joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2fc4db720
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4dc800
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4dc122
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4fe108]
test eax, eax
je 0x2fc4dc1ba
lea rax, [0x2fc4fe0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4fe110]
mov qword [rbp - 8], rax
jmp 0x2fc4dc19e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4dc192
cmp qword [rbp - 0x10], 0
je 0x2fc4dc192
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4dc158
lea rax, [0x2fc4fe0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4dc1bb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4dc2c0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4dc2e8
mov eax, 0
jmp 0x2fc4dc336
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4dc311
mov eax, 0
jmp 0x2fc4dc336
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4dc331
mov eax, 0
jmp 0x2fc4dc336
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4dc33c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4dc3ba
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4dc3b1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4dc3b1
mov rax, qword [rbp - 8]
jmp 0x2fc4dc3cf
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4dc384
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d84b0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d9590
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d8eb2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4fb108]
test eax, eax
je 0x2fc4d8f4a
lea rax, [0x2fc4fb0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4fb110]
mov qword [rbp - 8], rax
jmp 0x2fc4d8f2e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d8f22
cmp qword [rbp - 0x10], 0
je 0x2fc4d8f22
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d8ee8
lea rax, [0x2fc4fb0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d8f4b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d9050
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d9078
mov eax, 0
jmp 0x2fc4d90c6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d90a1
mov eax, 0
jmp 0x2fc4d90c6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d90c1
mov eax, 0
jmp 0x2fc4d90c6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d90cc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d914a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d9141
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d9141
mov rax, qword [rbp - 8]
jmp 0x2fc4d915f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d9114
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d9700
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4da7e0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4da102
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4fc108]
test eax, eax
je 0x2fc4da19a
lea rax, [0x2fc4fc0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4fc110]
mov qword [rbp - 8], rax
jmp 0x2fc4da17e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4da172
cmp qword [rbp - 0x10], 0
je 0x2fc4da172
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4da138
lea rax, [0x2fc4fc0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4da19b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4da2a0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4da2c8
mov eax, 0
jmp 0x2fc4da316
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4da2f1
mov eax, 0
jmp 0x2fc4da316
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4da311
mov eax, 0
jmp 0x2fc4da316
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4da31c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4da39a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4da391
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4da391
mov rax, qword [rbp - 8]
jmp 0x2fc4da3af
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4da364
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x180001340
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 7]
sub rsp, 0xe0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp - 1], rax
mov rax, qword [0x1800157b8]
mov rdi, rcx
movaps xmm0, xmmword [r8]
xor r8d, r8d
movaps xmm1, xmmword [r9]
mov r10, qword [rbp + 0x47]
mov rbx, qword [rbp + 0x67]
mov rcx, qword [rbp + 0x4f]
mov rdx, qword [rbp + 0x5f]
mov r11, qword [rbp + 0x87]
mov qword [rsp + 0x20], rax
mov al, byte [rbp + 0x6f]
movdqu xmmword [rsp + 0x28], xmm0
mov byte [rbp - 0x49], al
movss xmm0, dword [rbp + 0x57]
mov al, byte [rbp + 0x77]
movups xmmword [rsp + 0x38], xmm1
mov byte [rbp - 0x48], al
movaps xmm1, xmmword [r10]
mov rax, qword [0x1800197c0]
movss dword [rbp - 0x71], xmm0
movaps xmm0, xmmword [rbx]
movaps xmmword [rbp - 0x59], xmm0
movaps xmm0, xmmword [r11]
mov byte [rbp - 0x47], 1
movups xmmword [rsp + 0x48], xmm1
movaps xmm1, xmmword [rcx]
movdqu xmmword [rsp + 0x58], xmm1
movaps xmm1, xmmword [rdx]
movdqu xmmword [rbp - 0x6d], xmm1
movdqu xmmword [rbp - 0x45], xmm0
test rax, rax
jne 0x180001474
mov eax, dword [0x1800121f0]
lea r9, [rbp - 0x29]
movups xmm0, xmmword [0x1800121d0]
mov dword [rbp - 9], eax
movups xmm1, xmmword [0x1800121e0]
movzx eax, word [0x1800121f4]
movups xmmword [rbp - 0x29], xmm0
mov word [rbp - 5], ax
movups xmmword [rbp - 0x19], xmm1
mov ecx, r8d
mov eax, 0x29e4129f
mul r8d
mov eax, 1
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 5
sub ax, cx
movzx eax, ax
imul ecx, eax, 0x37
add cx, r8w
inc r8d
xor word [r9], cx
lea r9, [r9 + 2]
cmp r8d, 0x13
jl 0x18000141c
mov rax, qword [0x180015930]
lea r8, [rbp - 0x29]
add rax, 0x1909800
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call rax
mov qword [0x1800197c0], rax
mov r9, qword [rdi]
lea r8, [rsp + 0x20]
mov rdx, rax
mov rcx, rdi
call qword [r9 + 0x268]
mov rcx, qword [rbp - 1]
xor rcx, rsp
call fcn.18000f740
add rsp, 0xe0
pop rdi
pop rbx
pop rbp
ret
Function at 0x1800014a0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
lea rbp, [rsp - 0x47]
sub rsp, 0x98
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x2f], rax
movaps xmm0, xmmword [rdx]
mov rbx, rcx
mov rax, qword [rbp + 0x7f]
movups xmmword [rbp - 0x31], xmm0
movaps xmm0, xmmword [r8]
xor r8d, r8d
movups xmmword [rbp - 0x21], xmm0
movaps xmm0, xmmword [rax]
mov rax, qword [0x180019898]
movss dword [rbp - 0x11], xmm3
movdqu xmmword [rbp - 0xd], xmm0
test rax, rax
jne 0x180001579
mov eax, dword [0x1800124c8]
lea r9, [rbp + 7]
movups xmm0, xmmword [0x1800124a8]
mov dword [rbp + 0x27], eax
movups xmm1, xmmword [0x1800124b8]
movzx eax, word [0x1800124cc]
movups xmmword [rbp + 7], xmm0
mov word [rbp + 0x2b], ax
movups xmmword [rbp + 0x17], xmm1
mov ecx, r8d
mov eax, 0x29e4129f
mul r8d
mov eax, 1
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 5
sub ax, cx
movzx eax, ax
imul ecx, eax, 0x37
add cx, r8w
inc r8d
xor word [r9], cx
lea r9, [r9 + 2]
cmp r8d, 0x13
jl 0x180001521
mov rax, qword [0x180015930]
lea r8, [rbp + 7]
add rax, 0x1909800
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call rax
mov qword [0x180019898], rax
mov r9, qword [rbx]
lea r8, [rbp - 0x31]
mov rdx, rax
mov rcx, rbx
call qword [r9 + 0x268]
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.18000f740
add rsp, 0x98
pop rbx
pop rbp
ret

Function at 0x180001610
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rax, qword [0x180019830]
xor r8d, r8d
mov dword [rsp + 0x20], r8d
mov rbx, rcx
test rax, rax
jne 0x1800016d1
movaps xmm0, xmmword [0x180011e90]
lea r9, [rsp + 0x30]
movaps xmm1, xmmword [0x180011ea0]
movaps xmmword [rsp + 0x30], xmm0
movaps xmm0, xmmword [0x180011eb0]
movaps xmmword [rsp + 0x40], xmm1
movaps xmm1, xmmword [0x180011ec0]
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x60], xmm1
mov ecx, r8d
mov eax, 0x29e4129f
mul r8d
mov eax, 1
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 5
sub ax, cx
movzx eax, ax
imul ecx, eax, 0x37
add cx, r8w
inc r8d
xor word [r9], cx
lea r9, [r9 + 2]
cmp r8d, 0x20
jl 0x180001678
mov rax, qword [0x180015930]
lea r8, [rsp + 0x30]
add rax, 0x1909800
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call rax
mov qword [0x180019830], rax
mov r9, qword [rbx]
lea r8, [rsp + 0x20]
mov rdx, rax
mov rcx, rbx
call qword [r9 + 0x268]
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.18000f740
add rsp, 0x80
pop rbx
ret
Function at 0x180001700
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rax, qword [0x180019868]
xor r8d, r8d
mov dword [rsp + 0x20], r8d
mov rbx, rcx
test rax, rax
jne 0x1800017cc
movups xmm0, xmmword [str.qWKNlYNP.o]
movzx eax, word [0x180012098]
lea r9, [rsp + 0x28]
movups xmm1, xmmword [0x180012070]
mov word [rsp + 0x60], ax
movups xmmword [rsp + 0x28], xmm0
movups xmm0, xmmword [0x180012080]
movups xmmword [rsp + 0x38], xmm1
movups xmmword [rsp + 0x48], xmm0
movsd xmm0, qword [0x180012090]
movsd qword [rsp + 0x58], xmm0
mov ecx, r8d
mov eax, 0x29e4129f
mul r8d
mov eax, 1
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 5
sub ax, cx
movzx eax, ax
imul ecx, eax, 0x37
add cx, r8w
inc r8d
xor word [r9], cx
lea r9, [r9 + 2]
cmp r8d, 0x1d
jl 0x180001773
mov rax, qword [0x180015930]
lea r8, [rsp + 0x28]
add rax, 0x1909800
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call rax
mov qword [0x180019868], rax
mov r9, qword [rbx]
lea r8, [rsp + 0x20]
mov rdx, rax
mov rcx, rbx
call qword [r9 + 0x268]
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.18000f740
add rsp, 0x70
pop rbx
ret

Function at 0x1800017f8
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rax, qword [0x1800197f8]
xor r8d, r8d
mov qword [rsp + 0x20], r8
mov rbx, rcx
test rax, rax
jne 0x1800018b6
movups xmm0, xmmword [0x180012028]
movzx eax, word [0x180012058]
lea r9, [rsp + 0x28]
movups xmm1, xmmword [0x180012038]
mov word [rsp + 0x58], ax
movups xmmword [rsp + 0x28], xmm0
movups xmm0, xmmword [0x180012048]
movups xmmword [rsp + 0x38], xmm1
movups xmmword [rsp + 0x48], xmm0
mov ecx, r8d
mov eax, 0x29e4129f
mul r8d
mov eax, 1
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 5
sub ax, cx
movzx eax, ax
imul ecx, eax, 0x37
add cx, r8w
inc r8d
xor word [r9], cx
lea r9, [r9 + 2]
cmp r8d, 0x19
jl 0x18000185d
mov rax, qword [0x180015930]
lea r8, [rsp + 0x28]
add rax, 0x1909800
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call rax
mov qword [0x1800197f8], rax
mov r9, qword [rbx]
lea r8, [rsp + 0x20]
mov rdx, rax
mov rcx, rbx
call qword [r9 + 0x268]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.18000f740
add rsp, 0x70
pop rbx
ret
Function at 0x180001970
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword [0x1800198f0]
mov rdi, rdx
mov rbx, rcx
test rax, rax
jne 0x180001a32
movups xmm0, xmmword [0x180011498]
mov eax, dword [0x1800114c8]
xor r8d, r8d
movups xmm1, xmmword [0x1800114a8]
mov dword [rbp - 0x10], eax
lea r9, [rbp - 0x40]
movups xmmword [rbp - 0x40], xmm0
movups xmm0, xmmword [0x1800114b8]
movups xmmword [rbp - 0x30], xmm1
movups xmmword [rbp - 0x20], xmm0
mov ecx, r8d
mov eax, 0x29e4129f
mul r8d
mov eax, 1
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 5
sub ax, cx
movzx eax, ax
imul ecx, eax, 0x37
add cx, r8w
inc r8d
xor word [r9], cx
lea r9, [r9 + 2]
cmp r8d, 0x1a
jl 0x1800019da
mov rax, qword [0x180015930]
lea r8, [rbp - 0x40]
add rax, 0x1909800
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call rax
mov qword [0x1800198f0], rax
movups xmm0, xmmword [rdi]
mov dl, byte [rbp + 0x30]
lea r8, [rbp - 0x60]
movsd xmm1, qword [rdi + 0x10]
mov rcx, rbx
mov r9, qword [rbx]
and word [rbp - 0x48], 0
mov byte [rbp - 0x46], dl
mov rdx, rax
movups xmmword [rbp - 0x60], xmm0
movsd qword [rbp - 0x50], xmm1
call qword [r9 + 0x268]
mov al, byte [rbp - 0x45]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.18000f740
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret

Function at 0x180001a88
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor eax, eax
movss dword [rsp + 0x20], xmm1
mov dword [rsp + 0x24], eax
xor r8d, r8d
mov rax, qword [0x1800198e0]
mov rbx, rcx
test rax, rax
jne 0x180001b4b
movups xmm0, xmmword [str.v_MUI]
mov eax, dword [0x180011f48]
lea r9, [rsp + 0x28]
movups xmm1, xmmword [0x180011f28]
mov dword [rsp + 0x58], eax
movups xmmword [rsp + 0x28], xmm0
movups xmm0, xmmword [0x180011f38]
movups xmmword [rsp + 0x38], xmm1
movups xmmword [rsp + 0x48], xmm0
mov ecx, r8d
mov eax, 0x29e4129f
mul r8d
mov eax, 1
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 5
sub ax, cx
movzx eax, ax
imul ecx, eax, 0x37
add cx, r8w
inc r8d
xor word [r9], cx
lea r9, [r9 + 2]
cmp r8d, 0x1a
jl 0x180001af2
mov rax, qword [0x180015930]
lea r8, [rsp + 0x28]
add rax, 0x1909800
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call rax
mov qword [0x1800198e0], rax
mov r9, qword [rbx]
lea r8, [rsp + 0x20]
mov rdx, rax
mov rcx, rbx
call qword [r9 + 0x268]
mov al, byte [rsp + 0x24]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.18000f740
add rsp, 0x70
pop rbx
ret
Function at 0x180001b78
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword [0x1800198b0]
mov rdi, rdx
mov rbx, rcx
test rax, rax
jne 0x180001c3a
movups xmm0, xmmword [0x180011498]
mov eax, dword [0x1800114c8]
xor r8d, r8d
movups xmm1, xmmword [0x1800114a8]
mov dword [rbp - 0x10], eax
lea r9, [rbp - 0x40]
movups xmmword [rbp - 0x40], xmm0
movups xmm0, xmmword [0x1800114b8]
movups xmmword [rbp - 0x30], xmm1
movups xmmword [rbp - 0x20], xmm0
mov ecx, r8d
mov eax, 0x29e4129f
mul r8d
mov eax, 1
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 5
sub ax, cx
movzx eax, ax
imul ecx, eax, 0x37
add cx, r8w
inc r8d
xor word [r9], cx
lea r9, [r9 + 2]
cmp r8d, 0x1a
jl 0x180001be2
mov rax, qword [0x180015930]
lea r8, [rbp - 0x40]
add rax, 0x1909800
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call rax
mov qword [0x1800198b0], rax
movups xmm0, xmmword [rdi]
lea r8, [rbp - 0x60]
mov r9, qword [rbx]
movsd xmm1, qword [rdi + 0x10]
mov rdx, rax
and word [rbp - 0x48], 0
mov rcx, rbx
movups xmmword [rbp - 0x60], xmm0
mov byte [rbp - 0x46], 1
movsd qword [rbp - 0x50], xmm1
call qword [r9 + 0x268]
mov al, byte [rbp - 0x45]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.18000f740
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret

Function at 0x180001c8c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x80
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rax, qword [0x1800197f0]
xorps xmm0, xmm0
xor r8d, r8d
movsd qword [rsp + 0x30], xmm0
mov rbx, rdx
mov rdi, rcx
movups xmmword [rsp + 0x20], xmm0
test rax, rax
jne 0x180001d5b
movups xmm0, xmmword [0x180011b18]
mov eax, dword [0x180011b48]
lea r9, [rsp + 0x38]
movups xmm1, xmmword [0x180011b28]
mov dword [rsp + 0x68], eax
movups xmmword [rsp + 0x38], xmm0
movups xmm0, xmmword [0x180011b38]
movups xmmword [rsp + 0x48], xmm1
movups xmmword [rsp + 0x58], xmm0
mov ecx, r8d
mov eax, 0x29e4129f
mul r8d
mov eax, 1
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 5
sub ax, cx
movzx eax, ax
imul ecx, eax, 0x37
add cx, r8w
inc r8d
xor word [r9], cx
lea r9, [r9 + 2]
cmp r8d, 0x1a
jl 0x180001d02
mov rax, qword [0x180015930]
lea r8, [rsp + 0x38]
add rax, 0x1909800
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call rax
mov qword [0x1800197f0], rax
mov r9, qword [rdi]
lea r8, [rsp + 0x20]
mov rdx, rax
mov rcx, rdi
call qword [r9 + 0x268]
movups xmm0, xmmword [rsp + 0x20]
mov rax, rbx
movsd xmm1, qword [rsp + 0x30]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.18000f740
mov rbx, qword [rsp + 0xa0]
add rsp, 0x80
pop rdi
ret