joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401ee920
Capabilities:
Create process on windows

Disassembly:
jmp 0x1401ee920
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x128
lea rcx, [rsp + 0xe8]
call fcn.140003832
lea rcx, [rsp + 0xb8]
call fcn.140003832
lea rcx, [rsp + 0x88]
call fcn.140003832
call fcn.140004af2
mov r8d, eax
lea rdx, [rsp + 0xe8]
mov rcx, qword [rsp + 0x130]
call fcn.140003409
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
je 0x1401ee9c2
mov dword [rsp + 0x54], 0
lea rcx, [rsp + 0x88]
call fcn.140003f12
lea rcx, [rsp + 0xb8]
call fcn.140003f12
lea rcx, [rsp + 0xe8]
call fcn.140003f12
mov eax, dword [rsp + 0x54]
jmp 0x1401eeb68
call fcn.140004af2
mov r8d, eax
lea rdx, [rsp + 0xb8]
mov rcx, qword [rsp + 0x138]
call fcn.140003409
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x58], 0
je 0x1401eea22
mov dword [rsp + 0x5c], 0
lea rcx, [rsp + 0x88]
call fcn.140003f12
lea rcx, [rsp + 0xb8]
call fcn.140003f12
lea rcx, [rsp + 0xe8]
call fcn.140003f12
mov eax, dword [rsp + 0x5c]
jmp 0x1401eeb68
mov qword [rsp + 0x70], 0
cmp qword [rsp + 0x168], 0
je 0x1401eeaa8
call fcn.140004af2
mov r8d, eax
lea rdx, [rsp + 0x88]
mov rcx, qword [rsp + 0x168]
call fcn.140003409
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
je 0x1401eea96
mov dword [rsp + 0x64], 0
lea rcx, [rsp + 0x88]
call fcn.140003f12
lea rcx, [rsp + 0xb8]
call fcn.140003f12
lea rcx, [rsp + 0xe8]
call fcn.140003f12
mov eax, dword [rsp + 0x64]
jmp 0x1401eeb68
lea rcx, [rsp + 0x88]
call fcn.1400036ed
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0xb8]
call fcn.1400036ed
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0xe8]
call fcn.1400036ed
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x178]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x170]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x160]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x158]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x150]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x148]
mov r8, qword [rsp + 0x140]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [rsp + 0x68], eax
lea rcx, [rsp + 0x88]
call fcn.140003f12
lea rcx, [rsp + 0xb8]
call fcn.140003f12
lea rcx, [rsp + 0xe8]
call fcn.140003f12
mov eax, dword [rsp + 0x68]
add rsp, 0x128
ret
Function at 0x1401fce50
Capabilities:
Set environment variable

Disassembly:
jmp 0x1401fce50
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
lea rcx, [rsp + 0x78]
call fcn.140003832
lea rcx, [rsp + 0x48]
call fcn.140003832
call fcn.140004af2
mov r8d, eax
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0xc0]
call fcn.140003409
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x1401fcebf
mov dword [rsp + 0x24], 0
lea rcx, [rsp + 0x48]
call fcn.140003f12
lea rcx, [rsp + 0x78]
call fcn.140003f12
mov eax, dword [rsp + 0x24]
jmp 0x1401fcf50
call fcn.140004af2
mov r8d, eax
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0xc8]
call fcn.140003409
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
je 0x1401fcf06
mov dword [rsp + 0x2c], 0
lea rcx, [rsp + 0x48]
call fcn.140003f12
lea rcx, [rsp + 0x78]
call fcn.140003f12
mov eax, dword [rsp + 0x2c]
jmp 0x1401fcf50
lea rcx, [rsp + 0x48]
call fcn.1400036ed
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x78]
call fcn.1400036ed
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x48]
call fcn.140003f12
lea rcx, [rsp + 0x78]
call fcn.140003f12
mov eax, dword [rsp + 0x30]
add rsp, 0xb8
ret
Function at 0x180003ec0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x40
lea rcx, [0x1800146c0]
call fcn.18000653b
lea rsi, [rsp + 0x29]
movabs rax, 0x424b58565e563b
mov qword [rsi - 1], rax
mov eax, 1
xor byte [rsp + rax + 0x28], 0x3b
inc rax
cmp rax, 7
jne 0x180003ee9
xor eax, eax
mov byte [rsp + 0x2f], al
lea rcx, [rsp + 0x31]
movabs rdx, 0x54f0d0d05150f61
mov qword [rcx - 1], rdx
mov word [rcx + 7], 0xd0d
mov byte [rcx + 9], al
mov eax, 1
xor byte [rsp + rax + 0x30], 0x61
inc rax
cmp rax, 0xa
jne 0x180003f1e
mov byte [rsp + 0x3a], 0
call fcn.1800124e6
mov rcx, rax
mov rdx, rsi
call fcn.18001253d
mov qword [0x180018e50], rax
lea rcx, str._fortnite__SDK__Memory_:_memcpy_____0x_p
mov rdx, rax
call fcn.18000653b
lea rcx, str._fortnite__Initialised_SDK__Memory_
call fcn.18000653b
mov al, 1
add rsp, 0x40
pop rsi
ret
Function at 0x18000653b
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rax, rcx
lea rcx, [rsp + 0x68]
mov qword [rcx], rdx
mov qword [rcx + 8], r8
mov qword [rcx + 0x10], r9
mov qword [rsp + 0x20], rcx
mov rcx, qword gs:[0x60]
mov rdx, qword [rcx + 0x18]
add rdx, 0x10
mov rdx, qword [rdx]
mov rcx, qword [rdx + 0x30]
movsxd r8, dword [rcx + 0x3c]
mov r8d, dword [rcx + r8 + 0x88]
test r8, r8
je 0x180006570
mov r9d, dword [rcx + r8 + 0x18]
test r9, r9
je 0x180006570
mov r10d, dword [rcx + r8 + 0x20]
add r10, rcx
lea r11, [rcx + 1]
dec r9
mov esi, r9d
mov edi, dword [r10 + rsi*4]
mov bpl, byte [rcx + rdi]
test bpl, bpl
je 0x1800065ed
add rdi, r11
mov ebx, 0xd7cf2072
movsx r14d, bpl
lea ebp, [r14 - 0x41]
mov r15d, r14d
or r15d, 0x20
cmp bpl, 0x1a
cmovae r15d, r14d
xor r15d, ebx
imul ebx, r15d, 0x1000193
mov bpl, byte [rdi]
inc rdi
test bpl, bpl
jne 0x1800065b9
cmp ebx, 0xc0ca36d6
je 0x1800065f7
test rsi, rsi
jne 0x18000659e
jmp 0x180006570
mov edx, dword [rcx + r8 + 0x1c]
mov r8d, dword [rcx + r8 + 0x24]
add rdx, rcx
add r8, rcx
movzx r8d, word [r8 + rsi*2]
mov r10d, dword [rdx + r8*4]
add r10, rcx
mov r9, qword [rsp + 0x20]
lea rcx, [0x180018e60]
mov edx, 0x200
mov r8, rax
call r10
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x18000663b
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x18000663b
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov esi, dword [r9 + r11*4]
mov bl, byte [rax + rsi]
test bl, bl
je 0x1800066b1
add rsi, r10
mov edi, 0x68d6c07a
movsx ebx, bl
lea ebp, [rbx - 0x41]
mov r14d, ebx
or r14d, 0x20
cmp bpl, 0x1a
cmovae r14d, ebx
xor r14d, edi
imul edi, r14d, 0x1000193
mov bl, byte [rsi]
inc rsi
test bl, bl
jne 0x180006681
cmp edi, 0x4ed0986e
je 0x1800066b8
test r11, r11
jne 0x180006668
jmp 0x18000663b
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov edx, dword [rcx + rdx*4]
add rdx, rax
lea rsi, [0x180018e60]
mov rcx, rsi
call rdx
mov rax, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x18000e364
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xc0
movaps xmmword [rsp + 0xb0], xmm6
movaps xmm6, xmm3
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov r15, qword [rsp + 0x120]
lea r8, [rsp + 0x42]
movaps xmm0, xmmword [0x180015640]
movaps xmmword [r8 - 2], xmm0
movaps xmm0, xmmword [0x180015650]
movaps xmmword [r8 + 0xe], xmm0
movaps xmm0, xmmword [0x180015660]
movaps xmmword [r8 + 0x1e], xmm0
mov dword [r8 + 0x2e], 0x5d0025
mov word [r8 + 0x62], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0x5d
inc rax
cmp rax, 0x32
jne 0x18000e3cf
lea r14, [rsp + 0x40]
mov word [r14 + 0x64], 0
mov rax, qword [0x180019130]
lea r12, [rsp + 0x30]
mov qword [r12], rax
xor r13d, r13d
mov qword [r12 + 8], r13
mov qword [rsp + 0x20], r12
xor ecx, ecx
xor edx, edx
xor r9d, r9d
call fcn.1800137d0
movups xmm0, xmmword [rbx]
movaps xmmword [r14], xmm0
movups xmm0, xmmword [rdi]
movaps xmmword [r14 + 0x10], xmm0
movss dword [r14 + 0x20], xmm6
movups xmm0, xmmword [r15]
movups xmmword [r14 + 0x24], xmm0
mov rcx, qword [0x1800191f0]
mov qword [r12], rcx
mov qword [r12 + 8], r13
mov qword [rsp + 0x20], r12
mov rcx, rsi
mov rdx, rax
mov r8, r14
xor r9d, r9d
call fcn.1800137d0
movaps xmm6, xmmword [rsp + 0xb0]
add rsp, 0xc0
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x18000e472
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xa8
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
lea r8, [rsp + 0x42]
movaps xmm0, xmmword [0x180015670]
movaps xmmword [r8 - 2], xmm0
movaps xmm0, xmmword [0x180015680]
movaps xmmword [r8 + 0xe], xmm0
movaps xmm0, xmmword [0x180015690]
movaps xmmword [r8 + 0x1e], xmm0
mov dword [r8 + 0x2e], 0x70073
mov word [r8 + 0x62], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 7
inc rax
cmp rax, 0x32
jne 0x18000e4c8
lea r14, [rsp + 0x40]
mov word [r14 + 0x64], 0
mov rax, qword [0x180019130]
lea r15, [rsp + 0x30]
mov qword [r15], rax
xor r12d, r12d
mov qword [r15 + 8], r12
mov qword [rsp + 0x20], r15
xor ecx, ecx
xor edx, edx
xor r9d, r9d
call fcn.1800137d0
mov qword [r14 + 0x28], r12
xorps xmm0, xmm0
movups xmmword [r14 + 0x18], xmm0
movups xmm0, xmmword [rbx]
movaps xmmword [r14], xmm0
mov rcx, qword [rbx + 0x10]
mov qword [r14 + 0x10], rcx
mov rcx, qword [0x1800191f0]
mov qword [r15], rcx
mov qword [r15 + 8], r12
mov qword [rsp + 0x20], r15
mov rcx, rdi
mov rdx, rax
mov r8, r14
xor r9d, r9d
call fcn.1800137d0
mov rax, qword [r14 + 0x28]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [r14 + 0x18]
movups xmmword [rsi], xmm0
mov rax, rsi
add rsp, 0xa8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x18000e56c
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xc0
movaps xmmword [rsp + 0xb0], xmm6
movaps xmm6, xmm3
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov r15, qword [rsp + 0x120]
lea r8, [rsp + 0x42]
movaps xmm0, xmmword [0x1800156a0]
movaps xmmword [r8 - 2], xmm0
movaps xmm0, xmmword [str.rP_GPB]
movaps xmmword [r8 + 0xe], xmm0
movaps xmm0, xmmword [0x1800156c0]
movaps xmmword [r8 + 0x1e], xmm0
mov dword [r8 + 0x2e], 0x54005f
mov word [r8 + 0x32], 0x31
mov word [r8 + 0x66], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0x31
inc rax
cmp rax, 0x34
jne 0x18000e5de
lea r14, [rsp + 0x40]
mov word [r14 + 0x68], 0
mov rax, qword [0x180019130]
lea r12, [rsp + 0x30]
mov qword [r12], rax
xor r13d, r13d
mov qword [r12 + 8], r13
mov qword [rsp + 0x20], r12
xor ecx, ecx
xor edx, edx
xor r9d, r9d
call fcn.1800137d0
movups xmm0, xmmword [rbx]
movaps xmmword [r14], xmm0
movups xmm0, xmmword [rdi]
movaps xmmword [r14 + 0x10], xmm0
movss dword [r14 + 0x20], xmm6
movups xmm0, xmmword [r15]
movups xmmword [r14 + 0x24], xmm0
mov rcx, qword [0x1800191f0]
mov qword [r12], rcx
mov qword [r12 + 8], r13
mov qword [rsp + 0x20], r12
mov rcx, rsi
mov rdx, rax
mov r8, r14
xor r9d, r9d
call fcn.1800137d0
movaps xmm6, xmmword [rsp + 0xb0]
add rsp, 0xc0
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x18000e680
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xb8
mov rbx, r9
mov r14, r8
mov rsi, rdx
mov rdi, rcx
mov r12, qword [rsp + 0x110]
mov rdx, qword [0x180019148]
test rdx, rdx
jne 0x18000e742
lea r8, [rsp + 0x42]
movaps xmm0, xmmword [0x1800156d0]
movaps xmmword [r8 - 2], xmm0
movaps xmm0, xmmword [0x1800156e0]
movaps xmmword [r8 + 0xe], xmm0
movaps xmm0, xmmword [0x1800156f0]
movaps xmmword [r8 + 0x1e], xmm0
mov dword [r8 + 0x2e], 0x460059
mov word [r8 + 0x32], 0x23
mov word [r8 + 0x66], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0x23
inc rax
cmp rax, 0x34
jne 0x18000e6f8
mov word [rsp + 0xa8], 0
mov rax, qword [0x180019130]
lea rcx, [rsp + 0x30]
mov qword [rcx], rax
mov qword [rcx + 8], 0
mov qword [rsp + 0x20], rcx
xor ecx, ecx
xor edx, edx
xor r9d, r9d
call fcn.1800137d0
mov rdx, rax
mov qword [0x180019148], rax
lea r15, [rsp + 0x40]
mov qword [r15], r14
movups xmm0, xmmword [rbx]
movups xmmword [r15 + 8], xmm0
xorps xmm0, xmm0
movups xmmword [r15 + 0x28], xmm0
movups xmm0, xmmword [r12]
movups xmmword [r15 + 0x18], xmm0
mov rax, qword [0x1800191f0]
lea rcx, [rsp + 0x30]
mov qword [rcx], rax
mov qword [rcx + 8], 0
mov qword [rsp + 0x20], rcx
mov rcx, rdi
mov r8, r15
xor r9d, r9d
call fcn.1800137d0
movups xmm0, xmmword [r15 + 0x28]
movups xmmword [rsi], xmm0
mov rax, rsi
add rsp, 0xb8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x18000e7aa
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xe8
movaps xmmword [rsp + 0xd0], xmm6
mov rdi, r9
mov rbx, r8
mov r14, rdx
mov rsi, rcx
mov rax, qword [rsp + 0x190]
mov cl, byte [rsp + 0x188]
mov r9b, byte [rsp + 0x180]
mov r10b, byte [rsp + 0x178]
mov r15, qword [rsp + 0x170]
mov rbp, qword [rsp + 0x168]
movss xmm6, dword [rsp + 0x160]
mov r12, qword [rsp + 0x158]
mov r13, qword [rsp + 0x150]
mov rdx, qword [0x180019150]
test rdx, rdx
jne 0x18000e8d6
lea r8, [rsp + 0x42]
movaps xmm0, xmmword [0x180015700]
movaps xmmword [r8 - 2], xmm0
movaps xmm0, xmmword [0x180015710]
movaps xmmword [r8 + 0xe], xmm0
movaps xmm0, xmmword [0x180015720]
movaps xmmword [r8 + 0x1e], xmm0
mov dword [r8 + 0x2e], 0x390035
mov word [r8 + 0x32], 0x4d
mov word [r8 + 0x66], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0x4d
inc rax
cmp rax, 0x34
jne 0x18000e86d
mov word [rsp + 0xa8], 0
mov rax, qword [0x180019130]
lea rcx, [rsp + 0x30]
mov qword [rcx], rax
mov qword [rcx + 8], 0
mov qword [rsp + 0x20], rcx
xor ecx, ecx
xor edx, edx
xor r9d, r9d
call fcn.1800137d0
mov rdx, rax
mov qword [0x180019150], rax
mov rax, qword [rsp + 0x190]
mov cl, byte [rsp + 0x188]
mov r9b, byte [rsp + 0x180]
mov r10b, byte [rsp + 0x178]
lea r8, [rsp + 0x40]
mov qword [r8], r14
movups xmm0, xmmword [rbx]
movups xmmword [r8 + 8], xmm0
movups xmm0, xmmword [rdi]
movups xmmword [r8 + 0x18], xmm0
movups xmm0, xmmword [r13]
movups xmmword [r8 + 0x28], xmm0
movups xmm0, xmmword [r12]
movups xmmword [r8 + 0x38], xmm0
movss dword [r8 + 0x48], xmm6
movups xmm0, xmmword [rbp]
movups xmmword [r8 + 0x4c], xmm0
movups xmm0, xmmword [r15]
movups xmmword [r8 + 0x60], xmm0
mov byte [r8 + 0x70], r10b
mov byte [r8 + 0x71], r9b
mov byte [r8 + 0x72], cl
movups xmm0, xmmword [rax]
movups xmmword [r8 + 0x74], xmm0
mov rax, qword [0x1800191f0]
lea rcx, [rsp + 0x30]
mov qword [rcx], rax
mov qword [rcx + 8], 0
mov qword [rsp + 0x20], rcx
mov rcx, rsi
xor r9d, r9d
call fcn.1800137d0
movaps xmm6, xmmword [rsp + 0xd0]
add rsp, 0xe8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x18000eab6
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0xb8
mov rsi, rcx
mov rdx, qword [0x180019168]
test rdx, rdx
jne 0x18000eb67
lea r8, [rsp + 0x42]
movaps xmm0, xmmword [0x180015730]
movaps xmmword [r8 - 2], xmm0
movaps xmm0, xmmword [0x180015740]
movaps xmmword [r8 + 0xe], xmm0
movaps xmm0, xmmword [0x180015750]
movaps xmmword [r8 + 0x1e], xmm0
movabs rax, 0x65007300420066
mov qword [r8 + 0x2e], rax
mov dword [r8 + 0x36], 0x12007c
mov word [r8 + 0x72], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0x12
inc rax
cmp rax, 0x3a
jne 0x18000eb1d
mov word [rsp + 0xb4], 0
mov rax, qword [0x180019130]
lea rcx, [rsp + 0x30]
mov qword [rcx], rax
mov qword [rcx + 8], 0
mov qword [rsp + 0x20], rcx
xor ecx, ecx
xor edx, edx
xor r9d, r9d
call fcn.1800137d0
mov rdx, rax
mov qword [0x180019168], rax
mov rax, qword [0x1800191f0]
lea rcx, [rsp + 0x40]
mov qword [rcx], rax
mov qword [rcx + 8], 0
mov qword [rsp + 0x20], rcx
lea rdi, [rsp + 0x30]
mov rcx, rsi
mov r8, rdi
xor r9d, r9d
call fcn.1800137d0
mov rax, qword [rdi]
add rsp, 0xb8
pop rdi
pop rsi
ret

Function at 0x18000eba4
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xf0
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rdx, qword [0x180019170]
test rdx, rdx
jne 0x18000ec68
lea r8, [rsp + 0x42]
movaps xmm0, xmmword [0x180015760]
movaps xmmword [r8 - 2], xmm0
movaps xmm0, xmmword [0x180015770]
movaps xmmword [r8 + 0xe], xmm0
movaps xmm0, xmmword [0x180015780]
movaps xmmword [r8 + 0x1e], xmm0
movaps xmm0, xmmword [0x180015790]
movaps xmmword [r8 + 0x2e], xmm0
movaps xmm0, xmmword [0x1800157a0]
movaps xmmword [r8 + 0x3e], xmm0
mov word [r8 + 0x4e], 0x73
mov word [r8 + 0x9e], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0x73
inc rax
cmp rax, 0x50
jne 0x18000ec1e
mov word [rsp + 0xe0], 0
mov rax, qword [0x180019130]
lea rcx, [rsp + 0x30]
mov qword [rcx], rax
mov qword [rcx + 8], 0
mov qword [rsp + 0x20], rcx
xor ecx, ecx
xor edx, edx
xor r9d, r9d
call fcn.1800137d0
mov rdx, rax
mov qword [0x180019170], rax
mov rax, qword [0x1800191f0]
lea rcx, [rsp + 0x40]
mov qword [rcx], rax
mov qword [rcx + 8], 0
mov qword [rsp + 0x20], rcx
lea r8, [rsp + 0x30]
mov rcx, rbx
xor r9d, r9d
call fcn.1800137d0
test rdi, rdi
je 0x18000ec9f
mov eax, dword [rsp + 0x30]
mov dword [rdi], eax
test rsi, rsi
je 0x18000ecaa
mov eax, dword [rsp + 0x34]
mov dword [rsi], eax
add rsp, 0xf0
pop rbx
pop rdi
pop rsi
ret
Function at 0x18000ecb6
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x100
mov rdi, rdx
mov rsi, rcx
mov rdx, qword [0x180019178]
test rdx, rdx
jne 0x18000ed7c
lea r8, [rsp + 0x42]
movaps xmm0, xmmword [0x1800157b0]
movaps xmmword [r8 - 2], xmm0
movaps xmm0, xmmword [0x1800157c0]
movaps xmmword [r8 + 0xe], xmm0
movaps xmm0, xmmword [0x1800157d0]
movaps xmmword [r8 + 0x1e], xmm0
movaps xmm0, xmmword [0x1800157e0]
movaps xmmword [r8 + 0x2e], xmm0
movaps xmm0, xmmword [0x1800157f0]
movaps xmmword [r8 + 0x3e], xmm0
movaps xmm0, xmmword [0x180015800]
movaps xmmword [r8 + 0x4e], xmm0
mov word [r8 + 0xba], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0x11
inc rax
cmp rax, 0x5e
jne 0x18000ed32
mov word [rsp + 0xfc], 0
mov rax, qword [0x180019130]
lea rcx, [rsp + 0x30]
mov qword [rcx], rax
mov qword [rcx + 8], 0
mov qword [rsp + 0x20], rcx
xor ecx, ecx
xor edx, edx
xor r9d, r9d
call fcn.1800137d0
mov rdx, rax
mov qword [0x180019178], rax
mov rax, qword [rdi + 0x10]
lea rbx, [rsp + 0x40]
mov qword [rbx + 0x10], rax
movups xmm0, xmmword [rdi]
movaps xmmword [rbx], xmm0
mov rax, qword [0x1800191f0]
lea rcx, [rsp + 0x30]
mov qword [rcx], rax
mov qword [rcx + 8], 0
mov qword [rsp + 0x20], rcx
mov rcx, rsi
mov r8, rbx
xor r9d, r9d
call fcn.1800137d0
mov al, byte [rbx + 0x18]
add rsp, 0x100
pop rbx
pop rdi
pop rsi
ret

Function at 0x18000edc8
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x110
mov rdi, rdx
mov rsi, rcx
mov rdx, qword [0x180019180]
test rdx, rdx
jne 0x18000ee95
lea r8, [rsp + 0x42]
movaps xmm0, xmmword [0x180015810]
movaps xmmword [r8 - 2], xmm0
movaps xmm0, xmmword [0x180015820]
movaps xmmword [r8 + 0xe], xmm0
movaps xmm0, xmmword [0x180015830]
movaps xmmword [r8 + 0x1e], xmm0
movaps xmm0, xmmword [0x180015840]
movaps xmmword [r8 + 0x2e], xmm0
movaps xmm0, xmmword [0x180015850]
movaps xmmword [r8 + 0x3e], xmm0
movaps xmm0, xmmword [0x180015860]
movaps xmmword [r8 + 0x4e], xmm0
mov word [r8 + 0x5e], 0x7a
mov word [r8 + 0xbe], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0x7a
inc rax
cmp rax, 0x60
jne 0x18000ee4b
mov word [rsp + 0x100], 0
mov rax, qword [0x180019130]
lea rcx, [rsp + 0x30]
mov qword [rcx], rax
mov qword [rcx + 8], 0
mov qword [rsp + 0x20], rcx
xor ecx, ecx
xor edx, edx
xor r9d, r9d
call fcn.1800137d0
mov rdx, rax
mov qword [0x180019180], rax
mov rax, qword [rdi + 0x10]
lea rbx, [rsp + 0x40]
mov qword [rbx + 0x10], rax
movups xmm0, xmmword [rdi]
movaps xmmword [rbx], xmm0
mov rax, qword [0x1800191f0]
lea rcx, [rsp + 0x30]
mov qword [rcx], rax
mov qword [rcx + 8], 0
mov qword [rsp + 0x20], rcx
mov rcx, rsi
mov r8, rbx
xor r9d, r9d
call fcn.1800137d0
mov al, byte [rbx + 0x18]
add rsp, 0x110
pop rbx
pop rdi
pop rsi
ret
Function at 0x18000eee0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xe0
mov rdi, rdx
mov rsi, rcx
mov rdx, qword [0x180019188]
test rdx, rdx
jne 0x18000ef9a
lea r8, [rsp + 0x42]
movaps xmm0, xmmword [0x180015870]
movaps xmmword [r8 - 2], xmm0
movaps xmm0, xmmword [0x180015880]
movaps xmmword [r8 + 0xe], xmm0
movaps xmm0, xmmword [0x180015890]
movaps xmmword [r8 + 0x1e], xmm0
movaps xmm0, xmmword [0x1800158a0]
movaps xmmword [r8 + 0x2e], xmm0
movaps xmm0, xmmword [0x1800158b0]
movaps xmmword [r8 + 0x3e], xmm0
mov word [r8 + 0x9a], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0x71
inc rax
cmp rax, 0x4e
jne 0x18000ef50
mov word [rsp + 0xdc], 0
mov rax, qword [0x180019130]
lea rcx, [rsp + 0x30]
mov qword [rcx], rax
mov qword [rcx + 8], 0
mov qword [rsp + 0x20], rcx
xor ecx, ecx
xor edx, edx
xor r9d, r9d
call fcn.1800137d0
mov rdx, rax
mov qword [0x180019188], rax
mov rax, qword [rdi + 0x10]
lea rbx, [rsp + 0x40]
mov qword [rbx + 0x10], rax
movups xmm0, xmmword [rdi]
movaps xmmword [rbx], xmm0
mov rax, qword [0x1800191f0]
lea rcx, [rsp + 0x30]
mov qword [rcx], rax
mov qword [rcx + 8], 0
mov qword [rsp + 0x20], rcx
mov rcx, rsi
mov r8, rbx
xor r9d, r9d
call fcn.1800137d0
mov al, byte [rbx + 0x18]
add rsp, 0xe0
pop rbx
pop rdi
pop rsi
ret

Function at 0x18000efe6
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xf0
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rdx, qword [0x180019190]
test rdx, rdx
jne 0x18000f0ab
lea r8, [rsp + 0x42]
movaps xmm0, xmmword [0x1800158c0]
movaps xmmword [r8 - 2], xmm0
movaps xmm0, xmmword [0x1800158d0]
movaps xmmword [r8 + 0xe], xmm0
movaps xmm0, xmmword [0x1800158e0]
movaps xmmword [r8 + 0x1e], xmm0
movaps xmm0, xmmword [0x1800158f0]
movaps xmmword [r8 + 0x2e], xmm0
movaps xmm0, xmmword [0x180015900]
movaps xmmword [r8 + 0x3e], xmm0
mov dword [r8 + 0x4e], 0x54003a
mov word [r8 + 0xa2], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0x54
inc rax
cmp rax, 0x52
jne 0x18000f061
mov word [rsp + 0xe4], 0
mov rax, qword [0x180019130]
lea rcx, [rsp + 0x30]
mov qword [rcx], rax
mov qword [rcx + 8], 0
mov qword [rsp + 0x20], rcx
xor ecx, ecx
xor edx, edx
xor r9d, r9d
call fcn.1800137d0
mov rdx, rax
mov qword [0x180019190], rax
mov rax, qword [0x1800191f0]
lea rcx, [rsp + 0x40]
mov qword [rcx], rax
mov qword [rcx + 8], 0
mov qword [rsp + 0x20], rcx
lea r8, [rsp + 0x30]
mov rcx, rbx
xor r9d, r9d
call fcn.1800137d0
test rdi, rdi
je 0x18000f0e6
movss xmm0, dword [rsp + 0x30]
movss dword [rdi], xmm0
test rsi, rsi
je 0x18000f0f5
movss xmm0, dword [rsp + 0x34]
movss dword [rsi], xmm0
mov al, byte [rsp + 0x38]
add rsp, 0xf0
pop rbx
pop rdi
pop rsi
ret