joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180011da0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x80], 0
jne 0x180011dcd
xor ecx, ecx
call sub.KERNEL32.dll_GetModuleHandleW
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x180011ded
mov ecx, 0xc1
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x180011f66
mov rax, qword [rsp + 0x40]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x40]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp dword [rax], 0x4550
je 0x180011e24
mov ecx, 0xbf
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x180011f66
mov rax, qword [rsp + 0x38]
movzx eax, word [rax + 0x14]
test eax, eax
jne 0x180011e42
mov ecx, 0xc0
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x180011f66
mov rax, qword [rsp + 0x38]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x38]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x20], 0
jmp 0x180011e6e
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x38]
movzx eax, word [rax + 6]
cmp dword [rsp + 0x20], eax
jae 0x180011f4a
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
lea rdx, str..detour
mov rcx, rax
call fcn.180097980
test eax, eax
jne 0x180011f45
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x48]
cmp dword [rcx + rax + 0xc], 0
je 0x180011ed3
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x48]
cmp dword [rcx + rax + 0x10], 0
jne 0x180011ed5
jmp 0x180011f4a
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x48]
mov eax, dword [rcx + rax + 0xc]
mov rcx, qword [rsp + 0x40]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax]
cmp rax, 0x40
jb 0x180011f1b
mov rax, qword [rsp + 0x28]
cmp dword [rax + 4], 0x727444
je 0x180011f1d
jmp 0x180011f4a
mov rax, qword [rsp + 0x28]
cmp dword [rax + 8], 0
jne 0x180011f37
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x28]
mov ecx, dword [rcx]
mov dword [rax + 8], ecx
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rsp + 0x28]
jmp 0x180011f66
jmp 0x180011e64
mov ecx, 0xc0
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x180011f66
add rsp, 0x78
ret
Function at 0x180014e90
Capabilities:
Read file on windows

Disassembly:
push rdi
mov eax, 0x11b0
call fcn.180084490
sub rsp, rax
mov rax, qword [0x18013c128]
xor rax, rsp
mov qword [rsp + 0x11a0], rax
cmp qword [0x18013d118], 0
jne 0x180015147
lea rax, [rsp + 0x1a0]
mov rdi, rax
xor eax, eax
mov ecx, 0x1000
rep stosb byte [rdi], al
mov byte [0x18013d120], 0
mov byte [rsp + 0x70], 0xe2
mov byte [rsp + 0x71], 0xb4
mov byte [rsp + 0x72], 0xe2
mov byte [rsp + 0x73], 0xb4
mov byte [rsp + 0x74], 0
mov r8b, 0xc7
mov edx, 4
lea rcx, [rsp + 0x70]
call fcn.180004590
mov byte [rsp + 0x90], 0xb6
mov byte [rsp + 0x91], 0xb4
mov byte [rsp + 0x92], 0xa2
mov byte [rsp + 0x93], 0xa4
mov byte [rsp + 0x94], 0x98
mov byte [rsp + 0x95], 0xa4
mov byte [rsp + 0x96], 0xa8
mov byte [rsp + 0x97], 0xb5
mov byte [rsp + 0x98], 0xa2
mov byte [rsp + 0x99], 0xe9
mov byte [rsp + 0x9a], 0xab
mov byte [rsp + 0x9b], 0xa8
mov byte [rsp + 0x9c], 0xa0
mov byte [rsp + 0x9d], 0
mov r8b, 0xc7
mov edx, recv
lea rcx, [rsp + 0x90]
call fcn.180004590
mov byte [rsp + 0x78], 0xe9
mov byte [rsp + 0x79], 0xe8
mov byte [rsp + 0x7a], 0xb6
mov byte [rsp + 0x7b], 0xb4
mov byte [rsp + 0x7c], 0xe9
mov byte [rsp + 0x7d], 0xb4
mov byte [rsp + 0x7e], 0xa3
mov byte [rsp + 0x7f], 0
mov r8b, 0xc7
mov edx, 7
lea rcx, [rsp + 0x78]
call fcn.180004590
lea rax, [rsp + 0x78]
mov qword [rsp + 0x48], rax
mov byte [rsp + 0x34], 0xb5
mov byte [rsp + 0x35], 0
mov r8b, 0xc7
mov edx, 1
lea rcx, [rsp + 0x34]
call fcn.180004590
mov byte [rsp + 0x80], 0x81
mov byte [rsp + 0x81], 0x81
mov byte [rsp + 0x82], 0x81
mov byte [rsp + 0x83], 0x81
mov byte [rsp + 0x84], 0x81
mov byte [rsp + 0x85], 0x81
mov byte [rsp + 0x86], 0x81
mov byte [rsp + 0x87], 0x81
mov byte [rsp + 0x88], 0
mov r8b, 0xc7
mov edx, 8
lea rcx, [rsp + 0x80]
call fcn.180004590
mov byte [rsp + 0x38], 0xb0
mov byte [rsp + 0x39], 0xec
mov byte [rsp + 0x3a], 0
mov r8b, 0xc7
mov edx, 2
lea rcx, [rsp + 0x38]
call fcn.180004590
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, [0x18010dea4]
lea r8, [rsp + 0x70]
mov edx, 0xfff
lea rcx, [rsp + 0x1a0]
call fcn.180015f60
lea rdx, [rsp + 0x34]
mov rcx, qword [rsp + 0x48]
call fcn.1800986d8
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x180015147
lea rax, [rsp + 0xa0]
mov rdi, rax
xor eax, eax
mov ecx, 0x100
rep stosb byte [rdi], al
mov r9, qword [rsp + 0x40]
mov r8d, 1
mov edx, 0xff
lea rcx, [rsp + 0xa0]
call fcn.1800989e0
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x50]
call fcn.1800156f0
lea rdx, [rsp + 0x80]
mov rcx, rax
call fcn.1800153d0
mov byte [rsp + 0x30], al
lea rcx, [rsp + 0x50]
call fcn.1800157c0
movzx eax, byte [rsp + 0x30]
test eax, eax
je 0x18001513d
mov byte [0x18013d120], 1
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x1a0]
call fcn.1800986d8
mov qword [0x18013d118], rax
mov rcx, qword [rsp + 0x40]
call fcn.180097c00
mov rcx, qword [rsp + 0x11a0]
xor rcx, rsp
call fcn.1800844f0
add rsp, 0x11b0
pop rdi
ret
Function at 0x180015170
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rdi
mov eax, 0x10f0
call fcn.180084490
sub rsp, rax
mov rax, qword [0x18013c128]
xor rax, rsp
mov qword [rsp + 0x10e0], rax
movzx eax, byte [0x18013d120]
test eax, eax
je 0x180015340
lea rcx, [0x18013d128]
call fcn.1800760e0
lea rax, [rsp + 0xe0]
mov rdi, rax
xor eax, eax
mov ecx, 0x1000
rep stosb byte [rdi], al
lea rax, [rsp + 0x1108]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x20]
mov r8, qword [rsp + 0x1100]
mov edx, 0xfff
lea rcx, [rsp + 0xe0]
call fcn.180015fc0
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp qword [0x18013d118], 0
je 0x180015334
lea rax, [rsp + 0x60]
mov rdi, rax
xor eax, eax
mov ecx, 0x80
rep stosb byte [rdi], al
xor ecx, ecx
call fcn.180015380
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x28]
call fcn.180015360
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x40], 0xe2
mov byte [rsp + 0x41], 0x9e
mov byte [rsp + 0x42], 0xea
mov byte [rsp + 0x43], 0xe2
mov byte [rsp + 0x44], 0xaa
mov byte [rsp + 0x45], 0xea
mov byte [rsp + 0x46], 0xe2
mov byte [rsp + 0x47], 0xa3
mov byte [rsp + 0x48], 0xe7
mov byte [rsp + 0x49], 0xe2
mov byte [rsp + 0x4a], 0x8f
mov byte [rsp + 0x4b], 0xfd
mov byte [rsp + 0x4c], 0xe2
mov byte [rsp + 0x4d], 0x8a
mov byte [rsp + 0x4e], 0xfd
mov byte [rsp + 0x4f], 0xe2
mov byte [rsp + 0x50], __WSAFDIsSet
mov byte [rsp + 0x51], 0
mov r8b, 0xc7
mov edx, select
lea rcx, [rsp + 0x40]
call fcn.180004590
mov byte [rsp + 0x38], 0xe2
mov byte [rsp + 0x39], 0xb4
mov byte [rsp + 0x3a], 0xe7
mov byte [rsp + 0x3b], 0xe2
mov byte [rsp + 0x3c], 0xb4
mov byte [rsp + 0x3d], 0xcd
mov byte [rsp + 0x3e], 0
mov r8b, 0xc7
mov edx, 6
lea rcx, [rsp + 0x38]
call fcn.180004590
mov r9, qword [rsp + 0x30]
lea r8, [rsp + 0x40]
mov edx, 0x80
lea rcx, [rsp + 0x60]
call fcn.1800bce00
lea r9, [rsp + 0xe0]
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x38]
mov rcx, qword [0x18013d118]
call fcn.180015f10
mov rcx, qword [0x18013d118]
call fcn.18009839c
lea rcx, [0x18013d128]
call fcn.180076140
mov rcx, qword [rsp + 0x10e0]
xor rcx, rsp
call fcn.1800844f0
add rsp, 0x10f0
pop rdi
ret
Function at 0x18001d5ec
Capabilities:
Get file version info

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
xor ebx, ebx
mov rsi, rdx
lea rdx, [0x18010e098]
mov dword [rax + 0x20], ebx
mov rdi, rcx
mov dword [rax + 0x18], ebx
mov qword [rax - 0x28], rbx
lea r8d, [rbx + 4]
call fcn.1800be668
test eax, eax
jne 0x18001d629
add rdi, 8
lea rdx, [rsp + 0x68]
mov rcx, rdi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov r14d, eax
test eax, eax
je 0x18001d6b7
mov ecx, r14d
call fcn.18008495c
mov r9, rax
mov r8d, r14d
xor edx, edx
mov rcx, rdi
mov rbp, rax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x18001d6af
lea r9, [rsp + 0x60]
mov rcx, rbp
lea r8, [rsp + 0x20]
lea rdx, [0x18010e4a0]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x18001d6af
cmp dword [rsp + 0x60], ebx
je 0x18001d6af
mov rax, qword [rsp + 0x20]
cmp dword [rax], 0xfeef04bd
jne 0x18001d6af
movzx r8d, word [rax + 0xc]
mov bl, 1
movzx edx, word [rax + 0xe]
movzx ecx, word [rax + 8]
movzx eax, word [rax + 0xa]
mov word [rsi + 6], ax
mov word [rsi + 4], cx
mov word [rsi + 2], dx
mov word [rsi], r8w
mov rcx, rbp
call fcn.180084964
mov rbp, qword [rsp + 0x58]
mov al, bl
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret

Function at 0x180026b60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor edi, edi
mov rsi, rcx
cmp qword [rcx + 0x10], rdi
jne 0x180026bc3
lea ecx, [rdi + 0xb]
call fcn.180096e9c
mov rbx, rax
test rax, rax
je 0x180026bc3
lea r8d, [rdi + 0xb]
mov rdx, rsi
mov rcx, rax
call fcn.1800877a0
mov cl, dil
movabs rdx, 0xe943c1519f1d1789
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [rdi + rbx], dl
inc rdi
cmp rdi, 0xb
jb 0x180026b99
ror rbx, 0xd
mov qword [rsi + 0x10], rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x18002946c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor edi, edi
mov rsi, rcx
cmp qword [rcx + 8], rdi
jne 0x1800294cf
lea ecx, [rdi + 2]
call fcn.180096e9c
mov rbx, rax
test rax, rax
je 0x1800294cf
lea r8d, [rdi + 2]
mov rdx, rsi
mov rcx, rax
call fcn.1800877a0
mov cl, dil
movabs rdx, 0xdfafb5419f490ddb
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [rdi + rbx], dl
inc rdi
cmp rdi, 2
jb 0x1800294a5
ror rbx, 0xd
mov qword [rsi + 8], rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1800294e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor edi, edi
mov rsi, rcx
cmp qword [rcx + 8], rdi
jne 0x180029543
lea ecx, [rdi + 2]
call fcn.180096e9c
mov rbx, rax
test rax, rax
je 0x180029543
lea r8d, [rdi + 2]
mov rdx, rsi
mov rcx, rax
call fcn.1800877a0
mov cl, dil
movabs rdx, 0xd385d54713e1dbf3
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [rdi + rbx], dl
inc rdi
cmp rdi, 2
jb 0x180029519
ror rbx, 0xd
mov qword [rsi + 8], rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x180029554
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor edi, edi
mov rsi, rcx
cmp qword [rcx + 8], rdi
jne 0x1800295b7
lea ecx, [rdi + 3]
call fcn.180096e9c
mov rbx, rax
test rax, rax
je 0x1800295b7
lea r8d, [rdi + 3]
mov rdx, rsi
mov rcx, rax
call fcn.1800877a0
mov cl, dil
movabs rdx, 0x7bfd053919dfe721
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [rdi + rbx], dl
inc rdi
cmp rdi, 3
jb 0x18002958d
ror rbx, 0xd
mov qword [rsi + 8], rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1800295c8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor edi, edi
mov rsi, rcx
cmp qword [rcx + 8], rdi
jne 0x18002962b
lea ecx, [rdi + 4]
call fcn.180096e9c
mov rbx, rax
test rax, rax
je 0x18002962b
lea r8d, [rdi + 4]
mov rdx, rsi
mov rcx, rax
call fcn.1800877a0
mov cl, dil
movabs rdx, 0x8d8f017d7d7f3d23
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [rdi + rbx], dl
inc rdi
cmp rdi, 4
jb 0x180029601
ror rbx, 0xd
mov qword [rsi + 8], rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x18002963c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor edi, edi
mov rsi, rcx
cmp qword [rcx + 8], rdi
jne 0x18002969f
lea ecx, [rdi + 4]
call fcn.180096e9c
mov rbx, rax
test rax, rax
je 0x18002969f
lea r8d, [rdi + 4]
mov rdx, rsi
mov rcx, rax
call fcn.1800877a0
mov cl, dil
movabs rdx, 0x1ff1a10b71ffd95b
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [rdi + rbx], dl
inc rdi
cmp rdi, 4
jb 0x180029675
ror rbx, 0xd
mov qword [rsi + 8], rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1800296b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor edi, edi
mov rsi, rcx
cmp qword [rcx + 8], rdi
jne 0x180029713
lea ecx, [rdi + 4]
call fcn.180096e9c
mov rbx, rax
test rax, rax
je 0x180029713
lea r8d, [rdi + 4]
mov rdx, rsi
mov rcx, rax
call fcn.1800877a0
mov cl, dil
movabs rdx, 0x36fe57fe7f341c5
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [rdi + rbx], dl
inc rdi
cmp rdi, 4
jb 0x1800296e9
ror rbx, 0xd
mov qword [rsi + 8], rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x180029724
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor edi, edi
mov rsi, rcx
cmp qword [rcx + 8], rdi
jne 0x180029787
lea ecx, [rdi + 4]
call fcn.180096e9c
mov rbx, rax
test rax, rax
je 0x180029787
lea r8d, [rdi + 4]
mov rdx, rsi
mov rcx, rax
call fcn.1800877a0
mov cl, dil
movabs rdx, 0x565e3d71f5d074b
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [rdi + rbx], dl
inc rdi
cmp rdi, 4
jb 0x18002975d
ror rbx, 0xd
mov qword [rsi + 8], rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x180029798
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor edi, edi
mov rsi, rcx
cmp qword [rcx + 8], rdi
jne 0x1800297fb
lea ecx, [rdi + 5]
call fcn.180096e9c
mov rbx, rax
test rax, rax
je 0x1800297fb
lea r8d, [rdi + 5]
mov rdx, rsi
mov rcx, rax
call fcn.1800877a0
mov cl, dil
movabs rdx, 0xbb55ff59df597b8d
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [rdi + rbx], dl
inc rdi
cmp rdi, 5
jb 0x1800297d1
ror rbx, 0xd
mov qword [rsi + 8], rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x18002980c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor edi, edi
mov rsi, rcx
cmp qword [rcx + 8], rdi
jne 0x18002986f
lea ecx, [rdi + 5]
call fcn.180096e9c
mov rbx, rax
test rax, rax
je 0x18002986f
lea r8d, [rdi + 5]
mov rdx, rsi
mov rcx, rax
call fcn.1800877a0
mov cl, dil
movabs rdx, 0x39f9ff878333bf07
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [rdi + rbx], dl
inc rdi
cmp rdi, 5
jb 0x180029845
ror rbx, 0xd
mov qword [rsi + 8], rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x180029880
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor edi, edi
mov rsi, rcx
cmp qword [rcx + 8], rdi
jne 0x1800298e3
lea ecx, [rdi + 5]
call fcn.180096e9c
mov rbx, rax
test rax, rax
je 0x1800298e3
lea r8d, [rdi + 5]
mov rdx, rsi
mov rcx, rax
call fcn.1800877a0
mov cl, dil
movabs rdx, 0x730b5fc175f311ed
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [rdi + rbx], dl
inc rdi
cmp rdi, 5
jb 0x1800298b9
ror rbx, 0xd
mov qword [rsi + 8], rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1800298f4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor edi, edi
mov rsi, rcx
cmp qword [rcx + 8], rdi
jne 0x180029957
lea ecx, [rdi + 6]
call fcn.180096e9c
mov rbx, rax
test rax, rax
je 0x180029957
lea r8d, [rdi + 6]
mov rdx, rsi
mov rcx, rax
call fcn.1800877a0
mov cl, dil
movabs rdx, 0x2b37f18be345cbf9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [rdi + rbx], dl
inc rdi
cmp rdi, 6
jb 0x18002992d
ror rbx, 0xd
mov qword [rsi + 8], rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x180029968
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor edi, edi
mov rsi, rcx
cmp qword [rcx + 8], rdi
jne 0x1800299cb
lea ecx, [rdi + 6]
call fcn.180096e9c
mov rbx, rax
test rax, rax
je 0x1800299cb
lea r8d, [rdi + 6]
mov rdx, rsi
mov rcx, rax
call fcn.1800877a0
mov cl, dil
movabs rdx, 0x33936bbb8fbf972b
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [rdi + rbx], dl
inc rdi
cmp rdi, 6
jb 0x1800299a1
ror rbx, 0xd
mov qword [rsi + 8], rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1800299dc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor edi, edi
mov rsi, rcx
cmp qword [rcx + 8], rdi
jne 0x180029a3f
lea ecx, [rdi + 7]
call fcn.180096e9c
mov rbx, rax
test rax, rax
je 0x180029a3f
lea r8d, [rdi + 7]
mov rdx, rsi
mov rcx, rax
call fcn.1800877a0
mov cl, dil
movabs rdx, 0xdd3955d9efbff58d
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [rdi + rbx], dl
inc rdi
cmp rdi, 7
jb 0x180029a15
ror rbx, 0xd
mov qword [rsi + 8], rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x180029a50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor edi, edi
mov rsi, rcx
cmp qword [rcx + 8], rdi
jne 0x180029ab3
lea ecx, [rdi + 7]
call fcn.180096e9c
mov rbx, rax
test rax, rax
je 0x180029ab3
lea r8d, [rdi + 7]
mov rdx, rsi
mov rcx, rax
call fcn.1800877a0
mov cl, dil
movabs rdx, 0xd381b1bf7d99b1a9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [rdi + rbx], dl
inc rdi
cmp rdi, 7
jb 0x180029a89
ror rbx, 0xd
mov qword [rsi + 8], rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x180029ac4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor edi, edi
mov rsi, rcx
cmp qword [rcx + 8], rdi
jne 0x180029b27
lea ecx, [rdi + 7]
call fcn.180096e9c
mov rbx, rax
test rax, rax
je 0x180029b27
lea r8d, [rdi + 7]
mov rdx, rsi
mov rcx, rax
call fcn.1800877a0
mov cl, dil
movabs rdx, 0x93fbfda56fbfbdf5
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [rdi + rbx], dl
inc rdi
cmp rdi, 7
jb 0x180029afd
ror rbx, 0xd
mov qword [rsi + 8], rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x180029b38
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor edi, edi
mov rsi, rcx
cmp qword [rcx + 8], rdi
jne 0x180029b9b
lea ecx, [rdi + 7]
call fcn.180096e9c
mov rbx, rax
test rax, rax
je 0x180029b9b
lea r8d, [rdi + 7]
mov rdx, rsi
mov rcx, rax
call fcn.1800877a0
mov cl, dil
movabs rdx, 0x235f575351cb8319
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [rdi + rbx], dl
inc rdi
cmp rdi, 7
jb 0x180029b71
ror rbx, 0xd
mov qword [rsi + 8], rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x180029bac
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor edi, edi
mov rsi, rcx
cmp qword [rcx + 8], rdi
jne 0x180029c0f
lea ecx, [rdi + 7]
call fcn.180096e9c
mov rbx, rax
test rax, rax
je 0x180029c0f
lea r8d, [rdi + 7]
mov rdx, rsi
mov rcx, rax
call fcn.1800877a0
mov cl, dil
movabs rdx, 0x57972181e5d32b2d
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [rdi + rbx], dl
inc rdi
cmp rdi, 7
jb 0x180029be5
ror rbx, 0xd
mov qword [rsi + 8], rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x180029c20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor edi, edi
mov rsi, rcx
cmp qword [rcx + 8], rdi
jne 0x180029c83
lea ecx, [rdi + 8]
call fcn.180096e9c
mov rbx, rax
test rax, rax
je 0x180029c83
lea r8d, [rdi + 8]
mov rdx, rsi
mov rcx, rax
call fcn.1800877a0
mov cl, dil
movabs rdx, 0xeb995df1ff715fd1
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [rdi + rbx], dl
inc rdi
cmp rdi, 8
jb 0x180029c59
ror rbx, 0xd
mov qword [rsi + 8], rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x180029c94
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor edi, edi
mov rsi, rcx
cmp qword [rcx + 8], rdi
jne 0x180029cf7
lea ecx, [rdi + 8]
call fcn.180096e9c
mov rbx, rax
test rax, rax
je 0x180029cf7
lea r8d, [rdi + 8]
mov rdx, rsi
mov rcx, rax
call fcn.1800877a0
mov cl, dil
movabs rdx, 0xc5d97b5da5d3e971
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [rdi + rbx], dl
inc rdi
cmp rdi, 8
jb 0x180029ccd
ror rbx, 0xd
mov qword [rsi + 8], rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x180029d08
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor edi, edi
mov rsi, rcx
cmp qword [rcx + 8], rdi
jne 0x180029d6b
lea ecx, [rdi + 8]
call fcn.180096e9c
mov rbx, rax
test rax, rax
je 0x180029d6b
lea r8d, [rdi + 8]
mov rdx, rsi
mov rcx, rax
call fcn.1800877a0
mov cl, dil
movabs rdx, 0xc59f7d31b1dfcd87
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [rdi + rbx], dl
inc rdi
cmp rdi, 8
jb 0x180029d41
ror rbx, 0xd
mov qword [rsi + 8], rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x180029d7c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor edi, edi
mov rsi, rcx
cmp qword [rcx + 8], rdi
jne 0x180029ddf
lea ecx, [rdi + 8]
call fcn.180096e9c
mov rbx, rax
test rax, rax
je 0x180029ddf
lea r8d, [rdi + 8]
mov rdx, rsi
mov rcx, rax
call fcn.1800877a0
mov cl, dil
movabs rdx, 0x35c1a781c1734b63
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [rdi + rbx], dl
inc rdi
cmp rdi, 8
jb 0x180029db5
ror rbx, 0xd
mov qword [rsi + 8], rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x180029df0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor edi, edi
mov rsi, rcx
cmp qword [rcx + 0x18], rdi
jne 0x180029e53
lea ecx, [rdi + 0x11]
call fcn.180096e9c
mov rbx, rax
test rax, rax
je 0x180029e53
lea r8d, [rdi + 0x11]
mov rdx, rsi
mov rcx, rax
call fcn.1800877a0
mov cl, dil
movabs rdx, 0xa36b03d3a37d05d7
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [rdi + rbx], dl
inc rdi
cmp rdi, 0x11
jb 0x180029e29
ror rbx, 0xd
mov qword [rsi + 0x18], rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret