joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800fdca0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r15
sub rsp, 0x20
mov qword [rsp + 0x40], rbx
mov rsi, rcx
mov rbx, qword [rcx + 0x50]
mov r15, r8
mov rcx, qword [rcx + 0x38]
mov rbp, rdx
mov rdi, r8
test rcx, rcx
je 0x1800fdd86
mov qword [rsp + 0x48], r14
mov rax, rbx
sub rax, rcx
mov r14, r8
cmp rax, r8
mov r8, rdx
mov rdx, rcx
cmovb r14, rax
add rdx, qword [rsi + 0x20]
mov r9, r14
cmp r14, 0x10
jb 0x1800fdd30
mov r10, r14
shr r10, 4
imul r9, r10, 0xfffffffffffffff0
add r9, r14
nop word [rax + rax]
mov rcx, qword [r8 + 8]
xor rcx, qword [rdx + 8]
mov rax, qword [r8]
add r8, 0x10
xor qword [rdx], rax
mov qword [rdx + 8], rcx
add rdx, 0x10
sub r10, 1
jne 0x1800fdd10
test r9, r9
je 0x1800fdd51
sub r8, rdx
nop dword [rax + rax]
movzx eax, byte [r8 + rdx]
xor byte [rdx], al
lea rdx, [rdx + 1]
sub r9, 1
jne 0x1800fdd40
test r14, r14
je 0x1800fdd69
mov rdx, qword [rsi + 0x38]
mov r8, r14
add rdx, qword [rsi + 0x20]
mov rcx, rbp
call fcn.18017c7f0
add qword [rsi + 0x38], r14
sub rdi, r14
add rbp, r14
mov r14, qword [rsp + 0x48]
cmp qword [rsi + 0x38], rbx
jne 0x1800fdd86
mov rcx, rsi
call fcn.1800fdee0
cmp rdi, rbx
jb 0x1800fde1c
nop
mov rax, qword [rsi + 0x20]
mov r9, rbx
mov r8, rbp
cmp rbx, 0x10
jb 0x1800fddd0
mov r10, rbx
shr r10, 4
imul r9, r10, 0xfffffffffffffff0
add r9, rbx
nop
mov rdx, qword [r8 + 8]
xor rdx, qword [rax + 8]
mov rcx, qword [r8]
add r8, 0x10
xor qword [rax], rcx
mov qword [rax + 8], rdx
add rax, 0x10
sub r10, 1
jne 0x1800fddb0
test r9, r9
je 0x1800fddf1
sub r8, rax
nop dword [rax + rax]
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub r9, 1
jne 0x1800fdde0
test rbx, rbx
je 0x1800fde05
mov rdx, qword [rsi + 0x20]
mov r8, rbx
mov rcx, rbp
call fcn.18017c7f0
mov rcx, rsi
sub rdi, rbx
add rbp, rbx
call fcn.1800fdee0
cmp rdi, rbx
jae 0x1800fdd90
mov rbx, qword [rsp + 0x40]
test rdi, rdi
je 0x1800fdea4
mov rdx, qword [rsi + 0x20]
mov r9, rdi
mov r8, rbp
cmp rdi, 0x10
jb 0x1800fde70
mov r10, rdi
shr r10, 4
imul r9, r10, 0xfffffffffffffff0
add r9, rdi
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [r8 + 8]
xor rcx, qword [rdx + 8]
mov rax, qword [r8]
add r8, 0x10
xor qword [rdx], rax
mov qword [rdx + 8], rcx
add rdx, 0x10
sub r10, 1
jne 0x1800fde50
test r9, r9
je 0x1800fde91
sub r8, rdx
nop dword [rax + rax]
movzx eax, byte [r8 + rdx]
xor byte [rdx], al
lea rdx, [rdx + 1]
sub r9, 1
jne 0x1800fde80
mov rdx, qword [rsi + 0x20]
mov r8, rdi
mov rcx, rbp
call fcn.18017c7f0
add qword [rsi + 0x38], rdi
mov rax, r15
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop rdi
pop rsi
ret
Function at 0x1800fe0e0
Capabilities:
Encode data using xor

Disassembly:
mov r9, rdx
xor edx, edx
test r8, r8
je 0x1800fe198
cmp r8, 0x20
jb 0x1800fe16b
lea r10, [rcx - 1]
lea rax, [r8 - 1]
add r10, r8
add rax, r9
cmp rcx, rax
ja 0x1800fe10c
cmp r10, r9
jae 0x1800fe16b
mov r11, r8
mov r10, r9
and r11, 0xffffffffffffffe0
mov rax, rcx
sub r10, rcx
nop dword [rax]
movdqu xmm0, xmmword [rax]
add rdx, 0x20
movdqu xmm2, xmmword [r10 + rax]
movdqu xmmword [r10 + rax], xmm0
movdqu xmm1, xmmword [rax]
lea rax, [rax + 0x20]
pxor xmm2, xmm1
movdqu xmmword [rax - 0x20], xmm2
movdqu xmm2, xmmword [r10 + rax - 0x10]
movdqu xmm0, xmmword [rax - 0x10]
movdqu xmmword [r10 + rax - 0x10], xmm0
movdqu xmm1, xmmword [rax - 0x10]
pxor xmm1, xmm2
movdqu xmmword [rax - 0x10], xmm1
cmp rdx, r11
jne 0x1800fe120
cmp rdx, r8
je 0x1800fe198
sub r9, rcx
lea rax, [rdx + rcx]
sub r8, rdx
nop word [rax + rax]
movzx ecx, byte [rax]
movzx edx, byte [rax + r9]
mov byte [rax + r9], cl
xor byte [rax], dl
lea rax, [rax + 1]
sub r8, 1
jne 0x1800fe180
ret
Function at 0x1800ff340
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x18
mov eax, dword [rdx + 0x34]
mov r8d, dword [rdx]
mov r14d, dword [rdx + 4]
mov r15d, dword [rdx + 8]
mov r12d, dword [rdx + 0xc]
mov ebp, dword [rdx + 0x10]
mov r9d, dword [rdx + 0x14]
mov r10d, dword [rdx + 0x18]
mov r11d, dword [rdx + 0x1c]
mov ebx, dword [rdx + 0x20]
mov edi, dword [rdx + 0x24]
mov esi, dword [rdx + 0x28]
mov r13d, dword [rdx + 0x2c]
mov ecx, dword [rdx + 0x30]
mov dword [rsp + 0x68], eax
mov eax, dword [rdx + 0x38]
mov edx, dword [rdx + 0x3c]
mov dword [rsp + 0x70], eax
mov qword [rsp + 8], 0xa
nop dword [rax]
lea eax, [rcx + r8]
rol eax, 7
xor ebp, eax
lea eax, [r8 + rbp]
rol eax, 9
xor ebx, eax
lea eax, [rbx + rbp]
rol eax, 0xd
xor ecx, eax
lea eax, [rcx + rbx]
ror eax, 0xe
xor r8d, eax
lea eax, [r9 + r14]
rol eax, 7
xor edi, eax
lea eax, [rdi + r9]
rol eax, 9
xor dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x68]
add eax, edi
rol eax, 0xd
xor r14d, eax
mov eax, dword [rsp + 0x68]
add eax, r14d
ror eax, 0xe
xor r9d, eax
lea eax, [rsi + r10]
rol eax, 7
xor dword [rsp + 0x70], eax
mov eax, dword [rsp + 0x70]
add eax, esi
rol eax, 9
xor r15d, eax
mov eax, dword [rsp + 0x70]
add eax, r15d
rol eax, 0xd
xor r10d, eax
lea eax, [r10 + r15]
ror eax, 0xe
xor esi, eax
lea eax, [rdx + r13]
rol eax, 7
xor r12d, eax
lea eax, [rdx + r12]
rol eax, 9
xor r11d, eax
lea eax, [r11 + r12]
rol eax, 0xd
xor r13d, eax
lea eax, [r11 + r13]
ror eax, 0xe
xor edx, eax
lea eax, [r12 + r8]
rol eax, 7
xor r14d, eax
mov dword [rsp], r14d
lea eax, [r14 + r8]
rol eax, 9
xor r15d, eax
lea eax, [r15 + r14]
rol eax, 0xd
xor r12d, eax
lea eax, [r12 + r15]
ror eax, 0xe
xor r8d, eax
lea eax, [r9 + rbp]
rol eax, 7
xor r10d, eax
lea eax, [r10 + r9]
rol eax, 9
xor r11d, eax
lea eax, [r11 + r10]
rol eax, 0xd
xor ebp, eax
lea eax, [r11 + rbp]
ror eax, 0xe
xor r9d, eax
lea eax, [rsi + rdi]
rol eax, 7
xor r13d, eax
lea eax, [rsi + r13]
mov r14d, dword [rsp + 0x70]
rol eax, 9
xor ebx, eax
lea eax, [rbx + r13]
rol eax, 0xd
xor edi, eax
lea eax, [rdi + rbx]
ror eax, 0xe
xor esi, eax
mov eax, dword [rsp + 0x70]
add eax, edx
rol eax, 7
xor ecx, eax
lea eax, [rdx + rcx]
rol eax, 9
xor dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x68]
add eax, ecx
rol eax, 0xd
xor r14d, eax
mov eax, dword [rsp + 0x68]
add eax, r14d
mov dword [rsp + 0x70], r14d
mov r14d, dword [rsp]
ror eax, 0xe
xor edx, eax
sub qword [rsp + 8], 1
jne 0x1800ff3a0
mov rcx, qword [rsp + 0x60]
mov dword [rcx], r8d
mov dword [rcx + 4], r9d
mov dword [rcx + 8], esi
mov dword [rcx + 0xc], edx
mov dword [rcx + 0x10], r10d
mov dword [rcx + 0x14], r11d
mov dword [rcx + 0x18], ebx
mov dword [rcx + 0x1c], edi
add rsp, 0x18
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180102050
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
sub rsp, 0x20
lea rsi, [rcx + 8]
mov r14, rdx
lea r15, [rcx + 0x20]
mov edx, 0x19
mov rcx, rsi
mov rdi, r8
call fcn.180058010
mov edx, 0xa8
mov rcx, r15
call fcn.180033000
mov rcx, qword [rsi]
mov r8, qword [rsi + 8]
sub r8, rcx
and r8, 0xfffffffffffffff8
je 0x1801020a9
xor edx, edx
call fcn.18017cc00
xor ebx, ebx
shr rdi, 3
mov edx, ebx
test rdi, rdi
je 0x1801020d6
nop word [rax + rax]
mov rax, qword [rsi]
lea rcx, [rax + rdx*8]
mov rax, qword [r14 + rdx*8]
xor qword [rcx], rax
inc rdx
cmp rdx, rdi
jb 0x1801020c0
mov rax, qword [rsi]
movabs rcx, 0x8000000000000000
xor qword [rax + rdi*8], 0x1f
mov rax, qword [rsi]
xor qword [rax + 0xa0], rcx
mov rcx, qword [rsi]
call fcn.1800ccac0
mov r9, qword [r15 + 8]
sub r9, qword [r15]
mov rdx, qword [rsi]
mov r8, qword [r15]
cmp r9, 8
jb 0x180102134
mov rcx, r9
shr rcx, 3
imul rax, rcx, 0xfffffffffffffff8
add r9, rax
nop dword [rax + rax]
mov rax, qword [rdx]
add rdx, 8
mov qword [r8], rax
add r8, 8
sub rcx, 1
jne 0x180102120
test r9, r9
je 0x18010215b
nop dword [rax]
mov rax, qword [rdx]
movzx ecx, bl
and cl, 7
shl cl, 3
shr rax, cl
mov byte [rbx + r8], al
inc rbx
cmp rbx, r9
jne 0x180102140
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret

Function at 0x180103ab0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r15, rdx
mov rdi, rcx
mov edx, 0x100
add rcx, 0x18
mov rbp, r8
call fcn.180033000
mov edx, 0x100
lea rcx, [rdi + 0x30]
call fcn.180033000
xor ebx, ebx
mov word [rdi + 0x10], 0
mov qword [rdi + 0x48], rbx
mov eax, ebx
nop dword [rax + rax]
mov rcx, qword [rdi + 0x18]
mov byte [rax + rcx], al
inc rax
cmp rax, 0x100
jne 0x180103b00
mov r11, rbx
mov r10, rbx
nop dword [rax + rax]
mov r8, qword [rdi + 0x18]
xor edx, edx
mov rax, r10
div rbp
movzx r9d, byte [r8 + r10]
movzx ecx, byte [rdx + r15]
add rcx, r11
add rcx, r9
movzx r11d, cl
movzx eax, byte [r8 + r11]
mov byte [r8 + r10], al
inc r10
mov byte [r8 + r11], r9b
cmp r10, 0x100
jne 0x180103b20
nop dword [rax]
mov rcx, rdi
call fcn.180103920
mov rax, qword [rdi + 0x38]
sub rax, qword [rdi + 0x30]
add rbx, rax
cmp rbx, qword [rdi + 8]
jbe 0x180103b60
mov rcx, qword [rdi + 0x38]
xor edx, edx
sub rcx, qword [rdi + 0x30]
mov rax, qword [rdi + 8]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
div rcx
add qword [rdi + 0x48], rdx
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x180112e70
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
movaps xmmword [rsp + 0x20], xmm6
mov r10, rcx
movdqa xmm6, xmmword [0x1801bff80]
movaps xmmword [rsp + 0x10], xmm7
movdqa xmm7, xmmword [0x1801bbd30]
movdqu xmm0, xmmword [rcx]
pshufb xmm0, xmm6
test r9, r9
je 0x180112f66
movaps xmmword [rsp], xmm8
xorps xmm8, xmm8
nop dword [rax]
movdqu xmm4, xmmword [r8]
lea rax, [rdx + 0x20]
mov ecx, 0x20
movdqa xmm5, xmm8
pshufb xmm4, xmm6
pxor xmm4, xmm0
nop dword [rax]
movdqu xmm0, xmmword [rax - 0x20]
lea rax, [rax + 0x40]
movdqa xmm2, xmm4
psllq xmm4, 1
psrlq xmm2, 0x3f
movdqa xmm3, xmm4
psrlq xmm3, 0x3f
paddq xmm2, xmm7
psllq xmm4, 1
paddq xmm3, xmm7
movdqa xmm1, xmm2
punpckhqdq xmm1, xmm2
punpcklqdq xmm2, xmm2
pandn xmm1, xmm0
pxor xmm1, xmm5
movdqa xmm5, xmm1
movdqa xmm1, xmm3
punpckhqdq xmm1, xmm3
punpcklqdq xmm3, xmm3
movdqu xmm0, xmmword [rax - 0x50]
pandn xmm2, xmm0
pxor xmm5, xmm2
movdqu xmm0, xmmword [rax - 0x40]
pandn xmm1, xmm0
pxor xmm5, xmm1
movdqu xmm0, xmmword [rax - 0x30]
pandn xmm3, xmm0
pxor xmm5, xmm3
sub rcx, 1
jne 0x180112ed0
add r8, 0x10
pshufd xmm0, xmm5, 0x4e
sub r9, 1
jne 0x180112eb0
movaps xmm8, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
pshufb xmm0, xmm6
movaps xmm6, xmmword [rsp + 0x20]
movdqu xmmword [r10], xmm0
add rsp, 0x38
ret
Function at 0x180122130
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0xa0], rbx
mov rax, qword [0x1802609a8]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r15, rdx
mov rbx, rcx
lea rdx, [rsp + 0x20]
mov rcx, r15
call fcn.1800f0dc0
nop
mov rcx, r15
call fcn.1800f0d80
mov r14d, eax
xor esi, esi
mov r13d, esi
mov r11, qword [rsp + 0x20]
movzx r9d, word [r11]
cmp si, r9w
jae 0x18012232c
mov r10d, dword [rbx + 0x38]
mov r12d, r10d
imul r12d, r13d
mov eax, 1
mov ecx, r13d
shl ax, cl
movzx edx, ax
mov rax, qword [r11 + 8]
mov r8, qword [rax]
mov rcx, qword [rax + 8]
sub rcx, r8
sar rcx, 1
cmp rcx, rdx
jbe 0x18012231f
movzx eax, word [r8 + rdx*2]
mov word [rsp + 0x38], ax
add ax, ax
movzx edx, ax
movzx r8d, word [r11 + 2]
movzx ecx, r9b
mov eax, edx
sar eax, cl
and dx, r8w
add ax, dx
mov word [rsp + 0x3a], ax
add ax, ax
movzx eax, ax
mov edx, eax
sar edx, cl
and ax, r8w
add dx, ax
mov word [rsp + 0x3c], dx
add dx, dx
movzx edx, dx
mov eax, edx
sar eax, cl
and dx, r8w
add ax, dx
mov word [rsp + 0x3e], ax
mov edi, esi
test r10d, r10d
je 0x1801222f6
xor r10d, r10d
nop dword [rax]
lea ebp, [rdi + rdi*4]
lea eax, [rdi + r12]
lea rsi, [rax + rax]
mov rax, qword [rbx + 8]
mov word [rsi + rax], r10w
mov r8d, r10d
lea r9, [rsp + 0x38]
nop dword [rax]
mov ecx, r8d
mov eax, 1
shl eax, cl
add eax, ebp
cmp eax, r14d
ja 0x1801222e9
mov ecx, eax
mov rax, qword [r15 + 8]
movzx edx, word [rax + rcx*2]
test dx, dx
jne 0x18012227a
movzx ecx, r10w
jmp 0x1801222d0
movzx r10d, dx
mov rax, qword [r11 + 8]
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
sub rcx, rdx
sar rcx, 1
cmp rcx, r10
jbe 0x180122312
movzx edx, word [rdx + r10*2]
movzx eax, word [r9]
add edx, eax
movzx ecx, byte [r11]
mov eax, edx
sar eax, cl
and dx, word [r11 + 2]
add ax, dx
movzx edx, ax
mov rax, qword [r11 + 0x10]
mov r10, qword [rax]
mov rcx, qword [rax + 8]
sub rcx, r10
sar rcx, 1
cmp rcx, rdx
jbe 0x180122305
movzx ecx, word [r10 + rdx*2]
xor r10d, r10d
mov rax, qword [rbx + 8]
xor word [rax + rsi], cx
inc r8d
add r9, 2
cmp r8d, 3
jbe 0x180122250
inc edi
cmp edi, dword [rbx + 0x38]
jb 0x180122230
xor esi, esi
inc r13d
movzx r9d, word [r11]
cmp r13d, r9d
jmp 0x180122191
lea rcx, str.invalid_vector_T__subscript
call fcn.18015aa4c
int3
lea rcx, str.invalid_vector_T__subscript
call fcn.18015aa4c
int3
lea rcx, str.invalid_vector_T__subscript
call fcn.18015aa4c
nop
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x180122367
or edi, 0xffffffff
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x180122367
mov rbx, qword [rsp + 0x28]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x180122367
mov rcx, qword [rsp + 0x28]
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.18015e5e0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180122390
Capabilities:
Encode data using xor

Disassembly:
inc word [rcx + 0x3c]
xor r10d, r10d
movzx eax, word [rcx + 0x3c]
mov r8, rcx
movzx r11d, ax
shr r11w, 1
xor r11w, ax
test al, 1
je 0x1801223b3
mov r9d, r10d
jmp 0x180122416
test al, 2
je 0x1801223bd
mov r9d, dword [rcx + 0x38]
jmp 0x180122416
test al, 4
je 0x1801223ca
mov r9d, dword [rcx + 0x38]
add r9d, r9d
jmp 0x180122416
test al, 8
je 0x1801223d7
mov eax, dword [rcx + 0x38]
lea r9d, [rax + rax*2]
jmp 0x180122416
test al, 0x10
je 0x1801223e5
mov r9d, dword [rcx + 0x38]
shl r9d, 2
jmp 0x180122416
movzx eax, word [r8 + 0x3e]
mov ecx, 5
xor ax, r11w
movzx edx, ax
test dl, 0x20
jne 0x18012240b
nop dword [rax + rax]
inc cx
movzx eax, cl
bt edx, eax
jae 0x180122400
mov r9d, dword [r8 + 0x38]
movzx eax, cx
imul r9d, eax
mov word [r8 + 0x3e], r11w
cmp dword [r8 + 0x38], r10d
jbe 0x180122450
nop dword [rax]
nop word [rax + rax]
mov rax, qword [r8 + 0x20]
lea ecx, [r10 + r9]
lea rdx, [rax + r10*2]
mov rax, qword [r8 + 8]
inc r10d
movzx ecx, word [rax + rcx*2]
xor word [rdx], cx
cmp r10d, dword [r8 + 0x38]
jb 0x180122430
ret

Function at 0x180122650
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, 1
mov r9, rcx
mov word [rsp + 0x18], ax
xor eax, eax
cmp r8d, edx
sete al
xor r8d, r8d
mov word [rsp + 0x10], ax
movzx eax, word [rsp + 0x10]
test ax, ax
setne r8b
dec r8d
not r8d
mov word [rsp + 0x10], r8w
movzx eax, word [rsp + 0x10]
not eax
mov word [rsp + 0x10], ax
movzx eax, word [rsp + 0x10]
movzx ecx, word [rsp + 0x18]
and ecx, eax
mov word [rsp + 0x18], cx
mov dword [rsp + 0x20], 0
mov eax, dword [rsp + 0x20]
cmp eax, edx
jae 0x1801226e7
nop dword [rax]
nop word [rax + rax]
movzx ecx, word [rsp + 0x10]
movzx eax, word [rsp + 0x18]
inc word [rsp + 0x18]
and cx, ax
mov eax, dword [rsp + 0x20]
xor word [r9 + rax*2], cx
inc dword [rsp + 0x20]
mov eax, dword [rsp + 0x20]
cmp eax, edx
jb 0x1801226c0
mov eax, edx
ret
Function at 0x1801283b0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push r14
sub rsp, 0x70
mov qword [rax - 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rbx, r8
mov rdi, rdx
mov r14, rcx
mov rax, qword [rdx]
mov r8, qword [rdx + 8]
sub r8, rax
cmp r8, rbx
jae 0x180128413
mov dword [rsp + 0x20], 0x75
lea r9, str.gold
lea r8, str.update
lea rdx, str.Offset_ok
lea rcx, str.buffer.size_____offset
call fcn.1800401f0
int3
lea rdx, [rax + rbx]
sub r8, rbx
mov rax, qword [rcx]
call qword [rax + 0x10]
lea rdx, [rax + rbx]
mov rcx, rdi
call fcn.180033000
lea rdx, [rsp + 0x38]
mov rcx, qword [r14 + 0x20]
call fcn.180020930
nop
mov r9, qword [rsp + 0x40]
mov rax, qword [rsp + 0x38]
sub r9, rax
mov r8, qword [r14 + 0x40]
cmp r9, 0x10
jb 0x18012847f
mov r10, r9
shr r10, 4
imul rcx, r10, 0xfffffffffffffff0
add r9, rcx
mov rdx, qword [r8 + 8]
mov rcx, qword [rax]
xor rcx, qword [r8]
xor qword [rax + 8], rdx
mov qword [rax], rcx
add rax, 0x10
add r8, 0x10
sub r10, 1
jne 0x180128460
test r9, r9
je 0x1801284a1
sub r8, rax
nop word [rax + rax]
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub r9, 1
jne 0x180128490
mov rax, qword [r14 + 0x30]
cmp qword [r14 + 0x28], rax
jne 0x180128502
mov rbx, qword [r14 + 0x20]
mov rcx, qword [r14 + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x28]
xor ecx, ecx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rcx
mov r9, rbx
mov r8, rax
mov dl, 1
lea rcx, [rsp + 0x50]
call fcn.1801280f0
mov rdx, rax
lea rcx, [r14 + 0x28]
call fcn.180032d80
nop
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x180128502
mov rdx, qword [rsp + 0x60]
sub rdx, rcx
mov r8d, 1
call fcn.1800302d0
nop
mov r9, qword [rsp + 0x40]
mov rax, qword [rsp + 0x38]
sub r9, rax
mov r8, qword [r14 + 0x28]
cmp r9, 0x10
jb 0x18012854c
mov r10, r9
shr r10, 4
imul rcx, r10, 0xfffffffffffffff0
add r9, rcx
nop word [rax + rax]
mov rcx, qword [r8]
mov rdx, qword [r8 + 8]
xor qword [rax], rcx
xor qword [rax + 8], rdx
add rax, 0x10
add r8, 0x10
sub r10, 1
jne 0x180128530
test r9, r9
je 0x180128571
sub r8, rax
nop dword [rax]
nop dword [rax + rax]
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub r9, 1
jne 0x180128560
mov rsi, qword [r14 + 8]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rdi + 8]
sub rbx, qword [rdi]
lea rdx, [rbx + rsi]
mov rcx, rdi
call fcn.180033000
test rsi, rsi
je 0x1801285a4
mov rcx, qword [rdi]
add rcx, rbx
mov r8, rsi
mov rdx, rbp
call fcn.18017c7f0
nop
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1801285c2
mov rdx, qword [rsp + 0x48]
sub rdx, rcx
mov r8d, 1
call fcn.1800302d0
nop
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x180129f40
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x18012a039
mov qword [rsp + 0x18], rbx
push rsi
push r14
push r15
sub rsp, 0x20
mov r15, qword [rcx + 0x58]
mov rbx, r8
mov qword [rsp + 0x40], rbp
mov r14, rdx
mov qword [rsp + 0x48], rdi
mov rsi, rcx
nop
cmp qword [rsi + 0x60], rbx
mov rbp, rbx
mov rdx, qword [rsi + 0x18]
cmovb rbp, qword [rsi + 0x60]
mov rcx, qword [rsi + 0x10]
mov rdi, rbp
mov r8, rbp
imul rdi, r15
call fcn.180129c60
mov rcx, qword [rsi + 8]
mov r9, rbp
mov r8, rax
mov rdx, r14
mov r10, qword [rcx]
call qword [r10 + 0x58]
mov rax, qword [rsi + 0x20]
mov r9, rdi
mov r8, r14
cmp rdi, 0x10
jb 0x180129ff0
mov r10, rdi
shr r10, 4
imul r9, r10, 0xfffffffffffffff0
add r9, rdi
nop word [rax + rax]
mov rdx, qword [r8 + 8]
xor rdx, qword [rax + 8]
mov rcx, qword [r8]
add r8, 0x10
xor qword [rax], rcx
mov qword [rax + 8], rdx
add rax, 0x10
sub r10, 1
jne 0x180129fd0
test r9, r9
je 0x18012a011
sub r8, rax
nop dword [rax + rax]
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub r9, 1
jne 0x18012a000
add qword [rsi + 0x18], rbp
add r14, rdi
sub rbx, rbp
jne 0x180129f70
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rsi
ret

Function at 0x18012a040
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push r14
push r15
sub rsp, 0x30
cmp qword [rcx + 0x10], 0
mov rbp, r8
mov r15, qword [rcx + 0x58]
mov r14, rdx
mov rbx, rcx
je 0x18012a14d
test r8, r8
je 0x18012a13e
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdi
nop dword [rax]
cmp qword [rbx + 0x60], rbp
mov rsi, rbp
mov rdx, qword [rbx + 0x18]
cmovb rsi, qword [rbx + 0x60]
mov rcx, qword [rbx + 0x10]
mov rdi, rsi
mov r8, rsi
imul rdi, r15
call fcn.180129c60
mov rcx, qword [rbx + 0x20]
mov r11, rax
mov r9, rdi
mov r8, r14
cmp rdi, 0x10
jb 0x18012a0f0
mov r10, rdi
shr r10, 4
imul r9, r10, 0xfffffffffffffff0
add r9, rdi
nop dword [rax]
nop dword [rax + rax]
mov rdx, qword [r8 + 8]
xor rdx, qword [rcx + 8]
mov rax, qword [r8]
add r8, 0x10
xor qword [rcx], rax
mov qword [rcx + 8], rdx
add rcx, 0x10
sub r10, 1
jne 0x18012a0d0
test r9, r9
je 0x18012a111
sub r8, rcx
nop dword [rax + rax]
movzx eax, byte [r8 + rcx]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub r9, 1
jne 0x18012a100
mov rcx, qword [rbx + 8]
mov r9, rsi
mov r8, r11
mov rdx, r14
mov rax, qword [rcx]
call qword [rax + 0x50]
add qword [rbx + 0x18], rsi
add r14, rdi
sub rbp, rsi
jne 0x18012a080
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rbp
ret
lea r9, str.gold
mov dword [rsp + 0x20], 0x159
lea r8, str.encrypt
lea rdx, str.A_key_was_set
lea rcx, [0x1801fece8]
call fcn.1800401f0
int3
Function at 0x1801580b0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push r12
push r14
push r15
sub rsp, 0x50
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov r14, r9
mov r15, r8
mov r12, rdx
mov rdi, rcx
xor ebp, ebp
mov rsi, qword [rax + 0x28]
test rsi, rsi
je 0x18015820b
mov rax, qword [rdi]
mov r8, r15
mov rdx, r12
mov rcx, rdi
call qword [rax + 0x10]
xor ebx, ebx
movzx ecx, bl
not cl
and cl, 3
shl cl, 3
mov edx, ebp
shr edx, cl
mov byte [rsp + 0x20], dl
mov rax, qword [rdi]
mov r8d, 1
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [rax + 0x10]
inc rbx
cmp rbx, 4
jne 0x180158101
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.180020930
mov rcx, qword [rsp + 0x40]
mov r10, qword [rsp + 0x38]
sub rcx, r10
mov qword [rsp + 0x28], rcx
lea rax, [rsp + 0x90]
lea rdx, [rsp + 0x28]
cmp rsi, rcx
cmovae rax, rdx
mov r11, qword [rax]
mov r9, r11
mov r8, r10
mov rax, r14
cmp r11, 0x10
jb 0x1801581b8
mov r10, r11
shr r10, 4
imul r9, r10, 0xfffffffffffffff0
add r9, r11
nop dword [rax]
nop dword [rax + rax]
mov rdx, qword [rax]
xor rdx, qword [r8]
mov rcx, qword [rax + 8]
xor rcx, qword [r8 + 8]
mov qword [rax], rdx
mov qword [rax + 8], rcx
add rax, 0x10
add r8, 0x10
sub r10, 1
jne 0x180158190
mov r10, qword [rsp + 0x38]
test r9, r9
je 0x1801581d6
sub r8, rax
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub r9, 1
jne 0x1801581c0
mov r10, qword [rsp + 0x38]
add r14, r11
sub rsi, r11
mov qword [rsp + 0x90], rsi
inc ebp
test r10, r10
je 0x180158202
mov rdx, qword [rsp + 0x48]
sub rdx, r10
mov r8d, 1
mov rcx, r10
call fcn.1800302d0
nop
test rsi, rsi
jne 0x1801580f0
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret

Function at 0x180161a40
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x180161a53
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.180162054
lea rdx, [0x18025ddf0]
lea rcx, [rsp + 0x20]
call fcn.18017b8e8
int3

Function at 0x18016c28c
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x180273690]
xor edx, edx
jmp fcn.180161a40

Function at 0x18016cc20
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x180273690]
jmp fcn.180161a40
Function at 0x1801783bc
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x180178478]
mov r9, qword [r9 + 8]
jmp fcn.180169c90

Function at 0x180178450
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x180178488]
mov r9, qword [r9 + 8]
jmp fcn.180169c90