joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180034f90
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
sub rsp, 0x28
movdqa xmmword [rsp + 0x10], xmm7
movdqa xmmword [rsp], xmm6
cmp byte [0x18004ee90], 0
jne 0x1800350e7
lea rdx, [rcx + 0x29]
lea rax, [0x18004ee80]
cmp rdx, rax
jbe 0x180035047
lea rdx, [0x18004ee90]
cmp rcx, rdx
jae 0x180035047
xor edx, edx
movzx r11d, byte [rcx + rdx]
movzx r8d, byte [rcx + rdx + 0x19]
mov r10d, r11d
not r10b
and r10b, r8b
not r8b
mov r9d, r8d
xor r9b, r11b
or r10b, r9b
or r8b, r11b
mov r11d, r10d
mov ebx, r8d
mov esi, r8d
and r9b, r8b
xor r8b, r10b
and r10b, 0xa2
and r11b, 0x5d
or r11b, 0x80
xor r11b, r10b
mov r10d, r11d
xor r10b, 0xdd
xor bl, 0x5d
xor r11b, 0x22
and r11b, bl
xor sil, 0xa2
and sil, r10b
or sil, r11b
or r8b, r9b
not r8b
or r8b, sil
mov byte [rdx + rax], r8b
inc rdx
cmp rdx, 0x10
jne 0x180034fd0
jmp 0x1800350e0
movdqu xmm4, xmmword [rcx]
movdqu xmm0, xmmword [rcx + 0x19]
pcmpeqd xmm1, xmm1
movdqa xmm2, xmm4
pandn xmm2, xmm0
pxor xmm0, xmm1
movdqa xmm3, xmm0
pxor xmm3, xmm4
por xmm2, xmm3
por xmm0, xmm4
movdqa xmm4, xmmword [0x18003fdf0]
movdqa xmm5, xmm2
pand xmm5, xmm4
movdqa xmm6, xmmword [str.________________]
movdqa xmm7, xmm2
pand xmm7, xmm6
por xmm7, xmmword [0x18003fe10]
pxor xmm7, xmm5
movdqa xmm5, xmmword [0x18003fe20]
pxor xmm5, xmm7
pxor xmm6, xmm0
pxor xmm7, xmmword [str.________________00000000]
pand xmm7, xmm6
pxor xmm4, xmm0
pand xmm4, xmm5
por xmm4, xmm7
pand xmm3, xmm0
pxor xmm0, xmm2
por xmm0, xmm3
pxor xmm0, xmm1
por xmm0, xmm4
movdqa xmmword [0x18004ee80], xmm0
mov byte [0x18004ee90], 1
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x180035100
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
cmp byte [0x18004eece], 0
jne 0x18003524c
xor r8d, r8d
movabs r9, 0xcccccccccccccccd
lea r10, [0x18004eea7]
nop dword [rax]
mov rax, r8
mul r9
shr rdx, 2
and rdx, 0xfffffffffffffffc
lea rax, [rdx + rdx*4]
lea rdx, [rcx + r8]
sub rdx, rax
movzx eax, byte [rcx + r8 + 0x14]
mov r14d, eax
not r14b
movzx edx, byte [rdx]
mov ebp, edx
not bpl
mov edi, eax
xor dil, 0x60
and dil, al
mov ebx, edx
or bl, 0xe0
mov esi, ebx
not sil
and bpl, 0x1f
mov r11d, edx
xor r11b, 0xe0
or r11b, bpl
mov r15d, eax
and r15b, 0x1f
mov ebp, eax
or bpl, 0xe0
xor r15b, 0x70
and r15b, bpl
and r14b, 0x10
mov ebp, eax
and bpl, 0x60
and dil, 0xe0
xor dil, bpl
lea ebp, [r14 - 0x34]
and r14b, r15b
and r15b, 0x3f
xor bpl, r15b
or r14b, bpl
mov r15d, edi
xor r15b, 0x2f
xor bpl, 0x63
and bpl, r15b
and dil, 0x60
or dil, 0x10
and dil, r14b
mov r14d, eax
xor r14b, 0xe0
xor al, 0x1f
or al, r14b
not al
or al, dil
or al, bpl
mov edi, esi
and dil, 2
mov ebp, edx
or bpl, 0x40
and bpl, 0x5d
or bpl, dil
mov edi, ebp
xor dil, 0xae
mov r14d, r11d
xor r14b, 0xc
xor bpl, 0x51
and bpl, r14b
mov r14d, r11d
xor r14b, 0xf3
and r14b, dil
or r14b, bpl
and sil, 0x12
and dl, 0xd
or dl, sil
xor dl, r11b
xor dl, 0xf2
and r11b, bl
or r11b, dl
not r11b
or r11b, r14b
xor r11b, al
mov byte [r8 + r10], r11b
inc r8
cmp r8, 0x27
jne 0x180035130
mov byte [0x18004eece], 1
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x180035290
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
sub rsp, 0x68
movdqa xmmword [rsp + 0x50], xmm11
movdqa xmmword [rsp + 0x40], xmm10
movdqa xmmword [rsp + 0x30], xmm9
movdqa xmmword [rsp + 0x20], xmm8
movdqa xmmword [rsp + 0x10], xmm7
movdqa xmmword [rsp], xmm6
cmp byte [0x18004ef00], 0
jne 0x18003554f
lea rdx, [rcx + 0x32]
lea rax, [0x18004eee8]
cmp rdx, rax
jbe 0x18003536b
lea rdx, [0x18004ef00]
cmp rcx, rdx
jae 0x18003536b
xor edx, edx
movzx r10d, byte [rcx + rdx]
movzx r9d, byte [rcx + rdx + 0x1a]
not r9b
mov r8d, r10d
and r8b, r9b
or r9b, r10b
mov r10d, r9d
not r10b
mov r11d, r8d
not r11b
mov ebx, r8d
and bl, 0x30
mov esi, r11d
and sil, 4
or sil, bl
and r11b, 0x80
and r8b, 0x4b
or r8b, r11b
or sil, 0x80
or r8b, 0x30
xor r8b, sil
mov r11d, r10d
and r11b, 0x34
or r11b, 0x43
and r9b, 0x43
and r10b, 0x88
or r10b, r9b
or r10b, 0x34
xor r10b, r11b
xor r10b, r8b
mov byte [rdx + rax], r10b
inc rdx
cmp rdx, 0x18
jne 0x1800352f0
jmp 0x180035548
movq xmm7, qword [rcx + 0x1a]
movq xmm1, qword [rcx]
pcmpeqd xmm0, xmm0
movdqa xmm8, xmm7
pxor xmm8, xmm0
pandn xmm7, xmm1
por xmm8, xmm1
movdqa xmm1, xmmword [0x18003fe40]
movdqa xmm2, xmm7
pand xmm2, xmm1
movdqa xmm5, xmmword [0x18003fd00]
movdqa xmm4, xmm7
pandn xmm4, xmm5
por xmm4, xmm2
movdqa xmm3, xmmword [0x18003fe50]
movdqa xmm2, xmm7
pandn xmm2, xmm3
movdqa xmm6, xmmword [str.KKKKKKKK]
pand xmm7, xmm6
por xmm7, xmm2
por xmm4, xmm3
por xmm7, xmm1
pxor xmm7, xmm4
movdqa xmm2, xmmword [str.44444444]
movdqa xmm9, xmm8
pandn xmm9, xmm2
movdqa xmm4, xmmword [str.CCCCCCCC]
por xmm9, xmm4
pxor xmm9, xmm7
movdqa xmm10, xmm8
pand xmm10, xmm4
movdqa xmm7, xmmword [0x18003fe90]
pandn xmm8, xmm7
por xmm8, xmm10
por xmm8, xmm2
pxor xmm8, xmm9
movq qword [0x18004eee8], xmm8
movq xmm9, qword [rcx + 0x22]
movq xmm10, qword [rcx + 8]
movdqa xmm8, xmm9
pxor xmm8, xmm0
pandn xmm9, xmm10
por xmm8, xmm10
movdqa xmm10, xmm9
pand xmm10, xmm1
movdqa xmm11, xmm9
pandn xmm11, xmm5
por xmm11, xmm10
movdqa xmm10, xmm9
pandn xmm10, xmm3
pand xmm9, xmm6
por xmm9, xmm10
por xmm11, xmm3
por xmm9, xmm1
pxor xmm9, xmm11
movdqa xmm10, xmm8
pandn xmm10, xmm2
por xmm10, xmm4
pxor xmm10, xmm9
movdqa xmm9, xmm8
pand xmm9, xmm4
pandn xmm8, xmm7
por xmm8, xmm9
por xmm8, xmm2
pxor xmm8, xmm10
movq qword [0x18004eef0], xmm8
movq xmm8, qword [rcx + 0x2a]
movq xmm9, qword [rcx + 0x10]
pxor xmm0, xmm8
pandn xmm8, xmm9
por xmm0, xmm9
movdqa xmm9, xmm8
pand xmm9, xmm1
movdqa xmm10, xmm8
pandn xmm10, xmm5
por xmm10, xmm9
movdqa xmm5, xmm8
pandn xmm5, xmm3
pand xmm8, xmm6
por xmm8, xmm5
por xmm10, xmm3
por xmm8, xmm1
pxor xmm8, xmm10
movdqa xmm1, xmm0
pandn xmm1, xmm2
por xmm1, xmm4
pxor xmm1, xmm8
pand xmm4, xmm0
pandn xmm0, xmm7
por xmm0, xmm4
por xmm0, xmm2
pxor xmm0, xmm1
movq qword [0x18004eef8], xmm0
mov byte [0x18004ef00], 1
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
movaps xmm11, xmmword [rsp + 0x50]
add rsp, 0x68
pop rbx
pop rsi
ret
Function at 0x1800356d0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
cmp byte [0x18004ef70], 0
jne 0x180035799
xor r8d, r8d
movabs r9, 0xcccccccccccccccd
lea r10, [0x18004ef51]
nop word cs:[rax + rax]
mov rax, r8
mul r9
shr rdx, 2
and rdx, 0xfffffffffffffffc
lea rdx, [rdx + rdx*4]
lea rax, [rcx + r8]
sub rax, rdx
movzx edx, byte [rcx + r8 + 0x14]
mov r11d, edx
xor r11b, 8
and r11b, dl
mov ebx, edx
and bl, 0x40
mov esi, r11d
and sil, 0xe
or bl, 0x16
mov edi, edx
and dil, 0xb1
xor dil, bl
not r11b
or r11b, dl
not r11b
and r11b, 8
mov ebx, edx
and bl, 8
xor bl, sil
xor bl, 8
or bl, r11b
xor bl, dil
mov r11d, edx
xor r11b, 0xe
xor dl, 0xf1
or dl, r11b
xor bl, 0x10
mov r11d, ebx
xor r11b, dl
or bl, dl
not bl
or bl, r11b
xor bl, byte [rax]
xor bl, 0xf1
mov byte [r8 + r10], bl
inc r8
cmp r8, 0x1f
jne 0x180035700
mov byte [0x18004ef70], 1
pop rbx
pop rdi
pop rsi
ret

Function at 0x1800357a0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
cmp byte [0x18004ef91], 0
jne 0x180035926
lea rdx, [rcx + 0x30]
lea rax, [0x18004ef80]
cmp rdx, rax
jbe 0x1800357d2
lea rdx, [0x18004ef91]
cmp rcx, rdx
jae 0x1800357d2
xor edx, edx
jmp 0x180035890
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x1f]
movaps xmm3, xmmword [0x18003fed0]
andps xmm3, xmm0
movaps xmm2, xmmword [0x18003f710]
orps xmm3, xmm2
movaps xmm4, xmmword [str.XXXXXXXXXXXXXXXX]
andps xmm4, xmm0
xorps xmm4, xmm3
movaps xmm3, xmm4
movaps xmm5, xmmword [0x18003fef0]
andps xmm4, xmmword [str._]
andps xmm5, xmm0
orps xmm4, xmm5
xorps xmm4, xmmword [0x18003ff10]
xorps xmm3, xmm2
movaps xmm5, xmm0
andnps xmm5, xmmword [str.wwwwwwwwwwwwwwww]
orps xmm4, xmm3
xorps xmm0, xmmword [0x18003f9f0]
orps xmm0, xmm5
andps xmm0, xmm4
movaps xmm3, xmmword [0x18003ff30]
xorps xmm3, xmm1
movaps xmm4, xmmword [0x18003ff40]
andps xmm4, xmm0
andps xmm0, xmmword [str.ggggggggggggggggPPPPPPPPPPPPPPPP]
orps xmm0, xmm2
xorps xmm0, xmm4
movaps xmm2, xmmword [0x18003ff60]
xorps xmm1, xmmword [0x18003ff70]
xorps xmm2, xmm0
andps xmm1, xmm2
xorps xmm0, xmmword [0x18003ff80]
andps xmm0, xmm3
orps xmm0, xmm1
movaps xmmword [0x18004ef80], xmm0
mov edx, 0x10
nop word cs:[rax + rax]
movzx r8d, byte [rcx + rdx]
movzx r9d, byte [rcx + rdx + 0x1f]
mov r10d, r8d
not r10b
mov r11d, r8d
and r11b, 0xa7
or r11b, 0x40
mov ebx, r8d
and bl, 0x58
xor bl, r11b
mov r11d, ebx
xor r11b, 0x40
mov esi, r8d
and sil, 0xa3
and bl, 0x5c
or bl, sil
xor bl, 0xc8
or bl, r11b
and r10b, 0x77
xor r8b, 0x88
or r8b, r10b
and r8b, bl
mov r10d, r9d
xor r10b, 0xaf
mov r11d, r8d
and r11b, 0xd8
and r8b, 0x27
or r8b, 0x40
xor r8b, r11b
mov r11d, r8d
xor r11b, 0x67
xor r9b, 0x50
and r9b, r11b
xor r8b, 0x98
and r8b, r10b
or r8b, r9b
mov byte [rdx + rax], r8b
inc rdx
cmp rdx, 0x11
jne 0x180035890
mov byte [0x18004ef91], 1
pop rbx
pop rsi
ret
Function at 0x180035980
Capabilities:
Encode data using xor

Disassembly:
cmp byte [0x18004f053], 0
jne 0x180035a5f
lea rdx, [rcx + 0x37]
lea rax, [0x18004f038]
cmp rdx, rax
setbe dl
lea r8, [0x18004f053]
cmp rcx, r8
setae r8b
or r8b, dl
cmp r8b, 1
jne 0x1800359e8
mov rdx, qword [rcx]
xor rdx, qword [rcx + 0x1c]
mov qword [0x18004f038], rdx
mov rdx, qword [rcx + 8]
xor rdx, qword [rcx + 0x24]
mov qword [0x18004f040], rdx
mov rdx, qword [rcx + 0x10]
xor rdx, qword [rcx + 0x2c]
mov qword [0x18004f048], rdx
mov edx, 0x18
jmp 0x1800359ea
xor edx, edx
mov r9d, 3
movzx r10d, byte [rcx + rdx]
xor r10b, byte [rcx + rdx + 0x1c]
mov byte [rdx + rax], r10b
inc rdx
dec r9
jne 0x1800359f0
test r8b, r8b
jne 0x180035a58
nop dword [rax + rax]
movzx r8d, byte [rcx + rdx]
xor r8b, byte [rcx + rdx + 0x1c]
mov byte [rdx + rax], r8b
movzx r8d, byte [rcx + rdx + 1]
xor r8b, byte [rcx + rdx + 0x1d]
mov byte [rdx + rax + 1], r8b
movzx r8d, byte [rcx + rdx + 2]
xor r8b, byte [rcx + rdx + 0x1e]
mov byte [rdx + rax + 2], r8b
movzx r8d, byte [rcx + rdx + 3]
xor r8b, byte [rcx + rdx + 0x1f]
mov byte [rdx + rax + 3], r8b
add rdx, 4
cmp rdx, 0x1b
jne 0x180035a10
mov byte [0x18004f053], 1
ret

Function at 0x180035a60
Capabilities:
Encode data using xor

Disassembly:
push rbx
cmp byte [0x18004f06e], 0
jne 0x180035ad4
xor r8d, r8d
movabs r9, 0xd79435e50d79435f
lea r10, [0x18004f054]
nop
mov rax, r8
mul r9
shr rdx, 4
imul rax, rdx, 0xffffffffffffffed
lea rdx, [rcx + r8]
movzx r11d, byte [rcx + r8 + 0x13]
movzx eax, byte [rax + rdx]
mov edx, r11d
not dl
and dl, al
not al
and al, r11b
mov r11d, edx
xor r11b, 0x87
mov ebx, eax
xor bl, 0x87
xor dl, 0x78
and dl, bl
xor al, 0x78
and al, r11b
or al, dl
mov byte [r8 + r10], al
inc r8
cmp r8, 0x1a
jne 0x180035a80
mov byte [0x18004f06e], 1
pop rbx
ret
Function at 0x180035ae0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x10
movaps xmmword [rsp], xmm6
cmp byte [0x18004f100], 0
jne 0x180035c64
lea rdx, [rcx + 0x29]
lea rax, [0x18004f0f0]
cmp rdx, rax
jbe 0x180035baf
lea rdx, [0x18004f100]
cmp rcx, rdx
jae 0x180035baf
xor edx, edx
nop dword [rax]
movzx r9d, byte [rcx + rdx]
mov r10d, r9d
and r10b, 0xbb
mov r11d, r9d
and r11b, 0x44
lea r8d, [r11 + 0x30]
xor r8b, r10b
xor r10b, 0xbb
mov ebx, r10d
and bl, 0x39
and r9b, 0x82
or r9b, bl
or r9b, 0x40
or r10b, r11b
xor r9b, r11b
xor r9b, 0x3d
and r9b, r10b
xor r8b, 0x8b
or r8b, r9b
mov r9d, r8d
not r9b
mov r10d, r8d
and r10b, 0x42
mov r11d, r9d
and r11b, 0xa1
or r11b, r10b
and r9b, 0x18
and r8b, 4
or r8b, r9b
or r11b, 0x18
or r8b, 0x42
xor r8b, byte [rcx + rdx + 0x19]
xor r8b, r11b
xor r8b, 0x58
mov byte [rdx + rax], r8b
inc rdx
cmp rdx, 0x10
jne 0x180035b20
jmp 0x180035c5d
movups xmm2, xmmword [rcx]
movups xmm0, xmmword [rcx + 0x19]
movaps xmm3, xmmword [0x18003fa00]
movaps xmm4, xmm2
andps xmm4, xmm3
xorps xmm3, xmm4
movaps xmm5, xmmword [str.DDDDDDDDDDDDDDDD________________]
andps xmm5, xmm2
movaps xmm1, xmmword [str.0000000000000000]
orps xmm1, xmm5
xorps xmm1, xmm4
movaps xmm4, xmmword [str.9999999999999999_a_a_a_a_a_a_a_a_a_a_a_a_a_a_a_a]
andps xmm2, xmmword [0x18003ffa0]
andps xmm4, xmm3
orps xmm2, xmm4
orps xmm2, xmmword [0x18003f710]
orps xmm3, xmm5
xorps xmm2, xmm5
xorps xmm2, xmmword [str.]
andps xmm2, xmm3
xorps xmm1, xmmword [0x18003ffc0]
orps xmm1, xmm2
movaps xmm2, xmmword [str.BBBBBBBBBBBBBBBB]
movaps xmm3, xmm1
andps xmm3, xmm2
movaps xmm4, xmm1
andnps xmm4, xmmword [0x18003ffe0]
movaps xmm5, xmmword [0x18003f700]
movaps xmm6, xmm1
andnps xmm6, xmm5
andps xmm1, xmmword [0x18003fb00]
orps xmm3, xmm5
orps xmm3, xmm4
orps xmm6, xmm2
orps xmm6, xmm1
xorps xmm6, xmm0
xorps xmm6, xmm3
xorps xmm6, xmmword [str.XXXXXXXXXXXXXXXX]
movaps xmmword [0x18004f0f0], xmm6
mov byte [0x18004f100], 1
movaps xmm6, xmmword [rsp]
add rsp, 0x10
pop rbx
ret

Function at 0x180037250
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rbx
cmp byte [0x18004fbf5], 0
jne 0x1800372f1
xor r8d, r8d
movabs r9, 0x47ae147ae147ae15
lea r10, [0x18004fbcf]
nop word cs:[rax + rax]
mov rax, r8
mul r9
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
imul rax, rax, 0xffffffffffffffe7
lea rdx, [rcx + r8]
movzx r11d, byte [rcx + r8 + 0x19]
movzx eax, byte [rax + rdx]
not r11b
mov edx, eax
and dl, r11b
or r11b, al
mov eax, edx
xor al, 0x4a
mov ebx, r11d
and bl, 0x4a
and r11b, 0xb5
or r11b, 2
xor r11b, bl
mov ebx, r11d
xor bl, 0xb7
xor dl, 0xb5
and dl, bl
xor r11b, 0x48
and r11b, al
or r11b, dl
mov byte [r8 + r10], r11b
inc r8
cmp r8, 0x26
jne 0x180037280
mov byte [0x18004fbf5], 1
pop rbx
ret
Function at 0x180037300
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
cmp byte [0x18004fc1f], 0
jne 0x180037374
xor r8d, r8d
movabs r9, 0xf0f0f0f0f0f0f0f1
lea r10, [0x18004fbf6]
nop dword [rax]
mov rax, r8
mul r9
mov rax, rdx
shr rax, 4
and rdx, 0xfffffffffffffff0
add rdx, rax
lea rax, [rcx + r8]
sub rax, rdx
movzx edx, byte [rcx + r8 + 0x11]
movzx eax, byte [rax]
not al
mov r11d, edx
or r11b, al
and al, dl
mov edx, eax
and dl, 0x70
and al, 0x8f
xor al, r11b
or dl, 3
xor dl, al
xor dl, 0xfc
mov byte [r8 + r10], dl
inc r8
cmp r8, 0x29
jne 0x180037320
mov byte [0x18004fc1f], 1
ret

Function at 0x180037ad0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
cmp byte [0x18004fd70], 0
jne 0x180037b7e
xor eax, eax
lea rdx, [0x18004fd6a]
nop dword [rax]
movzx r8d, byte [rcx + rax]
movzx r10d, byte [rcx + rax + 0x1f]
mov r11d, r10d
or r11b, 0xba
mov ebx, r11d
not bl
and r11b, 0x66
mov r9d, ebx
and r9b, 1
or r9b, r11b
and r10b, 0xba
mov r11d, r9d
xor r11b, 0x66
mov esi, r9d
and sil, 5
or bl, 0xa
lea edi, [r10 + 5]
xor sil, 0xb4
and sil, dil
xor r10b, 0xf0
and r10b, bl
or r10b, sil
xor r9b, 0x99
or r9b, r11b
not r9b
or r9b, r10b
mov r10d, r8d
xor r10b, 0xba
or r10b, r9b
xor r8b, r9b
xor r8b, 0x45
and r8b, r9b
not r10b
or r10b, r8b
mov byte [rax + rdx], r10b
inc rax
cmp rax, 6
jne 0x180037af0
mov byte [0x18004fd70], 1
pop rbx
pop rdi
pop rsi
ret

Function at 0x180037c90
Capabilities:
Encode data using xor

Disassembly:
push rbx
cmp byte [0x18004fd94], 0
jne 0x180037d15
xor eax, eax
lea rdx, [0x18004fd7c]
nop word cs:[rax + rax]
movzx r9d, byte [rcx + rax + 0x10]
mov r8d, eax
and r8d, 0xf
movzx r8d, byte [rcx + r8]
mov r10d, r9d
not r10b
mov r11d, r10d
xor r11b, r8b
or r10b, r8b
not r8b
and r8b, r9b
or r11b, r8b
mov r9d, r11d
xor r9b, 0x91
mov ebx, r10d
or r8b, r10b
xor r10b, 0x91
xor r11b, 0x6e
and r11b, r10b
xor bl, 0x6e
and bl, r9b
or bl, r11b
not r8b
or r8b, bl
mov byte [rax + rdx], r8b
inc rax
cmp rax, 0x18
jne 0x180037cb0
mov byte [0x18004fd94], 1
pop rbx
ret

Function at 0x180037d20
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
cmp byte [0x18004fda2], 0
jne 0x180037e20
xor eax, eax
lea rdx, [0x18004fd95]
nop dword [rax]
movzx r10d, byte [rcx + rax]
movzx r8d, byte [rcx + rax + 0x1b]
mov esi, r10d
not sil
mov ebx, r10d
and bl, 0x24
mov r9d, r10d
and r9b, 0xdb
or bl, 0x81
xor bl, r9b
xor bl, 0x9b
mov r9d, r10d
and r9b, 0x1a
or r9b, bl
mov r11d, r9d
not r11b
and sil, 0xe5
xor r10b, 0x1a
or r10b, sil
mov esi, r11d
and sil, 6
mov edi, r9d
and dil, 0x58
or dil, sil
and bl, 0x81
and r11b, 0x20
or r11b, bl
or dil, 0x81
or r11b, 6
xor r11b, dil
mov ebx, r10d
and bl, 0xa1
or bl, 0x4e
or r9b, r10b
and r10b, 0x5e
xor r10b, bl
mov ebx, r10d
xor bl, 0xef
xor r10b, 0x10
and r10b, r11b
not r11b
and r11b, bl
not r9b
or r9b, r10b
or r9b, r11b
mov r10d, r8d
xor r10b, 0xa0
mov r11d, r9d
and r11b, 0x45
or r11b, 0x12
and r9b, 0xba
xor r9b, r11b
mov r11d, r9d
xor r11b, 0x57
xor r8b, 0x5f
and r8b, r11b
xor r9b, 0xa8
and r9b, r10b
or r9b, r8b
mov byte [rax + rdx], r9b
inc rax
cmp rax, 0xd
jne 0x180037d40
mov byte [0x18004fda2], 1
pop rbx
pop rdi
pop rsi
ret
Function at 0x180037e30
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
cmp byte [0x18004fdd4], 0
jne 0x180037f3c
xor r8d, r8d
movabs r9, 0xe38e38e38e38e38f
lea r10, [0x18004fda3]
nop word cs:[rax + rax]
mov rax, r8
mul r9
shr rdx, 3
and rdx, 0xfffffffffffffffe
lea rax, [rdx + rdx*8]
lea r11, [rcx + r8]
sub r11, rax
movzx edx, byte [rcx + r8 + 0x12]
movzx r11d, byte [r11]
mov eax, edx
and al, 0xa8
mov ebx, r11d
and bl, 0x45
mov esi, r11d
and sil, 0xba
xor sil, 0x1a
lea edi, [rsi + 1]
xor dil, bl
xor dil, 0xb3
and sil, 0xa8
xor sil, 8
or sil, dil
mov edi, r11d
and dil, 0xa8
mov ebx, edx
and bl, 0x57
or al, 0x42
xor al, bl
mov ebx, r11d
and bl, 0x28
xor r11b, 0x28
and r11b, dil
not dil
xor r11b, bl
mov ebx, esi
or dil, sil
and sil, 0x85
or sil, 0x28
and bl, 0x7a
xor bl, r11b
xor bl, sil
mov r11d, edi
and r11b, 0xee
xor r11b, bl
xor bl, 0x28
xor r11b, 0x39
or bl, dil
not bl
or bl, r11b
mov r11d, eax
and r11b, 0xc6
and dl, 0x20
and al, 0x19
or al, dl
or al, 0xc6
xor al, r11b
mov edx, ebx
and dl, 0x39
or dl, 0xc0
and bl, 0xc6
xor bl, al
xor bl, dl
xor bl, 0x13
mov byte [r8 + r10], bl
inc r8
cmp r8, 0x31
jne 0x180037e60
mov byte [0x18004fdd4], 1
pop rbx
pop rdi
pop rsi
ret

Function at 0x180037f70
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
cmp byte [0x18004fe26], 0
jne 0x18003802e
xor r8d, r8d
movabs r9, 0xaaaaaaaaaaaaaaab
lea r10, [0x18004fe02]
nop word cs:[rax + rax]
mov rax, r8
mul r9
shr rdx, 1
and rdx, 0xfffffffffffffff8
lea rax, [rdx + rdx*2]
lea rdx, [rcx + r8]
sub rdx, rax
movzx eax, byte [rcx + r8 + 0x18]
movzx edx, byte [rdx]
not al
mov edi, edx
and dil, al
mov esi, edx
or sil, al
mov r11d, edi
not r11b
mov ebp, r11d
and bpl, 0x4c
mov ebx, edi
and bl, 0x10
or bl, bpl
and dil, 0xa3
or bl, 0x23
xor bl, dil
mov edi, ebx
xor dil, 0xcc
mov ebp, esi
xor r11b, sil
xor sil, 0x5c
xor bl, 0x33
and bl, sil
xor bpl, 0xa3
and bpl, dil
xor al, dl
or r11b, al
not r11b
or r11b, bpl
or r11b, bl
mov byte [r8 + r10], r11b
inc r8
cmp r8, 0x24
jne 0x180037fa0
mov byte [0x18004fe26], 1
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x180038040
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
cmp byte [0x18004fe3d], 0
jne 0x18003819f
xor r8d, r8d
lea r10, [0x18004fe27]
nop word cs:[rax + rax]
mov rax, r8
movabs rdx, 0xe38e38e38e38e38f
mul rdx
shr rdx, 3
and rdx, 0xfffffffffffffffe
lea rax, [rdx + rdx*8]
lea rdx, [rcx + r8]
sub rdx, rax
movzx eax, byte [rcx + r8 + 0x12]
mov ebp, eax
not bpl
movzx esi, byte [rdx]
mov r11d, esi
not r11b
mov r14d, eax
xor r14b, 4
and r14b, al
mov r12d, r14d
not r12b
mov ebx, r11d
and bl, 0x7b
mov edx, esi
or dl, 0x84
mov edi, esi
and dil, 0x84
mov r13d, eax
and r13b, 0x18
mov r15d, eax
and r15b, 0x61
or r15b, 0x90
xor r15b, r13b
mov r13d, eax
or r13b, r12b
or r12b, 0x33
mov r9d, eax
and r9b, 4
and r12b, 0xb3
and r14b, 4
or r14b, r12b
xor r14b, r9b
xor r14b, 0xaf
not r13b
and r13b, 4
or r13b, r14b
mov r9d, eax
and r9b, 2
or r9b, r15b
xor r9b, r13b
xor r9b, 0xf7
mov r14d, ebp
and r14b, 0x4b
and al, 0x30
or al, r14b
xor al, 0x4b
and al, bpl
or al, r9b
mov r9d, edx
xor r9b, 0xa7
and r9b, sil
xor sil, 0x23
and sil, bl
xor sil, r9b
lea r9d, [rdi + 0x58]
mov ebp, r9d
xor bpl, 0x23
and bpl, sil
xor bpl, r9b
and r11b, 0x11
and dl, 0x6e
or dl, r11b
or bl, dil
xor dl, dil
xor dl, 0x91
and dl, bl
or dl, bpl
mov r9d, eax
xor r9b, 0x38
mov r11d, edx
xor r11b, 0x38
xor al, 0xc7
and al, r11b
xor dl, 0xc7
and dl, r9b
or dl, al
mov byte [r8 + r10], dl
inc r8
cmp r8, 0x16
jne 0x180038070
mov byte [0x18004fe3d], 1
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x1800381b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
cmp byte [0x18004feaf], 0
jne 0x180038229
xor r8d, r8d
movabs r9, 0xcccccccccccccccd
lea r10, [0x18004fe98]
nop
mov rax, r8
mul r9
shr rdx, 2
and rdx, 0xfffffffffffffffc
lea rax, [rdx + rdx*4]
lea rdx, [rcx + r8]
sub rdx, rax
movzx eax, byte [rcx + r8 + 0x14]
movzx edx, byte [rdx]
not dl
mov r11d, eax
and r11b, dl
or dl, al
mov eax, edx
xor al, 0x4b
mov ebx, r11d
xor bl, 0xb4
xor dl, 0xb4
and dl, bl
xor r11b, 0x4b
and r11b, al
or r11b, dl
mov byte [r8 + r10], r11b
inc r8
cmp r8, 0x17
jne 0x1800381d0
mov byte [0x18004feaf], 1
pop rbx
ret

Function at 0x180038230
Capabilities:
Encode data using xor

Disassembly:
push rbx
cmp byte [0x18005002b], 0
jne 0x180038298
xor r8d, r8d
movabs r9, 0x8888888888888889
lea r10, [0x18004fff8]
nop
mov rax, r8
mul r9
shr rdx, 4
imul rax, rdx, 0xffffffffffffffe2
lea rdx, [rcx + r8]
movzx r11d, byte [rcx + r8 + 0x1e]
movzx eax, byte [rax + rdx]
mov edx, r11d
xor dl, 0x36
xor r11b, 0xc9
mov ebx, eax
xor bl, 0xc9
and bl, dl
xor al, 0x36
and al, r11b
or al, bl
mov byte [r8 + r10], al
inc r8
cmp r8, 0x33
jne 0x180038250
mov byte [0x18005002b], 1
pop rbx
ret
Function at 0x1800382a0
Capabilities:
Encode data using xor

Disassembly:
push rbx
cmp byte [0x180050049], 0
jne 0x18003833e
xor r8d, r8d
movabs r9, 0xd79435e50d79435f
lea r10, [0x18005002c]
nop word cs:[rax + rax]
mov rax, r8
mul r9
shr rdx, 4
imul rdx, rdx, 0xffffffffffffffed
lea r11, [rcx + r8]
movzx eax, byte [rcx + r8 + 0x13]
movzx edx, byte [rdx + r11]
mov r11d, eax
and r11b, 0x23
mov ebx, eax
and bl, 0xdc
or r11b, 0xd8
xor r11b, bl
mov ebx, r11d
xor bl, 0xc5
xor r11b, 0x27
and r11b, bl
and al, 0xe2
or al, r11b
mov r11d, eax
xor r11b, 0x99
mov ebx, edx
xor bl, 0x84
xor al, 0x66
and al, bl
xor dl, 0x7b
and dl, r11b
or dl, al
mov byte [r8 + r10], dl
inc r8
cmp r8, 0x1d
jne 0x1800382d0
mov byte [0x180050049], 1
pop rbx
ret

Function at 0x18003a7dc
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x18003a816
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x18003a81b
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x18003a864
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1800423b0]
cmp byte [rcx + rax], 0
je 0x18003a864
dec r8
sub rdx, 1
jne 0x18003a84a
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret