joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003478
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400034c2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400034c2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400034c2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400034c2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400034c2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400034c4
xor al, al
add rsp, 0x28
ret

Function at 0x140005170
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400052c4

Function at 0x140007150
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140007178
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140007178
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x14000c3f8
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14000c47f
mov rsi, rbx
cmp word [rax], bp
je 0x14000c43e
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14000c428
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14000c424
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14000b410
mov rdi, rax
test rax, rax
je 0x14000c46c
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1400043e0
mov rbp, rdi
xor ecx, ecx
call fcn.14000a578
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1800300e0
Capabilities:
Hash data using fnv

Disassembly:
push rbx
movzx r11d, byte [rdx]
test r9b, r9b
je 0x180030100
lea r10d, [r11 - 0x41]
lea eax, [r11 + 0x20]
cmp r10b, 0x19
movzx ebx, al
cmova ebx, r11d
jmp 0x180030104
movzx ebx, r11b
test r8, r8
jne 0x18003010e
mov rax, rcx
pop rbx
ret
movabs rax, 0x100000001b3
dec r8
imul rcx, rax
movsx rax, bl
inc rdx
xor rcx, rax
pop rbx
jmp fcn.1800300e0

Function at 0x180030130
Capabilities:
Hash data using fnv

Disassembly:
movzx r11d, word [rdx]
test r9b, r9b
je 0x18003014c
lea eax, [r11 - 0x41]
cmp ax, 0x19
lea r10d, [r11 + 0x20]
cmova r10w, r11w
jmp 0x180030150
movzx r10d, r11w
test r8, r8
jne 0x180030159
mov rax, rcx
ret
movabs rax, 0x100000001b3
dec r8
imul rcx, rax
movzx eax, r10w
add rdx, 2
xor rcx, rax
jmp fcn.180030130
Function at 0x180032cf0
Capabilities:
Hash data using fnv

Disassembly:
test rcx, rcx
je 0x180032d5f
mov r9, qword [rcx]
test r9, r9
je 0x180032d5f
mov r9, qword [r9 + 0x10]
xor r8d, r8d
cmp byte [r9], r8b
je 0x180032d1a
nop dword [rax]
inc r8
cmp byte [r9 + r8], 0
jne 0x180032d10
movzx edx, byte [r9]
lea ecx, [rdx - 0x41]
cmp cl, 0x19
lea eax, [rdx + 0x20]
movzx r10d, al
cmova r10d, edx
test r8, r8
jne 0x180032d3f
movabs rax, 0xcbf29ce484222325
ret
movsx rcx, r10b
lea rdx, [r9 + 1]
movabs rax, 0xaf63bd4c8601b7df
dec r8
xor rcx, rax
mov r9b, 1
jmp fcn.1800300e0
xor eax, eax
ret
Function at 0x18003a8c0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ecx, dword [0x180004e00]
movups xmm1, xmmword [0x180004de8]
movzx edx, byte [0x180004e04]
movups xmm0, xmmword [0x180004dd8]
mov dword [rbp - 8], ecx
xor cl, 0x5c
xor byte [rbp - 7], 0x5d
xor dl, 0x60
xor byte [rbp - 6], 0x5e
xor byte [rbp - 5], 0x5f
movups xmmword [rbp - 0x30], xmm0
xor byte [rbp - 0x2f], 0x35
movsd xmm0, qword [0x180004df8]
xor byte [rbp - 0x2e], 0x36
xor byte [rbp - 0x2d], 0x37
xor byte [rbp - 0x2c], 0x38
xor byte [rbp - 0x2b], 0x39
xor byte [rbp - 0x2a], 0x3a
xor byte [rbp - 0x29], 0x3b
xor byte [rbp - 0x28], 0x3c
xor byte [rbp - 0x27], 0x3d
xor byte [rbp - 0x26], 0x3e
xor byte [rbp - 0x25], 0x3f
xor byte [rbp - 0x24], 0x40
xor byte [rbp - 0x23], 0x41
xor byte [rbp - 0x22], 0x42
xor byte [rbp - 0x21], 0x43
movups xmmword [rbp - 0x20], xmm1
xor byte [rbp - 0x1f], 0x45
xor byte [rbp - 0x1e], 0x46
xor byte [rbp - 0x1d], 0x47
xor byte [rbp - 0x1c], 0x48
xor byte [rbp - 0x1b], 0x49
xor byte [rbp - 0x1a], 0x4a
xor byte [rbp - 0x19], 0x4b
xor byte [rbp - 0x18], 0x4c
xor byte [rbp - 0x17], 0x4d
xor byte [rbp - 0x16], 0x4e
xor byte [rbp - 0x15], 0x4f
xor byte [rbp - 0x14], 0x50
xor byte [rbp - 0x13], 0x51
xor byte [rbp - 0x12], 0x52
xor byte [rbp - 0x11], 0x53
movsd qword [rbp - 0x10], xmm0
xor byte [rbp - 0x10], 0x54
xor byte [rbp - 0xf], 0x55
xor byte [rbp - 0xe], 0x56
xor byte [rbp - 0xd], 0x57
xor byte [rbp - 0xc], 0x58
xor byte [rbp - 0xb], 0x59
xor byte [rbp - 0xa], 0x5a
xor byte [rbp - 9], 0x5b
movd eax, xmm1
mov byte [rbp - 8], cl
movzx ecx, word [0x180004dc8]
xor al, 0x44
mov word [rbp + 0x1c], cx
xor byte [rbp + 0x1d], 0x39
xor cl, 0x38
mov byte [rbp - 0x20], al
mov eax, dword [0x180004dcc]
mov dword [rbp + 0x10], eax
movzx eax, byte [0x180004dd0]
xor byte [rbp + 0x11], 0x35
xor al, 0x38
xor byte [rbp + 0x12], 0x36
xor byte [rbp + 0x13], 0x37
mov byte [rbp + 0x14], al
mov eax, dword [0x180004dc4]
mov dword [rbp + 0x18], eax
movzx eax, byte [0x180004dca]
xor byte [rbp + 0x19], 0x35
xor byte [rbp + 0x1a], 0x36
xor byte [rbp + 0x1b], 0x37
xor al, 0x3a
mov byte [rbp - 0x30], 0x55
mov byte [rbp + 0x1e], al
mov byte [rbp - 4], dl
mov byte [rbp + 0x10], 0x54
mov byte [rbp + 0x18], 0x53
mov byte [rbp + 0x1c], cl
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x18]
call fcn.1800308e0
mov r8b, 1
movabs rdx, 0x8ca52fc2ff5d85cb
mov rcx, rax
call fcn.180030af0
lea rcx, [rbp - 0x30]
mov rbx, qword [rax]
mov rax, qword [0x180146290]
call rax
lea rcx, [rbx - 0x10000]
movabs rdx, 0x7ffffffeffff
cmp rcx, rdx
jbe 0x18003aa71
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret
mov rcx, rax
call rbx
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret
Function at 0x18003e0c0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
lea rax, [rdx - 0x10000]
mov rbp, rdx
movabs rdx, 0x7ffffffeffff
mov r13, r8
mov rsi, rcx
cmp rax, rdx
ja 0x18003e1bc
lea rax, [rcx - 0x10000]
cmp rax, rdx
ja 0x18003e1bc
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x18003e1bc
mov ecx, dword [rcx + 0x3c]
add rcx, rsi
cmp dword [rcx], 0x4550
jne 0x18003e1bc
lea rax, [rcx - 0x10000]
cmp rax, rdx
ja 0x18003e1bc
lea rax, [rcx - 0xff78]
cmp rax, rdx
ja 0x18003e1bc
mov eax, dword [rcx + 0x88]
test eax, eax
je 0x18003e1bc
lea rdi, [rsi + rax]
lea rax, [rdi - 0x10000]
cmp rax, rdx
ja 0x18003e1bc
mov eax, dword [rdi + 0x1c]
test eax, eax
je 0x18003e1bc
mov ecx, dword [rdi + 0x20]
test ecx, ecx
je 0x18003e1bc
mov edx, dword [rdi + 0x24]
test edx, edx
je 0x18003e1bc
xor ebx, ebx
lea r14, [rsi + rax]
lea r15, [rsi + rcx]
lea r12, [rsi + rdx]
cmp dword [rdi + 0x18], ebx
jbe 0x18003e1bc
nop dword [rax]
movzx r8d, word [r12 + rbx*2]
mov edx, dword [r14 + r8*4]
test edx, edx
je 0x18003e1b5
mov eax, dword [r15 + rbx*4]
test eax, eax
je 0x18003e1b5
lea r9, [rsi + rax]
add rdx, rsi
mov rcx, r13
call rbp
test al, al
jne 0x18003e1db
inc ebx
cmp ebx, dword [rdi + 0x18]
jb 0x18003e190
xor al, al
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov al, 1
jmp 0x18003e1be

Function at 0x18003e1e0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
lea rax, [rdx - 0x10000]
movabs r15, 0x7ffffffeffff
mov r14, r8
mov rbp, rdx
mov r9, rcx
cmp rax, r15
ja 0x18003e2c9
xor edi, edi
lea rax, [rcx - 0x10000]
mov esi, edi
cmp rax, r15
ja 0x18003e2c9
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x18003e2c9
mov ecx, dword [rcx + 0x3c]
add rcx, r9
cmp dword [rcx], 0x4550
jne 0x18003e2c9
lea rax, [rcx - 0x10000]
cmp rax, r15
ja 0x18003e2c9
lea rax, [rsp + 0x48]
add rax, 0xffffffffffff0000
lea rdx, [rcx + 0x18]
cmp rax, r15
ja 0x18003e274
movzx esi, word [rcx + 6]
movzx eax, si
jmp 0x18003e278
movzx eax, word [rcx + 6]
test ax, ax
je 0x18003e2c9
movzx ebx, word [rcx + 0x14]
add rbx, rdx
lea rax, [rbx - 0x10000]
cmp rax, r15
ja 0x18003e2c9
test rsi, rsi
je 0x18003e2c9
nop word [rax + rax]
lea rax, [rbx - 0x10000]
cmp rax, r15
ja 0x18003e2bd
test rbx, rbx
je 0x18003e2bd
mov rdx, rbx
mov rcx, r14
call rbp
test al, al
jne 0x18003e2e4
inc rdi
add rbx, 0x28
cmp rdi, rsi
jb 0x18003e2a0
xor al, al
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
mov al, 1
jmp 0x18003e2cb
Function at 0x18003e8f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov r8, qword [0x180147338]
xor ebp, ebp
mov rsi, qword [0x180147590]
movabs r14, 0x7ffffffeffff
mov rbx, rdx
mov rdi, rcx
lea rax, [r8 - 0x10000]
cmp rax, r14
ja 0x18003e937
test r8, r8
jne 0x18003ea86
movabs rax, 0x2baa037a5176c9c5
mov qword [rsp + 0x38], rbp
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
lea rcx, [0x18003e860]
mov qword [rsp + 0x40], rbp
call fcn.18003e2f0
test al, al
je 0x18003ea01
mov r10, qword [rsp + 0x38]
lea rax, [r10 - 0x10000]
cmp rax, r14
ja 0x18003ea01
mov eax, dword [0x18000548c]
mov r8, rbp
mov dword [rsp + 0x90], eax
movabs r9, 0x29e4129e4129e413
movzx eax, word [0x180005490]
mov word [rsp + 0x94], ax
nop word [rax + rax]
mov rax, r9
mul r8
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
movsx eax, al
imul edx, eax, 0x37
movzx eax, r8b
sub al, dl
add al, 0x31
xor byte [rsp + r8 + 0x90], al
inc r8
cmp r8, 6
jb 0x18003e9b0
lea r8, [rsp + 0x90]
movabs rdx, 0x11837e716e5fd5ec
mov rcx, r10
call fcn.18003e550
jmp 0x18003ea7c
mov eax, dword [0x180005494]
mov r8, rbp
mov dword [rsp + 0x98], eax
movabs r9, 0x29e4129e4129e413
movzx eax, word [0x180005498]
mov word [rsp + 0x9c], ax
nop word [rax + rax]
mov rax, r9
mul r8
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
movsx eax, al
imul ecx, eax, 0x37
movzx eax, r8b
sub al, cl
add al, 0x31
xor byte [rsp + r8 + 0x98], al
inc r8
cmp r8, 6
jb 0x18003ea30
lea rdx, [rsp + 0x98]
movabs rcx, 0x11837e716e5fd5ec
call fcn.18003e740
mov qword [0x180147338], rax
mov r8, rax
mov qword [rsp + 0x48], r8
lea rax, [rsp + 0x48]
xor r8d, r8d
mov qword [rsp + 0x28], rbp
xor r9d, r9d
mov qword [rsp + 0x20], rax
mov rdx, rbx
mov qword [rsp + 0x50], rsi
mov rcx, rdi
mov qword [rsp + 0x58], rbp
call fcn.18003e820
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x18003ead0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x80
mov r10, qword [0x180147340]
movabs r12, 0x7ffffffeffff
mov r14, qword [0x180147598]
xor r15d, r15d
mov rbx, r9
mov rdi, r8
mov rsi, rdx
mov rbp, rcx
lea rax, [r10 - 0x10000]
cmp rax, r12
ja 0x18003eb2d
test r10, r10
jne 0x18003ec60
movabs rax, 0x2baa037a5176c9c5
mov qword [rsp + 0x58], r15
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x50], rax
lea rcx, [0x18003e860]
mov qword [rsp + 0x60], r15
call fcn.18003e2f0
test al, al
je 0x18003ebeb
mov r10, qword [rsp + 0x58]
lea rax, [r10 - 0x10000]
cmp rax, r12
ja 0x18003ebeb
mov eax, dword [0x18000549c]
mov r8, r15
mov dword [rsp + 0x40], eax
movabs r9, 0x29e4129e4129e413
movzx eax, word [0x1800054a0]
mov word [rsp + 0x44], ax
nop dword [rax]
nop word [rax + rax]
mov rax, r9
mul r8
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
movsx eax, al
imul edx, eax, 0x37
movzx eax, r8b
sub al, dl
add al, 0x31
xor byte [rsp + r8 + 0x40], al
inc r8
cmp r8, 6
jb 0x18003eba0
lea r8, [rsp + 0x40]
movabs rdx, 0x11837e716e5fd5ec
mov rcx, r10
call fcn.18003e550
jmp 0x18003ec56
mov eax, dword [0x1800054a4]
mov r8, r15
mov dword [rsp + 0x46], eax
movabs r9, 0x29e4129e4129e413
movzx eax, word [0x1800054a8]
mov word [rsp + 0x4a], ax
nop
mov rax, r9
mul r8
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
movsx eax, al
imul ecx, eax, 0x37
movzx eax, r8b
sub al, cl
add al, 0x31
xor byte [rsp + r8 + 0x46], al
inc r8
cmp r8, 6
jb 0x18003ec10
lea rdx, [rsp + 0x46]
movabs rcx, 0x11837e716e5fd5ec
call fcn.18003e740
mov qword [0x180147340], rax
mov r10, rax
mov qword [rsp + 0x30], rbx
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], r15
xor r9d, r9d
mov r8, rdi
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov qword [rsp + 0x68], r10
mov rcx, rbp
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r15
call fcn.18003e820
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x18003edf0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rdx, qword [0x180147358]
movabs rsi, 0x7ffffffeffff
xor edi, edi
movaps xmmword [rsp + 0x50], xmm6
movaps xmm6, xmm1
mov rbx, rcx
lea rax, [rdx - 0x10000]
cmp rax, rsi
ja 0x18003ee32
test rdx, rdx
jne 0x18003ef54
movabs rax, 0x2baa037a5176c9c5
mov qword [rsp + 0x38], rdi
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
lea rcx, [0x18003e860]
mov qword [rsp + 0x40], rdi
call fcn.18003e2f0
test al, al
je 0x18003eedf
mov r10, qword [rsp + 0x38]
lea rax, [r10 - 0x10000]
cmp rax, rsi
ja 0x18003eedf
mov eax, dword [0x1800054cc]
mov r8, rdi
mov dword [rsp + 0x70], eax
movabs r9, 0x97b425ed097b425f
movzx eax, word [0x1800054d0]
mov word [rsp + 0x74], ax
nop dword [rax]
nop dword [rax + rax]
mov rax, r9
mul r8
shr rdx, 5
movsx eax, dl
imul edx, eax, 0x36
movzx eax, r8b
sub al, dl
add al, 0x31
xor byte [rsp + r8 + 0x70], al
inc r8
cmp r8, 6
jb 0x18003eea0
lea r8, [rsp + 0x70]
movabs rdx, 0x11837e716e5fd5ec
mov rcx, r10
call fcn.18003e550
jmp 0x18003ef4a
mov eax, dword [0x1800054d4]
mov r8, rdi
mov dword [rsp + 0x70], eax
movabs r9, 0x97b425ed097b425f
movzx eax, word [0x1800054d8]
mov word [rsp + 0x74], ax
nop dword [rax]
nop word [rax + rax]
mov rax, r9
mul r8
shr rdx, 5
movsx eax, dl
imul ecx, eax, 0x36
movzx eax, r8b
sub al, cl
add al, 0x31
xor byte [rsp + r8 + 0x70], al
inc r8
cmp r8, 6
jb 0x18003ef10
lea rdx, [rsp + 0x70]
movabs rcx, 0x11837e716e5fd5ec
call fcn.18003e740
mov qword [0x180147358], rax
mov rdx, rax
mov qword [rsp + 0x30], rdx
lea rax, [rsp + 0x30]
xor edx, edx
mov qword [rsp + 0x28], rdi
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x38], rbx
movaps xmm0, xmm6
mov qword [rsp + 0x40], rdi
call fcn.18003e820
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rdi
ret
Function at 0x18003f260
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x60
mov rdx, qword [0x180147350]
movabs rbp, 0x7ffffffeffff
mov rdi, qword [0x1801475e0]
xor esi, esi
mov rbx, rcx
lea rax, [rdx - 0x10000]
cmp rax, rbp
ja 0x18003f29e
test rdx, rdx
jne 0x18003f3ca
movabs rax, 0x2baa037a5176c9c5
mov qword [rsp + 0x38], rsi
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
lea rcx, [0x18003e860]
mov qword [rsp + 0x40], rsi
call fcn.18003e2f0
test al, al
je 0x18003f355
mov r10, qword [rsp + 0x38]
lea rax, [r10 - 0x10000]
cmp rax, rbp
ja 0x18003f355
mov eax, dword [0x1800054bc]
mov r8, rsi
mov dword [rsp + 0x88], eax
movabs r9, 0x97b425ed097b425f
movzx eax, word [0x1800054c0]
mov word [rsp + 0x8c], ax
nop word [rax + rax]
mov rax, r9
mul r8
shr rdx, 5
movsx eax, dl
imul edx, eax, 0x36
movzx eax, r8b
sub al, dl
add al, 0x31
xor byte [rsp + r8 + 0x88], al
inc r8
cmp r8, 6
jb 0x18003f310
lea r8, [rsp + 0x88]
movabs rdx, 0x11837e716e5fd5ec
mov rcx, r10
call fcn.18003e550
jmp 0x18003f3c0
mov eax, dword [0x1800054c4]
mov r8, rsi
mov dword [rsp + 0x90], eax
movabs r9, 0x97b425ed097b425f
movzx eax, word [0x1800054c8]
mov word [rsp + 0x94], ax
nop
mov rax, r9
mul r8
shr rdx, 5
movsx eax, dl
imul ecx, eax, 0x36
movzx eax, r8b
sub al, cl
add al, 0x31
xor byte [rsp + r8 + 0x90], al
inc r8
cmp r8, 6
jb 0x18003f380
lea rdx, [rsp + 0x90]
movabs rcx, 0x11837e716e5fd5ec
call fcn.18003e740
mov qword [0x180147350], rax
mov rdx, rax
mov qword [rsp + 0x48], rdx
lea rax, [rsp + 0x48]
xor edx, edx
mov qword [rsp + 0x28], rsi
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x50], rdi
mov rcx, rbx
mov qword [rsp + 0x58], rsi
call fcn.18003e820
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret

Function at 0x18003f570
Capabilities:
Encode data using xor

Disassembly:
mov rcx, qword [0x1801475b8]
movaps xmm2, xmm1
movaps xmm1, xmm0
jmp fcn.18003efa0
Function at 0x18003f5c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x50
mov r10, qword [0x180147360]
movabs r12, 0x7ffffffeffff
mov r14, qword [0x180147588]
xor r15d, r15d
mov rbx, r9
mov rdi, r8
mov rsi, rdx
mov rbp, rcx
lea rax, [r10 - 0x10000]
cmp rax, r12
ja 0x18003f61a
test r10, r10
jne 0x18003f734
movabs rax, 0x2baa037a5176c9c5
mov qword [rsp + 0x40], r15
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x38], rax
lea rcx, [0x18003e860]
mov qword [rsp + 0x48], r15
call fcn.18003e2f0
test al, al
je 0x18003f6bf
mov r10, qword [rsp + 0x40]
lea rax, [r10 - 0x10000]
cmp rax, r12
ja 0x18003f6bf
mov eax, dword [0x1800054dc]
mov r8, r15
mov dword [rsp + 0x30], eax
movabs r9, 0x97b425ed097b425f
movzx eax, word [0x1800054e0]
mov word [rsp + 0x34], ax
nop dword [rax]
mov rax, r9
mul r8
shr rdx, 5
movsx eax, dl
imul edx, eax, 0x36
movzx eax, r8b
sub al, dl
add al, 0x31
xor byte [rsp + r8 + 0x30], al
inc r8
cmp r8, 6
jb 0x18003f680
lea r8, [rsp + 0x30]
movabs rdx, 0x11837e716e5fd5ec
mov rcx, r10
call fcn.18003e550
jmp 0x18003f72a
mov eax, dword [0x1800054e4]
mov r8, r15
mov dword [rsp + 0x30], eax
movabs r9, 0x97b425ed097b425f
movzx eax, word [0x1800054e8]
mov word [rsp + 0x34], ax
nop dword [rax]
nop word [rax + rax]
mov rax, r9
mul r8
shr rdx, 5
movsx eax, dl
imul ecx, eax, 0x36
movzx eax, r8b
sub al, cl
add al, 0x31
xor byte [rsp + r8 + 0x30], al
inc r8
cmp r8, 6
jb 0x18003f6f0
lea rdx, [rsp + 0x30]
movabs rcx, 0x11837e716e5fd5ec
call fcn.18003e740
mov qword [0x180147360], rax
mov r10, rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], r15
mov r9, rbx
mov qword [rsp + 0x20], rax
mov r8, rdi
mov qword [rsp + 0x38], r10
mov rdx, rsi
mov qword [rsp + 0x40], r14
mov rcx, rbp
mov qword [rsp + 0x48], r15
call fcn.18003e820
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x180044710
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, qword [0x180147368]
mov edi, edx
mov r9, rcx
mov eax, dword [rbx + 0x1be8]
cmp dword [rbx + 0x1bd8], eax
jg 0x1800446ab
mov dword [rbx + 0x1b20], 0
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x1a80]
xor edx, edx
or edi, 0x141
movsxd rcx, dword [rax + 0xc0]
mov rax, qword [rax + 0xc8]
mov r8d, dword [rax + rcx*4 - 4]
mov rcx, r9
call fcn.180048db0
cmp dword [rbx + 0x1ac8], eax
jne 0x1800446e3
mov dword [rbx + 0x1acc], eax
cmp dword [rbx + 0x1b08], eax
jne 0x1800446f2
mov byte [rbx + 0x1b0c], 1
mov edx, edi
mov ecx, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x180044710
push rbx
sub rsp, 0x50
mov r9, qword [0x180147368]
mov ebx, edx
mov r11d, ecx
movsxd r10, dword [r9 + 0x1be8]
cmp dword [r9 + 0x1bd8], r10d
jle 0x18004485f
mov rax, qword [r9 + 0x1be0]
lea r8, [r10 + r10*2]
add r8, r8
cmp dword [rax + r8*8], ecx
jne 0x18004485f
bt edx, 0x1c
jae 0x1800447bb
cmp byte [0x180005b83], 0
movsd xmm0, qword [0x180005b78]
mov eax, dword [0x180005b80]
movsd qword [rsp + 0x20], xmm0
mov dword [rsp + 0x28], eax
je 0x1800447b1
xor ecx, ecx
movabs r8, 0x47ae147ae147ae15
mov rax, r8
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
movsx eax, al
imul edx, eax, 0x32
movzx eax, cl
sub al, dl
add al, 0x31
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0xc
jb 0x180044781
mov r9d, r10d
lea r8, [rsp + 0x20]
jmp 0x180044828
mov eax, dword [0x180005b90]
xor ecx, ecx
movsd xmm0, qword [0x180005b88]
movabs r8, 0x47ae147ae147ae15
mov dword [rsp + 0x28], eax
movzx eax, byte [0x180005b94]
mov byte [rsp + 0x2c], al
movsd qword [rsp + 0x20], xmm0
nop word [rax + rax]
mov rax, r8
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
movsx eax, al
imul edx, eax, 0x32
movzx eax, cl
sub al, dl
add al, 0x31
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0xd
jb 0x1800447f0
mov r9d, r11d
lea r8, [rsp + 0x20]
mov edx, 0x14
lea rcx, [rsp + 0x30]
call fcn.180048cc0
bts ebx, 0x1a
lea rcx, [rsp + 0x30]
mov r8d, ebx
xor edx, edx
call fcn.180041c10
movzx ebx, al
test al, al
jne 0x180044856
call fcn.1800471a0
movzx eax, bl
add rsp, 0x50
pop rbx
ret
xor ecx, ecx
mov dword [r9 + 0x1b20], ecx
xor al, al
add rsp, 0x50
pop rbx
ret
Function at 0x180044870
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x40
mov rdi, qword [0x180147368]
xor ebx, ebx
mov ebp, edx
mov esi, ecx
cmp byte [rdi + 0x1f1d], bl
jne 0x1800448a7
cmp byte [rdi + 0x1f1e], bl
je 0x180044925
movss xmm1, dword [rdi + 0x160c]
mov ebp, 1
movaps xmm0, xmm1
mulss xmm1, dword [0x180004dbc]
mulss xmm0, dword [0x180005d04]
addss xmm1, dword [rdi + 0x134]
addss xmm0, dword [rdi + 0x130]
or dword [rdi + 0x1b20], 1
mov qword [rdi + 0x1b38], rbx
movss dword [rdi + 0x1b34], xmm1
mov dword [rdi + 0x1b24], 1
movss dword [rdi + 0x1b30], xmm0
movss xmm0, dword [rdi + 0x1668]
mov rax, qword [0x180147368]
mulss xmm0, dword [0x180005ccc]
or dword [rax + 0x1b20], 0x40
movss dword [rax + 0x1b80], xmm0
mov eax, dword [0x180005b60]
mov r8, rbx
movsd xmm0, qword [0x180005b58]
movabs r14, 0x47ae147ae147ae15
mov dword [rsp + 0x28], eax
movzx eax, word [0x180005b64]
mov word [rsp + 0x2c], ax
movzx eax, byte [0x180005b66]
mov byte [rsp + 0x2e], al
movsd qword [rsp + 0x20], xmm0
mov rax, r14
mul r8
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
movsx eax, al
imul ecx, eax, 0x32
movzx eax, r8b
sub al, cl
add al, 0x31
xor byte [rsp + r8 + 0x20], al
inc r8
cmp r8, 0xf
jb 0x180044961
mov r9d, dword [rdi + 0x2f5c]
lea r8, [rsp + 0x20]
mov edx, 0x10
lea rcx, [rsp + 0x30]
call fcn.180048cc0
test bpl, 1
je 0x180044a74
lea rcx, [rsp + 0x30]
call fcn.1800478d0
test rax, rax
je 0x180044a74
cmp byte [rax + 0x7e], bl
je 0x180044a74
movsd xmm0, qword [0x180005b68]
mov byte [rax + 0x85], 1
mov dword [rax + 0x9c], 1
mov eax, dword [0x180005b70]
mov r9d, dword [rdi + 0x2f5c]
mov dword [rsp + 0x28], eax
inc r9d
movzx eax, word [0x180005b74]
mov word [rsp + 0x2c], ax
movzx eax, byte [0x180005b76]
mov byte [rsp + 0x2e], al
mov dword [rdi + 0x2f5c], r9d
movsd qword [rsp + 0x20], xmm0
nop word [rax + rax]
mov rax, r14
mul rbx
mov rax, rbx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
movsx eax, al
imul ecx, eax, 0x32
movzx eax, bl
sub al, cl
add al, 0x31
xor byte [rsp + rbx + 0x20], al
inc rbx
cmp rbx, 0xf
jb 0x180044a30
lea r8, [rsp + 0x20]
mov edx, 0x10
lea rcx, [rsp + 0x30]
call fcn.180048cc0
or esi, 0x20c0347
lea rcx, [rsp + 0x30]
mov r8d, esi
xor edx, edx
call fcn.180041c10
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret