joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180156ab0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xb0
mov rax, qword [0x1803d9938]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov ebp, edx
mov rsi, rcx
mov qword [rsp + 0x28], rcx
mov rbx, qword [0x18041bb78]
mov rdi, qword [0x18041bb80]
cmp rbx, rdi
je 0x180156c67
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
nop dword [rax]
nop dword [rax + rax]
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.1800be2c0
nop
lea rdx, [rbx + 0x20]
lea rcx, [rsp + 0x60]
call fcn.1800be2c0
nop
lea rdx, [rbx + 0x40]
lea rcx, [rsp + 0x80]
call fcn.1800be2c0
nop
lea r10, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae r10, qword [rsp + 0x40]
xor eax, eax
mov r11, qword [rsp + 0x50]
add r11, r10
cmp r10, r11
je 0x180156b94
nop
movzx r9d, byte [r10]
lea r8d, [r9 - 0x41]
movzx ecx, r9b
or cl, 0x20
movzx edx, cl
cmp r8b, 0x19
cmova edx, r9d
movsx ecx, dl
add ecx, eax
imul eax, ecx, 0x401
mov ecx, eax
shr ecx, 6
xor eax, ecx
inc r10
cmp r10, r11
jne 0x180156b60
lea ecx, [rax + rax*8]
mov eax, ecx
shr eax, 0xb
xor eax, ecx
imul eax, eax, 0x8001
cmp eax, ebp
je 0x180156bfa
lea rcx, [rsp + 0x60]
call fcn.1800ffed0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x180156beb
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180156be6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180156c58
call fcn.18026980c
add rbx, 0x60
cmp rbx, rdi
jne 0x180156b10
jmp 0x180156c67
lea rdx, [rsp + 0x60]
mov rcx, rsi
call fcn.1800be2c0
nop
lea rcx, [rsi + 0x20]
lea rdx, [rsp + 0x80]
call fcn.1800be2c0
nop
lea rcx, [rsp + 0x60]
call fcn.1800ffed0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x180156c64
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180156c5f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180156c5f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18026980c
mov rax, rsi
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.180269d00
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180156c90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0xa0
mov rax, qword [0x1803d9938]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov esi, ecx
mov rbx, qword [0x18041bb78]
mov rdi, qword [0x18041bb80]
cmp rbx, rdi
je 0x180156dc8
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
nop word [rax + rax]
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.1800be2c0
nop
lea rdx, [rbx + 0x20]
lea rcx, [rsp + 0x50]
call fcn.1800be2c0
nop
lea rdx, [rbx + 0x40]
lea rcx, [rsp + 0x70]
call fcn.1800be2c0
nop
lea r10, [rsp + 0x30]
cmp qword [rsp + 0x48], 0x10
cmovae r10, qword [rsp + 0x30]
xor eax, eax
mov r11, qword [rsp + 0x40]
add r11, r10
cmp r10, r11
je 0x180156d64
nop dword [rax]
movzx r9d, byte [r10]
lea r8d, [r9 - 0x41]
movzx ecx, r9b
or cl, 0x20
movzx edx, cl
cmp r8b, 0x19
cmova edx, r9d
movsx ecx, dl
add ecx, eax
imul eax, ecx, 0x401
mov ecx, eax
shr ecx, 6
xor eax, ecx
inc r10
cmp r10, r11
jne 0x180156d30
lea ecx, [rax + rax*8]
mov eax, ecx
shr eax, 0xb
xor eax, ecx
imul eax, eax, 0x8001
lea rcx, [rsp + 0x50]
cmp eax, esi
je 0x180156def
call fcn.1800ffed0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x180156dbb
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180156db6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180156e28
call fcn.18026980c
add rbx, 0x60
cmp rbx, rdi
jne 0x180156ce0
xor al, al
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.180269d00
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
call fcn.1800ffed0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x180156e34
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180156e2f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180156e2f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18026980c
mov al, 1
jmp 0x180156dca

Function at 0x180157ae0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
xor eax, eax
mov rbx, rdx
mov r11d, eax
mov rdi, rcx
nop word [rax + rax]
movzx r10d, byte [r11 + rbx]
movzx r8d, r10b
or r8b, 0x20
movzx edx, r8b
lea r9d, [r10 - 0x41]
cmp r9b, 0x19
cmova edx, r10d
inc r11
movsx ecx, dl
add ecx, eax
imul eax, ecx, 0x401
mov ecx, eax
shr ecx, 6
xor eax, ecx
cmp r11, 0x17
jb 0x180157b00
lea ecx, [rax + rax*8]
mov qword [rdi + 8], rbx
mov rbx, qword [rsp + 8]
mov eax, ecx
shr eax, 0xb
xor eax, ecx
imul eax, eax, 0x8001
mov dword [rdi], eax
mov rax, rdi
mov rdi, qword [rsp + 0x10]
ret
Function at 0x180157b60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
xor r10d, r10d
lea rbx, [rdx + 2]
mov rdi, rdx
mov r11, rcx
lea esi, [r10 + 5]
movzx r9d, byte [rbx - 2]
lea rbx, [rbx + 5]
movzx eax, r9b
or al, 0x20
movzx edx, al
lea r8d, [r9 - 0x41]
cmp r8b, 0x19
movzx r8d, byte [rbx - 6]
cmova edx, r9d
movsx eax, dl
add eax, r10d
lea edx, [r8 - 0x41]
imul r9d, eax, 0x401
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movzx r8d, byte [rbx - 5]
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
lea edx, [r8 - 0x41]
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movzx r8d, byte [rbx - 4]
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
lea edx, [r8 - 0x41]
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movzx r8d, byte [rbx - 3]
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
lea edx, [r8 - 0x41]
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movsx eax, cl
add eax, r9d
imul r10d, eax, 0x401
mov eax, r10d
shr eax, 6
xor r10d, eax
sub rsi, 1
jne 0x180157b80
mov rbx, qword [rsp + 8]
lea eax, [r10 + r10*8]
mov rsi, qword [rsp + 0x10]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
mov qword [r11 + 8], rdi
mov rdi, qword [rsp + 0x18]
imul eax, ecx, 0x8001
mov dword [r11], eax
mov rax, r11
ret

Function at 0x180157cb0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
xor eax, eax
mov rbx, rdx
mov r11d, eax
mov rdi, rcx
nop word [rax + rax]
movzx r10d, byte [r11 + rbx]
movzx r8d, r10b
or r8b, 0x20
movzx edx, r8b
lea r9d, [r10 - 0x41]
cmp r9b, 0x19
cmova edx, r10d
inc r11
movsx ecx, dl
add ecx, eax
imul eax, ecx, 0x401
mov ecx, eax
shr ecx, 6
xor eax, ecx
cmp r11, 0x1f
jb 0x180157cd0
lea ecx, [rax + rax*8]
mov qword [rdi + 8], rbx
mov rbx, qword [rsp + 8]
mov eax, ecx
shr eax, 0xb
xor eax, ecx
imul eax, eax, 0x8001
mov dword [rdi], eax
mov rax, rdi
mov rdi, qword [rsp + 0x10]
ret
Function at 0x1801587b0
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea r10, [rcx + 2]
lea r11d, [r9 + 3]
nop dword [rax + rax]
movzx r8d, byte [r10 - 2]
movzx eax, r8b
or al, 0x20
movzx ecx, al
lea edx, [r8 - 0x41]
cmp dl, 0x19
cmova ecx, r8d
movzx r8d, byte [r10 - 1]
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
lea edx, [r8 - 0x41]
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movzx r8d, byte [r10]
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
lea edx, [r8 - 0x41]
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movzx r8d, byte [r10 + 1]
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
lea edx, [r8 - 0x41]
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movzx r8d, byte [r10 + 2]
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
lea edx, [r8 - 0x41]
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movzx r8d, byte [r10 + 3]
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
lea edx, [r8 - 0x41]
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movzx r8d, byte [r10 + 4]
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
lea edx, [r8 - 0x41]
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, r8b
or al, 0x20
lea r10, [r10 + 7]
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
mov eax, r9d
shr eax, 6
xor r9d, eax
sub r11, 1
jne 0x1801587c0
lea eax, [r9 + r9*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
imul eax, ecx, 0x8001
ret
Function at 0x180158930
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea r10, [rcx + 2]
lea r11d, [r9 + 2]
nop dword [rax + rax]
movzx r8d, byte [r10 - 2]
movzx eax, r8b
or al, 0x20
movzx ecx, al
lea edx, [r8 - 0x41]
cmp dl, 0x19
cmova ecx, r8d
movzx r8d, byte [r10 - 1]
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
lea edx, [r8 - 0x41]
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movzx r8d, byte [r10]
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
lea edx, [r8 - 0x41]
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movzx r8d, byte [r10 + 1]
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
lea edx, [r8 - 0x41]
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movzx r8d, byte [r10 + 2]
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
lea edx, [r8 - 0x41]
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movzx r8d, byte [r10 + 3]
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
lea edx, [r8 - 0x41]
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movzx r8d, byte [r10 + 4]
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
lea edx, [r8 - 0x41]
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, r8b
or al, 0x20
lea r10, [r10 + 0xb]
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movzx r8d, byte [r10 - 6]
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
lea edx, [r8 - 0x41]
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movzx r8d, byte [r10 - 5]
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
lea edx, [r8 - 0x41]
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movzx r8d, byte [r10 - 4]
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
lea edx, [r8 - 0x41]
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movzx r8d, byte [r10 - 3]
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
lea edx, [r8 - 0x41]
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
mov eax, r9d
shr eax, 6
xor r9d, eax
sub r11, 1
jne 0x180158940
lea eax, [r9 + r9*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
imul eax, ecx, 0x8001
ret
Function at 0x180158b70
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea r10, [rcx + 2]
lea r11d, [r9 + 2]
nop dword [rax + rax]
movzx r8d, byte [r10 - 2]
movzx eax, r8b
or al, 0x20
movzx ecx, al
lea edx, [r8 - 0x41]
cmp dl, 0x19
cmova ecx, r8d
movzx r8d, byte [r10 - 1]
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
lea edx, [r8 - 0x41]
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movzx r8d, byte [r10]
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
lea edx, [r8 - 0x41]
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movzx r8d, byte [r10 + 1]
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
lea edx, [r8 - 0x41]
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movzx r8d, byte [r10 + 2]
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
lea edx, [r8 - 0x41]
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movzx r8d, byte [r10 + 3]
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
lea edx, [r8 - 0x41]
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movzx r8d, byte [r10 + 4]
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
lea edx, [r8 - 0x41]
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, r8b
or al, 0x20
lea r10, [r10 + 0xc]
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movzx r8d, byte [r10 - 7]
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
lea edx, [r8 - 0x41]
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movzx r8d, byte [r10 - 6]
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
lea edx, [r8 - 0x41]
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movzx r8d, byte [r10 - 5]
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
lea edx, [r8 - 0x41]
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movzx r8d, byte [r10 - 4]
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
lea edx, [r8 - 0x41]
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movzx r8d, byte [r10 - 3]
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
lea edx, [r8 - 0x41]
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
mov eax, r9d
shr eax, 6
xor r9d, eax
sub r11, 1
jne 0x180158b80
lea eax, [r9 + r9*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
imul eax, ecx, 0x8001
ret
Function at 0x180158de0
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea r10, [rcx + 2]
lea r11d, [r9 + 2]
nop dword [rax + rax]
movzx r8d, byte [r10 - 2]
movzx eax, r8b
or al, 0x20
movzx ecx, al
lea edx, [r8 - 0x41]
cmp dl, 0x19
cmova ecx, r8d
movzx r8d, byte [r10 - 1]
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
lea edx, [r8 - 0x41]
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movzx r8d, byte [r10]
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
lea edx, [r8 - 0x41]
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movzx r8d, byte [r10 + 1]
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
lea edx, [r8 - 0x41]
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movzx r8d, byte [r10 + 2]
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
lea edx, [r8 - 0x41]
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movzx r8d, byte [r10 + 3]
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
lea edx, [r8 - 0x41]
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movzx r8d, byte [r10 + 4]
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
lea edx, [r8 - 0x41]
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movzx r8d, byte [r10 + 5]
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
lea edx, [r8 - 0x41]
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movzx r8d, byte [r10 + 6]
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
lea edx, [r8 - 0x41]
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movzx r8d, byte [r10 + 7]
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
lea edx, [r8 - 0x41]
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movzx r8d, byte [r10 + 8]
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
lea edx, [r8 - 0x41]
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movzx r8d, byte [r10 + 9]
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
lea edx, [r8 - 0x41]
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movzx r8d, byte [r10 + 0xa]
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
lea edx, [r8 - 0x41]
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
lea r10, [r10 + 0xd]
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
mov eax, r9d
shr eax, 6
xor r9d, eax
sub r11, 1
jne 0x180158df0
lea eax, [r9 + r9*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
imul eax, ecx, 0x8001
ret
Function at 0x180159080
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea r10, [rcx + 2]
lea r11d, [r9 + 3]
nop dword [rax + rax]
movzx r8d, byte [r10 - 2]
movzx eax, r8b
or al, 0x20
movzx ecx, al
lea edx, [r8 - 0x41]
cmp dl, 0x19
cmova ecx, r8d
movzx r8d, byte [r10 - 1]
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
lea edx, [r8 - 0x41]
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movzx r8d, byte [r10]
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
lea edx, [r8 - 0x41]
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movzx r8d, byte [r10 + 1]
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
lea edx, [r8 - 0x41]
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movzx r8d, byte [r10 + 2]
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
lea edx, [r8 - 0x41]
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movzx r8d, byte [r10 + 3]
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
lea edx, [r8 - 0x41]
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movzx r8d, byte [r10 + 4]
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
lea edx, [r8 - 0x41]
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, r8b
or al, 0x20
lea r10, [r10 + 9]
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movzx r8d, byte [r10 - 4]
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
lea edx, [r8 - 0x41]
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movzx r8d, byte [r10 - 3]
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
lea edx, [r8 - 0x41]
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
mov eax, r9d
shr eax, 6
xor r9d, eax
sub r11, 1
jne 0x180159090
lea eax, [r9 + r9*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
imul eax, ecx, 0x8001
ret
Function at 0x180159260
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea r10, [rcx + 2]
lea r11d, [r9 + 2]
nop dword [rax + rax]
movzx r8d, byte [r10 - 2]
movzx eax, r8b
or al, 0x20
movzx ecx, al
lea edx, [r8 - 0x41]
cmp dl, 0x19
cmova ecx, r8d
movzx r8d, byte [r10 - 1]
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
lea edx, [r8 - 0x41]
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movzx r8d, byte [r10]
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
lea edx, [r8 - 0x41]
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movzx r8d, byte [r10 + 1]
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
lea edx, [r8 - 0x41]
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movzx r8d, byte [r10 + 2]
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
lea edx, [r8 - 0x41]
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movzx r8d, byte [r10 + 3]
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
lea edx, [r8 - 0x41]
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movzx r8d, byte [r10 + 4]
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
lea edx, [r8 - 0x41]
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movzx r8d, byte [r10 + 5]
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
lea edx, [r8 - 0x41]
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movzx r8d, byte [r10 + 6]
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
lea edx, [r8 - 0x41]
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movzx r8d, byte [r10 + 7]
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
lea edx, [r8 - 0x41]
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movzx r8d, byte [r10 + 8]
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
lea edx, [r8 - 0x41]
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movzx r8d, byte [r10 + 9]
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
lea edx, [r8 - 0x41]
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movzx r8d, byte [r10 + 0xa]
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
lea edx, [r8 - 0x41]
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movzx r8d, byte [r10 + 0xb]
movsx eax, cl
lea r10, [r10 + 0xe]
add eax, r9d
imul r9d, eax, 0x401
lea edx, [r8 - 0x41]
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
mov eax, r9d
shr eax, 6
xor r9d, eax
sub r11, 1
jne 0x180159270
lea eax, [r9 + r9*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
imul eax, ecx, 0x8001
ret
Function at 0x18015dc40
Capabilities:
Encode data using xor

Disassembly:
mov r10, qword [rcx]
xor eax, eax
mov r11, qword [rcx + 8]
add r11, r10
cmp r10, r11
je 0x18015dc85
movzx r9d, byte [r10]
movzx ecx, r9b
or cl, 0x20
movzx edx, cl
lea r8d, [r9 - 0x41]
cmp r8b, 0x19
cmova edx, r9d
inc r10
movsx ecx, dl
add ecx, eax
imul eax, ecx, 0x401
mov ecx, eax
shr ecx, 6
xor eax, ecx
cmp r10, r11
jne 0x18015dc51
lea ecx, [rax + rax*8]
mov eax, ecx
shr eax, 0xb
xor eax, ecx
imul eax, eax, 0x8001
ret