joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18003d348
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x18003d368
xor eax, eax
jmp 0x18003d44e
cmp qword [rcx + 0x68], 0
je 0x18003d379
call fcn.18003de44
jmp 0x18003d44e
mov rax, qword [rcx + 0x38]
mov rdi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x18003d390
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x18003d392
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x18003d3c4
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.1800b3790
mov rax, qword [rsi + 0x50]
add r14, rbx
sub rdi, rbx
sub dword [rax], ebx
mov rcx, qword [rsi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x18003d448
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x18003d3fb
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x18003d424
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.18008c76c
add r14, rax
sub rdi, rax
cmp rax, rbx
jne 0x18003d448
cmp rdi, rbx
ja 0x18003d402
test rdi, rdi
je 0x18003d448
mov r9, qword [rsi + 0x80]
mov r8, rdi
mov edx, 1
mov rcx, r14
call fcn.18008c76c
sub rdi, rax
sub rbp, rdi
mov rax, rbp
add rsp, 0x20
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18004223c
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x180123100]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, rdx
mov rbx, rcx
mov qword [rbp - 0x30], rcx
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x18004235d
movsxd rax, dword [rdx + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x18004235d
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x28], xmm1
xor edx, edx
mov qword [rbp - 0x18], rdx
mov ecx, dword [rax + rsi + 0xb0]
test ecx, ecx
jne 0x1800422ba
and qword [rbx], rdx
and qword [rbx + 8], rdx
and qword [rbx + 0x10], rdx
lea rcx, [rbp - 0x28]
call fcn.180041d08
jmp 0x18004236b
lea rdi, [rsi + rcx]
mov r14d, dword [rax + rsi + 0xb4]
add r14, rdi
mov rcx, qword [rbp - 0x20]
cmp rdi, r14
jae 0x18004233a
cmp dword [rdi + 4], 0
je 0x18004233a
mov eax, dword [rdi]
add rax, rsi
mov qword [rbp - 0x48], rax
lea rax, [rdi + 8]
mov qword [rbp - 0x40], rax
mov eax, dword [rdi + 4]
sub rax, 8
shr rax, 1
mov dword [rbp - 0x38], eax
cmp rcx, rdx
je 0x18004231a
movups xmm0, xmmword [rbp - 0x48]
movups xmmword [rcx], xmm0
movsd xmm1, qword [rbp - 0x38]
movsd qword [rcx + 0x10], xmm1
mov rcx, qword [rbp - 0x20]
add rcx, 0x18
mov qword [rbp - 0x20], rcx
jmp 0x18004232e
lea r8, [rbp - 0x48]
mov rdx, rcx
lea rcx, [rbp - 0x28]
call fcn.180042a08
mov rcx, qword [rbp - 0x20]
mov eax, dword [rdi + 4]
add rdi, rax
mov rdx, qword [rbp - 0x18]
jmp 0x1800422cd
and qword [rbp - 0x18], 0
and qword [rbp - 0x20], 0
mov rax, qword [rbp - 0x28]
and qword [rbp - 0x28], 0
mov qword [rbx], rax
mov qword [rbx + 8], rcx
mov qword [rbx + 0x10], rdx
jmp 0x1800422ac
and qword [rcx], 0
and qword [rcx + 8], 0
and qword [rcx + 0x10], 0
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.18007ff00
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1800435b4
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x180123100]
xor rax, rsp
mov qword [rbp - 8], rax
xor ebx, ebx
lea r9, [rbp - 0x30]
and dword [rbp - 0x30], ebx
mov r14, rcx
xor r8d, r8d
xor edx, edx
lea edi, [rbx + 0xb]
mov ecx, edi
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov esi, 0xc0000004
jmp 0x18004363b
test rbx, rbx
je 0x180043610
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp - 0x30]
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rbp - 0x30]
lea r9, [rbp - 0x30]
mov rdx, rax
mov ecx, edi
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, esi
je 0x1800435fa
test eax, eax
jns 0x18004367c
test rbx, rbx
je 0x180043659
mov r8d, 0x8000
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.18007ff00
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
test rbx, rbx
je 0x180043659
xor edi, edi
cmp dword [rbx], edi
jbe 0x180043648
and qword [rbp - 0x18], 0
xorps xmm0, xmm0
and qword [rbp - 0x10], 0
mov eax, edi
imul rsi, rax, 0x128
movups xmmword [rbp - 0x28], xmm0
movzx edx, word [rsi + rbx + 0x2e]
add rdx, 0x30
add rdx, rsi
add rdx, rbx
or r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x1800436b4
lea rcx, [rbp - 0x28]
call fcn.180002a0c
cmp qword [r14 + 0x18], 0xf
mov rdx, r14
jbe 0x1800436d4
mov rdx, qword [r14]
cmp qword [rbp - 0x10], 0xf
lea rcx, [rbp - 0x28]
cmova rcx, qword [rbp - 0x28]
call fcn.180093158
test eax, eax
je 0x180043731
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x180043722
mov rcx, qword [rbp - 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18004371d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180043786
call fcn.18007ff20
inc edi
cmp edi, dword [rbx]
jb 0x180043687
jmp 0x180043648
mov rdi, qword [rsi + rbx + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x18004377e
mov rcx, qword [rbp - 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180043779
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180043786
call fcn.18007ff20
mov rax, rdi
jmp 0x18004365b
call fcn.18008a8b4
int3
Function at 0x180045a0c
Capabilities:
Connect socket
Initialize winsock library

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rdi
sub rsp, 0x20
mov ebx, edx
mov edi, ecx
mov ecx, 0x202
lea rdx, [0x1801272f0]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x180045a57
lea rdx, str.Failed_to_initialize_Winsock
lea rcx, [0x180125650]
call fcn.1800027b8
mov rcx, rax
call fcn.180054600
xor eax, eax
jmp 0x180045b04
xor r8d, r8d
lea edx, [r8 + 1]
lea ebp, [rdx + 1]
mov ecx, ebp
call qword [sym.imp.WS2_32.dll_socket]
mov qword [0x1801274a0], rax
cmp rax, 0xffffffffffffffff
jne 0x180045a99
lea rdx, str.Failed_to_create_socket
lea rcx, [0x180125650]
call fcn.1800027b8
mov rcx, rax
call fcn.180054600
call qword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x180045a50
movzx ecx, bx
mov word [0x1801274b0], bp
mov dword [0x1801274b4], edi
call qword [sym.imp.WS2_32.dll_htons]
mov rcx, qword [0x1801274a0]
lea rdx, [0x1801274b0]
mov r8d, reloc.WS2_32.dll_recv
mov word [0x1801274b2], ax
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x180045aff
lea rdx, str.Failed_to_connect_to_server
lea rcx, [0x180125650]
call fcn.1800027b8
mov rcx, rax
call fcn.180054600
mov rcx, qword [0x1801274a0]
call qword [sym.imp.WS2_32.dll_closesocket]
jmp 0x180045a91
mov eax, 1
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x180045b14
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push rbx
push rsi
push rdi
mov eax, 0xc550
call fcn.180080c00
sub rsp, rax
mov rax, qword [0x180123100]
xor rax, rsp
mov qword [rsp + 0xc540], rax
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x40], 2
mov rcx, rdx
cmp qword [rdx + 0x18], 0xf
jbe 0x180045b64
mov rcx, qword [rdx]
lea rdx, [rsp + 0x44]
sub rdx, rcx
mov al, byte [rcx]
mov byte [rdx + rcx], al
inc rcx
test al, al
jne 0x180045b6c
mov rcx, rbx
cmp qword [r8 + 0x18], 0xf
jbe 0x180045b85
mov rcx, qword [r8]
lea rdx, [rsp + 0x10c]
sub rdx, rcx
mov al, byte [rcx]
mov byte [rdx + rcx], al
inc rcx
test al, al
jne 0x180045b90
xor r9d, r9d
mov r8d, 0x194
lea rdx, [rsp + 0x40]
mov rcx, qword [0x1801274a0]
call qword [sym.imp.WS2_32.dll_send]
mov dword [rsp + 0x1e0], reloc.WS2_32.dll_inet_addr
xor r9d, r9d
mov r8d, 0xc354
lea rdx, [rsp + 0x1e0]
mov rcx, qword [0x1801274a0]
call qword [sym.imp.WS2_32.dll_recv]
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
and qword [rsi + 0x10], 0
and qword [rsi + 0x18], 0
lea rax, [rsp + 0x1e4]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x180045bfc
lea rdx, [rsp + 0x1e4]
mov rcx, rsi
call fcn.180002a0c
nop
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x180045c4d
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x180045c48
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180045cc1
mov rcx, r8
call fcn.18007ff20
and qword [rdi + 0x10], 0
mov qword [rdi + 0x18], send
mov byte [rdi], 0
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x180045c93
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x180045c8e
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180045cc7
mov rcx, r8
call fcn.18007ff20
and qword [rbx + 0x10], 0
mov qword [rbx + 0x18], send
mov byte [rbx], 0
mov rax, rsi
mov rcx, qword [rsp + 0xc540]
xor rcx, rsp
call fcn.18007ff00
add rsp, 0xc550
pop rdi
pop rsi
pop rbx
ret
call fcn.18008a8b4
nop
call fcn.18008a8b4
int3
Function at 0x18004670c
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0xc510]
mov eax, 0xc610
call fcn.180080c00
sub rsp, rax
mov rax, qword [0x180123100]
xor rax, rsp
mov qword [rbp + 0xc500], rax
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x40], 8
movzx eax, word [0x1800c5534]
mov word [rbp + 0xd4], ax
xor edx, edx
mov r8d, 0xc6
lea rcx, [rbp + 0xd6]
call fcn.1800b3e30
mov rcx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x180046789
mov rcx, qword [rdi]
lea rdx, [rsp + 0x44]
sub rdx, rcx
mov al, byte [rcx]
mov byte [rdx + rcx], al
inc rcx
test al, al
jne 0x180046791
mov rcx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x1800467aa
mov rcx, qword [rbx]
lea rdx, [rbp + 0xc]
sub rdx, rcx
mov al, byte [rcx]
mov byte [rdx + rcx], al
inc rcx
test al, al
jne 0x1800467b1
xor r9d, r9d
mov r8d, 0x25c
lea rdx, [rsp + 0x40]
mov rcx, qword [0x1801274a0]
call qword [sym.imp.WS2_32.dll_send]
mov dword [rbp + 0x1a0], reloc.WS2_32.dll_inet_addr
xor r9d, r9d
mov r8d, 0xc354
lea rdx, [rbp + 0x1a0]
mov rcx, qword [0x1801274a0]
call qword [sym.imp.WS2_32.dll_recv]
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
and qword [rsi + 0x10], 0
and qword [rsi + 0x18], 0
lea rax, [rbp + 0x1a4]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x18004681a
lea rdx, [rbp + 0x1a4]
mov rcx, rsi
call fcn.180002a0c
nop
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x18004686e
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x180046869
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800468e9
mov rcx, r8
call fcn.18007ff20
and qword [rdi + 0x10], 0
mov qword [rdi + 0x18], send
mov byte [rdi], 0
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x1800468b4
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x1800468af
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800468ef
mov rcx, r8
call fcn.18007ff20
and qword [rbx + 0x10], 0
mov qword [rbx + 0x18], send
mov byte [rbx], 0
mov rax, rsi
mov rcx, qword [rbp + 0xc500]
xor rcx, rsp
call fcn.18007ff00
mov rbx, qword [rsp + 0xc648]
add rsp, 0xc610
pop rdi
pop rsi
pop rbp
ret
call fcn.18008a8b4
nop
call fcn.18008a8b4
int3
Function at 0x1800468f8
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
mov eax, 0xc780
call fcn.180080c00
sub rsp, rax
mov rax, qword [0x180123100]
xor rax, rsp
mov qword [rsp + 0xc770], rax
movzx eax, word [0x1800c5534]
mov rdi, r8
mov rbx, qword [rsp + 0xc7e0]
mov r14, rdx
mov rbp, rcx
mov word [rsp + 0x344], ax
xor edx, edx
mov dword [rsp + 0x20], 9
mov r8d, 0xc6
lea rcx, [rsp + 0x346]
mov rsi, r9
call fcn.1800b3e30
mov r12d, send
mov rcx, r14
cmp qword [r14 + 0x18], r12
jbe 0x180046974
mov rcx, qword [r14]
lea rdx, [rsp + 0x24]
sub rdx, rcx
mov al, byte [rcx]
mov byte [rdx + rcx], al
inc rcx
test al, al
jne 0x18004697c
mov rcx, rdi
cmp qword [rdi + 0x18], r12
jbe 0x180046994
mov rcx, qword [rdi]
lea rdx, [rsp + 0xec]
sub rdx, rcx
mov al, byte [rcx]
mov byte [rdx + rcx], al
inc rcx
test al, al
jne 0x18004699f
mov rcx, rsi
cmp qword [rsi + 0x18], r12
jbe 0x1800469b7
mov rcx, qword [rsi]
lea rdx, [rsp + 0x1b4]
sub rdx, rcx
mov al, byte [rcx]
mov byte [rdx + rcx], al
inc rcx
test al, al
jne 0x1800469c2
mov rcx, rbx
cmp qword [rbx + 0x18], r12
jbe 0x1800469da
mov rcx, qword [rbx]
lea rdx, [rsp + 0x27c]
sub rdx, rcx
mov al, byte [rcx]
mov byte [rcx + rdx], al
inc rcx
test al, al
jne 0x1800469e5
mov rcx, qword [0x1801274a0]
lea rdx, [rsp + 0x20]
xor r9d, r9d
mov r8d, 0x3ec
call qword [sym.imp.WS2_32.dll_send]
mov rcx, qword [0x1801274a0]
lea rdx, [rsp + 0x410]
xor r9d, r9d
mov dword [rsp + 0x410], 0xb
mov r8d, 0xc354
call qword [sym.imp.WS2_32.dll_recv]
mov rcx, rbp
lea rdx, [rsp + 0x414]
mov r8d, 0x57c
call fcn.1800b3790
mov rdx, qword [r14 + 0x18]
mov r13d, 0x1000
cmp rdx, r12
jbe 0x180046a86
mov rcx, qword [r14]
inc rdx
cmp rdx, r13
jb 0x180046a81
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180046b73
mov rcx, r8
call fcn.18007ff20
and qword [r14 + 0x10], 0
mov qword [r14 + 0x18], r12
mov byte [r14], 0
mov rdx, qword [rdi + 0x18]
cmp rdx, r12
jbe 0x180046ac8
mov rcx, qword [rdi]
inc rdx
cmp rdx, r13
jb 0x180046ac3
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180046b73
mov rcx, r8
call fcn.18007ff20
and qword [rdi + 0x10], 0
mov qword [rdi + 0x18], r12
mov byte [rdi], 0
mov rdx, qword [rsi + 0x18]
cmp rdx, r12
jbe 0x180046b05
mov rcx, qword [rsi]
inc rdx
cmp rdx, r13
jb 0x180046b00
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180046b73
mov rcx, r8
call fcn.18007ff20
and qword [rsi + 0x10], 0
mov qword [rsi + 0x18], r12
mov byte [rsi], 0
mov rdx, qword [rbx + 0x18]
cmp rdx, r12
jbe 0x180046b42
mov rcx, qword [rbx]
inc rdx
cmp rdx, r13
jb 0x180046b3d
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180046b73
mov rcx, r8
call fcn.18007ff20
and qword [rbx + 0x10], 0
mov rax, rbp
mov qword [rbx + 0x18], r12
mov byte [rbx], 0
mov rcx, qword [rsp + 0xc770]
xor rcx, rsp
call fcn.18007ff00
add rsp, 0xc780
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.18008a8b4
int3
Function at 0x180052114
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
mov r8, rcx
cmp byte [rcx + 0x11], r9b
je 0x180052153
mov r10, rcx
mov eax, 0x1f7047dd
mul r9d
mov eax, r9d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r9b
inc r9d
sub al, cl
add al, 0x3a
xor byte [r10], al
inc r10
cmp r9d, 0x12
jl 0x180052123
mov rax, r8
ret

Function at 0x180052158
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
mov r8, rcx
cmp byte [rcx + 9], r9b
je 0x180052197
mov r10, rcx
mov eax, 0x1f7047dd
mul r9d
mov eax, r9d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r9b
inc r9d
sub al, cl
add al, 0x3a
xor byte [r10], al
inc r10
cmp r9d, 0xa
jl 0x180052167
mov rax, r8
ret

Function at 0x18005219c
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
mov r8, rcx
cmp byte [rcx + 0xc], r9b
je 0x1800521db
mov r10, rcx
mov eax, 0x1f7047dd
mul r9d
mov eax, r9d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r9b
inc r9d
sub al, cl
add al, 0x3a
xor byte [r10], al
inc r10
cmp r9d, 0xd
jl 0x1800521ab
mov rax, r8
ret

Function at 0x1800521e0
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
mov r8, rcx
cmp byte [rcx + 0xa], r9b
je 0x18005221f
mov r10, rcx
mov eax, 0x1f7047dd
mul r9d
mov eax, r9d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r9b
inc r9d
sub al, cl
add al, 0x3a
xor byte [r10], al
inc r10
cmp r9d, 0xb
jl 0x1800521ef
mov rax, r8
ret

Function at 0x180052224
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
mov r8, rcx
cmp byte [rcx + 0x14], r9b
je 0x180052263
mov r10, rcx
mov eax, 0x1f7047dd
mul r9d
mov eax, r9d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r9b
inc r9d
sub al, cl
add al, 0x3a
xor byte [r10], al
inc r10
cmp r9d, 0x15
jl 0x180052233
mov rax, r8
ret

Function at 0x180052268
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
mov r8, rcx
cmp byte [rcx + 0x17], r9b
je 0x1800522a7
mov r10, rcx
mov eax, 0x1f7047dd
mul r9d
mov eax, r9d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r9b
inc r9d
sub al, cl
add al, 0x3a
xor byte [r10], al
inc r10
cmp r9d, 0x18
jl 0x180052277
mov rax, r8
ret

Function at 0x1800522ac
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
mov r8, rcx
cmp byte [rcx + 6], r9b
je 0x1800522eb
mov r10, rcx
mov eax, 0x1f7047dd
mul r9d
mov eax, r9d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r9b
inc r9d
sub al, cl
add al, 0x3a
xor byte [r10], al
inc r10
cmp r9d, 7
jl 0x1800522bb
mov rax, r8
ret

Function at 0x1800522f0
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
mov r8, rcx
cmp byte [rcx + 4], r9b
je 0x18005232f
mov r10, rcx
mov eax, 0x1f7047dd
mul r9d
mov eax, r9d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r9b
inc r9d
sub al, cl
add al, 0x3a
xor byte [r10], al
inc r10
cmp r9d, 5
jl 0x1800522ff
mov rax, r8
ret
Function at 0x180052334
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
mov r8, rcx
cmp byte [rcx + 3], r9b
je 0x180052373
mov r10, rcx
mov eax, 0x1f7047dd
mul r9d
mov eax, r9d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r9b
inc r9d
sub al, cl
add al, 0x3a
xor byte [r10], al
inc r10
cmp r9d, 4
jl 0x180052343
mov rax, r8
ret

Function at 0x180052378
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
mov r8, rcx
cmp byte [rcx + 0xb], r9b
je 0x1800523b7
mov r10, rcx
mov eax, 0x1f7047dd
mul r9d
mov eax, r9d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r9b
inc r9d
sub al, cl
add al, 0x3a
xor byte [r10], al
inc r10
cmp r9d, 0xc
jl 0x180052387
mov rax, r8
ret

Function at 0x1800527b4
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
mov r8, rcx
cmp byte [rcx + 8], r9b
je 0x1800527f3
mov r10, rcx
mov eax, 0x1f7047dd
mul r9d
mov eax, r9d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r9b
inc r9d
sub al, cl
add al, 0x3a
xor byte [r10], al
inc r10
cmp r9d, 9
jl 0x1800527c3
mov rax, r8
ret

Function at 0x1800527f8
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
mov r8, rcx
cmp byte [rcx + 0x10], r9b
je 0x180052837
mov r10, rcx
mov eax, 0x1f7047dd
mul r9d
mov eax, r9d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r9b
inc r9d
sub al, cl
add al, 0x3a
xor byte [r10], al
inc r10
cmp r9d, 0x11
jl 0x180052807
mov rax, r8
ret

Function at 0x18005283c
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
mov r8, rcx
cmp word [rcx + 0x24], r9w
je 0x180052882
mov r10, rcx
mov eax, 0x1f7047dd
mul r9d
mov eax, r9d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movzx eax, ax
imul ecx, eax, 0x39
movzx eax, r9w
inc r9d
sub ax, cx
add ax, 0x3a
xor word [r10], ax
lea r10, [r10 + 2]
cmp r9d, 0x13
jl 0x18005284c
mov rax, r8
ret

Function at 0x180052888
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
mov r8, rcx
cmp byte [rcx + 7], r9b
je 0x1800528c7
mov r10, rcx
mov eax, 0x1f7047dd
mul r9d
mov eax, r9d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r9b
inc r9d
sub al, cl
add al, 0x3a
xor byte [r10], al
inc r10
cmp r9d, 8
jl 0x180052897
mov rax, r8
ret

Function at 0x1800528cc
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
mov r8, rcx
cmp byte [rcx + 0x22], r9b
je 0x18005290b
mov r10, rcx
mov eax, 0x1f7047dd
mul r9d
mov eax, r9d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r9b
inc r9d
sub al, cl
add al, 0x3a
xor byte [r10], al
inc r10
cmp r9d, 0x23
jl 0x1800528db
mov rax, r8
ret

Function at 0x180052910
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
mov r8, rcx
cmp byte [rcx + 0xf], r9b
je 0x18005294f
mov r10, rcx
mov eax, 0x1f7047dd
mul r9d
mov eax, r9d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r9b
inc r9d
sub al, cl
add al, 0x3a
xor byte [r10], al
inc r10
cmp r9d, 0x10
jl 0x18005291f
mov rax, r8
ret
Function at 0x180052954
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
mov r8, rcx
cmp byte [rcx + 2], r9b
je 0x180052993
mov r10, rcx
mov eax, 0x1f7047dd
mul r9d
mov eax, r9d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r9b
inc r9d
sub al, cl
add al, 0x3a
xor byte [r10], al
inc r10
cmp r9d, 3
jl 0x180052963
mov rax, r8
ret

Function at 0x180052998
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
mov r8, rcx
cmp byte [rcx + 0xd], r9b
je 0x1800529d7
mov r10, rcx
mov eax, 0x1f7047dd
mul r9d
mov eax, r9d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r9b
inc r9d
sub al, cl
add al, 0x3a
xor byte [r10], al
inc r10
cmp r9d, 0xe
jl 0x1800529a7
mov rax, r8
ret

Function at 0x1800529dc
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
mov r8, rcx
cmp byte [rcx + 0x1a], r9b
je 0x180052a1b
mov r10, rcx
mov eax, 0x1f7047dd
mul r9d
mov eax, r9d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r9b
inc r9d
sub al, cl
add al, 0x3a
xor byte [r10], al
inc r10
cmp r9d, 0x1b
jl 0x1800529eb
mov rax, r8
ret

Function at 0x180052a20
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
mov r8, rcx
cmp byte [rcx + 5], r9b
je 0x180052a5f
mov r10, rcx
mov eax, 0x1f7047dd
mul r9d
mov eax, r9d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r9b
inc r9d
sub al, cl
add al, 0x3a
xor byte [r10], al
inc r10
cmp r9d, 6
jl 0x180052a2f
mov rax, r8
ret

Function at 0x180052a64
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
mov r8, rcx
cmp byte [rcx + 0x1d], r9b
je 0x180052aa3
mov r10, rcx
mov eax, 0x1f7047dd
mul r9d
mov eax, r9d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r9b
inc r9d
sub al, cl
add al, 0x3a
xor byte [r10], al
inc r10
cmp r9d, 0x1e
jl 0x180052a73
mov rax, r8
ret

Function at 0x180052aa8
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
mov r8, rcx
cmp byte [rcx + 0x20], r9b
je 0x180052ae7
mov r10, rcx
mov eax, 0x1f7047dd
mul r9d
mov eax, r9d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r9b
inc r9d
sub al, cl
add al, 0x3a
xor byte [r10], al
inc r10
cmp r9d, 0x21
jl 0x180052ab7
mov rax, r8
ret

Function at 0x180052aec
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
mov r8, rcx
cmp byte [rcx + 0xe], r9b
je 0x180052b2b
mov r10, rcx
mov eax, 0x1f7047dd
mul r9d
mov eax, r9d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r9b
inc r9d
sub al, cl
add al, 0x3a
xor byte [r10], al
inc r10
cmp r9d, 0xf
jl 0x180052afb
mov rax, r8
ret