joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18008c4bc
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
mov rsi, rcx
mov r14b, dl
mov rcx, qword [0x1800e6460]
add rcx, rsi
call fcn.18002b270
mov rcx, qword [0x1800e6988]
add rcx, rax
call fcn.18002b270
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.18008c6b8
xor r8d, r8d
mov dword [rbp - 0x30], 0x1a445d53
lea r9, [rbp - 0x30]
mov dword [rbp - 0x2c], 0x485a5956
mov dword [rbp - 0x28], 0x58554f56
mov byte [rbp - 0x24], 0x3d
mov eax, 0x5397829d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 0xd
jl 0x18008c521
lea rcx, [rbp - 0x30]
or rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x18008c550
mov rdi, qword [rbp - 8]
lea rcx, [rbp - 0x20]
mov rbx, qword [rbp - 0x20]
lea r9, [rbp - 0x30]
mov rdx, qword [rbp - 0x10]
cmp rdi, 0x10
mov qword [rsp + 0x20], rax
cmovae rcx, rbx
xor r8d, r8d
call fcn.1800297a4
cmp rax, 0xffffffffffffffff
jne 0x18008c667
mov dword [rbp + 0x20], 0x475c4052
lea r9, [rbp + 0x20]
mov word [rbp + 0x24], 0x3646
xor r8d, r8d
mov eax, 0x5397829d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9], al
inc r9
cmp r8d, 6
jl 0x18008c5a0
lea rcx, [rbp + 0x20]
or rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x18008c5cf
mov rdx, qword [rbp - 0x10]
lea rcx, [rbp - 0x20]
cmp rdi, 0x10
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x20]
cmovae rcx, rbx
xor r8d, r8d
call fcn.1800297a4
cmp rax, 0xffffffffffffffff
jne 0x18008c667
mov rcx, qword [0x1800e6478]
add rcx, rsi
call fcn.18002b270
mov r9, rax
mov rax, qword [0x1800e6108]
cmp r9, rax
jbe 0x18008c62c
mov rdx, qword [0x1800e6110]
add rdx, rax
cmp r9, rdx
jb 0x18008c642
lea rcx, [r9 - 0x10000]
movabs rax, 0x7ffffffdfffe
cmp rcx, rax
ja 0x18008c65f
mov rcx, qword [0x1800e66b0]
lea rdx, [rbp + 0x20]
add rcx, r9
mov byte [rbp + 0x20], r14b
mov r8d, 1
call fcn.1800dfb54
mov rbx, qword [rbp - 0x20]
mov rdi, qword [rbp - 8]
cmp rdi, 0x10
jb 0x18008c69a
lea rdx, [rdi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x18008c692
mov rbx, qword [rbx - 8]
add rdx, 0x27
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18008c6af
mov rcx, rbx
call fcn.1800dcb68
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.1800a5e1c
int3
Function at 0x180098040
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
mov rdi, qword [0x1800ebb60]
xor edx, edx
mov r12d, ecx
mov r14d, edx
mov r13d, edx
mov r15, qword [rdi + 0x3eb0]
test cl, 0x10
jne 0x1800981cc
mov esi, dword [rdi + 0x474c]
test esi, esi
je 0x1800980ca
cmp dword [rdi + 0x3f10], esi
jne 0x1800981c5
mov r14d, dword [rdi + 0x3f3c]
cmp r14d, 0xffffffff
cmove r14d, edx
movsxd rax, r14d
cmp byte [rax + rdi + 0xe04], dl
je 0x1800981c5
cmp byte [r15 + 0xb3], dl
jne 0x1800981c5
mov bl, dl
jmp 0x180098166
cmp byte [rdi + 0xe04], dl
je 0x1800981c5
cmp byte [r15 + 0xb3], dl
jne 0x1800981c5
test byte [rdi + 0x4754], 1
jne 0x180098105
cmp dword [rdi + 0x3f10], edx
je 0x1800981c5
cmp qword [rdi + 0x3f30], r15
jne 0x1800981c5
test r12b, 8
je 0x1800981c5
lea rbx, [rdi + 0x4758]
mov rcx, r15
mov rdx, rbx
call fcn.18009bfec
mov ecx, eax
mov dword [rdi + 0x474c], eax
mov esi, eax
call fcn.18009e018
mov edx, esi
mov rcx, rbx
call fcn.18009dce4
xor edx, edx
mov bl, al
test al, al
je 0x18009815e
cmp byte [rdi + 0x3738], dl
je 0x18009815e
mov rdx, r15
mov ecx, esi
call fcn.1800a5640
mov rcx, r15
call fcn.18009b8f8
xor edx, edx
cmp dword [rdi + 0x3f10], esi
jne 0x1800981c5
mov byte [rdi + 0x3f1d], bl
mov rax, qword [r15 + 0xf0]
movsxd rcx, dword [r15 + 0xe8]
mov r15, qword [0x1800ebb60]
mov r13d, dword [rax + rcx*4 - 4]
movsxd rax, r14d
cmp byte [rax + r15 + 0xe04], dl
jne 0x180098197
mov bl, dl
jmp 0x1800981a9
movss xmm1, dword [0x180006124]
mov ecx, r14d
call fcn.18009d8ac
mov bl, al
mov dword [r15 + 0x4720], 0xf
mov byte [r15 + 0x4724], 1
call fcn.18009efa8
test bl, bl
jne 0x180098225
xor al, al
jmp 0x1800982c6
mov dword [rbp - 0x10], 0x435a6710
lea r9, [rbp - 0x10]
mov dword [rbp - 0xc], 0x7f5c5b45
mov r8d, edx
mov dword [rbp - 8], 0x4c584843
mov word [rbp - 4], 0x4051
mov eax, 0x51eb851f
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
inc r8d
sub al, cl
add al, 0x33
xor byte [r9], al
inc r9
cmp r8d, 0xe
jl 0x1800981ee
xor r8d, r8d
lea rcx, [rbp - 0x10]
xor edx, edx
call fcn.18009cdc8
mov esi, eax
cmp byte [rdi + 0x4a3c], 0
jne 0x180098264
call fcn.180099940
mov dword [rdi + 0x4a5c], esi
mov dword [rdi + 0x4a60], r13d
mov byte [rdi + 0x4a3c], 1
mov dword [rdi + 0x4a40], r12d
mov dword [rdi + 0x4a48], r14d
cmp esi, dword [rdi + 0x3f10]
jne 0x180098264
mov byte [rdi + 0x3f1e], 1
mov eax, dword [rdi + 0x3e30]
mov dword [rdi + 0x4a44], eax
mov byte [rdi + 0x4a3d], 1
test r12b, 1
jne 0x1800982b7
xor edx, edx
xor ecx, ecx
call fcn.1800985c0
cmp dword [rdi + 0x4ab0], 0
je 0x1800982b7
test dword [rdi + 0x4aa4], 0x1000
je 0x1800982b7
mov rcx, qword [rdi + 0x3eb0]
mov byte [rcx + 0xb3], 1
mov byte [rcx + 0xb5], 1
mov byte [rcx + 0xd0], 1
test r12b, 0x12
jne 0x1800982c4
and dword [rdi + 0x4754], 0xfffffffe
mov al, 1
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x1800984a4
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov r8, qword [0x1800ebb60]
mov ebx, edx
mov eax, dword [r8 + 0x4868]
cmp dword [r8 + 0x4858], eax
jg 0x18009846f
and dword [r8 + 0x4788], 0
xor al, al
add rsp, 0x20
pop rbx
ret
mov r8, qword [r8 + 0x3eb0]
xor edx, edx
movsxd rax, dword [r8 + 0xe8]
mov r8, qword [r8 + 0xf0]
mov r8d, dword [r8 + rax*4 - 4]
call fcn.18009cdc8
or ebx, 0x141
mov ecx, eax
mov edx, ebx
add rsp, 0x20
pop rbx
jmp 0x1800984a4
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rdi, qword [0x1800ebb60]
mov ebx, edx
xor edx, edx
mov esi, ecx
call fcn.18009da28
test al, al
jne 0x1800984dd
and dword [rdi + 0x4788], 0
jmp 0x1800985ab
xor r8d, r8d
bt ebx, 0x1c
jae 0x180098533
mov dword [rbp - 0x30], 0x53781710
lea r10, [rbp - 0x30]
mov dword [rbp - 0x2c], 0x1f664d59
mov dword [rbp - 0x28], 0x3e590e0b
mov eax, 0x51eb851f
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
inc r8d
sub al, cl
add al, 0x33
xor byte [r10], al
inc r10
cmp r8d, 0xc
jl 0x1800984ff
mov r9d, dword [rdi + 0x4878]
lea r8, [rbp - 0x30]
jmp 0x18009857e
mov dword [rbp - 0x30], 0x59651710
lea r9, [rbp - 0x30]
mov dword [rbp - 0x2c], 0x65494d47
mov dword [rbp - 0x28], 0x46050c1e
mov byte [rbp - 0x24], 0x3f
mov eax, 0x51eb851f
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
inc r8d
sub al, cl
add al, 0x33
xor byte [r9], al
inc r9
cmp r8d, 0xd
jl 0x180098550
mov r9d, esi
lea r8, [rbp - 0x30]
mov edx, 0x14
lea rcx, [rbp - 0x20]
call fcn.18009cc0c
bts ebx, 0x1a
lea rcx, [rbp - 0x20]
mov r8d, ebx
xor edx, edx
call fcn.180095ff4
mov bl, al
test al, al
jne 0x1800985a9
call fcn.18009ac1c
mov al, bl
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret
Function at 0x1800985c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rbx, qword [0x1800ebb60]
xor edi, edi
mov esi, edx
mov r14d, ecx
lea r15d, [rdi + 1]
cmp byte [rbx + 0x4a3d], dil
jne 0x1800985ff
cmp byte [rbx + 0x4a3e], dil
je 0x180098678
movss xmm1, dword [rbx + 0x3898]
mov r14d, r15d
movaps xmm0, xmm1
mulss xmm1, dword [0x180006070]
mulss xmm0, dword [0x180008b54]
addss xmm1, dword [rbx + 0xe00]
addss xmm0, dword [rbx + 0xdfc]
or dword [rbx + 0x4788], r15d
mov qword [rbx + 0x47a0], rdi
movss dword [rbx + 0x479c], xmm1
mov dword [rbx + 0x478c], r15d
movss dword [rbx + 0x4798], xmm0
movss xmm0, dword [rbx + 0x3904]
mov rax, qword [0x1800ebb60]
mulss xmm0, dword [0x180008b28]
or dword [rax + 0x4788], 0x40
movss dword [rax + 0x47e8], xmm0
movsx r9d, word [rbx + 0x5b3a]
lea r10, [rbp - 0x20]
mov dword [rbp - 0x20], 0x59611710
mov r8d, edi
mov dword [rbp - 0x1c], 0x534d5458
mov dword [rbp - 0x18], 0xe18634b
mov word [rbp - 0x14], 0x240d
mov byte [rbp - 0x12], 0x41
mov eax, 0x51eb851f
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
add r8d, r15d
sub al, cl
add al, 0x33
xor byte [r10], al
add r10, r15
cmp r8d, 0xf
jl 0x1800986a6
lea r8, [rbp - 0x20]
mov edx, 0x10
lea rcx, [rbp - 0x10]
call fcn.18009cc0c
test r15b, r14b
je 0x180098795
xor r8d, r8d
lea rcx, [rbp - 0x10]
xor edx, edx
call fcn.18009cdc8
mov rcx, qword [0x1800ebb60]
mov edx, eax
add rcx, 0x3e90
call fcn.18009c948
test rax, rax
je 0x180098795
cmp byte [rax + 0xae], dil
je 0x180098795
mov byte [rax + 0xb5], r15b
lea r8, [rbp - 0x20]
mov byte [rax + 0xd0], r15b
add word [rbx + 0x5b3a], r15w
movsx r9d, word [rbx + 0x5b3a]
mov dword [rbp - 0x20], 0x59611710
mov dword [rbp - 0x1c], 0x534d5458
mov dword [rbp - 0x18], 0xe18634b
mov word [rbp - 0x14], 0x240d
mov byte [rbp - 0x12], 0x41
mov eax, 0x51eb851f
mul edi
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, dil
add edi, r15d
sub al, cl
add al, 0x33
xor byte [r8], al
add r8, r15
cmp edi, 0xf
jl 0x18009875e
lea r8, [rbp - 0x20]
mov edx, 0x10
lea rcx, [rbp - 0x10]
call fcn.18009cc0c
or esi, 0x20c0347
lea rcx, [rbp - 0x10]
mov r8d, esi
xor edx, edx
call fcn.180095ff4
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret

Function at 0x18009bc14
Capabilities:
Contain obfuscated stackstrings
Encode data using add xor sub operations

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov r10, rcx
mov dword [rbp - 0x10], 0x57771710
mov dword [rbp - 0xc], 0x485e5354
lea r9, [rbp - 0x10]
mov dword [rbp - 8], 0x5a534954
xor r8d, r8d
mov byte [rbp - 4], 0x3f
mov eax, 0x51eb851f
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
inc r8d
sub al, cl
add al, 0x33
xor byte [r9], al
inc r9
cmp r8d, 0xd
jl 0x18009bc40
lea r8, [rbp - 0x10]
xor edx, edx
mov rcx, r10
call fcn.18009c810
add rsp, 0x30
pop rbp
ret
Function at 0x18009bc7c
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov rax, qword [0x1800ebb60]
mov rcx, qword [rax + 0x4888]
mov rcx, qword [rcx]
jmp fcn.18009bc14

Function at 0x18009be4c
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
test dword [rcx + 0xc], 0x4000000
mov r8, rcx
je 0x18009be74
mov rax, qword [0x1800ebb60]
mov rcx, qword [rax + 0x5c08]
jmp 0x18009bf05
test dword [rcx + 0xc], 0x400
je 0x18009bef7
mov dword [rbp - 0x10], 0x57781710
lea r10, [rbp - 0x10]
mov dword [rbp - 0xc], 0x5f74565e
xor r9d, r9d
mov dword [rbp - 8], 0x5f7f4955
mov word [rbp - 4], 0x404d
mov eax, 0x51eb851f
mul r9d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r9b
inc r9d
sub al, cl
add al, 0x33
xor byte [r10], al
inc r10
cmp r9d, 0xe
jl 0x18009be9f
mov rax, qword [r8]
lea r8, [rbp - 0x10]
sub r8, rax
movzx ecx, byte [rax]
movzx edx, byte [rax + r8]
sub ecx, edx
jne 0x18009bee3
inc rax
test edx, edx
jne 0x18009bed0
test ecx, ecx
jne 0x18009bef7
mov rax, qword [0x1800ebb60]
mov rcx, qword [rax + 0x5c00]
jmp 0x18009bf05
mov rax, qword [0x1800ebb60]
mov rcx, qword [rax + 0x5c10]
test rcx, rcx
lea rax, [0x180005f30]
cmovne rax, rcx
add rsp, 0x10
pop rbp
ret

Function at 0x18009bf1c
Capabilities:
Contain obfuscated stackstrings
Encode data using add xor sub operations

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov r10, rcx
mov dword [rbp - 0x10], 0x59731710
mov dword [rbp - 0xc], 0x485e5d45
lea r9, [rbp - 0x10]
mov dword [rbp - 8], 0x5a534954
xor r8d, r8d
mov byte [rbp - 4], 0x3f
mov eax, 0x51eb851f
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
inc r8d
sub al, cl
add al, 0x33
xor byte [r9], al
inc r9
cmp r8d, 0xd
jl 0x18009bf48
lea r8, [rbp - 0x10]
mov edx, 1
mov rcx, r10
call fcn.18009c810
add rsp, 0x30
pop rbp
ret

Function at 0x18009bf88
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov rax, qword [0x1800ebb60]
mov rcx, qword [rax + 0x4888]
mov rcx, qword [rcx]
jmp fcn.18009bf1c

Function at 0x18009bfbc
Capabilities:
Hash data with crc32

Disassembly:
movsxd r9, dword [rcx + 0xe8]
mov r10, r8
mov r8, qword [rcx + 0xf0]
mov r11, rdx
mov rax, r10
mov rcx, r11
sub rax, rdx
neg r10
mov r8d, dword [r8 + r9*4 - 4]
sbb rdx, rdx
and rdx, rax
jmp fcn.18009cdc8

Function at 0x18009cd90
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r9, rcx
not r8d
test rdx, rdx
je 0x18009cdbe
movzx eax, byte [r9]
inc r9
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
lea rax, [0x180008490]
xor r8d, dword [rax + rcx*4]
sub rdx, 1
jne 0x18009cd9b
not r8d
mov eax, r8d
ret
Function at 0x18009cdc8
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
not r8d
mov r10, rcx
mov r9d, r8d
test rdx, rdx
je 0x18009ce22
mov r11b, 0x23
lea rdi, [0x180008490]
movzx ebx, byte [r10]
dec rdx
inc r10
cmp bl, r11b
jne 0x18009ce0c
cmp rdx, 2
jb 0x18009ce0c
cmp byte [r10], r11b
jne 0x18009ce0c
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
xor rcx, rbx
shr r9d, 8
xor r9d, dword [rdi + rcx*4]
test rdx, rdx
jne 0x18009cdea
jmp 0x18009ce63
mov dl, byte [rcx]
inc r10
test dl, dl
je 0x18009ce63
mov r11b, 0x23
lea rdi, [0x180008490]
cmp dl, r11b
jne 0x18009ce47
cmp byte [r10], r11b
jne 0x18009ce47
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
movzx eax, dl
mov dl, byte [r10]
xor rcx, rax
shr r9d, 8
inc r10
xor r9d, dword [rdi + rcx*4]
test dl, dl
jne 0x18009ce35
mov rbx, qword [rsp + 8]
not r9d
mov rdi, qword [rsp + 0x10]
mov eax, r9d
ret

Function at 0x18009e040
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0x20
and qword [rax + 0x18], 0
lea r9, [rax + 0x10]
xor r8d, r8d
mov word [rax + 0x10], 0x5641
mov r10, rcx
mov byte [rax + 0x12], 0x35
mov eax, 0x51eb851f
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
inc r8d
sub al, cl
add al, 0x33
xor byte [r9], al
inc r9
cmp r8d, 3
jl 0x18009e061
xor r9d, r9d
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x38]
mov rcx, r10
call fcn.18009cb24
mov rbx, rax
test rax, rax
je 0x18009e0d9
mov rdx, qword [rsp + 0x40]
test rdx, rdx
je 0x18009e0b7
mov rcx, rax
call fcn.18009e0e0
mov rcx, qword [0x1800ebb60]
test rcx, rcx
je 0x18009e0c9
dec dword [rcx + 0xf4]
mov rdx, qword [0x1800ebb88]
mov rcx, rbx
call qword [0x1800e5ac8]
add rsp, 0x20
pop rbx
ret

Function at 0x18009e328
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [0x1800ebb60]
cmp byte [rbx + 0x5c18], 0
je 0x18009e41f
mov word [rsp + 0x30], 0x3e3e
lea r9, [rsp + 0x30]
mov byte [rsp + 0x32], 0x35
xor r8d, r8d
mov eax, 0x51eb851f
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
inc r8d
sub al, cl
add al, 0x33
xor byte [r9], al
inc r9
cmp r8d, 3
jl 0x18009e356
lea rcx, [rsp + 0x30]
call fcn.18009e694
mov eax, dword [rbx + 0x5c1c]
cmp eax, 2
je 0x18009e3bc
cmp eax, 4
jne 0x18009e3c8
cmp dword [rbx + 0x5c28], 1
jle 0x18009e3c8
mov rax, qword [rbx + 0x5c30]
lea rcx, [0x1800ebb80]
test rax, rax
cmovne rcx, rax
call fcn.1800a5710
jmp 0x18009e3c8
mov rcx, qword [rbx + 0x5c20]
call fcn.1800de8fc
and dword [rbx + 0x5c1c], 0
and qword [rbx + 0x5c20], 0
mov byte [rbx + 0x5c18], 0
mov rcx, qword [rbx + 0x5c30]
test rcx, rcx
je 0x18009e41f
and dword [rbx + 0x5c2c], 0
and dword [rbx + 0x5c28], 0
mov rax, qword [0x1800ebb60]
test rax, rax
je 0x18009e40a
dec dword [rax + 0xf4]
mov rdx, qword [0x1800ebb88]
call qword [0x1800e5ac8]
and qword [rbx + 0x5c30], 0
add rsp, 0x20
pop rbx
ret
Function at 0x18009e428
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
mov rbx, r8
mov r14, rdx
mov r13, rcx
mov rdi, qword [0x1800ebb60]
mov rsi, qword [rdi + 0x5c38]
mov r12, qword [rdi + 0x5c40]
and qword [rdi + 0x5c40], 0
and qword [rdi + 0x5c38], 0
mov r15, qword [rdi + 0x3eb0]
test rbx, rbx
jne 0x18009e486
xor edx, edx
mov rcx, r14
call fcn.18009b628
mov rbx, rax
lea rcx, [r13 + 4]
test r13, r13
je 0x18009e4b8
movss xmm1, dword [rdi + 0x3820]
lea rdx, [rdi + 0x5c48]
addss xmm1, dword [rdx]
movss xmm0, dword [rcx]
addss xmm1, dword [0x180005ff0]
comiss xmm0, xmm1
jbe 0x18009e4b8
mov r8b, 1
jmp 0x18009e4c7
xor r8b, r8b
lea rdx, [rdi + 0x5c48]
test r13, r13
je 0x18009e518
mov eax, dword [rcx]
mov dword [rdx], eax
test r8b, r8b
je 0x18009e518
mov word [rbp + 0x40], 0x3e3e
lea r9, [rbp + 0x40]
mov byte [rbp + 0x42], 0x35
xor r8d, r8d
mov eax, 0x51eb851f
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
inc r8d
sub al, cl
add al, 0x33
xor byte [r9], al
inc r9
cmp r8d, 3
jl 0x18009e4e1
lea rcx, [rbp + 0x40]
call fcn.18009e694
mov byte [rdi + 0x5c4c], 1
test rsi, rsi
je 0x18009e539
or r8, 0xffffffffffffffff
inc r8
cmp byte [rsi + r8], 0
jne 0x18009e521
add r8, rsi
mov rdx, rsi
mov rcx, r13
call fcn.18009e428
mov ecx, dword [rdi + 0x5c50]
mov eax, dword [r15 + 0x180]
cmp ecx, eax
jle 0x18009e552
mov dword [rdi + 0x5c50], eax
mov ecx, eax
mov r15d, dword [r15 + 0x180]
sub r15d, ecx
mov r8, rbx
mov edx, 0xa
sub r8, r14
mov rcx, r14
call fcn.1800def10
test rax, rax
mov rsi, rbx
cmovne rsi, rax
cmp r14, rsi
jne 0x18009e587
cmp rsi, rbx
je 0x18009e65c
mov r9d, esi
mov dword [rbp + 0x50], 0x13461e16
sub r9d, r14d
mov dword [rbp + 0x54], 0x3a4a1219
cmp byte [rdi + 0x5c4c], 0
lea eax, [r15*4]
mov r10d, 1
lea r11, [rbp + 0x50]
cmovne r10d, eax
xor r8d, r8d
mov eax, 0x51eb851f
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
inc r8d
sub al, cl
add al, 0x33
xor byte [r11], al
inc r11
cmp r8d, 8
jl 0x18009e5bb
lea r8, [0x180005f30]
mov qword [rsp + 0x20], r14
mov edx, r10d
lea rcx, [rbp + 0x50]
call fcn.18009e694
mov byte [rdi + 0x5c4c], 0
cmp byte [rsi], 0xa
jne 0x18009e64e
mov word [rbp + 0x48], 0x3e3e
lea r9, [rbp + 0x48]
mov byte [rbp + 0x4a], 0x35
xor r8d, r8d
mov eax, 0x51eb851f
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
inc r8d
sub al, cl
add al, 0x33
xor byte [r9], al
inc r9
cmp r8d, 3
jl 0x18009e617
lea rcx, [rbp + 0x48]
call fcn.18009e694
mov byte [rdi + 0x5c4c], 1
cmp rsi, rbx
je 0x18009e65c
lea r14, [rsi + 1]
jmp 0x18009e55c
test r12, r12
je 0x18009e67a
or rbx, 0xffffffffffffffff
inc rbx
cmp byte [r12 + rbx], 0
jne 0x18009e665
add rbx, r12
mov r14, r12
jmp 0x18009e448
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800a19f8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
mov rbx, qword [0x1800ebb60]
movss xmm0, dword [0x180005fbc]
mov rdi, rbx
comiss xmm0, dword [rbx + 0x4a18]
ja 0x1800a1c67
cmp qword [rbx + 0x4a10], 0
mov esi, 0x51eb851f
jne 0x1800a1aa4
movdqa xmm0, xmmword [0x180008bc0]
lea r9, [rbp - 0x20]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x4631372a
xor r8d, r8d
mov eax, esi
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
inc r8d
sub al, cl
add al, 0x33
xor byte [r9], al
inc r9
cmp r8d, 0x14
jl 0x1800a1a56
xor r8d, r8d
lea rcx, [rbp - 0x20]
xor edx, edx
call fcn.18009cdc8
mov edx, eax
lea rcx, [rbx + 0x3e90]
call fcn.18009c948
mov qword [rbx + 0x4a10], rax
mov rbx, qword [0x1800ebb60]
mov rax, qword [rbx + 0x4888]
lea rdx, [rbp + 0x20]
mov dword [rbp - 0x18], 0x7f7fffff
mov dword [rbp - 0x14], 0x7f7fffff
mov rcx, qword [rax]
movss xmm2, dword [rcx + 0xc]
movss xmm1, dword [rcx + 0x10]
or dword [rbx + 0x4788], 0x10
and qword [rbx + 0x47d8], 0
and qword [rbx + 0x47e0], 0
mulss xmm1, dword [0x180005fc4]
mulss xmm2, dword [0x180005fc4]
movss dword [rbp - 0x1c], xmm1
movss dword [rbp - 0x20], xmm2
movups xmm1, xmmword [rbp - 0x20]
movdqu xmmword [rbx + 0x47c4], xmm1
mov rax, qword [0x1800ebb60]
movss xmm1, dword [rcx + 0x10]
movss xmm2, dword [rcx + 0xc]
mulss xmm1, dword [0x180005fdc]
mulss xmm2, dword [0x180005fdc]
addss xmm1, dword [rcx + 8]
addss xmm2, dword [rcx + 4]
or dword [rax + 0x4788], 1
mov ecx, 0x3f000000
mov dword [rax + 0x47a0], ecx
movss dword [rax + 0x479c], xmm1
mov dword [rax + 0x47a4], ecx
mov ecx, 2
movss dword [rax + 0x4798], xmm2
mov dword [rax + 0x478c], 1
movss xmm0, dword [rdi + 0x37e8]
movss xmm1, dword [rdi + 0x37ec]
addss xmm0, xmm0
addss xmm1, xmm1
movss dword [rbp + 0x20], xmm0
movss dword [rbp + 0x24], xmm1
call fcn.1800a2c74
movdqa xmm0, xmmword [0x180008bc0]
lea r9, [rbp - 0x20]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x4631372a
xor r8d, r8d
mov eax, esi
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
inc r8d
sub al, cl
add al, 0x33
xor byte [r9], al
inc r9
cmp r8d, 0x14
jl 0x1800a1bab
xor edx, edx
lea rcx, [rbp - 0x20]
mov r8d, 0xc1347
call fcn.180095ff4
mov eax, dword [rdi + 0x3e60]
sub eax, 1
movsxd rsi, eax
js 0x1800a1c58
mov rax, qword [rdi + 0x3e68]
mov rbx, qword [rax + rsi*8]
cmp byte [rbx + 0xaf], 0
je 0x1800a1c52
cmp rbx, qword [rbx + 0x370]
jne 0x1800a1c52
test dword [rbx + 0xc], 0x80000
jne 0x1800a1c52
mov r14, qword [rbx]
xor edx, edx
mov rcx, r14
call fcn.18009b628
cmp r14, rax
jne 0x1800a1c31
mov rcx, rbx
call fcn.18009be4c
mov r14, rax
and dword [rbp + 0x20], 0
lea r9, [rbp + 0x20]
and dword [rbp + 0x24], 0
mov rcx, r14
cmp qword [rdi + 0x4a00], rbx
sete dl
xor r8d, r8d
call fcn.1800c8a74
sub rsi, 1
jns 0x1800a1bee
call fcn.18009a334
mov ecx, 1
call fcn.1800a2894
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rbp
ret
Function at 0x1800a4fec
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x1800ebb60]
mov rbx, rcx
and dword [rax + 0x5b84], 0
test rcx, rcx
je 0x1800a5091
and qword [rsp + 0x38], 0
lea rcx, [rsp + 0x38]
call fcn.1800a509c
mov rdi, rax
mov word [rsp + 0x30], 0x4044
xor r8d, r8d
mov byte [rsp + 0x32], 0x35
lea r9, [rsp + 0x30]
mov eax, 0x51eb851f
mul r8d
shr edx, 4
movsx ecx, dl
imul eax, ecx, 0x32
mov cl, r8b
inc r8d
sub cl, al
add cl, 0x33
xor byte [r9], cl
inc r9
cmp r8d, 3
jl 0x1800a5037
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1800deaec
mov rbx, rax
test rax, rax
je 0x1800a5091
mov r8, qword [rsp + 0x38]
mov r9, rax
mov edx, 1
mov rcx, rdi
call fcn.1800ded90
mov rcx, rbx
call fcn.1800de8fc
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret