 0x2780
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x18007d040
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x16], 0
je 0x18007d065
xor eax, eax
mov r8d, 0x36e3
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0xa
jb 0x18007d050
mov byte [rcx + 0x16], 0
ret
Function at 0x180084af0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [rcx + 0x10]
mov r10d, ecx
and r10d, 7
je 0x180084b24
cmp ecx, r10d
jge 0x180084b12
mov rcx, rbx
call fcn.1800842e0
mov eax, dword [rbx + 0x14]
mov ecx, r10d
shr eax, cl
sub dword [rbx + 0x10], r10d
mov ecx, dword [rbx + 0x10]
mov dword [rbx + 0x14], eax
xor r8d, r8d
mov eax, ecx
test ecx, ecx
jle 0x180084b5e
mov ecx, dword [rbx + 0x14]
lea rdx, [rsp + 0x30]
movzx r9d, cl
nop dword [rax]
shr ecx, 8
inc r8d
mov byte [rdx], r9b
lea rdx, [rdx + 1]
sub eax, 8
mov dword [rbx + 0x14], ecx
movzx r9d, cl
test eax, eax
jg 0x180084b40
mov dword [rbx + 0x10], eax
test eax, eax
jns 0x180084b8d
mov edx, dword [0x1801ad66c]
mov rax, qword gs:[0x58]
mov ecx, 0x18
mov rax, qword [rax + rdx*8]
lea rdx, str.zlib_corrupt
mov qword [rcx + rax], rdx
xor eax, eax
add rsp, 0x20
pop rbx
ret
movsxd rcx, r8d
cmp rcx, 4
jge 0x180084bbf
mov r8, qword [rbx + 8]
mov rax, qword [rbx]
nop dword [rax]
cmp rax, r8
jb 0x180084ba9
xor dl, dl
jmp 0x180084bb2
movzx edx, byte [rax]
inc rax
mov qword [rbx], rax
mov byte [rsp + rcx + 0x30], dl
inc rcx
cmp rcx, 4
jl 0x180084ba0
movzx eax, byte [rsp + 0x30]
movzx r8d, byte [rsp + 0x31]
movzx ecx, byte [rsp + 0x33]
shl r8d, 8
add r8d, eax
shl ecx, 8
movzx eax, byte [rsp + 0x32]
add ecx, eax
mov eax, r8d
xor eax, 0xffff
cmp ecx, eax
jne 0x180084b62
mov rcx, qword [rbx]
mov qword [rsp + 0x38], rdi
mov edi, r8d
add rcx, rdi
cmp rcx, qword [rbx + 8]
jbe 0x180084c34
mov edx, dword [0x1801ad66c]
mov rax, qword gs:[0x58]
mov ecx, 0x18
mov rax, qword [rax + rdx*8]
lea rdx, str.read_past_buffer
mov qword [rcx + rax], rdx
mov rdi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rdx, qword [rbx + 0x18]
lea rax, [r8 + rdx]
cmp rax, qword [rbx + 0x28]
jbe 0x180084c4e
mov rcx, rbx
call fcn.180084420
test eax, eax
je 0x180084c27
mov rdx, qword [rbx]
mov r8, rdi
mov rcx, qword [rbx + 0x18]
call sub.VCRUNTIME140.dll_memcpy
add qword [rbx], rdi
mov eax, 1
add qword [rbx + 0x18], rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x1800a18d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], r8d
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xe0
mov rsi, rdx
xor ebx, ebx
mov dword [rbp + 0x77], ebx
cmp byte [0x1801ab5f0], bl
je 0x1800a19cb
lea rax, [rbp - 0x41]
mov qword [rbp + 0x67], rax
lea rdx, [0x1801ab618]
lea rcx, [rbp - 0x41]
call fcn.180015180
nop
lea rcx, [rbp - 0x21]
call fcn.1800a6810
nop
mov dword [rbp + 0x77], 0x19
movdqa xmm0, xmmword [0x180192a00]
movdqu xmmword [rbp - 0x79], xmm0
mov byte [rbp - 0x69], 1
nop dword [rax]
lea eax, [rbx + 0x6b]
xor byte [rbp + rbx - 0x79], al
inc rbx
cmp rbx, 0xf
jb 0x1800a1940
mov byte [rbp - 0x69], 0
lea r8, [rbp - 0x21]
lea rdx, [rbp - 0x79]
lea rcx, [rbp - 1]
call fcn.180015c70
nop
lea r9, [rbp - 0x41]
mov r8, rax
lea rdx, [rbp + 0x1f]
call fcn.1800a0fa0
mov rdi, rax
mov dword [rbp + 0x77], 0x1b
lea rdx, [0x1801ab5f8]
lea rcx, [rbp - 0x61]
call fcn.180015180
mov ebx, 0x3f
mov rax, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 0xf
jbe 0x1800a19a3
mov rdi, qword [rdi]
lea rcx, [rbp - 0x61]
cmp qword [rbp - 0x49], 0xf
cmova rcx, qword [rbp - 0x61]
mov r8, qword [rbp - 0x51]
cmp r8, rax
jne 0x1800a19cb
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1800a19cb
mov dil, 1
jmp 0x1800a19ce
xor dil, dil
test bl, 4
je 0x1800a19e0
and ebx, 0xfffffffb
lea rcx, [rbp - 0x61]
call fcn.18000e640
nop
test bl, 2
je 0x1800a19f2
and ebx, 0xfffffffd
lea rcx, [rbp + 0x1f]
call fcn.18000e640
nop
test bl, 1
je 0x1800a1a00
lea rcx, [rbp - 0x21]
call fcn.18000e640
test dil, dil
je 0x1800a1a23
call fcn.1800a1710
test al, al
je 0x1800a1a23
test rsi, rsi
je 0x1800a1a23
mov rcx, rsi
call fcn.1800a1a70
mov rcx, rax
call fcn.1800a4c80
mov rbx, qword [rsp + 0x108]
add rsp, 0xe0
pop rdi
pop rsi
pop rbp
ret

Function at 0x1800a1a40
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1b], 0
je 0x1800a1a63
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x68]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1a
jb 0x1800a1a50
mov byte [rcx + 0x1b], 0
ret
Function at 0x1800a1a70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
xor eax, eax
mov dword [rbp - 0x40], 0x29052908
mov word [rbp - 0xc], ax
mov rdi, rcx
mov dword [rbp - 0x3c], 0x29072919
mov edx, 0x296b
mov dword [rbp - 0x38], 0x29152915
mov dword [rbp - 0x34], 0x295f291f
mov dword [rbp - 0x30], 0x29172900
mov dword [rbp - 0x2c], 0x291f2907
mov dword [rbp - 0x28], 0x290c2907
mov dword [rbp - 0x24], 0x29142910
mov dword [rbp - 0x20], 0x2951291c
mov dword [rbp - 0x1c], 0x2911291e
mov dword [rbp - 0x18], 0x29e5290d
mov dword [rbp - 0x14], 0x29e629af
mov dword [rbp - 0x10], 0x29e829ef
mov byte [rbp - 0xa], 1
nop
lea ecx, [rdx + rax]
xor word [rbp + rax*2 - 0x40], cx
inc rax
cmp rax, 0x1a
jb 0x1800a1af0
lea rcx, [rbp - 0x40]
mov byte [rbp - 0xa], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rcx, [rdi + 0x10]
movsxd rbx, dword [rax + 0xceca0]
mov rax, qword [rcx]
call qword [rax]
mov rdi, qword [rsp + 0x78]
mov rax, qword [rax]
mov rax, qword [rax + 0x10]
mov rax, qword [rax + rbx*8]
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x1800a4b80
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x10], rdx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
xor eax, eax
mov dword [rbp - 0x40], eax
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx], rax
mov qword [rdx + 8], rax
mov qword [rdx + 0x10], rax
mov dword [rbp - 0x40], 1
mov dword [rbp - 0x38], 0x29052908
mov dword [rbp - 0x34], 0x29072919
mov dword [rbp - 0x30], 0x29152915
mov dword [rbp - 0x2c], 0x295f291f
mov dword [rbp - 0x28], 0x29112901
mov dword [rbp - 0x24], 0x29192906
mov dword [rbp - 0x20], 0x290a2902
mov dword [rbp - 0x1c], 0x291f291a
mov dword [rbp - 0x18], 0x29512908
mov dword [rbp - 0x14], 0x2911291e
mov dword [rbp - 0x10], 0x29e5290d
mov dword [rbp - 0xc], 0x29e629af
mov dword [rbp - 8], 0x29e829ef
mov word [rbp - 4], ax
mov byte [rbp - 2], 1
mov edx, 0x296b
nop word [rax + rax]
lea ecx, [rdx + rax]
xor word [rbp + rax*2 - 0x38], cx
inc rax
cmp rax, 0x1a
jb 0x1800a4c30
mov byte [rbp - 2], 0
lea rcx, [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
add rax, 0x16910
mov r8, rdi
mov rdx, rbx
mov rcx, rsi
call rax
mov rax, rbx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1800a4c80
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0xd0
mov rax, qword [0x1801ab040]
xor rax, rsp
mov qword [rsp + 0xc8], rax
mov rsi, rcx
xor r14d, r14d
mov dword [rsp + 0xc0], r14d
mov rdi, qword [rcx + 0x10]
mov rbx, qword [rcx + 0x4e0]
test rbx, rbx
je 0x1800a4d00
nop dword [rax + rax]
mov qword [rsp + 0xc0], rdi
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x1800a4e58
mov rax, qword [rcx]
lea rdx, [rsp + 0xc0]
call qword [rax + 0x10]
test al, al
je 0x1800a4d00
mov rbx, qword [rbx + 0x40]
test rbx, rbx
jne 0x1800a4cd0
movdqa xmm0, xmmword [0x180193360]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [str.MZOM_KJ]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmm0, xmmword [0x180193fb0]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x180194300]
movdqa xmmword [rsp + 0x60], xmm1
movdqa xmm0, xmmword [0x1801936e0]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x1801942a0]
movdqa xmmword [rsp + 0x80], xmm1
mov dword [rsp + 0x90], 0x8aebfaf9
mov dword [rsp + 0x94], 0x9689ee88
mov dword [rsp + 0x98], 0xf49594f1
mov dword [rsp + 0x9c], 0x1009093
xor ecx, ecx
nop word [rax + rax]
lea eax, [rcx + 0x69]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0x6e
jb 0x1800a4d90
mov byte [rsp + 0x9f], 0
movdqa xmm0, xmmword [0x180192d80]
movdqu xmmword [rsp + 0xa0], xmm0
mov dword [rsp + 0xb0], 0x1419541f
mov dword [rsp + 0xb4], 0x1b50180e
mov dword [rsp + 0xb8], 0x100edec
xor ecx, ecx
nop dword [rax]
lea eax, [rcx + 0x68]
xor byte [rsp + rcx + 0xa0], al
inc rcx
cmp rcx, 0x1a
jb 0x1800a4de0
mov byte [rsp + 0xbb], 0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0xa0]
call fcn.18000b2c0
mov rdi, rax
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x1800a4e5f
lea rdx, [rsp + 0xa0]
call fcn.1800a4ef0
mov r14d, 1
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x1800a4e3a
mov rax, qword [rax]
test r8, r8
jne 0x1800a4e52
lea rdx, [0x1800d5238]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1800a4e5f
movzx ebx, r14b
jmp 0x1800a4e61
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xbad_function_call_void_]
nop
xor bl, bl
test r14b, 1
je 0x1800a4e74
lea rcx, [rsp + 0xa0]
call fcn.18000e640
test bl, bl
je 0x1800a4ebc
lea rax, section..text
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rdi
xor eax, eax
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call fcn.1800c6850
nop
mov rcx, qword [rsp + 0xc8]
xor rcx, rsp
call fcn.1800cac00
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x1800a50b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x1801ab040]
xor rax, rsp
mov qword [rbp + 0x47], rax
movdqa xmm0, xmmword [0x180193350]
mov rbx, rcx
movdqu xmmword [rbp + 0x17], xmm0
mov word [rbp + 0x27], 0x4d
xor ecx, ecx
mov byte [rbp + 0x29], 1
nop dword [rax]
lea eax, [rcx + 0x6d]
xor byte [rbp + rcx + 0x17], al
inc rcx
cmp rcx, 0x11
jb 0x1800a50f0
movdqa xmm0, xmmword [0x180192c10]
xor eax, eax
movdqu xmmword [rbp - 9], xmm0
mov byte [rbp + 0x29], 0
mov dword [rbp + 7], 0x1419540b
mov dword [rbp + 0xb], 0x1b50180e
mov dword [rbp + 0xf], 0x100edec
nop dword [rax + rax]
lea ecx, [rax + 0x68]
xor byte [rbp + rax - 9], cl
inc rax
cmp rax, 0x1a
jb 0x1800a5130
lea rax, section..text
mov byte [rbp + 0x12], 0
lea rdx, [rbp + 0x17]
mov qword [rbp + 0x2f], rax
lea rcx, [rbp - 9]
call fcn.18000b2c0
mov qword [rbp + 0x37], rax
xor r9d, r9d
xor eax, eax
xor r8d, r8d
mov qword [rsp + 0x28], rax
xor edx, edx
mov qword [rbp + 0x3f], rax
mov rcx, rbx
lea rax, [rbp + 0x2f]
mov qword [rsp + 0x20], rax
call fcn.1800c6850
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1800cac00
mov rbx, qword [rsp + 0xa8]
add rsp, 0x90
pop rbp
ret
Function at 0x1800a51b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
movdqa xmm0, xmmword [0x180193a00]
xor ebx, ebx
movdqu xmmword [rbp - 0x20], xmm0
mov ecx, ebx
mov dword [rbp - 0x10], 0xa5ab84e8
mov dword [rbp - 0xc], 0xbdabaaad
mov word [rbp - 8], 0x100
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x48]
xor byte [rbp + rcx - 0x20], al
inc rcx
cmp rcx, 0x18
jb 0x1800a51f0
xor edx, edx
mov byte [rbp - 7], bl
lea rcx, [rbp - 0x20]
lea r8d, [rdx + 8]
call fcn.180044380
cmp byte [0x1801ab0b6], bl
mov r9, qword [0x1801ad7e0]
je 0x1800a523d
mov rcx, qword [r9 + 0x1c10]
lea rdx, [0x1801f8288]
xor r8d, r8d
call fcn.180046f90
mov byte [0x1801ab0b6], bl
mov rcx, qword [r9 + 0x1c10]
movss xmm0, dword [rcx + 0x220]
cmp qword [rcx + 0x178], rbx
jne 0x1800a525e
cmp qword [r9 + 0x2020], rbx
je 0x1800a5266
movss xmm0, dword [rcx + 0x1f0]
subss xmm0, dword [rcx + 0xd8]
mov dword [rbp + 0x14], 0x42000000
mov rcx, rbx
mov dword [rbp - 0x30], 0x11e0939
mov dword [rbp - 0x2c], 0x1712021a
mov word [rbp - 0x28], bx
mulss xmm0, dword [0x1801925dc]
mov byte [rbp - 0x26], 1
movss dword [rbp + 0x10], xmm0
nop dword [rax + rax]
lea eax, [rcx + 0x6b]
xor byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 9
jb 0x1800a52a0
xor r8d, r8d
mov byte [rbp - 0x26], bl
lea rdx, [rbp + 0x10]
lea rcx, [rbp - 0x30]
call fcn.180065040
test al, al
je 0x1800a52d1
mov dword [0x1801ad818], 1
movss xmm1, dword [0x1801927e0]
xorps xmm0, xmm0
call fcn.1800478d0
mov r8, qword [0x1801ad7e0]
mov rcx, qword [r8 + 0x1c10]
movss xmm0, dword [rcx + 0x220]
cmp qword [rcx + 0x178], rbx
jne 0x1800a5309
cmp qword [r8 + 0x2020], rbx
je 0x1800a5311
movss xmm0, dword [rcx + 0x1f0]
subss xmm0, dword [rcx + 0xd8]
mov dword [rbp + 0x14], 0x42000000
mov dword [rbp - 0x30], 0xdcd3cbec
mov dword [rbp - 0x2c], 0xccccd8db
mov word [rbp - 0x28], 0x100
movss dword [rbp + 0x10], xmm0
nop dword [rax]
lea eax, [rbx - 0x48]
xor byte [rbp + rbx - 0x30], al
inc rbx
cmp rbx, 8
jb 0x1800a5340
xor r8d, r8d
mov byte [rbp - 0x27], 0
lea rdx, [rbp + 0x10]
lea rcx, [rbp - 0x30]
call fcn.180065040
test al, al
je 0x1800a5374
mov dword [0x1801ad818], 2
jmp 0x1800a538f
mov eax, dword [0x1801ad818]
cmp eax, 1
jne 0x1800a538a
call fcn.180036070
mov eax, dword [0x1801ad818]
cmp eax, 2
jne 0x1800a5394
call fcn.1800370b0
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
jmp fcn.180046780
Function at 0x1800a53b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
xor eax, eax
mov dword [rbp - 0x38], 0x29052908
mov word [rbp - 4], ax
mov rbx, rcx
mov dword [rbp - 0x34], 0x29072919
mov edx, 0x296b
mov dword [rbp - 0x30], 0x29152915
mov dword [rbp - 0x2c], 0x295f291f
mov dword [rbp - 0x28], 0x29112901
mov dword [rbp - 0x24], 0x29192906
mov dword [rbp - 0x20], 0x290a2902
mov dword [rbp - 0x1c], 0x291f291a
mov dword [rbp - 0x18], 0x29512908
mov dword [rbp - 0x14], 0x2911291e
mov dword [rbp - 0x10], 0x29e5290d
mov dword [rbp - 0xc], 0x29e629af
mov dword [rbp - 8], 0x29e829ef
mov byte [rbp - 2], 1
nop word [rax + rax]
lea ecx, [rdx + rax]
xor word [rbp + rax*2 - 0x38], cx
inc rax
cmp rax, 0x1a
jb 0x1800a5430
lea rdx, [rbp - 0x38]
mov byte [rbp - 2], 0
call fcn.18007bee0
mov rcx, rbx
lea rdx, [rax + 0xae6c0]
call fcn.1800242d0
mov rax, rbx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x1800a5800
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
xor eax, eax
mov qword [rbp - 0x20], rdx
mov rbx, rdx
mov rdi, rcx
test r8b, r8b
je 0x1800a5883
lea rcx, [rbp - 0x18]
call fcn.1800a5470
mov rdx, rax
mov rcx, rdi
call fcn.180095ef0
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x1800a587b
mov rdx, qword [rbp - 8]
mov rax, rcx
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x1800a5876
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800a5876
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800cafcc
mov rdx, rdi
jmp 0x1800a5915
mov dword [rbp - 0x60], 0x29052908
mov edx, 0x296b
mov dword [rbp - 0x5c], 0x29072919
mov dword [rbp - 0x58], 0x29152915
mov dword [rbp - 0x54], 0x295f291f
mov dword [rbp - 0x50], 0x29112901
mov dword [rbp - 0x4c], 0x29192906
mov dword [rbp - 0x48], 0x290a2902
mov dword [rbp - 0x44], 0x291f291a
mov dword [rbp - 0x40], 0x29512908
mov dword [rbp - 0x3c], 0x2911291e
mov dword [rbp - 0x38], 0x29e5290d
mov dword [rbp - 0x34], 0x29e629af
mov dword [rbp - 0x30], 0x29e829ef
mov word [rbp - 0x2c], ax
mov byte [rbp - 0x2a], 1
nop dword [rax + rax]
lea ecx, [rdx + rax]
xor word [rbp + rax*2 - 0x60], cx
inc rax
cmp rax, 0x1a
jb 0x1800a58f0
lea rdx, [rbp - 0x60]
mov byte [rbp - 0x2a], 0
call fcn.18007bee0
lea rdx, [rax + 0xae6c0]
mov rcx, rbx
call fcn.1800242d0
lea r11, [rsp + 0x80]
mov rax, rbx
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret