joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800a5e5c
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x19
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x1800a5e69
mov byte [rcx + 0x1d], r10b
ret

Function at 0x1800a5ea0
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov dl, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8b, dl
mov byte [rax + r9], r8b
inc r9
cmp r9, 9
jb 0x1800a5ea7
mov byte [rcx + 0xd], 0
ret

Function at 0x1800a5ec8
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 6
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x1800a5ed5
mov byte [rcx + 0xa], r10b
ret

Function at 0x1800a5f0c
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov dl, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8b, dl
mov byte [rax + r9], r8b
inc r9
cmp r9, 0xa
jb 0x1800a5f13
mov byte [rcx + 0xe], 0
ret

Function at 0x1800a5f50
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 4
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x1800a5f5d
mov byte [rcx + 8], r10b
ret
Function at 0x1800a76d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x180199d30]
mov rbx, rdx
test rax, rax
jne 0x1800a7781
mov dword [rbp - 0x50], 0x70
xor edx, edx
mov byte [rbp - 0x4c], 0x26
mov byte [rbp - 0x4b], 0x19
mov byte [rbp - 0x4a], 2
mov byte [rbp - 0x49], 4
mov byte [rbp - 0x48], 5
mov byte [rbp - 0x47], 0x11
mov byte [rbp - 0x46], 0x1c
mov byte [rbp - 0x45], 0x21
mov byte [rbp - 0x44], 5
mov byte [rbp - 0x43], 0x15
mov byte [rbp - 0x42], 2
mov byte [rbp - 0x41], 9
mov byte [rbp - 0x40], al
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x1800a772f
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x180199d30], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x180199d30]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x1800a77aa
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x1800a77d6
cmp dword [rbp - 0x18], 0x10000
je 0x1800a77d6
cmp qword [rbp - 0x20], 0x1000
jb 0x1800a77d6
cmp dword [rbp - 0x10], 0x1000000
je 0x1800a77d2
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x1800a77d8
mov al, 1
jmp 0x1800a77d8
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x1800a7e58
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x180199d48]
mov rbx, rdx
test rax, rax
jne 0x1800a7f09
mov dword [rbp - 0x50], 0x70
xor edx, edx
mov byte [rbp - 0x4c], 0x26
mov byte [rbp - 0x4b], 0x19
mov byte [rbp - 0x4a], 2
mov byte [rbp - 0x49], 4
mov byte [rbp - 0x48], 5
mov byte [rbp - 0x47], 0x11
mov byte [rbp - 0x46], 0x1c
mov byte [rbp - 0x45], 0x21
mov byte [rbp - 0x44], 5
mov byte [rbp - 0x43], 0x15
mov byte [rbp - 0x42], 2
mov byte [rbp - 0x41], 9
mov byte [rbp - 0x40], al
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x1800a7eb7
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x180199d48], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x180199d48]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x1800a7f32
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x1800a7f5e
cmp dword [rbp - 0x18], 0x10000
je 0x1800a7f5e
cmp qword [rbp - 0x20], 0x1000
jb 0x1800a7f5e
cmp dword [rbp - 0x10], 0x1000000
je 0x1800a7f5a
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x1800a7f60
mov al, 1
jmp 0x1800a7f60
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x1800a9a74
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
xor ebx, ebx
mov r12, r8
mov rdi, rdx
test rdx, rdx
jne 0x1800a9aa6
xor eax, eax
jmp 0x1800a9c4f
movsxd r13, dword [rdx + 0x3c]
mov ecx, dword [rdx + r13 + 0x88]
add rcx, rdi
mov r15d, dword [rcx + 0x1c]
mov ebp, dword [rcx + 0x20]
add r15, rdi
mov esi, dword [rcx + 0x24]
add rbp, rdi
add rsi, rdi
test r12d, 0xffff0000
jne 0x1800a9ae4
movzx eax, r12w
sub eax, dword [rcx + 0x10]
mov ebx, dword [r15 + rax*4]
add rbx, rdi
jmp 0x1800a9c4c
mov r14d, dword [rcx + 0x18]
jmp 0x1800a9b08
mov ecx, dword [rbp]
mov rdx, r12
add rcx, rdi
dec r14d
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcmp]
test eax, eax
je 0x1800a9b12
add rbp, 4
add rsi, 2
test r14d, r14d
jne 0x1800a9aea
jmp 0x1800a9c4c
movzx eax, word [rsi]
mov edx, dword [rdi + r13 + 0x88]
mov ecx, dword [r15 + rax*4]
cmp rdx, rcx
ja 0x1800a9c48
mov eax, dword [rdi + r13 + 0x8c]
add eax, edx
cmp rcx, rax
jae 0x1800a9c48
lea rsi, [rcx + rdi]
mov rcx, rsi
lea rdx, [0x180164cbc]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
mov r15d, 2
mov rbp, rax
mov edx, r15d
lea rdi, [rax + 1]
sub rdi, rsi
lea rcx, [rdi + 4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov r14, rax
test rax, rax
je 0x1800a9c4c
lea r8, [rdi + 1]
mov qword [rsp + 0x20], rdi
mov r9, rsi
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_mbstowcs_s]
lea rdi, [r14 + rdi*2]
lea ecx, [r15 + 4]
lea rsi, [0x1801653c0]
rep movsb byte [rdi], byte [rsi]
lea edi, [r15 + 2]
mov rcx, r14
mov r8d, edi
lea rdx, str.api_
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x1800a9bd4
mov r8d, edi
lea rdx, str.ext_
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x1800a9c1d
mov rdx, qword [rsp + 0x88]
lea r9, [rsp + 0x78]
mov r8, r14
call fcn.1800a9088
mov rsi, rax
test rax, rax
je 0x1800a9c1d
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rdi, qword [rsp + 0x78]
mov rdx, r15
lea rcx, [rdi + 1]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov r14, rax
test rax, rax
je 0x1800a9c4c
lea rcx, [rdi + rdi]
mov rdi, rax
rep movsb byte [rdi], byte [rsi]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, qword [rsp + 0x70]
lea r8, [rbp + 1]
mov rdx, rax
mov r9, r14
call fcn.1800a9a74
mov rcx, r14
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1800a9c4c
lea rbx, [rcx + rdi]
mov rax, rbx
mov rbx, qword [rsp + 0x80]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800a9c68
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
mov rsi, r8
mov rdx, r9
mov r8, qword [rsp + 0x50]
mov rcx, rsi
mov rbx, r9
call qword [sym.imp.VCRUNTIME140.dll_memcmp]
test eax, eax
je 0x1800a9cd6
mov rdx, qword [rsp + 0x50]
lea r9, [rsp + 0x38]
mov r8d, 0x40
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1800a9cd6
mov rcx, qword [rsp + 0x50]
lea r9, [rsp + 0x38]
mov r8d, dword [rsp + 0x38]
mov rdi, rbx
mov rdx, qword [rsp + 0x50]
rep movsb byte [rdi], byte [rsi]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1800ab56c
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x35
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x1800ab579
xor edx, edx
mov word [rcx + 0x6e], dx
ret

Function at 0x1800ab59c
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x14
jb 0x1800ab5a9
mov word [rcx + 0x2c], r11w
ret
Function at 0x1800b4554
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov dl, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8b, dl
mov byte [rax + r9], r8b
inc r9
cmp r9, 0x21
jb 0x1800b455b
mov byte [rcx + 0x25], 0
ret
Function at 0x1800b66b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x180199d60]
mov rbx, rdx
test rax, rax
jne 0x1800b6753
mov byte [rbp - 0x40], 0x5f
xor ecx, ecx
mov byte [rbp - 0x3f], 0x72
mov byte [rbp - 0x3e], 0x7b
mov byte [rbp - 0x3d], 0x7d
mov byte [rbp - 0x3c], 0x7e
mov byte [rbp - 0x3b], 0x6a
mov byte [rbp - 0x3a], 0x75
mov byte [rbp - 0x39], 0x5a
mov byte [rbp - 0x38], 0x7e
mov byte [rbp - 0x37], 0x6e
mov byte [rbp - 0x36], 0x7b
mov byte [rbp - 0x35], 0x82
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 9
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x1800b6708
lea rcx, [0x180164c98]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x180199d60], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x180199d60]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x1800b677c
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x1800b67a8
cmp dword [rbp - 0x10], 0x10000
je 0x1800b67a8
cmp qword [rbp - 0x18], 0x1000
jb 0x1800b67a8
cmp dword [rbp - 8], 0x1000000
je 0x1800b67a4
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x1800b67aa
mov al, 1
jmp 0x1800b67aa
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x1800b7e6c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x180199d88]
mov rbx, rdx
test rax, rax
jne 0x1800b7f0f
mov byte [rbp - 0x40], 0x5f
xor ecx, ecx
mov byte [rbp - 0x3f], 0x72
mov byte [rbp - 0x3e], 0x7b
mov byte [rbp - 0x3d], 0x7d
mov byte [rbp - 0x3c], 0x7e
mov byte [rbp - 0x3b], 0x6a
mov byte [rbp - 0x3a], 0x75
mov byte [rbp - 0x39], 0x5a
mov byte [rbp - 0x38], 0x7e
mov byte [rbp - 0x37], 0x6e
mov byte [rbp - 0x36], 0x7b
mov byte [rbp - 0x35], 0x82
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 9
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x1800b7ec4
lea rcx, [0x180164c98]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x180199d88], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x180199d88]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x1800b7f38
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x1800b7f64
cmp dword [rbp - 0x10], 0x10000
je 0x1800b7f64
cmp qword [rbp - 0x18], 0x1000
jb 0x1800b7f64
cmp dword [rbp - 8], 0x1000000
je 0x1800b7f60
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x1800b7f66
mov al, 1
jmp 0x1800b7f66
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x1800b9628
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x180199d70]
mov rbx, rdx
test rax, rax
jne 0x1800b96cb
mov byte [rbp - 0x40], 0x5f
xor ecx, ecx
mov byte [rbp - 0x3f], 0x72
mov byte [rbp - 0x3e], 0x7b
mov byte [rbp - 0x3d], 0x7d
mov byte [rbp - 0x3c], 0x7e
mov byte [rbp - 0x3b], 0x6a
mov byte [rbp - 0x3a], 0x75
mov byte [rbp - 0x39], 0x5a
mov byte [rbp - 0x38], 0x7e
mov byte [rbp - 0x37], 0x6e
mov byte [rbp - 0x36], 0x7b
mov byte [rbp - 0x35], 0x82
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 9
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x1800b9680
lea rcx, [0x180164c98]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x180199d70], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x180199d70]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x1800b96f4
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x1800b9720
cmp dword [rbp - 0x10], 0x10000
je 0x1800b9720
cmp qword [rbp - 0x18], 0x1000
jb 0x1800b9720
cmp dword [rbp - 8], 0x1000000
je 0x1800b971c
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x1800b9722
mov al, 1
jmp 0x1800b9722
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x1800c86f8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x180199e48]
mov rbx, rdx
test rax, rax
jne 0x1800c87f3
mov dword [rbp - 0x50], 0x53
mov eax, dword [rbp - 0x50]
xor al, 0x56
mov byte [rbp - 0x4c], al
mov eax, dword [rbp - 0x50]
inc al
xor al, 0x69
mov byte [rbp - 0x4b], al
mov eax, dword [rbp - 0x50]
add al, 2
xor al, 0x72
mov byte [rbp - 0x4a], al
mov eax, dword [rbp - 0x50]
add al, 3
xor al, 0x74
mov byte [rbp - 0x49], al
mov eax, dword [rbp - 0x50]
add al, 4
xor al, 0x75
mov byte [rbp - 0x48], al
mov eax, dword [rbp - 0x50]
add al, 5
xor al, 0x61
mov byte [rbp - 0x47], al
mov eax, dword [rbp - 0x50]
add al, 6
xor al, 0x6c
mov byte [rbp - 0x46], al
mov eax, dword [rbp - 0x50]
add al, 7
xor al, 0x51
mov byte [rbp - 0x45], al
mov eax, dword [rbp - 0x50]
add al, 8
xor al, 0x75
mov byte [rbp - 0x44], al
mov eax, dword [rbp - 0x50]
add al, 9
xor al, 0x65
mov byte [rbp - 0x43], al
mov eax, dword [rbp - 0x50]
add al, 0xa
xor al, 0x72
mov byte [rbp - 0x42], al
mov eax, dword [rbp - 0x50]
add al, 0xb
xor al, 0x79
mov byte [rbp - 0x41], al
xor eax, eax
mov byte [rbp - 0x40], al
xor edx, edx
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
add cl, dl
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x1800c879f
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x180199e48], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x180199e48]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x1800c881c
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x1800c8848
cmp dword [rbp - 0x18], 0x10000
je 0x1800c8848
cmp qword [rbp - 0x20], 0x1000
jb 0x1800c8848
cmp dword [rbp - 0x10], 0x1000000
je 0x1800c8844
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x1800c884a
mov al, 1
jmp 0x1800c884a
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x1800c8e80
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x180199eb0]
mov rbx, rdx
test rax, rax
jne 0x1800c8f7b
mov dword [rbp - 0x50], 0x53
mov eax, dword [rbp - 0x50]
xor al, 0x56
mov byte [rbp - 0x4c], al
mov eax, dword [rbp - 0x50]
inc al
xor al, 0x69
mov byte [rbp - 0x4b], al
mov eax, dword [rbp - 0x50]
add al, 2
xor al, 0x72
mov byte [rbp - 0x4a], al
mov eax, dword [rbp - 0x50]
add al, 3
xor al, 0x74
mov byte [rbp - 0x49], al
mov eax, dword [rbp - 0x50]
add al, 4
xor al, 0x75
mov byte [rbp - 0x48], al
mov eax, dword [rbp - 0x50]
add al, 5
xor al, 0x61
mov byte [rbp - 0x47], al
mov eax, dword [rbp - 0x50]
add al, 6
xor al, 0x6c
mov byte [rbp - 0x46], al
mov eax, dword [rbp - 0x50]
add al, 7
xor al, 0x51
mov byte [rbp - 0x45], al
mov eax, dword [rbp - 0x50]
add al, 8
xor al, 0x75
mov byte [rbp - 0x44], al
mov eax, dword [rbp - 0x50]
add al, 9
xor al, 0x65
mov byte [rbp - 0x43], al
mov eax, dword [rbp - 0x50]
add al, 0xa
xor al, 0x72
mov byte [rbp - 0x42], al
mov eax, dword [rbp - 0x50]
add al, 0xb
xor al, 0x79
mov byte [rbp - 0x41], al
xor eax, eax
mov byte [rbp - 0x40], al
xor edx, edx
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
add cl, dl
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x1800c8f27
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x180199eb0], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x180199eb0]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x1800c8fa4
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x1800c8fd0
cmp dword [rbp - 0x18], 0x10000
je 0x1800c8fd0
cmp qword [rbp - 0x20], 0x1000
jb 0x1800c8fd0
cmp dword [rbp - 0x10], 0x1000000
je 0x1800c8fcc
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x1800c8fd2
mov al, 1
jmp 0x1800c8fd2
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x1800c9608
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x180199e50]
mov rbx, rdx
test rax, rax
jne 0x1800c9703
mov dword [rbp - 0x50], 0x53
mov eax, dword [rbp - 0x50]
xor al, 0x56
mov byte [rbp - 0x4c], al
mov eax, dword [rbp - 0x50]
inc al
xor al, 0x69
mov byte [rbp - 0x4b], al
mov eax, dword [rbp - 0x50]
add al, 2
xor al, 0x72
mov byte [rbp - 0x4a], al
mov eax, dword [rbp - 0x50]
add al, 3
xor al, 0x74
mov byte [rbp - 0x49], al
mov eax, dword [rbp - 0x50]
add al, 4
xor al, 0x75
mov byte [rbp - 0x48], al
mov eax, dword [rbp - 0x50]
add al, 5
xor al, 0x61
mov byte [rbp - 0x47], al
mov eax, dword [rbp - 0x50]
add al, 6
xor al, 0x6c
mov byte [rbp - 0x46], al
mov eax, dword [rbp - 0x50]
add al, 7
xor al, 0x51
mov byte [rbp - 0x45], al
mov eax, dword [rbp - 0x50]
add al, 8
xor al, 0x75
mov byte [rbp - 0x44], al
mov eax, dword [rbp - 0x50]
add al, 9
xor al, 0x65
mov byte [rbp - 0x43], al
mov eax, dword [rbp - 0x50]
add al, 0xa
xor al, 0x72
mov byte [rbp - 0x42], al
mov eax, dword [rbp - 0x50]
add al, 0xb
xor al, 0x79
mov byte [rbp - 0x41], al
xor eax, eax
mov byte [rbp - 0x40], al
xor edx, edx
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
add cl, dl
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x1800c96af
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x180199e50], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x180199e50]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x1800c972c
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x1800c9758
cmp dword [rbp - 0x18], 0x10000
je 0x1800c9758
cmp qword [rbp - 0x20], 0x1000
jb 0x1800c9758
cmp dword [rbp - 0x10], 0x1000000
je 0x1800c9754
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x1800c975a
mov al, 1
jmp 0x1800c975a
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x1800c9d90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x180199e28]
mov rbx, rdx
test rax, rax
jne 0x1800c9e8b
mov dword [rbp - 0x50], 0x53
mov eax, dword [rbp - 0x50]
xor al, 0x56
mov byte [rbp - 0x4c], al
mov eax, dword [rbp - 0x50]
inc al
xor al, 0x69
mov byte [rbp - 0x4b], al
mov eax, dword [rbp - 0x50]
add al, 2
xor al, 0x72
mov byte [rbp - 0x4a], al
mov eax, dword [rbp - 0x50]
add al, 3
xor al, 0x74
mov byte [rbp - 0x49], al
mov eax, dword [rbp - 0x50]
add al, 4
xor al, 0x75
mov byte [rbp - 0x48], al
mov eax, dword [rbp - 0x50]
add al, 5
xor al, 0x61
mov byte [rbp - 0x47], al
mov eax, dword [rbp - 0x50]
add al, 6
xor al, 0x6c
mov byte [rbp - 0x46], al
mov eax, dword [rbp - 0x50]
add al, 7
xor al, 0x51
mov byte [rbp - 0x45], al
mov eax, dword [rbp - 0x50]
add al, 8
xor al, 0x75
mov byte [rbp - 0x44], al
mov eax, dword [rbp - 0x50]
add al, 9
xor al, 0x65
mov byte [rbp - 0x43], al
mov eax, dword [rbp - 0x50]
add al, 0xa
xor al, 0x72
mov byte [rbp - 0x42], al
mov eax, dword [rbp - 0x50]
add al, 0xb
xor al, 0x79
mov byte [rbp - 0x41], al
xor eax, eax
mov byte [rbp - 0x40], al
xor edx, edx
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
add cl, dl
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x1800c9e37
lea rcx, [0x180164c98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x180199e28], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x180199e28]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x1800c9eb4
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x1800c9ee0
cmp dword [rbp - 0x18], 0x10000
je 0x1800c9ee0
cmp qword [rbp - 0x20], 0x1000
jb 0x1800c9ee0
cmp dword [rbp - 0x10], 0x1000000
je 0x1800c9edc
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x1800c9ee2
mov al, 1
jmp 0x1800c9ee2
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret