joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180043c20
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
cmp byte [0x18005e154], 0
jne 0x180043cf3
xor r8d, r8d
movabs r9, 0xd79435e50d79435f
lea r10, [0x18005e135]
nop word cs:[rax + rax]
mov rax, r8
mul r9
shr rdx, 4
imul rax, rdx, 0xffffffffffffffed
lea r11, [rcx + r8]
movzx edx, byte [rcx + r8 + 0x13]
movzx r11d, byte [rax + r11]
mov ebx, r11d
and bl, 0xe3
or bl, 0x14
mov eax, r11d
and al, 0x1c
xor al, bl
mov ebx, eax
xor bl, 0x14
xor al, 0xfb
or al, bl
and r11b, 0xef
mov ebx, eax
xor bl, 0xcf
mov esi, eax
mov edi, r11d
not al
and al, r11b
xor r11b, 0x30
xor sil, 0x30
and sil, r11b
xor dil, 0xcf
and dil, bl
or al, dil
or al, sil
mov r11d, edx
and r11b, 0xb
and dl, 0xf4
or r11b, 0xd0
xor r11b, dl
mov edx, r11d
xor dl, 0x34
mov ebx, eax
xor bl, 0xf4
xor r11b, 0xcb
and r11b, bl
xor al, 0xb
and al, dl
or al, r11b
mov byte [r8 + r10], al
inc r8
cmp r8, 0x1f
jne 0x180043c50
mov byte [0x18005e154], 1
pop rbx
pop rdi
pop rsi
ret

Function at 0x180043d00
Capabilities:
Encode data using xor

Disassembly:
push rbx
cmp byte [0x18005e171], 0
jne 0x180043e09
lea rdx, [rcx + 0x22]
lea rax, [0x18005e160]
cmp rdx, rax
setbe dl
lea r8, [0x18005e171]
cmp rcx, r8
setae r8b
or r8b, dl
cmp r8b, 1
jne 0x180043d6e
movdqu xmm0, xmmword [rcx]
movdqu xmm1, xmmword [rcx + 0x11]
pcmpeqd xmm2, xmm2
pxor xmm2, xmm1
movdqa xmm3, xmm2
pxor xmm3, xmm0
por xmm2, xmm0
pandn xmm0, xmm1
por xmm0, xmm3
pxor xmm2, xmm0
movdqa xmmword [0x18005e160], xmm2
mov edx, 0x10
jmp 0x180043d70
xor edx, edx
movzx r9d, byte [rcx + rdx]
movzx r10d, byte [rcx + rdx + 0x11]
mov r11d, r9d
not r11b
and r11b, r10b
not r10b
mov ebx, r10d
xor bl, r9b
or r11b, bl
or r10b, r9b
xor r10b, r11b
mov byte [rdx + rax], r10b
test r8b, r8b
jne 0x180043e02
nop
movzx r8d, byte [rcx + rdx + 1]
movzx r9d, byte [rcx + rdx + 0x12]
mov r10d, r8d
not r10b
and r10b, r9b
not r9b
mov r11d, r9d
xor r11b, r8b
or r10b, r11b
or r9b, r8b
xor r9b, r10b
mov byte [rdx + rax + 1], r9b
movzx r8d, byte [rcx + rdx + 2]
movzx r9d, byte [rcx + rdx + 0x13]
mov r10d, r8d
not r10b
and r10b, r9b
not r9b
mov r11d, r9d
xor r11b, r8b
or r10b, r11b
or r9b, r8b
xor r9b, r10b
mov byte [rdx + rax + 2], r9b
add rdx, 2
cmp rdx, 0x10
jne 0x180043da0
mov byte [0x18005e171], 1
pop rbx
ret
Function at 0x180043e10
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
movdqa xmmword [rsp], xmm6
cmp byte [0x18005e18a], 0
jne 0x18004400a
lea rdx, [rcx + 0x33]
lea rax, [0x18005e174]
cmp rdx, rax
jbe 0x180043e49
lea rdx, [0x18005e18a]
cmp rcx, rdx
jae 0x180043e49
xor edx, edx
jmp 0x180043fc0
movd xmm1, dword [rcx + 0x1d]
movd xmm3, dword [rcx]
pcmpeqd xmm0, xmm0
movdqa xmm4, xmm3
pxor xmm4, xmm0
pandn xmm3, xmm1
por xmm4, xmm1
movdqa xmm1, xmmword [str.5555]
movdqa xmm5, xmm4
pxor xmm5, xmm1
movdqa xmm2, xmmword [0x18004e070]
movdqa xmm6, xmm3
pxor xmm6, xmm2
pxor xmm4, xmm2
pand xmm4, xmm6
pxor xmm3, xmm1
pand xmm3, xmm5
por xmm3, xmm4
movd dword [0x18005e174], xmm3
movd xmm3, dword [rcx + 0x21]
movd xmm4, dword [rcx + 4]
movdqa xmm5, xmm4
pxor xmm5, xmm0
pandn xmm4, xmm3
por xmm5, xmm3
movdqa xmm3, xmm5
pxor xmm3, xmm1
movdqa xmm6, xmm4
pxor xmm6, xmm2
pxor xmm5, xmm2
pand xmm5, xmm6
pxor xmm4, xmm1
pand xmm4, xmm3
por xmm4, xmm5
movd dword [0x18005e178], xmm4
movd xmm3, dword [rcx + 0x25]
movd xmm4, dword [rcx + 8]
movdqa xmm5, xmm4
pxor xmm5, xmm0
pandn xmm4, xmm3
por xmm5, xmm3
movdqa xmm3, xmm5
pxor xmm3, xmm1
movdqa xmm6, xmm4
pxor xmm6, xmm2
pxor xmm5, xmm2
pand xmm5, xmm6
pxor xmm4, xmm1
pand xmm4, xmm3
por xmm4, xmm5
movd dword [0x18005e17c], xmm4
movd xmm3, dword [rcx + 0x29]
movd xmm4, dword [rcx + 0xc]
movdqa xmm5, xmm4
pxor xmm5, xmm0
pandn xmm4, xmm3
por xmm5, xmm3
movdqa xmm3, xmm5
pxor xmm3, xmm1
movdqa xmm6, xmm4
pxor xmm6, xmm2
pxor xmm5, xmm2
pand xmm5, xmm6
pxor xmm4, xmm1
pand xmm4, xmm3
por xmm4, xmm5
movd dword [0x18005e180], xmm4
movd xmm3, dword [rcx + 0x2d]
movd xmm4, dword [rcx + 0x10]
pxor xmm0, xmm4
pandn xmm4, xmm3
por xmm0, xmm3
movdqa xmm3, xmm0
pxor xmm3, xmm1
movdqa xmm5, xmm4
pxor xmm5, xmm2
pxor xmm0, xmm2
pand xmm0, xmm5
pxor xmm4, xmm1
pand xmm4, xmm3
por xmm4, xmm0
movd dword [0x18005e184], xmm4
mov edx, 0x14
nop dword [rax + rax]
movzx r8d, byte [rcx + rdx]
movzx r9d, byte [rcx + rdx + 0x1d]
not r8b
mov r10d, r9d
and r10b, r8b
or r8b, r9b
mov r9d, r8d
xor r9b, 0x35
mov r11d, r10d
xor r11b, 0xca
xor r8b, 0xca
and r8b, r11b
xor r10b, 0x35
and r10b, r9b
or r10b, r8b
mov byte [rdx + rax], r10b
inc rdx
cmp rdx, 0x16
jne 0x180043fc0
mov byte [0x18005e18a], 1
movaps xmm6, xmmword [rsp]
add rsp, 0x18
ret

Function at 0x180044020
Capabilities:
Encode data using xor

Disassembly:
push rbx
cmp byte [0x18005e221], 0
jne 0x18004408e
xor r8d, r8d
movabs r9, 0xcccccccccccccccd
lea r10, [0x18005e206]
nop
mov rax, r8
mul r9
shr rdx, 2
and rdx, 0xfffffffffffffffc
lea rax, [rdx + rdx*4]
lea rdx, [rcx + r8]
sub rdx, rax
movzx eax, byte [rcx + r8 + 0x14]
movzx edx, byte [rdx]
mov r11d, eax
xor r11b, 0xd7
mov ebx, edx
xor bl, 0xd7
xor al, 0x28
and al, bl
xor dl, 0x28
and dl, r11b
or dl, al
mov byte [r8 + r10], dl
inc r8
cmp r8, 0x1b
jne 0x180044040
mov byte [0x18005e221], 1
pop rbx
ret
Function at 0x180044090
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rbx
cmp byte [0x18005e23c], 0
jne 0x180044110
xor r8d, r8d
movabs r9, 0x8618618618618619
lea r10, [0x18005e222]
nop
mov rax, r8
mul r9
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
imul rax, rax, 0xffffffffffffffeb
lea rdx, [rcx + r8]
movzx r11d, byte [rcx + r8 + 0x15]
movzx eax, byte [rax + rdx]
mov edx, r11d
not dl
and dl, al
not al
and al, r11b
mov r11d, edx
xor r11b, 0xd5
mov ebx, eax
xor bl, 0xd5
xor dl, 0x2a
and dl, bl
xor al, 0x2a
and al, r11b
or al, dl
mov byte [r8 + r10], al
inc r8
cmp r8, 0x1a
jne 0x1800440b0
mov byte [0x18005e23c], 1
pop rbx
ret

Function at 0x180044120
Capabilities:
Encode data using xor

Disassembly:
push rbx
cmp byte [0x18005e2d0], 0
jne 0x1800442c1
lea rdx, [rcx + 0x26]
lea rax, [0x18005e2c0]
cmp rdx, rax
jbe 0x1800441f1
lea rdx, [0x18005e2d0]
cmp rcx, rdx
jae 0x1800441f1
xor edx, edx
nop word cs:[rax + rax]
movzx r9d, byte [rcx + rdx]
movzx r8d, byte [rcx + rdx + 0x16]
mov r10d, r9d
and r10b, 0x44
mov r11d, r8d
and r11b, 0x44
or r11b, 0x88
and r8b, 0xbb
xor r8b, r11b
xor r10b, 0x66
mov r11d, r9d
or r11b, 0x44
and r11b, r10b
mov r10d, r9d
and r10b, 0x99
or r10b, r11b
mov r11d, r9d
xor r11b, 0xbb
mov ebx, r9d
xor bl, 0x44
or bl, r11b
mov r11d, r10d
and r11b, 0xfe
and r9b, 1
or r9b, r11b
not bl
xor r9b, bl
and bl, r10b
or bl, r9b
mov r9d, ebx
and r9b, 0xb0
or r9b, 0x45
and bl, 0x4f
xor bl, r8b
xor bl, r9b
xor bl, 0x89
mov byte [rdx + rax], bl
inc rdx
cmp rdx, 0x10
jne 0x180044160
jmp 0x1800442ba
movdqu xmm3, xmmword [rcx]
movdqu xmm1, xmmword [rcx + 0x16]
movdqa xmm0, xmmword [str.DDDDDDDDDDDDDDDD]
movdqa xmm4, xmm3
movdqa xmm2, xmm1
pand xmm2, xmm0
por xmm2, xmmword [0x18004de60]
pand xmm4, xmm0
pxor xmm4, xmmword [str.ffffffffffffffff]
movdqa xmm5, xmm3
por xmm5, xmm0
pand xmm5, xmm4
movdqa xmm4, xmmword [0x18004dd80]
pand xmm4, xmm3
por xmm4, xmm5
movdqa xmm5, xmmword [0x18004de70]
pand xmm1, xmm5
pxor xmm5, xmm3
pxor xmm0, xmm3
por xmm0, xmm5
movdqa xmm5, xmmword [0x18004de90]
pand xmm5, xmm4
pand xmm3, xmmword [0x18004dd10]
por xmm3, xmm5
pcmpeqd xmm5, xmm5
pxor xmm5, xmm0
pxor xmm5, xmm3
pandn xmm0, xmm4
por xmm0, xmm5
movdqa xmm3, xmmword [0x18004dea0]
pand xmm3, xmm0
por xmm3, xmmword [str.EEEEEEEEEEEEEEEEOOOOOOOOOOOOOOOO]
pxor xmm1, xmm2
pand xmm0, xmmword [0x18004dec0]
pxor xmm0, xmm1
pxor xmm0, xmm3
pxor xmm0, xmmword [0x18004ded0]
movdqa xmmword [0x18005e2c0], xmm0
mov byte [0x18005e2d0], 1
pop rbx
ret
Function at 0x1800454a0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
cmp byte [0x18005edc5], 0
jne 0x18004557a
xor r8d, r8d
movabs r9, 0x642c8590b21642c9
lea r10, [0x18005ed9f]
nop word [rax + rax]
mov rax, r8
mul r9
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
imul rdx, rax, 0xffffffffffffffe9
lea r11, [rcx + r8]
movzx eax, byte [rcx + r8 + 0x17]
movzx edx, byte [rdx + r11]
mov esi, eax
not sil
and sil, dl
mov r11d, edx
not r11b
and r11b, al
mov ebx, r11d
not bl
mov edi, esi
mov ebp, ebx
mov r14d, esi
xor bl, sil
and sil, 1
and dil, 0xd6
or sil, 0x10
xor sil, dil
mov edi, r11d
and dil, 0xc0
and bpl, 0x16
or bpl, dil
or bpl, 1
mov edi, r11d
and dil, 1
xor dil, bpl
and r14b, 0x28
or r14b, sil
and r11b, 0x28
or r11b, dil
xor r11b, r14b
xor r11b, 7
xor al, dl
or al, bl
not al
or al, r11b
mov byte [r8 + r10], al
inc r8
cmp r8, 0x26
jne 0x1800454d0
mov byte [0x18005edc5], 1
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x180045590
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
cmp byte [0x18005edef], 0
jne 0x1800456c0
xor r8d, r8d
movabs r9, 0xe38e38e38e38e38f
lea r10, [0x18005edc6]
nop dword [rax]
mov rax, r8
mul r9
shr rdx, 3
and rdx, 0xfffffffffffffffe
lea rax, [rdx + rdx*8]
lea rdx, [rcx + r8]
sub rdx, rax
movzx ebx, byte [rcx + r8 + 0x12]
mov edi, ebx
not dil
movzx eax, byte [rdx]
mov esi, ebx
and sil, 0x34
mov r11d, eax
xor r11b, 0x30
and r11b, al
mov ebp, ebx
and bpl, 0xcb
mov r14d, ebx
or r14b, 0x34
mov edx, ebx
xor dl, 0x30
and dl, sil
or sil, 0x88
xor sil, bpl
xor bpl, 0x72
and bpl, r14b
mov r14d, ebx
and r14b, 0x10
mov r15d, ebx
or r15b, 0xc
and r15b, 0x4e
xor r15b, bpl
and bpl, dil
and bpl, 0x42
mov edi, r15d
and dil, 0x89
or dil, bpl
and r15b, 0x52
xor r15b, 0x42
or r15b, dil
mov edi, edx
xor dil, bl
and dil, 0x20
and dl, 0x14
xor dl, r14b
or dl, dil
xor dl, r15b
xor sil, 0x43
xor bl, 0x34
or bl, sil
xor dl, 0x6e
mov esi, edx
xor sil, bl
or dl, bl
not dl
or dl, sil
mov ebx, eax
and bl, 0xcb
mov esi, r11d
xor sil, al
or r11b, 0xcb
xor bl, 0xcf
and bl, r11b
and sil, 0x30
or sil, bl
mov r11d, eax
xor r11b, 0x34
xor al, 0xcb
or al, r11b
not al
or al, sil
xor al, dl
mov byte [r8 + r10], al
inc r8
cmp r8, 0x29
jne 0x1800455c0
mov byte [0x18005edef], 1
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x180045890
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rbx
cmp byte [0x18005ef5b], 0
jne 0x180045918
xor r8d, r8d
movabs r9, 0xf0f0f0f0f0f0f0f1
lea r10, [0x18005ef43]
nop
mov rax, r8
mul r9
mov rax, rdx
shr rax, 4
and rdx, 0xfffffffffffffff0
add rdx, rax
lea rax, [rcx + r8]
sub rax, rdx
movzx edx, byte [rcx + r8 + 0x11]
movzx eax, byte [rax]
not dl
mov r11d, eax
and r11b, dl
or dl, al
mov eax, r11d
xor al, 0xe1
mov ebx, edx
and bl, 0xe1
and dl, 0x1e
or dl, 1
xor dl, bl
mov ebx, edx
xor bl, 0x1f
xor r11b, 0x1e
and r11b, bl
xor dl, 0xe0
and dl, al
or dl, r11b
mov byte [r8 + r10], dl
inc r8
cmp r8, 0x18
jne 0x1800458b0
mov byte [0x18005ef5b], 1
pop rbx
ret
Function at 0x180045920
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
cmp byte [0x18005ef9b], 0
jne 0x180045991
xor r8d, r8d
movabs r9, 0x1a7b9611a7b9611b
lea r10, [0x18005ef6a]
nop dword [rax]
mov rax, r8
mul r9
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
imul rax, rax, 0xffffffffffffffe3
lea rdx, [rcx + r8]
movzx r11d, byte [rcx + r8 + 0x1d]
movzx eax, byte [rax + rdx]
mov edx, r11d
xor dl, 0xb6
xor r11b, al
xor al, 0x49
or al, dl
and r11b, dl
not al
or al, r11b
mov byte [r8 + r10], al
inc r8
cmp r8, 0x31
jne 0x180045940
mov byte [0x18005ef9b], 1
ret

Function at 0x1800459a0
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
cmp byte [0x18005efc3], 0
jne 0x180045a8c
xor eax, eax
lea rdx, [0x18005efb2]
nop dword [rax]
movzx r8d, byte [rcx + rax + 0x10]
mov r9d, eax
and r9d, 0xf
movzx r9d, byte [rcx + r9]
mov r11d, r9d
not r11b
mov esi, r8d
xor sil, 0xc
and sil, r8b
mov r10d, r9d
xor r10b, 0x45
and r10b, r9b
mov ebx, r8d
and bl, 0xc
and sil, 0x4d
mov edi, r8d
and dil, 0xb2
mov ebp, edi
xor bpl, 0x1c
lea r14d, [rsi - 0x5e]
xor dil, 0xe3
and dil, r14b
or bl, 0x10
xor bl, sil
and bl, bpl
or bl, dil
mov esi, r8d
xor sil, 0x4d
xor r8b, 0xb2
or r8b, sil
not r8b
or r8b, bl
mov ebx, r10d
and bl, 0x4d
and r11b, 0x80
or r11b, 0x11
mov esi, r9d
and sil, 0x30
xor sil, r11b
mov r11d, r9d
and r11b, 0x45
or r11b, 0x30
xor r11b, bl
xor r11b, 0xf5
and r10b, 0x45
or r10b, r11b
and r9b, 2
or r9b, sil
xor r9b, r8b
or r10b, 2
xor r10b, r9b
xor r10b, 0xe4
mov byte [rax + rdx], r10b
inc rax
cmp rax, 0x11
jne 0x1800459c0
mov byte [0x18005efc3], 1
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x180045aa0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
cmp byte [0x18005efff], 0
jne 0x180045b46
xor eax, eax
lea rdx, [0x18005efe9]
nop dword [rax]
movzx r9d, byte [rcx + rax + 0x10]
mov esi, r9d
not sil
mov r8d, eax
and r8d, 0xf
mov r10d, esi
and r10b, 0x6b
mov edi, r9d
and dil, 0x94
mov r11d, r9d
or r11b, 0x14
mov ebx, esi
and bl, 0x90
and sil, 1
and r11b, 0x7e
or r11b, sil
or r10b, dil
xor r11b, dil
xor dil, 0x90
and dil, r9b
or r9b, 0x80
and r9b, 0xeb
xor r9b, 0x7b
or bl, dil
and dil, 4
not bl
and bl, r9b
or bl, dil
xor r11b, 0x81
and r11b, r10b
or r11b, bl
xor r11b, byte [rcx + r8]
xor r11b, 0x6b
mov byte [rax + rdx], r11b
inc rax
cmp rax, 0x16
jne 0x180045ac0
mov byte [0x18005efff], 1
pop rbx
pop rdi
pop rsi
ret
Function at 0x180045b50
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x10
movdqa xmmword [rsp], xmm6
cmp byte [0x18005f019], 0
jne 0x180045d15
lea rdx, [rcx + 0x36]
lea rax, [0x18005f000]
cmp rdx, rax
setbe r8b
lea rdx, [0x18005f019]
cmp rcx, rdx
setae dl
or dl, r8b
cmp dl, 1
jne 0x180045c5b
movq xmm3, qword [rcx + 0x1d]
movq xmm2, qword [rcx]
movdqa xmm0, xmmword [0x18004e080]
movdqa xmm4, xmm2
pxor xmm4, xmm0
movdqa xmm1, xmmword [str._]
movdqa xmm5, xmm3
pxor xmm5, xmm1
por xmm5, xmm4
pxor xmm2, xmm1
pxor xmm3, xmm0
por xmm3, xmm2
pand xmm3, xmm5
pcmpeqd xmm2, xmm2
pxor xmm3, xmm2
movq qword [0x18005f000], xmm3
movq xmm3, qword [rcx + 0x25]
movq xmm4, qword [rcx + 8]
movdqa xmm5, xmm4
pxor xmm5, xmm0
movdqa xmm6, xmm3
pxor xmm6, xmm1
por xmm6, xmm5
pxor xmm4, xmm1
pxor xmm3, xmm0
por xmm3, xmm4
pand xmm3, xmm6
pxor xmm3, xmm2
movq qword [0x18005f008], xmm3
movq xmm3, qword [rcx + 0x2d]
movq xmm4, qword [rcx + 0x10]
movdqa xmm5, xmm4
pxor xmm5, xmm0
movdqa xmm6, xmm3
pxor xmm6, xmm1
por xmm6, xmm5
pxor xmm4, xmm1
pxor xmm3, xmm0
por xmm3, xmm4
pand xmm3, xmm6
pxor xmm3, xmm2
movq qword [0x18005f010], xmm3
mov r8d, 0x18
jmp 0x180045c5e
xor r8d, r8d
movzx r9d, byte [rcx + r8]
movzx r10d, byte [rcx + r8 + 0x1d]
mov r11d, r9d
xor r11b, 0xa3
mov ebx, r10d
xor bl, 0x5c
or bl, r11b
xor r9b, 0x5c
xor r10b, 0xa3
or r10b, r9b
and r10b, bl
not r10b
mov byte [r8 + rax], r10b
test dl, dl
jne 0x180045d0e
nop word cs:[rax + rax]
movzx edx, byte [rcx + r8 + 1]
movzx r9d, byte [rcx + r8 + 0x1e]
mov r10d, edx
xor r10b, 0xa3
mov r11d, r9d
xor r11b, 0x5c
or r11b, r10b
xor dl, 0x5c
xor r9b, 0xa3
or r9b, dl
and r9b, r11b
not r9b
mov byte [r8 + rax + 1], r9b
movzx edx, byte [rcx + r8 + 2]
movzx r9d, byte [rcx + r8 + 0x1f]
mov r10d, edx
xor r10b, 0xa3
mov r11d, r9d
xor r11b, 0x5c
or r11b, r10b
xor dl, 0x5c
xor r9b, 0xa3
or r9b, dl
and r9b, r11b
not r9b
mov byte [r8 + rax + 2], r9b
add r8, 2
cmp r8, 0x18
jne 0x180045ca0
mov byte [0x18005f019], 1
movaps xmm6, xmmword [rsp]
add rsp, 0x10
pop rbx
ret

Function at 0x180045df0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
cmp byte [0x18005f075], 0
jne 0x180045ece
xor r8d, r8d
movabs r9, 0xf0f0f0f0f0f0f0f1
lea r10, [0x18005f05e]
nop dword [rax]
mov rax, r8
mul r9
mov rax, rdx
shr rax, 4
and rdx, 0xfffffffffffffff0
add rdx, rax
lea rax, [rcx + r8]
sub rax, rdx
movzx eax, byte [rax]
mov edx, eax
or dl, 0xa0
mov ebx, eax
and bl, 0xb8
lea ebp, [rax - 0x80]
and bpl, bl
mov r11d, eax
or r11b, 0x80
and r11b, 0xc7
mov edi, r11d
xor dil, 0x40
mov r14d, ebp
not r14b
mov r15d, eax
and r15b, 0x80
mov esi, eax
or sil, r14b
and r14b, 0x84
and bpl, 0x38
or bpl, r14b
or r15b, 3
xor r15b, bpl
not sil
and sil, 0x80
or sil, r15b
xor r11b, 0xbf
and r11b, r15b
not sil
and sil, dil
and dl, 0xe7
xor dl, bl
xor dl, 0xe7
xor al, 0xb8
or al, dl
not al
or al, r11b
or al, sil
xor al, byte [rcx + r8 + 0x11]
xor al, 0x47
mov byte [r8 + r10], al
inc r8
cmp r8, 0x17
jne 0x180045e20
mov byte [0x18005f075], 1
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x180045ee0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
cmp byte [0x18005f1fb], 0
jne 0x180045fe0
xor r8d, r8d
movabs r9, 0xd79435e50d79435f
lea r10, [0x18005f1c8]
nop dword [rax + rax]
mov rax, r8
mul r9
shr rdx, 4
imul rax, rdx, 0xffffffffffffffed
lea rdx, [rcx + r8]
movzx esi, byte [rcx + r8 + 0x13]
mov ebx, esi
not bl
movzx eax, byte [rax + rdx]
or bl, 0x5e
mov edx, eax
and dl, 0xa1
mov r11d, esi
and r11b, 0x5e
mov ebp, ebx
and bpl, 0x96
mov edi, esi
and dil, 0x21
or dil, bpl
mov ebp, edi
xor bpl, 0x69
mov r15d, r11d
xor r15b, 0x5e
mov r14d, edi
xor r14b, 0x22
xor dil, 0x96
or dil, r15b
and r15b, 0x10
mov r12d, esi
and r12b, 0xc
or r12b, r15b
or r12b, 0x23
mov r15d, esi
and r15b, 0x42
and r14b, bpl
and bl, 0x43
or bl, 0xb4
xor bl, r15b
xor bl, r12b
xor bl, r14b
xor bl, 0x2e
and sil, 0x20
and bpl, 0x81
or bpl, sil
or r11b, 0x20
xor r11b, bpl
and r11b, dil
or r11b, bl
and al, 0x5e
mov ebx, eax
xor bl, 0xcc
lea esi, [rdx + 0x12]
xor al, 0x33
and al, sil
xor dl, 0x6d
and dl, bl
or dl, al
xor dl, r11b
mov byte [r8 + r10], dl
inc r8
cmp r8, 0x33
jne 0x180045f10
mov byte [0x18005f1fb], 1
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x180045ff0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0xa0
movaps xmmword [rsp + 0x90], xmm15
movaps xmmword [rsp + 0x80], xmm14
movaps xmmword [rsp + 0x70], xmm13
movaps xmmword [rsp + 0x60], xmm12
movaps xmmword [rsp + 0x50], xmm11
movaps xmmword [rsp + 0x40], xmm10
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp], xmm6
cmp byte [0x18005f219], 0
jne 0x180046255
lea rdx, [rcx + 0x3a]
lea rax, [0x18005f1fc]
cmp rdx, rax
jbe 0x180046067
lea rdx, [0x18005f219]
cmp rcx, rdx
jae 0x180046067
xor edx, edx
jmp 0x1800461a0
xor edx, edx
movaps xmm0, xmmword [str.]
movaps xmm1, xmmword [0x18004dcd0]
movaps xmm3, xmmword [str.____]
movaps xmm5, xmmword [str.2222]
movaps xmm6, xmmword [0x18004e100]
movaps xmm7, xmmword [str.6666]
movaps xmm8, xmmword [0x18004e120]
movaps xmm9, xmmword [0x18004e130]
movaps xmm10, xmmword [0x18004e140]
movaps xmm11, xmmword [0x18004dff0]
movaps xmm12, xmmword [0x18004e150]
nop dword [rax + rax]
movss xmm14, dword [rcx + rdx]
movaps xmm2, xmm14
andps xmm2, xmm0
movaps xmm4, xmm2
xorps xmm4, xmm0
movaps xmm15, xmm14
xorps xmm15, xmm1
movaps xmm13, xmm14
orps xmm13, xmm1
xorps xmm2, xmmword [0x18004e0c0]
andps xmm2, xmm13
andnps xmm14, xmm3
orps xmm14, xmm2
movaps xmm2, xmm4
orps xmm13, xmm4
orps xmm4, xmm15
andps xmm2, xmm3
andps xmm15, xmm5
orps xmm15, xmm2
andps xmm4, xmmword [0x18004e0e0]
orps xmm15, xmm6
xorps xmm15, xmm4
movaps xmm2, xmm15
xorps xmm2, xmm7
xorps xmm15, xmm8
andps xmm15, xmm14
andnps xmm14, xmm2
orps xmm14, xmm15
movaps xmm2, xmm13
andps xmm2, xmm0
xorps xmm2, xmm0
xorps xmm2, xmm14
andnps xmm13, xmm14
orps xmm13, xmm2
movaps xmm2, xmm13
movaps xmm4, xmm13
movaps xmm14, xmm13
andnps xmm14, xmm11
andps xmm13, xmm3
orps xmm13, xmm14
andps xmm2, xmm9
andnps xmm4, xmm10
orps xmm2, xmm11
orps xmm2, xmm4
movss xmm4, dword [rcx + rdx + 0x1d]
orps xmm13, xmm9
xorps xmm13, xmm4
xorps xmm13, xmm2
xorps xmm13, xmm12
movss dword [rdx + rax], xmm13
add rdx, 4
cmp rdx, 0x1c
jne 0x1800460c0
mov edx, 0x1c
nop
movzx r8d, byte [rcx + rdx]
mov r10d, r8d
not r10b
mov r11d, r8d
and r11b, 0x27
mov ebx, r11d
xor bl, 0x27
mov r9d, r8d
xor r9b, 0xd8
or r9b, bl
or r8b, 0xd8
xor r11b, 0x22
and r11b, r8b
and r10b, 0x22
or r10b, r11b
mov r11d, r9d
and r11b, 0xcd
and r9b, 0x32
or r9b, 0xcc
xor r9b, r11b
xor r9b, r10b
xor r9b, 0x36
or r8b, bl
mov r10d, r8d
and r10b, 0x27
xor r10b, r9b
xor r10b, 0x27
not r8b
and r8b, r9b
or r8b, r10b
mov r9d, r8d
not r9b
mov r10d, r8d
and r10b, 0x1c
mov r11d, r9d
and r11b, 0x81
or r11b, r10b
and r9b, 0x40
and r8b, 0x22
or r8b, r9b
or r11b, 0x40
or r8b, 0x1c
xor r8b, byte [rcx + rdx + 0x1d]
xor r8b, r11b
xor r8b, 0xba
mov byte [rdx + rax], r8b
inc rdx
cmp rdx, 0x1d
jne 0x1800461a0
mov byte [0x18005f219], 1
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
movaps xmm11, xmmword [rsp + 0x50]
movaps xmm12, xmmword [rsp + 0x60]
movaps xmm13, xmmword [rsp + 0x70]
movaps xmm14, xmmword [rsp + 0x80]
movaps xmm15, xmmword [rsp + 0x90]
add rsp, 0xa0
pop rbx
ret
Function at 0x1800488ac
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1800488e6
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1800488eb
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x180048934
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x180050600]
cmp byte [rcx + rax], 0
je 0x180048934
dec r8
sub rdx, 1
jne 0x18004891a
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x1400049d4
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x480]
sub rsp, 0x580
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x470], rax
movups xmm0, xmmword [str.SOFTWAREMicrosoftWindows_NTCurrentVersion]
mov eax, dword [0x140018f30]
movups xmm1, xmmword [0x140018f18]
mov dword [rsp + 0x70], eax
mov al, byte [0x140018f34]
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x80]
mov rbx, r8
mov dword [rsp + 0x30], 0xff
movups xmmword [rsp + 0x48], xmm0
movsd xmm0, qword [0x140018f28]
movups xmmword [rsp + 0x58], xmm1
mov byte [rsp + 0x74], al
movsd qword [rsp + 0x68], xmm0
call fcn.140005dc0
lea r8, [rsp + 0x40]
lea rdx, [rbp - 0x80]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x38]
lea rdx, str.CurrentBuild
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x38], 1
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x140004aa7
lea rdx, str.9200
mov rcx, rbx
call fcn.140005dc0
mov rcx, rbx
call fcn.140005e90
test rax, rax
jne 0x140004ac3
lea rdx, str.9200
mov rcx, rbx
call fcn.140005dc0
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rbp + 0x470]
xor rcx, rsp
call fcn.140004f50
mov rbx, qword [rsp + 0x590]
add rsp, 0x580
pop rbp
ret

Function at 0x140006350
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.1400061b8