joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000f532
Capabilities:
Access peb ldr_data
Encode data using xor
Get kernel32 base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, r8
mov rsi, rdx
mov rax, qword [0x180019ce8]
test rax, rax
jne 0x18000f631
mov qword [rsp + 0x20], rdi
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rdx, qword [rax]
mov rcx, qword [rdx + 0x30]
xor eax, eax
mov r8, rdx
movsxd r9, dword [rcx + 0x3c]
mov r9d, dword [rcx + r9 + 0x88]
test r9, r9
je 0x18000f5f3
mov r10d, dword [rcx + r9 + 0x18]
test r10, r10
je 0x18000f5f3
mov r11d, dword [rcx + r9 + 0x20]
add r11, rcx
lea rbx, [rcx + 1]
dec r10
mov r14d, r10d
mov r15d, dword [r11 + r14*4]
mov r12b, byte [rcx + r15]
test r12b, r12b
je 0x18000f5ee
add r15, rbx
mov ebp, 0x29071926
movsx r12d, r12b
lea r13d, [r12 - 0x41]
mov edi, r12d
or edi, 0x20
cmp r13b, 0x1a
cmovae edi, r12d
xor edi, ebp
imul ebp, edi, 0x1000193
mov r12b, byte [r15]
inc r15
test r12b, r12b
jne 0x18000f5bc
cmp ebp, 0xafdc0f61
je 0x18000f60a
test r14, r14
jne 0x18000f5a1
mov r8, qword [r8]
cmp r8, rdx
je 0x18000f625
mov rcx, qword [r8 + 0x30]
test rcx, rcx
jne 0x18000f57a
jmp 0x18000f625
mov eax, dword [rcx + r9 + 0x1c]
mov edx, dword [rcx + r9 + 0x24]
add rax, rcx
add rdx, rcx
movzx edx, word [rdx + r14*2]
mov eax, dword [rax + rdx*4]
add rax, rcx
mov qword [0x180019ce8], rax
mov rdi, qword [rsp + 0x20]
mov edx, 0x18
mov rcx, rdi
call rax
test eax, eax
je 0x18000f64f
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
jmp 0x18000f65d
mov rax, qword [rdi + 0x10]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rdi]
movups xmmword [rsi], xmm0
mov rax, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x18000f672
Capabilities:
Access peb ldr_data
Encode data using xor
Get kernel32 base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rdx
mov rax, qword [0x180019ce8]
test rax, rax
jne 0x18000f765
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rdx, qword [rax]
mov rcx, qword [rdx + 0x30]
xor eax, eax
mov r8, rdx
movsxd r9, dword [rcx + 0x3c]
mov r9d, dword [rcx + r9 + 0x88]
test r9, r9
je 0x18000f72d
mov r10d, dword [rcx + r9 + 0x18]
test r10, r10
je 0x18000f72d
mov r11d, dword [rcx + r9 + 0x20]
add r11, rcx
lea rdi, [rcx + 1]
dec r10
mov ebx, r10d
mov r14d, dword [r11 + rbx*4]
mov r15b, byte [rcx + r14]
test r15b, r15b
je 0x18000f728
add r14, rdi
mov ebp, 0x29071926
movsx r15d, r15b
lea r12d, [r15 - 0x41]
mov r13d, r15d
or r13d, 0x20
cmp r12b, 0x1a
cmovae r13d, r15d
xor r13d, ebp
imul ebp, r13d, 0x1000193
mov r15b, byte [r14]
inc r14
test r15b, r15b
jne 0x18000f6f4
cmp ebp, 0xafdc0f61
je 0x18000f744
test rbx, rbx
jne 0x18000f6d9
mov r8, qword [r8]
cmp r8, rdx
je 0x18000f75e
mov rcx, qword [r8 + 0x30]
test rcx, rcx
jne 0x18000f6b2
jmp 0x18000f75e
mov eax, dword [rcx + r9 + 0x1c]
mov edx, dword [rcx + r9 + 0x24]
add rax, rcx
add rdx, rcx
movzx edx, word [rdx + rbx*2]
mov eax, dword [rax + rdx*4]
add rax, rcx
mov qword [0x180019ce8], rax
mov edx, 8
mov rcx, rsi
call rax
xorps xmm0, xmm0
test eax, eax
jne 0x18000f77a
movsd xmm0, qword [rsi]
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x18000f858
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xd0
cmp qword [0x180019f70], 0
jne 0x18000f8da
xor eax, eax
mov word [rsp + 0x30], ax
lea rdx, [rsp + 0x42]
movaps xmm0, xmmword [0x180016670]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x180016680]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x180016690]
movaps xmmword [rdx + 0x1e], xmm0
movaps xmm0, xmmword [0x1800166a0]
movaps xmmword [rdx + 0x2e], xmm0
mov word [rdx + 0x3e], 0x43
mov word [rdx + 0x7e], ax
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0x43
inc rax
cmp rax, 0x40
jne 0x18000f8b1
mov word [rsp + 0xc0], 0
lea rcx, [rsp + 0x30]
call fcn.180003922
mov qword [0x180019f70], rax
cmp byte [0x180019f80], 0
je 0x18000f940
mov rcx, qword [0x180019f78]
mov rax, qword [0x180019d10]
mov qword [rsp + 0x30], rax
test rcx, rcx
je 0x18000f937
mov rdx, qword [0x180019f70]
mov rax, qword [rcx]
mov rax, qword [rax + 0x268]
lea r8, [rsp + 0x40]
mov qword [r8], rax
mov qword [r8 + 8], 0
mov qword [rsp + 0x20], r8
lea rsi, [rsp + 0x30]
mov r8, rsi
xor r9d, r9d
call fcn.1800147b0
mov rax, qword [rsi + 8]
jmp 0x18000f937
add rsp, 0xd0
pop rsi
ret
mov byte [0x180019f80], 1
xor eax, eax
mov word [rsp + 0x30], ax
lea rdx, [rsp + 0x42]
movaps xmm0, xmmword [0x1800166b0]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x1800166c0]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x1800166d0]
movaps xmmword [rdx + 0x1e], xmm0
movaps xmm0, xmmword [0x1800166e0]
movaps xmmword [rdx + 0x2e], xmm0
mov word [rdx + 0x3e], 0x4a
mov word [rdx + 0x7e], ax
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0x4a
inc rax
cmp rax, 0x40
jne 0x18000f98e
mov word [rsp + 0xc0], 0
lea rcx, [rsp + 0x30]
call fcn.180003922
mov rcx, rax
mov qword [0x180019f78], rax
jmp 0x18000f8ea

Function at 0x18000f9c0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xe0
mov rdx, qword [0x180019f88]
test rdx, rdx
jne 0x18000fa5c
xor eax, eax
mov word [rsp + 0x30], ax
lea rdx, [rsp + 0x42]
movaps xmm0, xmmword [0x1800166f0]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x180016700]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x180016710]
movaps xmmword [rdx + 0x1e], xmm0
movaps xmm0, xmmword [0x180016720]
movaps xmmword [rdx + 0x2e], xmm0
movabs rcx, 0x58004f00460046
mov qword [rdx + 0x3e], rcx
mov word [rdx + 0x46], 0x2a
mov word [rdx + 0x8e], ax
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0x2a
inc rax
cmp rax, 0x48
jne 0x18000fa30
mov word [rsp + 0xd0], 0
lea rcx, [rsp + 0x30]
call fcn.180003922
mov rdx, rax
mov qword [0x180019f88], rax
mov rax, qword [0x180019df0]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], 0
mov rcx, qword [0x180019de0]
test rcx, rcx
je 0x18000fab1
mov rax, qword [rcx]
mov rax, qword [rax + 0x268]
lea r8, [rsp + 0x30]
mov qword [r8], rax
mov qword [r8 + 8], 0
mov qword [rsp + 0x20], r8
lea rsi, [rsp + 0x40]
mov r8, rsi
xor r9d, r9d
call fcn.1800147b0
mov rax, qword [rsi + 0x10]
jmp 0x18000fab1
add rsp, 0xe0
pop rsi
ret
Function at 0x18000faba
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xe0
mov rdx, qword [0x180019f90]
test rdx, rdx
jne 0x18000fb49
xor eax, eax
mov word [rsp + 0x30], ax
lea rdx, [rsp + 0x42]
movaps xmm0, xmmword [0x180016730]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x180016740]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x180016750]
movaps xmmword [rdx + 0x1e], xmm0
movaps xmm0, xmmword [0x180016760]
movaps xmmword [rdx + 0x2e], xmm0
movaps xmm0, xmmword [0x180016770]
movaps xmmword [rdx + 0x3e], xmm0
mov word [rdx + 0x9a], ax
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0x63
inc rax
cmp rax, 0x4e
jne 0x18000fb1d
mov word [rsp + 0xdc], 0
lea rcx, [rsp + 0x30]
call fcn.180003922
mov rdx, rax
mov qword [0x180019f90], rax
mov rax, qword [0x180019df0]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], 0
mov rcx, qword [0x180019de0]
test rcx, rcx
je 0x18000fb9e
mov rax, qword [rcx]
mov rax, qword [rax + 0x268]
lea r8, [rsp + 0x30]
mov qword [r8], rax
mov qword [r8 + 8], 0
mov qword [rsp + 0x20], r8
lea rsi, [rsp + 0x40]
mov r8, rsi
xor r9d, r9d
call fcn.1800147b0
mov rax, qword [rsi + 0x10]
jmp 0x18000fb9e
add rsp, 0xe0
pop rsi
ret

Function at 0x18000fba8
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xc0
mov rdx, qword [0x180019f98]
test rdx, rdx
jne 0x18000fc29
xor eax, eax
mov word [rsp + 0x30], ax
lea rdx, [rsp + 0x42]
movaps xmm0, xmmword [0x180016780]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x180016790]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x1800167a0]
movaps xmmword [rdx + 0x1e], xmm0
movaps xmm0, xmmword [0x1800167b0]
movaps xmmword [rdx + 0x2e], xmm0
mov word [rdx + 0x7a], ax
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0x18
inc rax
cmp rax, 0x3e
jne 0x18000fbfd
mov word [rsp + 0xbc], 0
lea rcx, [rsp + 0x30]
call fcn.180003922
mov rdx, rax
mov qword [0x180019f98], rax
mov rax, qword [0x180019df0]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], 0
mov rcx, qword [0x180019de0]
test rcx, rcx
je 0x18000fc7e
mov rax, qword [rcx]
mov rax, qword [rax + 0x268]
lea r8, [rsp + 0x30]
mov qword [r8], rax
mov qword [r8 + 8], 0
mov qword [rsp + 0x20], r8
lea rsi, [rsp + 0x40]
mov r8, rsi
xor r9d, r9d
call fcn.1800147b0
mov rax, qword [rsi + 0x10]
jmp 0x18000fc7e
add rsp, 0xc0
pop rsi
ret
Function at 0x18000fc88
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0xd8
mov rsi, r8
mov rdi, rdx
mov rdx, qword [0x180019fa0]
test rdx, rdx
jne 0x18000fd2b
xor eax, eax
mov word [rsp + 0x30], ax
lea rdx, [rsp + 0x42]
movaps xmm0, xmmword [0x1800167c0]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x1800167d0]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x1800167e0]
movaps xmmword [rdx + 0x1e], xmm0
movaps xmm0, xmmword [str._3_54_b_]
movaps xmmword [rdx + 0x2e], xmm0
movabs rcx, 0x3400340026002b
mov qword [rdx + 0x3e], rcx
mov word [rdx + 0x46], 0x47
mov word [rdx + 0x8e], ax
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0x47
inc rax
cmp rax, 0x48
jne 0x18000fcff
mov word [rsp + 0xd0], 0
lea rcx, [rsp + 0x30]
call fcn.180003922
mov rdx, rax
mov qword [0x180019fa0], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov rax, qword [0x180019df0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rdi
mov rcx, qword [0x180019de0]
test rcx, rcx
je 0x18000fd7c
mov rax, qword [rcx]
mov rax, qword [rax + 0x268]
lea r8, [rsp + 0x30]
mov qword [r8], rax
mov qword [r8 + 8], 0
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x40]
xor r9d, r9d
call fcn.1800147b0
test rsi, rsi
je 0x18000fd8c
lea rax, [rsp + 0x50]
movups xmm0, xmmword [rax]
movups xmmword [rsi], xmm0
add rsp, 0xd8
pop rdi
pop rsi
ret

Function at 0x18000fd96
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xc0
mov rdx, qword [0x180019fa8]
test rdx, rdx
jne 0x18000fe17
xor eax, eax
mov word [rsp + 0x30], ax
lea rdx, [rsp + 0x42]
movaps xmm0, xmmword [str._oIEMXDIQIAK_]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x180016810]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x180016820]
movaps xmmword [rdx + 0x1e], xmm0
movaps xmm0, xmmword [0x180016830]
movaps xmmword [rdx + 0x2e], xmm0
mov word [rdx + 0x7a], ax
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0x28
inc rax
cmp rax, 0x3e
jne 0x18000fdeb
mov word [rsp + 0xbc], 0
lea rcx, [rsp + 0x30]
call fcn.180003922
mov rdx, rax
mov qword [0x180019fa8], rax
mov rax, qword [0x180019df0]
mov qword [rsp + 0x30], rax
mov rcx, qword [0x180019de0]
test rcx, rcx
je 0x18000fe65
mov rax, qword [rcx]
mov rax, qword [rax + 0x268]
lea r8, [rsp + 0x40]
mov qword [r8], rax
mov qword [r8 + 8], 0
mov qword [rsp + 0x20], r8
lea rsi, [rsp + 0x30]
mov r8, rsi
xor r9d, r9d
call fcn.1800147b0
movsd xmm0, qword [rsi + 8]
jmp 0x18000fe65
add rsp, 0xc0
pop rsi
ret
Function at 0x18000fe6e
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0xb8
mov rsi, r8
mov rdi, rdx
mov rdx, qword [0x180019fb0]
test rdx, rdx
jne 0x18000ff00
xor eax, eax
mov word [rsp + 0x28], ax
lea rdx, [rsp + 0x32]
movaps xmm0, xmmword [0x180016840]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x180016850]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x180016860]
movaps xmmword [rdx + 0x1e], xmm0
movaps xmm0, xmmword [0x180016870]
movaps xmmword [rdx + 0x2e], xmm0
mov dword [rdx + 0x3e], 0x4e002b
mov word [rdx + 0x82], ax
mov eax, 1
xor byte [rsp + rax*2 + 0x30], 0x4e
inc rax
cmp rax, 0x42
jne 0x18000fed4
mov word [rsp + 0xb4], 0
lea rcx, [rsp + 0x28]
call fcn.180003922
mov rdx, rax
mov qword [0x180019fb0], rax
mov rcx, qword [0x180019df8]
test rcx, rcx
je 0x18000ff38
mov rax, qword [rcx]
mov rax, qword [rax + 0x268]
lea r8, [rsp + 0x30]
mov qword [r8], rax
mov qword [r8 + 8], 0
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x28]
xor r9d, r9d
call fcn.1800147b0
test rdi, rdi
je 0x18000ff43
mov eax, dword [rsp + 0x28]
mov dword [rdi], eax
test rsi, rsi
je 0x18000ff4e
mov eax, dword [rsp + 0x2c]
mov dword [rsi], eax
add rsp, 0xb8
pop rdi
pop rsi
ret

Function at 0x18000ff58
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xf0
mov rsi, rdx
mov rdx, qword [0x180019fb8]
test rdx, rdx
jne 0x18000fff4
xor eax, eax
mov word [rsp + 0x30], ax
lea rdx, [rsp + 0x42]
movaps xmm0, xmmword [0x180016880]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x180016890]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x1800168a0]
movaps xmmword [rdx + 0x1e], xmm0
movaps xmm0, xmmword [0x1800168b0]
movaps xmmword [rdx + 0x2e], xmm0
movaps xmm0, xmmword [0x1800168c0]
movaps xmmword [rdx + 0x3e], xmm0
mov word [rdx + 0x4e], 0xd
mov word [rdx + 0x9e], ax
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0xd
inc rax
cmp rax, 0x50
jne 0x18000ffc8
mov word [rsp + 0xe0], 0
lea rcx, [rsp + 0x30]
call fcn.180003922
mov rdx, rax
mov qword [0x180019fb8], rax
mov rax, qword [rsi + 0x10]
mov qword [rsp + 0x50], rax
movups xmm0, xmmword [rsi]
movaps xmmword [rsp + 0x40], xmm0
mov rcx, qword [0x180019df8]
test rcx, rcx
je 0x180010049
mov rax, qword [rcx]
mov rax, qword [rax + 0x268]
lea r8, [rsp + 0x30]
mov qword [r8], rax
mov qword [r8 + 8], 0
mov qword [rsp + 0x20], r8
lea rsi, [rsp + 0x40]
mov r8, rsi
xor r9d, r9d
call fcn.1800147b0
cmp byte [rsi + 0x18], 0
setne al
jmp 0x180010049
and al, 1
add rsp, 0xf0
pop rsi
ret
Function at 0x180010054
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xf0
mov rsi, rdx
mov rdx, qword [0x180019fc0]
test rdx, rdx
jne 0x1800100f1
xor eax, eax
mov word [rsp + 0x30], ax
lea rdx, [rsp + 0x42]
movaps xmm0, xmmword [0x1800168d0]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x1800168e0]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x1800168f0]
movaps xmmword [rdx + 0x1e], xmm0
movaps xmm0, xmmword [0x180016900]
movaps xmmword [rdx + 0x2e], xmm0
movaps xmm0, xmmword [0x180016910]
movaps xmmword [rdx + 0x3e], xmm0
mov dword [rdx + 0x4e], 0x750011
mov word [rdx + 0xa2], ax
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0x75
inc rax
cmp rax, 0x52
jne 0x1800100c5
mov word [rsp + 0xe4], 0
lea rcx, [rsp + 0x30]
call fcn.180003922
mov rdx, rax
mov qword [0x180019fc0], rax
mov rax, qword [rsi + 0x10]
mov qword [rsp + 0x50], rax
movups xmm0, xmmword [rsi]
movaps xmmword [rsp + 0x40], xmm0
mov rcx, qword [0x180019df8]
test rcx, rcx
je 0x180010146
mov rax, qword [rcx]
mov rax, qword [rax + 0x268]
lea r8, [rsp + 0x30]
mov qword [r8], rax
mov qword [r8 + 8], 0
mov qword [rsp + 0x20], r8
lea rsi, [rsp + 0x40]
mov r8, rsi
xor r9d, r9d
call fcn.1800147b0
cmp byte [rsi + 0x18], 0
setne al
jmp 0x180010146
and al, 1
add rsp, 0xf0
pop rsi
ret

Function at 0x180010152
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xd0
mov rsi, rdx
mov rdx, qword [0x180019fc8]
test rdx, rdx
jne 0x1800101dc
xor eax, eax
mov word [rsp + 0x30], ax
lea rdx, [rsp + 0x42]
movaps xmm0, xmmword [0x180016920]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x180016930]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x180016940]
movaps xmmword [rdx + 0x1e], xmm0
movaps xmm0, xmmword [0x180016950]
movaps xmmword [rdx + 0x2e], xmm0
mov word [rdx + 0x3e], 6
mov word [rdx + 0x7e], ax
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 6
inc rax
cmp rax, 0x40
jne 0x1800101b0
mov word [rsp + 0xc0], 0
lea rcx, [rsp + 0x30]
call fcn.180003922
mov rdx, rax
mov qword [0x180019fc8], rax
mov rax, qword [rsi + 0x10]
mov qword [rsp + 0x50], rax
movups xmm0, xmmword [rsi]
movaps xmmword [rsp + 0x40], xmm0
mov rcx, qword [0x180019df8]
test rcx, rcx
je 0x180010231
mov rax, qword [rcx]
mov rax, qword [rax + 0x268]
lea r8, [rsp + 0x30]
mov qword [r8], rax
mov qword [r8 + 8], 0
mov qword [rsp + 0x20], r8
lea rsi, [rsp + 0x40]
mov r8, rsi
xor r9d, r9d
call fcn.1800147b0
cmp byte [rsi + 0x18], 0
setne al
jmp 0x180010231
and al, 1
add rsp, 0xd0
pop rsi
ret
Function at 0x18001023c
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0xd8
mov rsi, r8
mov rdi, rdx
mov rdx, qword [0x180019fd0]
test rdx, rdx
jne 0x1800102d4
xor eax, eax
mov word [rsp + 0x34], ax
lea rdx, [rsp + 0x42]
movaps xmm0, xmmword [0x180016960]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x180016970]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x180016980]
movaps xmmword [rdx + 0x1e], xmm0
movaps xmm0, xmmword [0x180016990]
movaps xmmword [rdx + 0x2e], xmm0
mov dword [rdx + 0x3e], 0x90008
mov word [rdx + 0x42], 0x67
mov word [rdx + 0x86], ax
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0x67
inc rax
cmp rax, 0x44
jne 0x1800102a8
mov word [rsp + 0xc8], 0
lea rcx, [rsp + 0x34]
call fcn.180003922
mov rdx, rax
mov qword [0x180019fd0], rax
mov rcx, qword [0x180019df8]
test rcx, rcx
je 0x18001030c
mov rax, qword [rcx]
mov rax, qword [rax + 0x268]
lea r8, [rsp + 0x40]
mov qword [r8], rax
mov qword [r8 + 8], 0
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x34]
xor r9d, r9d
call fcn.1800147b0
test rdi, rdi
je 0x18001031b
movss xmm0, dword [rsp + 0x34]
movss dword [rdi], xmm0
test rsi, rsi
je 0x18001032a
movss xmm0, dword [rsp + 0x38]
movss dword [rsi], xmm0
mov al, byte [rsp + 0x3c]
add rsp, 0xd8
pop rdi
pop rsi
ret

Function at 0x180010338
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x100
mov rsi, rdx
mov rdx, qword [0x180019fd8]
test rdx, rdx
jne 0x1800103e3
xor eax, eax
mov word [rsp + 0x30], ax
lea rdx, [rsp + 0x42]
movaps xmm0, xmmword [0x1800169a0]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x1800169b0]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x1800169c0]
movaps xmmword [rdx + 0x1e], xmm0
movaps xmm0, xmmword [0x1800169d0]
movaps xmmword [rdx + 0x2e], xmm0
movaps xmm0, xmmword [0x1800169e0]
movaps xmmword [rdx + 0x3e], xmm0
movabs rcx, 0x2b0024002e0033
mov qword [rdx + 0x4e], rcx
mov dword [rdx + 0x56], 0x470022
mov word [rdx + 0xb2], ax
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0x47
inc rax
cmp rax, 0x5a
jne 0x1800103b7
mov word [rsp + 0xf4], 0
lea rcx, [rsp + 0x30]
call fcn.180003922
mov rdx, rax
mov qword [0x180019fd8], rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 0
mov rcx, qword [0x180019df8]
test rcx, rcx
je 0x18001042c
mov rax, qword [rcx]
mov rax, qword [rax + 0x268]
lea r8, [rsp + 0x30]
mov qword [r8], rax
mov qword [r8 + 8], 0
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x40]
xor r9d, r9d
call fcn.1800147b0
mov rax, qword [rsp + 0x50]
mov qword [rsi + 0x10], rax
movaps xmm0, xmmword [rsp + 0x40]
movups xmmword [rsi], xmm0
mov rax, rsi
add rsp, 0x100
pop rsi
ret
Function at 0x18001044a
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x90
mov rdx, qword [0x180019fe0]
test rdx, rdx
jne 0x1800104d0
xor eax, eax
mov word [rsp + 0x28], ax
lea rdx, [rsp + 0x32]
movaps xmm0, xmmword [0x1800169f0]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x180016a00]
movaps xmmword [rdx + 0xe], xmm0
movabs rcx, 0x22001300370026
mov qword [rdx + 0x1e], rcx
mov dword [rdx + 0x26], 0x2d0034
mov word [rdx + 0x2a], 0x43
mov word [rdx + 0x56], ax
mov eax, 1
xor byte [rsp + rax*2 + 0x30], 0x43
inc rax
cmp rax, 0x2c
jne 0x1800104a4
mov word [rsp + 0x88], 0
lea rcx, [rsp + 0x28]
call fcn.180003922
mov rdx, rax
mov qword [0x180019fe0], rax
mov rcx, qword [0x180019df8]
test rcx, rcx
je 0x180010510
mov rax, qword [rcx]
mov rax, qword [rax + 0x268]
lea r8, [rsp + 0x30]
mov qword [r8], rax
mov qword [r8 + 8], 0
mov qword [rsp + 0x20], r8
lea rsi, [rsp + 0x28]
mov r8, rsi
xor r9d, r9d
call fcn.1800147b0
mov rax, qword [rsi]
jmp 0x180010510
add rsp, 0x90
pop rsi
ret

Function at 0x1800105e8
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0xb8
mov rdi, r8
mov rsi, rdx
mov rdx, qword [0x180019ff0]
test rdx, rdx
jne 0x180010672
xor eax, eax
mov word [rsp + 0x30], ax
lea rdx, [rsp + 0x42]
movaps xmm0, xmmword [0x180016a40]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x180016a50]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x180016a60]
movaps xmmword [rdx + 0x1e], xmm0
mov dword [rdx + 0x2e], 0x4b004a
mov word [rdx + 0x32], 0x25
mov word [rdx + 0x66], ax
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0x25
inc rax
cmp rax, 0x34
jne 0x180010646
mov word [rsp + 0xa8], 0
lea rcx, [rsp + 0x30]
call fcn.180003922
mov rdx, rax
mov qword [0x180019ff0], rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 0
test rdi, rdi
je 0x1800106b7
mov rax, qword [rdi]
mov rax, qword [rax + 0x268]
lea rcx, [rsp + 0x30]
mov qword [rcx], rax
mov qword [rcx + 8], 0
mov qword [rsp + 0x20], rcx
lea r8, [rsp + 0x40]
mov rcx, rdi
xor r9d, r9d
call fcn.1800147b0
mov rax, qword [rsp + 0x50]
mov qword [rsi + 0x10], rax
movaps xmm0, xmmword [rsp + 0x40]
movups xmmword [rsi], xmm0
mov rax, rsi
add rsp, 0xb8
pop rdi
pop rsi
ret
Function at 0x1800107b8
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0xd8
mov rsi, rdx
mov rdx, qword [0x18001a000]
test rdx, rdx
jne 0x180010859
xor eax, eax
mov word [rsp + 0x30], ax
lea rdx, [rsp + 0x42]
movaps xmm0, xmmword [0x180016a90]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x180016aa0]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x180016ab0]
movaps xmmword [rdx + 0x1e], xmm0
movaps xmm0, xmmword [0x180016ac0]
movaps xmmword [rdx + 0x2e], xmm0
movabs rcx, 0x1c000500130022
mov qword [rdx + 0x3e], rcx
mov dword [rdx + 0x46], 0x720001
mov word [rdx + 0x92], ax
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0x72
inc rax
cmp rax, 0x4a
jne 0x18001082d
mov word [rsp + 0xd4], 0
lea rcx, [rsp + 0x30]
call fcn.180003922
mov rdx, rax
mov qword [0x18001a000], rax
lea rdi, [rsp + 0x48]
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov rax, qword [0x180019df0]
mov qword [rdi - 8], rax
mov rcx, qword [0x180019de0]
test rcx, rcx
je 0x1800108a7
mov rax, qword [rcx]
mov rax, qword [rax + 0x268]
lea r8, [rsp + 0x30]
mov qword [r8], rax
mov qword [r8 + 8], 0
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x40]
xor r9d, r9d
call fcn.1800147b0
movups xmm0, xmmword [rdi]
movups xmmword [rsi], xmm0
mov rax, rsi
add rsp, 0xd8
pop rdi
pop rsi
ret

Function at 0x1800108ba
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xe0
mov rdi, r8
mov rsi, rdx
mov rdx, qword [0x18001a008]
test rdx, rdx
jne 0x180010951
xor eax, eax
mov word [rsp + 0x30], ax
lea rdx, [rsp + 0x42]
movaps xmm0, xmmword [str.eLQWhJPNFWoJAQBQZ_rdFWkVNBMqFBGBAOFmBNF_ITRmOUKCRjODTGT__biHuGKaHUSwFPI_tnTcBFC_bNgzXi]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x180016ae0]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x180016af0]
movaps xmmword [rdx + 0x1e], xmm0
movaps xmm0, xmmword [0x180016b00]
movaps xmmword [rdx + 0x2e], xmm0
movaps xmm0, xmmword [0x180016b10]
movaps xmmword [rdx + 0x3e], xmm0
mov word [rdx + 0x9a], ax
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0x23
inc rax
cmp rax, 0x4e
jne 0x180010925
mov word [rsp + 0xdc], 0
lea rcx, [rsp + 0x30]
call fcn.180003922
mov rdx, rax
mov qword [0x18001a008], rax
lea rbx, [rsp + 0x48]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx - 8], rdi
mov rcx, qword [0x180019de0]
test rcx, rcx
je 0x180010998
mov rax, qword [rcx]
mov rax, qword [rax + 0x268]
lea r8, [rsp + 0x30]
mov qword [r8], rax
mov qword [r8 + 8], 0
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x40]
xor r9d, r9d
call fcn.1800147b0
movups xmm0, xmmword [rbx]
movups xmmword [rsi], xmm0
mov rax, rsi
add rsp, 0xe0
pop rbx
pop rdi
pop rsi
ret