joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18001b8e0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x12], 0
je 0x18001b903
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x6d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x11
jb 0x18001b8f0
mov byte [rcx + 0x12], 0
ret

Function at 0x18001bdc0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
call fcn.18000af30
mov r11, rax
test rax, rax
je 0x18001be63
mov eax, 0x5a4d
cmp word [r11], ax
jne 0x18001be63
movsxd rcx, dword [r11 + 0x3c]
cmp dword [rcx + r11], 0x4550
jne 0x18001be63
mov eax, dword [rcx + r11 + 0x88]
test eax, eax
je 0x18001be63
mov ebx, dword [rax + r11 + 0x1c]
xor r9d, r9d
mov r10d, dword [rax + r11 + 0x20]
mov ebp, dword [rax + r11 + 0x24]
add r10, r11
add rbp, r11
lea rsi, [r11 + rbx]
test ebx, ebx
je 0x18001be63
nop dword [rax]
mov r8d, dword [r10]
mov rax, rdi
add r8, r11
sub r8, rdi
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x18001be53
inc rax
test ecx, ecx
jne 0x18001be40
test edx, edx
je 0x18001be7a
inc r9d
add r10, 4
cmp r9d, ebx
jb 0x18001be30
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
movzx ecx, word [rbp + r9*2]
mov eax, dword [rsi + rcx*4]
add rax, r11
jmp 0x18001be65
Function at 0x18001be90
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rdi
push rbp
lea rbp, [r11 - 0x5f]
sub rsp, 0x90
mov rax, qword [0x1801ab040]
xor rax, rsp
mov qword [rbp + 0x4f], rax
xor ebx, ebx
mov rdi, rcx
cmp edx, 1
jne 0x18001c096
mov rax, qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
xor r9d, r9d
mov qword [rbp + 0x3f], rax
xor r8d, r8d
xor eax, eax
mov qword [r11 + 0x10], rsi
mov qword [rbp + 0x47], rax
lea rsi, section..text
lea rax, [rbp + 0x37]
mov qword [r11 - 0x70], rbx
xor edx, edx
mov qword [r11 - 0x78], rax
mov qword [rbp + 0x37], rsi
call fcn.1800c6850
movdqa xmm0, xmmword [0x180192a80]
mov ecx, ebx
movdqu xmmword [rbp + 0x37], xmm0
mov qword [0x1801ada00], rdi
mov word [rbp + 0x47], 0x100
nop dword [rax + rax]
lea eax, [rcx + 0x6b]
xor byte [rbp + rcx + 0x37], al
inc rcx
cmp rcx, 0x10
jb 0x18001bf20
mov byte [rbp + 0x48], bl
mov rcx, rbx
mov dword [rbp + 0x27], 0x2091805
mov dword [rbp + 0x2b], 0x1e155e03
mov word [rbp + 0x2f], 0x1f
mov byte [rbp + 0x31], 1
nop
lea eax, [rcx + 0x6b]
xor byte [rbp + rcx + 0x27], al
inc rcx
cmp rcx, 9
jb 0x18001bf50
lea rdx, [rbp + 0x37]
mov byte [rbp + 0x31], bl
lea rcx, [rbp + 0x27]
call fcn.18001bdc0
mov qword [rsp + 0x50], rbx
lea rcx, [0x1800c1310]
mov qword [rsp + 0x48], rbx
mov r9, 0xffffffffffffffff
mov qword [rsp + 0x40], rbx
xor r8d, r8d
mov qword [rsp + 0x38], rbx
mov edx, 0x1fffff
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rcx
lea rcx, [0x1801ad760]
call rax
mov edi, eax
mov dword [rbp + 0x27], 0x3350527e
mov rcx, rbx
mov dword [rbp + 0x2b], 0x2a220a24
mov dword [rbp + 0x2f], 0x222a21
mov byte [rbp + 0x33], 1
nop
lea eax, [rcx + 0x3d]
xor byte [rbp + rcx + 0x27], al
inc rcx
cmp rcx, 0xb
jb 0x18001bfd0
mov byte [rbp + 0x33], bl
mov rcx, rbx
mov dword [rbp + 0x37], 0x1f0900
mov dword [rbp + 0x3b], 0x40421c0a
mov dword [rbp + 0x3f], 0x1a19105d
mov word [rbp + 0x43], 0x100
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x6b]
xor byte [rbp + rcx + 0x37], al
inc rcx
cmp rcx, 0xc
jb 0x18001c010
lea rdx, [rbp + 0x27]
mov byte [rbp + 0x44], bl
lea rcx, [rbp + 0x37]
call fcn.18001bdc0
test edi, edi
js 0x18001c092
mov rcx, qword [0x1801ad760]
xor r9d, r9d
mov qword [rbp + 0x3f], rax
xor r8d, r8d
xor eax, eax
mov qword [rsp + 0x28], rbx
mov qword [rbp + 0x47], rax
xor edx, edx
lea rax, [rbp + 0x37]
mov qword [rbp + 0x37], rsi
mov qword [rsp + 0x20], rax
call fcn.1800c6850
mov eax, 1
mov rsi, qword [rsp + 0xa8]
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.1800cac00
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
xor eax, eax
jmp 0x18001c069
test edx, edx
sete bl
mov eax, ebx
jmp 0x18001c071

Function at 0x18001c0a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xc], 0
je 0x18001c0c3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xb
jb 0x18001c0b0
mov byte [rcx + 0xc], 0
mov rax, rcx
ret
Function at 0x18001c0d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xc], 0
je 0x18001c0f3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xb
jb 0x18001c0e0
mov byte [rcx + 0xc], 0
ret

Function at 0x18001c2d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 4], 0
je 0x18001c2f3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x48]
xor byte [rax + rcx], dl
inc rax
cmp rax, 3
jb 0x18001c2e0
mov byte [rcx + 4], 0
mov rax, rcx
ret

Function at 0x18001c5b0
Capabilities:
Encode data using xor

Disassembly:
test rdx, rdx
jne 0x18001c5be
add rdx, 0x20
jmp fcn.18000bad0
mov eax, dword [0x1801ad6f0]
mov rdx, qword [rax + rdx]
add rdx, 0x20
jmp fcn.18000bad0

Function at 0x18001cff0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x23], 0
je 0x18001d013
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x48]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x22
jb 0x18001d000
mov byte [rcx + 0x23], 0
mov rax, rcx
ret

Function at 0x18001d020
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 3], 0
je 0x18001d043
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x48]
xor byte [rax + rcx], dl
inc rax
cmp rax, 2
jb 0x18001d030
mov byte [rcx + 3], 0
mov rax, rcx
ret

Function at 0x18001d050
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1e], 0
je 0x18001d073
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x48]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1d
jb 0x18001d060
mov byte [rcx + 0x1e], 0
mov rax, rcx
ret

Function at 0x18001d080
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 9], 0
je 0x18001d0a3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x48]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x18001d090
mov byte [rcx + 9], 0
mov rax, rcx
ret

Function at 0x18001d0b0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x24], 0
je 0x18001d0d3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x48]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x23
jb 0x18001d0c0
mov byte [rcx + 0x24], 0
mov rax, rcx
ret

Function at 0x18001d0e0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2e], 0
je 0x18001d103
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x48]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x2d
jb 0x18001d0f0
mov byte [rcx + 0x2e], 0
mov rax, rcx
ret

Function at 0x18001d110
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x34], 0
je 0x18001d133
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x48]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x33
jb 0x18001d120
mov byte [rcx + 0x34], 0
mov rax, rcx
ret
Function at 0x180022b60
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 7], 0
je 0x180022b83
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x48]
xor byte [rax + rcx], dl
inc rax
cmp rax, 6
jb 0x180022b70
mov byte [rcx + 7], 0
mov rax, rcx
ret

Function at 0x180022b90
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2b], 0
je 0x180022bb3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x48]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x2a
jb 0x180022ba0
mov byte [rcx + 0x2b], 0
mov rax, rcx
ret

Function at 0x180022bc0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2f], 0
je 0x180022be3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x48]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x2e
jb 0x180022bd0
mov byte [rcx + 0x2f], 0
mov rax, rcx
ret

Function at 0x180022bf0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x25], 0
je 0x180022c13
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x48]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x24
jb 0x180022c00
mov byte [rcx + 0x25], 0
mov rax, rcx
ret

Function at 0x180022c20
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x22], 0
je 0x180022c43
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x48]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x21
jb 0x180022c30
mov byte [rcx + 0x22], 0
mov rax, rcx
ret

Function at 0x180022c50
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xb0], 0
je 0x180022c78
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x48]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xaf
jb 0x180022c60
mov byte [rcx + 0xb0], 0
mov rax, rcx
ret

Function at 0x180022c80
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x14a], 0
je 0x180022ca8
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x48]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x149
jb 0x180022c90
mov byte [rcx + 0x14a], 0
mov rax, rcx
ret

Function at 0x180022cb0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x144], 0
je 0x180022cd8
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x48]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x143
jb 0x180022cc0
mov byte [rcx + 0x144], 0
mov rax, rcx
ret

Function at 0x180022ce0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x83], 0
je 0x180022d08
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x48]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x82
jb 0x180022cf0
mov byte [rcx + 0x83], 0
mov rax, rcx
ret

Function at 0x180022d10
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x19], 0
je 0x180022d33
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x48]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x18
jb 0x180022d20
mov byte [rcx + 0x19], 0
mov rax, rcx
ret

Function at 0x180022d40
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x80], 0
je 0x180022d66
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x48]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x7f
jb 0x180022d50
mov byte [rcx + 0x80], 0
mov rax, rcx
ret
Function at 0x180022d70
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2d], 0
je 0x180022d93
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x48]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x2c
jb 0x180022d80
mov byte [rcx + 0x2d], 0
mov rax, rcx
ret

Function at 0x180022da0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x28], 0
je 0x180022dc3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x48]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x27
jb 0x180022db0
mov byte [rcx + 0x28], 0
mov rax, rcx
ret

Function at 0x180022dd0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2c], 0
je 0x180022df3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x48]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x2b
jb 0x180022de0
mov byte [rcx + 0x2c], 0
mov rax, rcx
ret

Function at 0x180022e00
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x26], 0
je 0x180022e23
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x48]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x25
jb 0x180022e10
mov byte [rcx + 0x26], 0
mov rax, rcx
ret

Function at 0x180022e30
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x48], 0
je 0x180022e53
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x48]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x47
jb 0x180022e40
mov byte [rcx + 0x48], 0
mov rax, rcx
ret

Function at 0x180022e60
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x51], 0
je 0x180022e83
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x48]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x50
jb 0x180022e70
mov byte [rcx + 0x51], 0
mov rax, rcx
ret
Function at 0x180023eb0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x58], 0
je 0x180023ed3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x48]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x57
jb 0x180023ec0
mov byte [rcx + 0x58], 0
ret

Function at 0x180023ee0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xaa], 0
je 0x180023f08
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x48]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xa9
jb 0x180023ef0
mov byte [rcx + 0xaa], 0
ret

Function at 0x180023f10
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x43c], 0
je 0x180023f38
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x48]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x43b
jb 0x180023f20
mov byte [rcx + 0x43c], 0
ret

Function at 0x180023f40
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x30], 0
je 0x180023f63
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x48]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x2f
jb 0x180023f50
mov byte [rcx + 0x30], 0
ret

Function at 0x180023f70
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x241], 0
je 0x180023f98
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x48]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x240
jb 0x180023f80
mov byte [rcx + 0x241], 0
ret

Function at 0x180023fa0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2c], 0
je 0x180023fc3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x48]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x2b
jb 0x180023fb0
mov byte [rcx + 0x2c], 0
ret

Function at 0x180023fd0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2d], 0
je 0x180023ff3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x48]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x2c
jb 0x180023fe0
mov byte [rcx + 0x2d], 0
ret

Function at 0x180024000
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x19], 0
je 0x180024023
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x48]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x18
jb 0x180024010
mov byte [rcx + 0x19], 0
ret

Function at 0x180024030
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2f], 0
je 0x180024053
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x48]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x2e
jb 0x180024040
mov byte [rcx + 0x2f], 0
ret

Function at 0x180024060
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 7], 0
je 0x180024083
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x48]
xor byte [rax + rcx], dl
inc rax
cmp rax, 6
jb 0x180024070
mov byte [rcx + 7], 0
ret

Function at 0x180024090
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x14], 0
je 0x1800240b3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x48]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x13
jb 0x1800240a0
mov byte [rcx + 0x14], 0
ret

Function at 0x180024120
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2e], 0
je 0x180024143
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x48]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x2d
jb 0x180024130
mov byte [rcx + 0x2e], 0
ret
Function at 0x180024150
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 9], 0
je 0x180024173
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x48]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x180024160
mov byte [rcx + 9], 0
ret

Function at 0x180024180
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1e], 0
je 0x1800241a3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x48]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1d
jb 0x180024190
mov byte [rcx + 0x1e], 0
ret

Function at 0x1800241b0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 3], 0
je 0x1800241d3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x48]
xor byte [rax + rcx], dl
inc rax
cmp rax, 2
jb 0x1800241c0
mov byte [rcx + 3], 0
ret

Function at 0x1800243b0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 4], 0
je 0x1800243d3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x48]
xor byte [rax + rcx], dl
inc rax
cmp rax, 3
jb 0x1800243c0
mov byte [rcx + 4], 0
ret
Function at 0x1800251a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1801ab040]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r15, rdx
mov r14, rcx
mov qword [rbp - 0x30], rcx
mov qword [rbp - 0x38], rdx
xor r12d, r12d
mov qword [rbp - 0x30], r12
mov dword [rbp - 0x60], 0x36823695
mov dword [rbp - 0x5c], 0x36cb3696
mov dword [rbp - 0x58], 0x36873684
mov dword [rbp - 0x54], 0x368f369b
mov dword [rbp - 0x50], 0x368836c5
mov dword [rbp - 0x4c], 0x36823681
mov word [rbp - 0x48], r12w
mov byte [rbp - 0x46], 1
mov eax, r12d
mov edx, 0x36e3
nop word [rax + rax]
lea ecx, [rdx + rax]
xor word [rbp + rax*2 - 0x60], cx
inc rax
cmp rax, 0xc
jb 0x180025220
mov byte [rbp - 0x46], 0
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
add rax, 0xf230
mov rdx, r15
lea rcx, [rbp - 0x30]
call rax
nop
mov rdx, qword [rbp - 0x30]
test rdx, rdx
jne 0x180025261
mov byte [r14 + 0x20], dl
jmp 0x18002535e
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x28], xmm1
mov rdi, r12
mov qword [rbp - 0x18], r12
mov rcx, qword [rdx + 0x10]
mov rax, qword [rcx]
mov r8, qword [rax + 0x98]
mov rdx, qword [rdx + 0x18]
call r8
test rax, rax
je 0x18002529a
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.1800182e0
mov rdi, qword [rbp - 0x18]
mov r9, qword [rbp - 0x20]
mov rsi, qword [rbp - 0x28]
sub r9, rsi
mov rdx, qword [rbp - 0x30]
mov rcx, qword [rdx + 0x10]
mov rax, qword [rcx]
mov r10, qword [rax + 0x30]
mov r8, rsi
mov rdx, qword [rdx + 0x18]
call r10
mov r8, qword [rbp - 0x20]
mov rdx, rsi
lea rcx, [rbp - 0x60]
call fcn.1800168c0
xorps xmm0, xmm0
movups xmmword [r14], xmm0
mov qword [r14 + 0x10], r12
mov qword [r14 + 0x18], r12
movups xmm0, xmmword [rax]
movups xmmword [r14], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [r14 + 0x10], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov byte [r14 + 0x20], 1
lea rcx, [rbp - 0x60]
call fcn.18000e640
nop
test rsi, rsi
je 0x180025347
sub rdi, rsi
mov rax, rsi
cmp rdi, 0x1000
jb 0x18002533b
add rdi, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18002533b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, rdi
mov rcx, rsi
call fcn.1800cafcc
nop
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x18002535e
mov rax, qword [rcx]
call qword [rax + 0x10]
test al, al
je 0x18002535e
mov qword [rbp - 0x30], r12
mov rcx, r15
call fcn.18000e640
mov rax, r14
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1800cac00
mov rsi, qword [rsp + 0xc0]
add rsp, 0x80
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x180025d20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rdx, qword [0x1801ad7e0]
mov rdi, rcx
movaps xmmword [rsp + 0x60], xmm6
movss xmm6, dword [0x1801927e0]
mov rax, qword [rdx + 0x1c10]
mov byte [rax + 0x90], 1
mov rax, qword [rdx + 0x1c10]
cmp byte [rax + 0x93], 0
jne 0x180025d80
movaps xmm1, xmm6
mov qword [rbp + 0x18], 0
lea rcx, [rbp + 0x18]
call fcn.180047590
xor esi, esi
mov dword [rbp - 0x40], 0x3244f48
mov ecx, esi
mov dword [rbp - 0x3c], 0x48180528
mov dword [rbp - 0x38], 0x131b1d3f
mov word [rbp - 0x34], 0x28
mov byte [rbp - 0x32], 1
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x6b]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xd
jb 0x180025db0
lea rcx, [rbp - 0x40]
mov byte [rbp - 0x32], sil
call fcn.1800472f0
mov rbx, qword [0x1801ad7e0]
lea rdx, [rbp - 0x30]
mov dword [rbp - 0x30], 3
movups xmm0, xmmword [rbx + 0x1658]
lea rcx, [rbx + 0x1d78]
movups xmmword [rbp - 0x2c], xmm0
call fcn.18004f130
mov qword [rbx + 0x1658], rsi
mov qword [rbx + 0x1660], rsi
mov rcx, qword [0x1801ad7e0]
mov rdx, qword [rcx + 0x1c10]
movss xmm0, dword [rdx + 0x220]
cmp qword [rdx + 0x178], rsi
jne 0x180025e2c
cmp qword [rcx + 0x2020], rsi
je 0x180025e34
movss xmm0, dword [rdx + 0x1f0]
subss xmm0, dword [rdx + 0xd8]
mov byte [rdx + 0x90], 1
mov rdx, rdi
mov rcx, qword [rcx + 0x1c10]
mov dword [rbp + 0x1c], 0x3f800000
movss dword [rbp + 0x18], xmm0
call fcn.18003c580
mov edx, eax
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8, [rbp + 0x18]
mov rcx, rdi
call fcn.1800416d0
mov rax, qword [0x1801ad7e0]
mov rax, qword [rax + 0x1c10]
cmp byte [rax + 0x93], sil
jne 0x180025e9c
mov eax, dword [rax + 0x184]
neg eax
sbb ecx, ecx
add ecx, 6
call fcn.180067620
call fcn.180041970
mov r8, qword [0x1801ad7e0]
movsxd rax, dword [r8 + 0x1d78]
mov rcx, qword [r8 + 0x1d80]
lea rdx, [rax + rax*4]
movsxd rax, dword [rcx + rdx*4 - 0x14]
movups xmm0, xmmword [rcx + rdx*4 - 0x10]
add rax, rax
movups xmmword [r8 + rax*8 + 0x1628], xmm0
dec dword [r8 + 0x1d78]
mov rax, qword [r8 + 0x1c10]
dec dword [rax + 0xc8]
mov rax, qword [r8 + 0x1c10]
mov byte [rax + 0x90], 1
mov rax, qword [r8 + 0x1c10]
cmp byte [rax + 0x93], sil
jne 0x180025f12
movaps xmm1, xmm6
mov qword [rbp + 0x18], rsi
lea rcx, [rbp + 0x18]
call fcn.180047590
movaps xmm6, xmmword [rsp + 0x60]
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1800263b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xe0
mov rax, qword [0x1801ab040]
xor rax, rsp
mov qword [rbp + 0x27], rax
xor r13d, r13d
lea rcx, [rbp - 0x49]
call fcn.1800a5470
mov rdx, rax
lea rcx, [0x1801ae098]
call fcn.180095ef0
mov rcx, qword [rbp - 0x49]
test rcx, rcx
je 0x180026452
mov rax, qword [rbp - 0x39]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180026441
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180026441
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800cafcc
mov qword [rbp - 0x49], r13
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x41], xmm0
lea rdx, [0x1801ae098]
lea rcx, [rbp + 0xf]
call fcn.1800242d0
nop
mov rdi, qword [rbp + 0xf]
mov rsi, rdi
mov r14, qword [rbp + 0x17]
cmp rdi, r14
je 0x180026561
mov r12d, 0x296b
nop dword [rax]
mov r15, qword [rsi]
mov dword [rsp + 0x20], 0x29052908
mov dword [rsp + 0x24], 0x29072919
mov dword [rsp + 0x28], 0x29152915
mov dword [rbp - 0x7d], 0x295f291f
mov dword [rbp - 0x79], 0x29172900
mov dword [rbp - 0x75], 0x291f2907
mov dword [rbp - 0x71], 0x290c2907
mov dword [rbp - 0x6d], 0x29142910
mov dword [rbp - 0x69], 0x2951291c
mov dword [rbp - 0x65], 0x2911291e
mov dword [rbp - 0x61], 0x29e5290d
mov dword [rbp - 0x5d], 0x29e629af
mov dword [rbp - 0x59], 0x29e829ef
mov word [rbp - 0x55], r13w
mov byte [rbp - 0x53], 1
mov rax, r13
nop dword [rax]
lea ecx, [r12 + rax]
xor word [rsp + rax*2 + 0x20], cx
inc rax
cmp rax, 0x1a
jb 0x1800264f0
mov byte [rbp - 0x53], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
movsxd rbx, dword [rax + 0xced48]
lea rcx, [r15 + 0x10]
mov rax, qword [rcx]
call qword [rax]
mov rax, qword [rax]
mov rax, qword [rax + 0x10]
mov rdx, qword [rax + rbx*8]
lea rcx, [rdx + 0x28]
lea rax, [0x18018dee0]
mov qword [rbp - 0x31], rax
mov qword [rbp - 0x29], rdx
lea rax, [rbp - 0x31]
mov qword [rbp + 7], rax
lea rdx, [rbp - 0x31]
call fcn.180029f00
add rsi, 8
cmp rsi, r14
jne 0x180026480
mov rdi, qword [rbp + 0xf]
test rdi, rdi
je 0x1800265a1
mov rdx, qword [rbp + 0x1f]
sub rdx, rdi
and rdx, 0xfffffffffffffff8
mov rax, rdi
cmp rdx, 0x1000
jb 0x180026599
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180026599
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.1800cafcc
call fcn.1800c8840
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
call fcn.1800c8d70
lea rdx, [0x180025fa0]
lea rcx, [0x1801ae0d8]
call fcn.1800c8070
call fcn.1800c88c0
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1800cac00
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret