joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1802e1420
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.1802e1520
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x20], rax
jae 0x1802e1518
cmp qword [rsp + 0x20], 0x50000000
jb 0x1802e1470
mov eax, 0x80000000
cmp qword [rsp + 0x20], rax
ja 0x1802e1470
mov eax, 0x80010000
mov qword [rsp + 0x20], rax
jmp 0x1802e143d
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.180363570
mov r8d, 0x30
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x1802e149f
jmp 0x1802e1518
cmp dword [rsp + 0x48], 0x10000
jne 0x1802e14f6
cmp qword [rsp + 0x40], 0x10000
jb 0x1802e14f6
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
je 0x1802e14e4
mov rax, qword [rsp + 0x58]
jmp 0x1802e151a
mov rax, qword [rsp + 0x20]
add rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x1802e1513
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.1802e1520
mov qword [rsp + 0x20], rax
jmp 0x1802e143d
xor eax, eax
add rsp, 0x68
ret

Function at 0x1802e1570
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
sub rax, 0x10000
mov rcx, rax
call fcn.1802e1680
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x20], rax
jbe 0x1802e166b
cmp qword [rsp + 0x20], 0x50000000
jb 0x1802e15c8
mov eax, 0x80000000
cmp qword [rsp + 0x20], rax
ja 0x1802e15c8
mov qword [rsp + 0x20], 0x4fff0000
jmp 0x1802e1596
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.180363570
mov r8d, 0x30
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x1802e15f7
jmp 0x1802e166b
cmp dword [rsp + 0x48], 0x10000
jne 0x1802e164e
cmp qword [rsp + 0x40], 0x10000
jb 0x1802e164e
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
je 0x1802e163c
mov rax, qword [rsp + 0x58]
jmp 0x1802e166d
mov rax, qword [rsp + 0x20]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x1802e1666
mov rax, qword [rsp + 0x30]
sub rax, 0x10000
mov rcx, rax
call fcn.1802e1680
mov qword [rsp + 0x20], rax
jmp 0x1802e1596
xor eax, eax
add rsp, 0x68
ret
Function at 0x1802e1900
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
cmp qword [rsp + 0x80], 0
jne 0x1802e191f
mov qword [rsp + 0x20], 0x10000
jmp 0x1802e1932
mov rax, qword [rsp + 0x80]
add rax, 0x10000
mov qword [rsp + 0x20], rax
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.180363570
jmp 0x1802e195b
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov r8d, 0x30
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
ja 0x1802e197b
jmp 0x1802e1a18
cmp dword [rsp + 0x48], 0x1000
jne 0x1802e19a0
mov eax, dword [rsp + 0x4c]
and eax, 0xff
cmp eax, 1
je 0x1802e19a0
mov eax, dword [rsp + 0x4c]
and eax, 0x100
test eax, eax
je 0x1802e19a2
jmp 0x1802e1946
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
movzx eax, word [rax]
cmp eax, 0x5a4d
jne 0x1802e19d8
mov rax, qword [rsp + 0x58]
mov eax, dword [rax + 0x3c]
cmp rax, qword [rsp + 0x40]
ja 0x1802e19d8
mov rax, qword [rsp + 0x58]
mov eax, dword [rax + 0x3c]
cmp rax, 0x40
jae 0x1802e19dd
jmp 0x1802e1946
mov rax, qword [rsp + 0x58]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x58]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
cmp dword [rax], 0x4550
jne 0x1802e1946
mov rax, qword [rsp + 0x58]
jmp 0x1802e1a1a
xor eax, eax
add rsp, 0x78
ret
Function at 0x1802e1a20
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x60], 0
jne 0x1802e1a48
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1802e1a69
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1802e1be7
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x1802e1aa1
mov ecx, 0xbf
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1802e1be7
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x14]
test eax, eax
jne 0x1802e1ac0
mov ecx, 0xc0
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1802e1be7
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x30]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x38], 0
jmp 0x1802e1aec
mov eax, dword [rsp + 0x38]
inc eax
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 6]
cmp dword [rsp + 0x38], eax
jae 0x1802e1bc9
mov eax, dword [rsp + 0x38]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
lea rdx, str..detour
mov rcx, rax
call fcn.180377030
test eax, eax
jne 0x1802e1bc4
mov eax, dword [rsp + 0x38]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0xc], 0
je 0x1802e1b51
mov eax, dword [rsp + 0x38]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x10], 0
jne 0x1802e1b53
jmp 0x1802e1bc9
mov eax, dword [rsp + 0x38]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x28]
mov eax, dword [rcx + rax + 0xc]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
cmp rax, 0x40
jb 0x1802e1b99
mov rax, qword [rsp + 0x40]
cmp dword [rax + 4], 0x727444
je 0x1802e1b9b
jmp 0x1802e1bc9
mov rax, qword [rsp + 0x40]
cmp dword [rax + 8], 0
jne 0x1802e1bb5
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x40]
mov ecx, dword [rcx]
mov dword [rax + 8], ecx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsp + 0x40]
jmp 0x1802e1be7
jmp 0x1802e1ae2
mov ecx, 0xc0
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1802e1be7
add rsp, 0x58
ret
Function at 0x1802e1eb0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax]
cmp rax, 0x688
jne 0x1802e1ee3
mov rax, qword [rsp + 0x38]
mov ecx, dword [rsp + 0x58]
cmp dword [rax], ecx
jbe 0x1802e1ef5
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1802e2092
mov dword [rsp + 0x30], 0xffffffff
mov dword [rsp + 0x20], 0xffffffff
mov dword [rsp + 0x2c], 0xffffffff
mov dword [rsp + 0x24], 0
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 4]
lea r9, [rsp + 0x30]
mov r8d, 0x40
mov edx, eax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1802e208e
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 8]
lea r9, [rsp + 0x20]
mov r8d, 0x40
mov edx, eax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1802e206b
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 4]
mov rcx, qword [rsp + 0x38]
add rcx, 0x28
mov r8d, eax
mov rdx, rcx
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x10]
call fcn.180362ec0
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 8]
mov rcx, qword [rsp + 0x38]
add rcx, 0x68
mov r8d, eax
mov rdx, rcx
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x18]
call fcn.180362ec0
mov rax, qword [rsp + 0x38]
cmp qword [rax + 0x20], 0
je 0x1802e2040
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0xc]
lea r9, [rsp + 0x2c]
mov r8d, 0x40
mov edx, eax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1802e203e
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x38]
add rcx, 0x670
mov r8d, eax
mov rdx, rcx
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x20]
call fcn.180362ec0
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0xc]
lea r9, [rsp + 0x28]
mov r8d, dword [rsp + 0x2c]
mov edx, eax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [rsp + 0x24], 1
jmp 0x1802e2048
mov dword [rsp + 0x24], 1
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 8]
lea r9, [rsp + 0x28]
mov r8d, dword [rsp + 0x20]
mov edx, eax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 4]
lea r9, [rsp + 0x28]
mov r8d, dword [rsp + 0x30]
mov edx, eax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [rsp + 0x24]
add rsp, 0x48
ret

Function at 0x1802e2de0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x28
call fcn.1802e6db0
sub rsp, rax
add rsp, 0x28
jmp fcn.1802e8c80
Function at 0x1802ebbb0
Capabilities:
Encode data using xor

Disassembly:
xor r9b, r9b
mov r10, rdx
test r8, r8
je 0x1802ebbd7
sub r10, rcx
nop
movzx edx, byte [r10 + rcx]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
xor dl, al
or r9b, dl
sub r8, 1
jne 0x1802ebbc0
movzx eax, r9b
ret

Function at 0x18030dd80
Capabilities:
Encode data using base64

Disassembly:
mov eax, 8
call fcn.1802e6db0
sub rsp, rax
xor r11d, r11d
mov r9, rcx
test r8d, r8d
jle 0x18030de95
mov qword [rsp + 0x10], rbx
inc rdx
mov qword [rsp], rdi
lea rdi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
nop
movzx eax, byte [rdx - 1]
cmp r8d, 3
jl 0x18030de0e
movzx ecx, al
movzx eax, byte [rdx]
shl rcx, 8
or rcx, rax
movzx eax, byte [rdx + 1]
shl rcx, 8
or rcx, rax
mov rax, rcx
shr rax, 0x12
movzx eax, byte [rax + rdi]
mov byte [r9], al
mov rax, rcx
shr rax, 0xc
inc r9
and eax, 0x3f
mov r10, r9
movzx eax, byte [rax + rdi]
mov byte [r9], al
mov rax, rcx
and eax, 0x3f
shr rcx, 6
and ecx, 0x3f
movzx ebx, byte [rax + rdi]
movzx eax, byte [rcx + rdi]
jmp 0x18030de5d
movzx ecx, al
shl ecx, 0x10
cmp r8d, 2
jne 0x18030de22
movzx eax, byte [rdx]
shl eax, 8
or ecx, eax
mov eax, ecx
lea r10, [r9 + 1]
shr rcx, 0x12
movzx ecx, byte [rcx + rdi]
mov byte [r9], cl
mov ecx, eax
shr rcx, 0xc
mov r9, r10
and ecx, 0x3f
movzx ecx, byte [rcx + rdi]
mov byte [r10], cl
cmp r8d, 1
jne 0x18030de50
mov al, 0x3d
jmp 0x18030de5b
shr rax, 6
and eax, 0x3f
movzx eax, byte [rax + rdi]
mov bl, 0x3d
lea rcx, [r9 + 2]
mov byte [r10 + 1], al
add r11d, 4
mov byte [rcx], bl
add rdx, 3
lea r9, [rcx + 1]
sub r8d, 3
test r8d, r8d
jg 0x18030ddb0
mov rdi, qword [rsp]
mov eax, r11d
mov rbx, qword [rsp + 0x10]
mov byte [r9], 0
add rsp, 8
ret
mov byte [rcx], r11b
mov eax, r11d
add rsp, 8
ret
Function at 0x180313170
Capabilities:
Check for software breakpoints

Disassembly:
mov eax, 0x38
call fcn.1802e6db0
sub rsp, rax
mov r11, rcx
cmp dword [rsp + 0x60], r9d
jne 0x180313263
movzx r10d, byte [r8]
lea eax, [r10 - 0x6a]
cmp al, 1
ja 0x180313263
mov qword [rsp + 0x30], rbx
lea rdx, [r8 + 1]
cmp r10b, 0x6b
jne 0x180313210
lea ebx, [r9 - 3]
xor eax, eax
test ebx, ebx
jle 0x1803131ca
movzx ecx, byte [rdx]
inc rdx
cmp cl, 0xba
je 0x1803131ca
cmp cl, 0xbb
jne 0x1803131ff
inc eax
cmp eax, ebx
jl 0x1803131b4
sub ebx, eax
test eax, eax
jne 0x180313214
mov dword [rsp + 0x20], 0x83
lea r9, [0x1805b6ae0]
mov edx, 0x80
lea ecx, [rdx - 0x7c]
lea r8d, [rdx + 0xa]
call fcn.1802ec950
mov rbx, qword [rsp + 0x30]
mov eax, 0xffffffff
add rsp, 0x38
ret
mov dword [rsp + 0x20], 0x7b
lea r9, [0x1805b6ac8]
jmp 0x1803131df
lea ebx, [r9 - 2]
movsxd rax, ebx
cmp byte [rax + rdx], 0xcc
je 0x18031324c
mov edx, 0x80
mov dword [rsp + 0x20], 0x8b
lea r9, str..crypto_rsa_rsa_x931.c
lea ecx, [rdx - 0x7c]
lea r8d, [rdx + 0xb]
call fcn.1802ec950
mov rbx, qword [rsp + 0x30]
mov eax, 0xffffffff
add rsp, 0x38
ret
mov r8d, ebx
mov rcx, r11
call fcn.180362ec0
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
ret
mov edx, 0x80
mov dword [rsp + 0x20], 0x70
lea r9, [0x1805b6ab0]
lea ecx, [rdx - 0x7c]
lea r8d, [rdx + 9]
call fcn.1802ec950
mov eax, 0xffffffff
add rsp, 0x38
ret

Function at 0x180314000
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
mov eax, 0x20
call fcn.1802e6db0
sub rsp, rax
mov esi, dword [rdx + 8]
mov r14, rdx
mov rbx, rcx
test esi, esi
jne 0x180314041
xor edx, edx
call fcn.1802e4f30
lea eax, [rsi + 1]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
lea eax, [rsi - 1]
mov qword [rsp + 0x30], rdi
movsxd rdi, eax
xor eax, eax
mov qword [rsp + 0x38], r15
mov r15, qword [rdx]
mov rcx, qword [r15 + rdi*8]
cmp rcx, 1
sete al
sub esi, eax
cmp r14, rbx
je 0x18031408c
cmp esi, dword [rbx + 0xc]
jg 0x180314072
mov rax, rbx
jmp 0x18031407c
mov edx, esi
mov rcx, rbx
call fcn.1802e56d0
test rax, rax
je 0x1803140f6
mov eax, dword [r14 + 0x10]
mov dword [rbx + 0x10], eax
mov rcx, qword [r15 + rdi*8]
mov rdx, qword [rbx]
mov rax, rcx
xor rax, 1
inc rax
neg rax
shl rax, 0x3f
lea r8, [rdx + rdi*8]
shr rcx, 1
je 0x1803140ac
mov qword [r8], rcx
test rdi, rdi
jle 0x1803140ee
sub r15, rdx
nop dword [rax]
nop dword [rax + rax]
mov rdx, qword [r15 + r8 - 8]
lea r8, [r8 - 8]
mov rcx, rdx
dec rdi
shr rcx, 1
or rcx, rax
mov rax, rdx
xor rax, 1
mov qword [r8], rcx
inc rax
neg rax
shl rax, 0x3f
test rdi, rdi
jg 0x1803140c0
mov dword [rbx + 8], esi
mov eax, 1
mov rdi, qword [rsp + 0x30]
mov r15, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x180338920
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x28
call fcn.1802e6db0
sub rsp, rax
cmp dword [0x1805bc89c], 0
je 0x180338968
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x18033894d
mov dword [0x1805bc89c], eax
jmp 0x180338968
xorps xmm2, xmm2
lea rcx, [rsp + 0x38]
mov edx, 8
call fcn.1802f9c30
cmp dword [0x1805bc89c], 0
jne 0x180338984
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xorps xmm2, xmm2
lea rcx, [rsp + 0x30]
mov edx, 4
mov dword [rsp + 0x30], eax
call fcn.1802f9c30
add rsp, 0x28
ret

Function at 0x18033fc30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x20
call fcn.1802e6db0
sub rsp, rax
mov r9d, dword [rdx + 8]
mov rsi, rdx
cmp r9d, dword [r8 + 8]
mov rdi, r8
mov rbx, rcx
cmovge rdi, rdx
cmovge rsi, r8
mov edx, dword [rdi + 8]
cmp edx, dword [rcx + 0xc]
jg 0x18033fc6e
mov rax, rcx
jmp 0x18033fc73
call fcn.1802e56d0
test rax, rax
jne 0x18033fc88
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor r8d, r8d
cmp dword [rsi + 8], r8d
jle 0x18033fcc5
xor r9d, r9d
nop dword [rax]
nop dword [rax + rax]
mov rax, qword [rsi]
lea r9, [r9 + 8]
mov rcx, qword [rdi]
inc r8d
mov rdx, qword [rcx + r9 - 8]
xor rdx, qword [r9 + rax - 8]
mov rax, qword [rbx]
mov qword [r9 + rax - 8], rdx
cmp r8d, dword [rsi + 8]
jl 0x18033fca0
mov eax, dword [rdi + 8]
cmp r8d, eax
jge 0x18033fcff
movsxd rax, r8d
lea rdx, [rax*8]
nop dword [rax + rax]
mov rax, qword [rdi]
lea rdx, [rdx + 8]
mov rcx, qword [rbx]
inc r8d
mov rax, qword [rdx + rax - 8]
mov qword [rdx + rcx - 8], rax
mov eax, dword [rdi + 8]
cmp r8d, eax
jl 0x18033fce0
mov dword [rbx + 8], eax
test eax, eax
jle 0x18033fd2b
mov rcx, qword [rbx]
sub rcx, 8
movsxd r8, eax
lea r8, [rcx + r8*8]
mov rcx, qword [r8]
lea r8, [r8 - 8]
test rcx, rcx
jne 0x18033fd26
dec eax
test eax, eax
jg 0x18033fd14
mov dword [rbx + 8], eax
test eax, eax
jne 0x18033fd34
mov dword [rbx + 0x10], 0
mov rbx, qword [rsp + 0x30]
mov eax, 1
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x18035a510
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
mov eax, 0x20
call fcn.1802e6db0
sub rsp, rax
mov rbp, qword [rsp + 0x70]
mov r12, r9
mov r13, qword [rsp + 0x78]
mov r10, rbp
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
cmp r8, 0x10
jb 0x18035a5a8
mov rbp, r8
shr rbp, 4
imul rax, rbp, 0xfffffffffffffff0
add rdi, rax
nop word [rax + rax]
sub r10, rsi
mov r8, rbx
sub r8, rsi
mov rcx, rsi
mov edx, 2
mov rax, qword [r10 + rcx]
xor rax, qword [rcx]
mov qword [r8 + rcx], rax
lea rcx, [rcx + 8]
sub rdx, 1
jne 0x18035a571
mov r8, r12
mov rdx, rbx
mov rcx, rbx
call r13
mov r10, rbx
add rsi, 0x10
add rbx, 0x10
sub rbp, 1
jne 0x18035a560
mov rbp, qword [rsp + 0x70]
test rdi, rdi
je 0x18035a6c2
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], r15
nop dword [rax + rax]
mov r8, r10
mov r9, rbx
mov r11d, 1
mov r14d, 2
sub r8, rsi
sub r9, rsi
sub r11, rsi
sub r14, rsi
xor eax, eax
mov r15d, 3
sub r15, rsi
nop dword [rax]
cmp rax, rdi
jae 0x18035a664
lea rdx, [rax + rsi]
movzx ecx, byte [r8 + rdx]
xor cl, byte [rdx]
mov byte [r9 + rdx], cl
lea rcx, [r11 + rdx]
cmp rcx, rdi
jae 0x18035a661
movzx ecx, byte [rsi + rax + 1]
xor cl, byte [rax + r10 + 1]
mov byte [rbx + rax + 1], cl
lea rcx, [r14 + rdx]
cmp rcx, rdi
jae 0x18035a65b
movzx ecx, byte [rsi + rax + 2]
xor cl, byte [rax + r10 + 2]
mov byte [rbx + rax + 2], cl
lea rcx, [r15 + rdx]
cmp rcx, rdi
jae 0x18035a655
movzx ecx, byte [rsi + rax + 3]
xor cl, byte [rax + r10 + 3]
mov byte [rbx + rax + 3], cl
add rax, 4
cmp rax, 0x10
jb 0x18035a5f0
jmp 0x18035a691
add rax, 3
jmp 0x18035a664
add rax, 2
jmp 0x18035a664
inc rax
cmp rax, 0x10
jae 0x18035a691
sub r10, rbx
lea rcx, [rax + rbx]
mov edx, 0x10
sub rdx, rax
nop dword [rax]
movzx eax, byte [r10 + rcx]
mov byte [rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x18035a680
mov r8, r12
mov rdx, rbx
mov rcx, rbx
call r13
mov r10, rbx
cmp rdi, 0x10
jbe 0x18035a6b8
add rsi, 0x10
add rbx, 0x10
sub rdi, 0x10
jne 0x18035a5c0
mov r14, qword [rsp + 0x50]
mov r15, qword [rsp + 0x58]
movups xmm0, xmmword [r10]
mov rbx, qword [rsp + 0x60]
movups xmmword [rbp], xmm0
add rsp, 0x20
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18035a6e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x50
call fcn.1802e6db0
sub rsp, rax
mov rax, qword [0x1805a54a8]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r14, qword [rsp + 0xb0]
mov r12, r9
mov r13, qword [rsp + 0xb8]
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
cmp rcx, rdx
je 0x18035a779
mov r15, r14
cmp r8, 0x10
jb 0x18035a76f
mov rbp, r8
shr rbp, 4
imul rax, rbp, 0xfffffffffffffff0
add rdi, rax
mov r8, r12
mov rdx, rsi
mov rcx, rbx
call r13
mov rax, qword [r15]
xor qword [rsi], rax
mov rax, qword [r15 + 8]
mov r15, rbx
xor qword [rsi + 8], rax
add rbx, 0x10
add rsi, 0x10
sub rbp, 1
jne 0x18035a744
movups xmm0, xmmword [r15]
movups xmmword [r14], xmm0
jmp 0x18035a7d2
cmp rdi, 0x10
jb 0x18035a7d2
mov rbp, rdi
shr rbp, 4
imul rax, rbp, 0xfffffffffffffff0
add rdi, rax
nop dword [rax]
mov r8, r12
lea rdx, [rsp + 0x38]
mov rcx, rbx
call r13
mov rcx, qword [rbx]
mov rax, qword [r14]
xor rax, qword [rsp + 0x38]
mov qword [rsi], rax
mov rax, qword [r14 + 8]
xor rax, qword [rsp + 0x40]
mov qword [r14], rcx
mov rcx, qword [rbx + 8]
add rbx, 0x10
mov qword [rsi + 8], rax
add rsi, 0x10
mov qword [r14 + 8], rcx
sub rbp, 1
jne 0x18035a790
test rdi, rdi
je 0x18035a950
lea rcx, [rsp + 0x38]
mov rax, r14
sub rax, rcx
lea r15, [rsp + 0x39]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x38]
mov eax, 1
mov ebp, 3
sub rax, rcx
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov eax, 2
sub rax, rcx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x38]
sub rbp, rax
inc rsi
neg r15
nop word [rax + rax]
mov r8, r12
lea rdx, [rsp + 0x38]
mov rcx, rbx
call r13
mov r10, qword [rsp + 0x20]
lea r9, [r15 + rsi]
xor eax, eax
nop dword [rax]
cmp rax, rdi
jae 0x18035a904
lea r8, [rsp + 0x38]
add r8, rax
lea rcx, [r8 + rbx]
movzx edx, byte [rcx + r15 + 1]
movzx ecx, byte [r8]
xor cl, byte [r10 + r8]
mov byte [r8 + r9], cl
mov rcx, qword [rsp + 0x28]
add rcx, r8
mov byte [r10 + r8], dl
cmp rcx, rdi
jae 0x18035a901
movzx ecx, byte [r8 + 1]
xor cl, byte [r14 + rax + 1]
movzx edx, byte [rax + rbx + 1]
mov byte [rsi + rax], cl
mov rcx, qword [rsp + 0x30]
add rcx, r8
mov byte [r14 + rax + 1], dl
cmp rcx, rdi
jae 0x18035a8fb
movzx ecx, byte [r8 + 2]
xor cl, byte [r14 + rax + 2]
movzx edx, byte [rbx + rax + 2]
mov byte [rsi + rax + 1], cl
lea rcx, [r8 + rbp]
mov byte [r14 + rax + 2], dl
cmp rcx, rdi
jae 0x18035a8f5
movzx edx, byte [rbx + rax + 3]
movzx ecx, byte [r8 + 3]
xor cl, byte [r14 + rax + 3]
mov byte [rsi + rax + 2], cl
mov byte [r14 + rax + 3], dl
add rax, 4
cmp rax, 0x10
jb 0x18035a850
jmp 0x18035a904
add rax, 3
jmp 0x18035a904
add rax, 2
jmp 0x18035a904
inc rax
cmp rdi, 0x10
jbe 0x18035a91e
add rbx, 0x10
add rsi, 0x10
sub rdi, 0x10
jne 0x18035a830
jmp 0x18035a950
cmp rax, 0x10
jae 0x18035a950
sub rbx, r14
lea rcx, [r14 + rax]
mov edx, 0x10
sub rdx, rax
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbx + rcx]
mov byte [rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x18035a940
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1802edac0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret