joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18010a230
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x18032f0e0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rsi, rcx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call fcn.1800294e0
nop
movabs r9, 0xcbf29ce484222325
lea rax, [rsp + 0x20]
cmp qword [rsp + 0x38], 0x10
cmovae rax, qword [rsp + 0x20]
lea rdx, [rsp + 0x20]
cmovae rdx, qword [rsp + 0x20]
mov r8, qword [rsp + 0x30]
add r8, rdx
cmp rax, r8
je 0x18010a2c3
movabs rdx, 0x100000001b3
nop dword [rax]
imul r9, rdx
movsx rcx, byte [rax]
xor r9, rcx
inc rax
cmp rax, r8
jne 0x18010a2b0
mov qword [rsi + 0x40], r9
mov byte [rsi + 0x68], 0
lea r8, [rsi + 0x20]
mov rdx, rsi
lea rcx, [rsp + 0x20]
call fcn.180109f30
mov rax, qword [rsi + 0x30]
mov qword [rsi + 0x48], rax
mov rbx, qword [0x1803aaf40]
lea r8, [rbx + 8]
mov rax, qword [r8]
mov rdi, rbx
cmp byte [rax + 0x19], 0
jne 0x18010a328
mov rdx, qword [rsi + 0x40]
nop
mov rcx, qword [rax + 0x20]
cmp rcx, rdx
jae 0x18010a30f
mov rax, qword [rax + 0x10]
jmp 0x18010a322
cmp byte [rdi + 0x19], 0
je 0x18010a31c
cmp rdx, rcx
cmovb rdi, rax
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x18010a300
cmp byte [rdi + 0x19], 0
cmove r8, rdi
mov rax, qword [r8]
cmp byte [rax + 0x19], 0
jne 0x18010a358
mov rcx, qword [rsi + 0x40]
nop dword [rax]
cmp rcx, qword [rax + 0x20]
jae 0x18010a34e
mov rdi, rax
mov rax, qword [rax]
jmp 0x18010a352
mov rax, qword [rax + 0x10]
cmp byte [rax + 0x19], 0
je 0x18010a340
cmp rbx, rdi
je 0x18010a3d9
nop dword [rax]
mov rdx, qword [rbx + 0x28]
mov rcx, rsi
call fcn.18010a5b0
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x18010a398
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x18010a393
cmp rbx, qword [rax + 0x10]
jne 0x18010a393
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x18010a380
mov rbx, rax
jmp 0x18010a3bf
mov rbx, rax
mov rcx, qword [rax]
cmp byte [rcx + 0x19], 0
jne 0x18010a3bf
nop dword [rax]
nop dword [rax + rax]
mov rbx, rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x18010a3b0
cmp rbx, rdi
jne 0x18010a360
mov rax, qword [rsi + 0x58]
sub rax, qword [rsi + 0x50]
sar rax, 3
test rax, rax
je 0x18010a3d9
mov byte [rsi + 0x68], 1
lea rcx, [rsp + 0x20]
call fcn.1800292b0
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1801fcf00
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x1801ea620
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor r12d, r12d
lea r14, str.stt_prop_race_start_line_01
mov r15d, r12d
movabs r13, 0x98a4eb5d89a0c952
mov rcx, qword [r14]
call fcn.18010b700
test al, al
je 0x1801ea74d
mov rsi, qword [r14]
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rsi + rbx], r12b
jne 0x1801ea670
mov ebp, r12d
mov edi, r12d
test rbx, rbx
je 0x1801ea6a8
mov rax, r12
movsx ecx, byte [rax + rsi]
call fcn.18022e718
add eax, edi
inc ebp
imul edi, eax, 0x401
mov eax, edi
shr eax, 6
xor edi, eax
mov eax, ebp
cmp rax, rbx
jb 0x1801ea687
lea eax, [rdi + rdi*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
imul ebx, ecx, 0x8001
mov ecx, ebx
call qword [0x1803856f0]
mov qword [rsp + 0x50], r12
mov dword [rsp + 0x50], ebx
mov rax, qword [rsp + 0x50]
mov qword [0x18035ebb8], rax
mov dword [0x18035eaf0], r12d
mov qword [0x1803afcd8], r13
mov dword [0x18035eae0], 1
call fcn.180110360
cmp dword [rax], r12d
jne 0x1801ea747
call qword [sym.imp.WINMM.dll_timeGetTime]
mov rcx, qword [0x180385680]
mov dword [0x1803855fc], eax
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
mov qword [rsp + 0x50], r12
mov dword [rsp + 0x50], ebx
mov rax, qword [rsp + 0x50]
mov qword [0x18035ebb8], rax
mov dword [0x18035eaf0], r12d
mov qword [0x1803afcd8], r13
mov dword [0x18035eae0], 1
call fcn.180110360
cmp dword [rax], r12d
je 0x1801ea6f7
mov dword [0x180343ea0], ebx
inc r15d
add r14, 8
cmp r15d, 0x71
jb 0x1801ea653
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1801ea780
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor r12d, r12d
lea r14, str.prop_weed_01
mov r15d, r12d
movabs r13, 0x98a4eb5d89a0c952
mov rcx, qword [r14]
call fcn.18010b700
test al, al
je 0x1801ea8ad
mov rsi, qword [r14]
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rsi + rbx], r12b
jne 0x1801ea7d0
mov ebp, r12d
mov edi, r12d
test rbx, rbx
je 0x1801ea808
mov rax, r12
movsx ecx, byte [rax + rsi]
call fcn.18022e718
add eax, edi
inc ebp
imul edi, eax, 0x401
mov eax, edi
shr eax, 6
xor edi, eax
mov eax, ebp
cmp rax, rbx
jb 0x1801ea7e7
lea eax, [rdi + rdi*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
imul ebx, ecx, 0x8001
mov ecx, ebx
call qword [0x1803856f0]
mov qword [rsp + 0x50], r12
mov dword [rsp + 0x50], ebx
mov rax, qword [rsp + 0x50]
mov qword [0x18035ebb8], rax
mov dword [0x18035eaf0], r12d
mov qword [0x1803afcd8], r13
mov dword [0x18035eae0], 1
call fcn.180110360
cmp dword [rax], r12d
jne 0x1801ea8a7
call qword [sym.imp.WINMM.dll_timeGetTime]
mov rcx, qword [0x180385680]
mov dword [0x1803855fc], eax
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
mov qword [rsp + 0x50], r12
mov dword [rsp + 0x50], ebx
mov rax, qword [rsp + 0x50]
mov qword [0x18035ebb8], rax
mov dword [0x18035eaf0], r12d
mov qword [0x1803afcd8], r13
mov dword [0x18035eae0], 1
call fcn.180110360
cmp dword [rax], r12d
je 0x1801ea857
mov dword [0x180343ea0], ebx
inc r15d
add r14, 8
cmp r15d, 0x94
jb 0x1801ea7b3
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1801ea8e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor r12d, r12d
lea r14, str.xs_prop_arena_goal_sf
mov r15d, r12d
movabs r13, 0x98a4eb5d89a0c952
mov rcx, qword [r14]
call fcn.18010b700
test al, al
je 0x1801eaa0d
mov rsi, qword [r14]
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rsi + rbx], r12b
jne 0x1801ea930
mov ebp, r12d
mov edi, r12d
test rbx, rbx
je 0x1801ea968
mov rax, r12
movsx ecx, byte [rax + rsi]
call fcn.18022e718
add eax, edi
inc ebp
imul edi, eax, 0x401
mov eax, edi
shr eax, 6
xor edi, eax
mov eax, ebp
cmp rax, rbx
jb 0x1801ea947
lea eax, [rdi + rdi*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
imul ebx, ecx, 0x8001
mov ecx, ebx
call qword [0x1803856f0]
mov qword [rsp + 0x50], r12
mov dword [rsp + 0x50], ebx
mov rax, qword [rsp + 0x50]
mov qword [0x18035ebb8], rax
mov dword [0x18035eaf0], r12d
mov qword [0x1803afcd8], r13
mov dword [0x18035eae0], 1
call fcn.180110360
cmp dword [rax], r12d
jne 0x1801eaa07
call qword [sym.imp.WINMM.dll_timeGetTime]
mov rcx, qword [0x180385680]
mov dword [0x1803855fc], eax
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
mov qword [rsp + 0x50], r12
mov dword [rsp + 0x50], ebx
mov rax, qword [rsp + 0x50]
mov qword [0x18035ebb8], rax
mov dword [0x18035eaf0], r12d
mov qword [0x1803afcd8], r13
mov dword [0x18035eae0], 1
call fcn.180110360
cmp dword [rax], r12d
je 0x1801ea9b7
mov dword [0x180343ea0], ebx
inc r15d
add r14, 8
cmp r15d, 0x295
jb 0x1801ea913
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1801eaa40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor r12d, r12d
lea r14, str.prop_a4_pile_01
mov r15d, r12d
movabs r13, 0x98a4eb5d89a0c952
mov rcx, qword [r14]
call fcn.18010b700
test al, al
je 0x1801eab6d
mov rsi, qword [r14]
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rsi + rbx], r12b
jne 0x1801eaa90
mov ebp, r12d
mov edi, r12d
test rbx, rbx
je 0x1801eaac8
mov rax, r12
movsx ecx, byte [rax + rsi]
call fcn.18022e718
add eax, edi
inc ebp
imul edi, eax, 0x401
mov eax, edi
shr eax, 6
xor edi, eax
mov eax, ebp
cmp rax, rbx
jb 0x1801eaaa7
lea eax, [rdi + rdi*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
imul ebx, ecx, 0x8001
mov ecx, ebx
call qword [0x1803856f0]
mov qword [rsp + 0x50], r12
mov dword [rsp + 0x50], ebx
mov rax, qword [rsp + 0x50]
mov qword [0x18035ebb8], rax
mov dword [0x18035eaf0], r12d
mov qword [0x1803afcd8], r13
mov dword [0x18035eae0], 1
call fcn.180110360
cmp dword [rax], r12d
jne 0x1801eab67
call qword [sym.imp.WINMM.dll_timeGetTime]
mov rcx, qword [0x180385680]
mov dword [0x1803855fc], eax
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
mov qword [rsp + 0x50], r12
mov dword [rsp + 0x50], ebx
mov rax, qword [rsp + 0x50]
mov qword [0x18035ebb8], rax
mov dword [0x18035eaf0], r12d
mov qword [0x1803afcd8], r13
mov dword [0x18035eae0], 1
call fcn.180110360
cmp dword [rax], r12d
je 0x1801eab17
mov dword [0x180343ea0], ebx
inc r15d
add r14, 8
cmp r15d, 0x1b3e
jb 0x1801eaa73
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1801eaba0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor r12d, r12d
lea r14, str.vw_prop_casino_champset
mov r15d, r12d
movabs r13, 0x98a4eb5d89a0c952
mov rcx, qword [r14]
call fcn.18010b700
test al, al
je 0x1801eaccd
mov rsi, qword [r14]
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rsi + rbx], r12b
jne 0x1801eabf0
mov ebp, r12d
mov edi, r12d
test rbx, rbx
je 0x1801eac28
mov rax, r12
movsx ecx, byte [rax + rsi]
call fcn.18022e718
add eax, edi
inc ebp
imul edi, eax, 0x401
mov eax, edi
shr eax, 6
xor edi, eax
mov eax, ebp
cmp rax, rbx
jb 0x1801eac07
lea eax, [rdi + rdi*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
imul ebx, ecx, 0x8001
mov ecx, ebx
call qword [0x1803856f0]
mov qword [rsp + 0x50], r12
mov dword [rsp + 0x50], ebx
mov rax, qword [rsp + 0x50]
mov qword [0x18035ebb8], rax
mov dword [0x18035eaf0], r12d
mov qword [0x1803afcd8], r13
mov dword [0x18035eae0], 1
call fcn.180110360
cmp dword [rax], r12d
jne 0x1801eacc7
call qword [sym.imp.WINMM.dll_timeGetTime]
mov rcx, qword [0x180385680]
mov dword [0x1803855fc], eax
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
mov qword [rsp + 0x50], r12
mov dword [rsp + 0x50], ebx
mov rax, qword [rsp + 0x50]
mov qword [0x18035ebb8], rax
mov dword [0x18035eaf0], r12d
mov qword [0x1803afcd8], r13
mov dword [0x18035eae0], 1
call fcn.180110360
cmp dword [rax], r12d
je 0x1801eac77
mov dword [0x180343ea0], ebx
inc r15d
add r14, 8
cmp r15d, 0x467
jb 0x1801eabd3
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1801ee7e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor r12d, r12d
lea r14, str.stt_prop_race_start_line_01
mov r15d, r12d
movabs r13, 0x98a4eb5d89a0c952
mov rcx, qword [r14]
call fcn.18010b700
test al, al
je 0x1801ee90d
mov rsi, qword [r14]
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rsi + rbx], r12b
jne 0x1801ee830
mov ebp, r12d
mov edi, r12d
test rbx, rbx
je 0x1801ee868
mov rax, r12
movsx ecx, byte [rax + rsi]
call fcn.18022e718
add eax, edi
inc ebp
imul edi, eax, 0x401
mov eax, edi
shr eax, 6
xor edi, eax
mov eax, ebp
cmp rax, rbx
jb 0x1801ee847
lea eax, [rdi + rdi*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
imul ebx, ecx, 0x8001
mov ecx, ebx
call qword [0x1803856f0]
mov qword [rsp + 0x50], r12
mov dword [rsp + 0x50], ebx
mov rax, qword [rsp + 0x50]
mov qword [0x18035ebb8], rax
mov dword [0x18035eaf0], r12d
mov qword [0x1803afcd8], r13
mov dword [0x18035eae0], 1
call fcn.180110360
cmp dword [rax], r12d
jne 0x1801ee907
call qword [sym.imp.WINMM.dll_timeGetTime]
mov rcx, qword [0x180385680]
mov dword [0x1803855fc], eax
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
mov qword [rsp + 0x50], r12
mov dword [rsp + 0x50], ebx
mov rax, qword [rsp + 0x50]
mov qword [0x18035ebb8], rax
mov dword [0x18035eaf0], r12d
mov qword [0x1803afcd8], r13
mov dword [0x18035eae0], 1
call fcn.180110360
cmp dword [rax], r12d
je 0x1801ee8b7
mov dword [0x180343efc], ebx
inc r15d
add r14, 8
cmp r15d, 0x71
jb 0x1801ee813
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1801ee940
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor r12d, r12d
lea r14, str.stt_prop_race_start_line_01
mov r15d, r12d
movabs r13, 0x98a4eb5d89a0c952
mov rcx, qword [r14]
call fcn.18010b700
test al, al
je 0x1801eea6d
mov rsi, qword [r14]
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rsi + rbx], r12b
jne 0x1801ee990
mov ebp, r12d
mov edi, r12d
test rbx, rbx
je 0x1801ee9c8
mov rax, r12
movsx ecx, byte [rax + rsi]
call fcn.18022e718
add eax, edi
inc ebp
imul edi, eax, 0x401
mov eax, edi
shr eax, 6
xor edi, eax
mov eax, ebp
cmp rax, rbx
jb 0x1801ee9a7
lea eax, [rdi + rdi*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
imul ebx, ecx, 0x8001
mov ecx, ebx
call qword [0x1803856f0]
mov qword [rsp + 0x50], r12
mov dword [rsp + 0x50], ebx
mov rax, qword [rsp + 0x50]
mov qword [0x18035ebb8], rax
mov dword [0x18035eaf0], r12d
mov qword [0x1803afcd8], r13
mov dword [0x18035eae0], 1
call fcn.180110360
cmp dword [rax], r12d
jne 0x1801eea67
call qword [sym.imp.WINMM.dll_timeGetTime]
mov rcx, qword [0x180385680]
mov dword [0x1803855fc], eax
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
mov qword [rsp + 0x50], r12
mov dword [rsp + 0x50], ebx
mov rax, qword [rsp + 0x50]
mov qword [0x18035ebb8], rax
mov dword [0x18035eaf0], r12d
mov qword [0x1803afcd8], r13
mov dword [0x18035eae0], 1
call fcn.180110360
cmp dword [rax], r12d
je 0x1801eea17
mov dword [0x180343e74], ebx
inc r15d
add r14, 8
cmp r15d, 0x71
jb 0x1801ee973
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1801eeaa0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor r12d, r12d
lea r14, str.stt_prop_race_start_line_01
mov r15d, r12d
movabs r13, 0x98a4eb5d89a0c952
mov rcx, qword [r14]
call fcn.18010b700
test al, al
je 0x1801eebcd
mov rsi, qword [r14]
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rsi + rbx], r12b
jne 0x1801eeaf0
mov ebp, r12d
mov edi, r12d
test rbx, rbx
je 0x1801eeb28
mov rax, r12
movsx ecx, byte [rax + rsi]
call fcn.18022e718
add eax, edi
inc ebp
imul edi, eax, 0x401
mov eax, edi
shr eax, 6
xor edi, eax
mov eax, ebp
cmp rax, rbx
jb 0x1801eeb07
lea eax, [rdi + rdi*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
imul ebx, ecx, 0x8001
mov ecx, ebx
call qword [0x1803856f0]
mov qword [rsp + 0x50], r12
mov dword [rsp + 0x50], ebx
mov rax, qword [rsp + 0x50]
mov qword [0x18035ebb8], rax
mov dword [0x18035eaf0], r12d
mov qword [0x1803afcd8], r13
mov dword [0x18035eae0], 1
call fcn.180110360
cmp dword [rax], r12d
jne 0x1801eebc7
call qword [sym.imp.WINMM.dll_timeGetTime]
mov rcx, qword [0x180385680]
mov dword [0x1803855fc], eax
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
mov qword [rsp + 0x50], r12
mov dword [rsp + 0x50], ebx
mov rax, qword [rsp + 0x50]
mov qword [0x18035ebb8], rax
mov dword [0x18035eaf0], r12d
mov qword [0x1803afcd8], r13
mov dword [0x18035eae0], 1
call fcn.180110360
cmp dword [rax], r12d
je 0x1801eeb77
mov dword [0x180343ef8], ebx
inc r15d
add r14, 8
cmp r15d, 0x71
jb 0x1801eead3
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1801eec00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor r12d, r12d
lea r14, str.prop_weed_01
mov r15d, r12d
movabs r13, 0x98a4eb5d89a0c952
mov rcx, qword [r14]
call fcn.18010b700
test al, al
je 0x1801eed2d
mov rsi, qword [r14]
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rsi + rbx], r12b
jne 0x1801eec50
mov ebp, r12d
mov edi, r12d
test rbx, rbx
je 0x1801eec88
mov rax, r12
movsx ecx, byte [rax + rsi]
call fcn.18022e718
add eax, edi
inc ebp
imul edi, eax, 0x401
mov eax, edi
shr eax, 6
xor edi, eax
mov eax, ebp
cmp rax, rbx
jb 0x1801eec67
lea eax, [rdi + rdi*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
imul ebx, ecx, 0x8001
mov ecx, ebx
call qword [0x1803856f0]
mov qword [rsp + 0x50], r12
mov dword [rsp + 0x50], ebx
mov rax, qword [rsp + 0x50]
mov qword [0x18035ebb8], rax
mov dword [0x18035eaf0], r12d
mov qword [0x1803afcd8], r13
mov dword [0x18035eae0], 1
call fcn.180110360
cmp dword [rax], r12d
jne 0x1801eed27
call qword [sym.imp.WINMM.dll_timeGetTime]
mov rcx, qword [0x180385680]
mov dword [0x1803855fc], eax
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
mov qword [rsp + 0x50], r12
mov dword [rsp + 0x50], ebx
mov rax, qword [rsp + 0x50]
mov qword [0x18035ebb8], rax
mov dword [0x18035eaf0], r12d
mov qword [0x1803afcd8], r13
mov dword [0x18035eae0], 1
call fcn.180110360
cmp dword [rax], r12d
je 0x1801eecd7
mov dword [0x180343efc], ebx
inc r15d
add r14, 8
cmp r15d, 0x94
jb 0x1801eec33
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1801eed60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor r12d, r12d
lea r14, str.prop_weed_01
mov r15d, r12d
movabs r13, 0x98a4eb5d89a0c952
mov rcx, qword [r14]
call fcn.18010b700
test al, al
je 0x1801eee8d
mov rsi, qword [r14]
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rsi + rbx], r12b
jne 0x1801eedb0
mov ebp, r12d
mov edi, r12d
test rbx, rbx
je 0x1801eede8
mov rax, r12
movsx ecx, byte [rax + rsi]
call fcn.18022e718
add eax, edi
inc ebp
imul edi, eax, 0x401
mov eax, edi
shr eax, 6
xor edi, eax
mov eax, ebp
cmp rax, rbx
jb 0x1801eedc7
lea eax, [rdi + rdi*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
imul ebx, ecx, 0x8001
mov ecx, ebx
call qword [0x1803856f0]
mov qword [rsp + 0x50], r12
mov dword [rsp + 0x50], ebx
mov rax, qword [rsp + 0x50]
mov qword [0x18035ebb8], rax
mov dword [0x18035eaf0], r12d
mov qword [0x1803afcd8], r13
mov dword [0x18035eae0], 1
call fcn.180110360
cmp dword [rax], r12d
jne 0x1801eee87
call qword [sym.imp.WINMM.dll_timeGetTime]
mov rcx, qword [0x180385680]
mov dword [0x1803855fc], eax
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
mov qword [rsp + 0x50], r12
mov dword [rsp + 0x50], ebx
mov rax, qword [rsp + 0x50]
mov qword [0x18035ebb8], rax
mov dword [0x18035eaf0], r12d
mov qword [0x1803afcd8], r13
mov dword [0x18035eae0], 1
call fcn.180110360
cmp dword [rax], r12d
je 0x1801eee37
mov dword [0x180343e74], ebx
inc r15d
add r14, 8
cmp r15d, 0x94
jb 0x1801eed93
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1801eeec0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor r12d, r12d
lea r14, str.prop_weed_01
mov r15d, r12d
movabs r13, 0x98a4eb5d89a0c952
mov rcx, qword [r14]
call fcn.18010b700
test al, al
je 0x1801eefed
mov rsi, qword [r14]
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rsi + rbx], r12b
jne 0x1801eef10
mov ebp, r12d
mov edi, r12d
test rbx, rbx
je 0x1801eef48
mov rax, r12
movsx ecx, byte [rax + rsi]
call fcn.18022e718
add eax, edi
inc ebp
imul edi, eax, 0x401
mov eax, edi
shr eax, 6
xor edi, eax
mov eax, ebp
cmp rax, rbx
jb 0x1801eef27
lea eax, [rdi + rdi*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
imul ebx, ecx, 0x8001
mov ecx, ebx
call qword [0x1803856f0]
mov qword [rsp + 0x50], r12
mov dword [rsp + 0x50], ebx
mov rax, qword [rsp + 0x50]
mov qword [0x18035ebb8], rax
mov dword [0x18035eaf0], r12d
mov qword [0x1803afcd8], r13
mov dword [0x18035eae0], 1
call fcn.180110360
cmp dword [rax], r12d
jne 0x1801eefe7
call qword [sym.imp.WINMM.dll_timeGetTime]
mov rcx, qword [0x180385680]
mov dword [0x1803855fc], eax
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
mov qword [rsp + 0x50], r12
mov dword [rsp + 0x50], ebx
mov rax, qword [rsp + 0x50]
mov qword [0x18035ebb8], rax
mov dword [0x18035eaf0], r12d
mov qword [0x1803afcd8], r13
mov dword [0x18035eae0], 1
call fcn.180110360
cmp dword [rax], r12d
je 0x1801eef97
mov dword [0x180343ef8], ebx
inc r15d
add r14, 8
cmp r15d, 0x94
jb 0x1801eeef3
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1801ef020
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor r12d, r12d
lea r14, str.prop_a4_pile_01
mov r15d, r12d
movabs r13, 0x98a4eb5d89a0c952
mov rcx, qword [r14]
call fcn.18010b700
test al, al
je 0x1801ef14d
mov rsi, qword [r14]
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rsi + rbx], r12b
jne 0x1801ef070
mov ebp, r12d
mov edi, r12d
test rbx, rbx
je 0x1801ef0a8
mov rax, r12
movsx ecx, byte [rax + rsi]
call fcn.18022e718
add eax, edi
inc ebp
imul edi, eax, 0x401
mov eax, edi
shr eax, 6
xor edi, eax
mov eax, ebp
cmp rax, rbx
jb 0x1801ef087
lea eax, [rdi + rdi*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
imul ebx, ecx, 0x8001
mov ecx, ebx
call qword [0x1803856f0]
mov qword [rsp + 0x50], r12
mov dword [rsp + 0x50], ebx
mov rax, qword [rsp + 0x50]
mov qword [0x18035ebb8], rax
mov dword [0x18035eaf0], r12d
mov qword [0x1803afcd8], r13
mov dword [0x18035eae0], 1
call fcn.180110360
cmp dword [rax], r12d
jne 0x1801ef147
call qword [sym.imp.WINMM.dll_timeGetTime]
mov rcx, qword [0x180385680]
mov dword [0x1803855fc], eax
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
mov qword [rsp + 0x50], r12
mov dword [rsp + 0x50], ebx
mov rax, qword [rsp + 0x50]
mov qword [0x18035ebb8], rax
mov dword [0x18035eaf0], r12d
mov qword [0x1803afcd8], r13
mov dword [0x18035eae0], 1
call fcn.180110360
cmp dword [rax], r12d
je 0x1801ef0f7
mov dword [0x180343efc], ebx
inc r15d
add r14, 8
cmp r15d, 0x1b3e
jb 0x1801ef053
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret