joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180190210
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
xorps xmm5, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
nop dword [rax]
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x180190239
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
repz ret

Function at 0x1801902a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesenc xmm2, xmm1
lea rcx, [rcx + rax + 0x20]
neg rax
aesenc xmm3, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesenc xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x1801902ff

Function at 0x1801902f0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne fcn.1801902f0
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
repz ret

Function at 0x180190380
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesdec xmm2, xmm1
lea rcx, [rcx + rax + 0x20]
neg rax
aesdec xmm3, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesdec xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x1801903df
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1801903d0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
repz ret
Function at 0x180190460
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
pxor xmm6, xmm0
lea rcx, [rcx + rax + 0x20]
neg rax
aesenc xmm2, xmm1
pxor xmm7, xmm0
pxor xmm8, xmm0
aesenc xmm3, xmm1
pxor xmm9, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x1801904ba

Function at 0x1801904da
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
aesenc xmm8, xmm0
aesenc xmm9, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1801904b0
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
aesenclast xmm8, xmm0
aesenclast xmm9, xmm0
repz ret

Function at 0x180190570
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
pxor xmm6, xmm0
lea rcx, [rcx + rax + 0x20]
neg rax
aesdec xmm2, xmm1
pxor xmm7, xmm0
pxor xmm8, xmm0
aesdec xmm3, xmm1
pxor xmm9, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x1801905ca
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdec xmm8, xmm1
aesdec xmm9, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
aesdec xmm8, xmm0
aesdec xmm9, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1801905c0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdec xmm8, xmm1
aesdec xmm9, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
aesdeclast xmm8, xmm0
aesdeclast xmm9, xmm0
repz ret
Function at 0x180192d60
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
pxor xmm15, xmm9
movdqu xmm11, xmmword [rbx + r12]
movdqa xmm12, xmm10
movdqu xmm13, xmmword [rbx + r13]
movdqa xmm14, xmm10
pxor xmm10, xmm15
movdqu xmm15, xmmword [rbx + r14]
pxor xmm11, xmm10
pxor xmm8, xmm2
pxor xmm2, xmm10
pxor xmm12, xmm11
pxor xmm8, xmm3
pxor xmm3, xmm11
pxor xmm13, xmm12
pxor xmm8, xmm4
pxor xmm4, xmm12
pxor xmm14, xmm13
pxor xmm8, xmm5
pxor xmm5, xmm13
pxor xmm15, xmm14
pxor xmm8, xmm6
pxor xmm6, xmm14
pxor xmm8, xmm7
pxor xmm7, xmm15
movups xmm0, xmmword [r11 + 0x20]
lea r12, [r8 + 1]
lea r13, [r8 + 3]
lea r14, [r8 + 5]
add r8, 6
pxor xmm10, xmm9
bsf r12, r12
bsf r13, r13
bsf r14, r14
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
pxor xmm11, xmm9
pxor xmm12, xmm9
aesenc xmm6, xmm1
pxor xmm13, xmm9
pxor xmm14, xmm9
aesenc xmm7, xmm1
movups xmm1, xmmword [r11 + 0x30]
pxor xmm15, xmm9
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [r11 + 0x40]
shl r12, 4
shl r13, 4
jmp 0x180192e80
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x180192e80
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [r11 + 0x10]
shl r14, 4
aesenclast xmm2, xmm10
movdqu xmm10, xmmword [rbx]
mov rax, r10
aesenclast xmm3, xmm11
aesenclast xmm4, xmm12
aesenclast xmm5, xmm13
aesenclast xmm6, xmm14
aesenclast xmm7, xmm15
repz ret

Function at 0x180192f20
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
pxor xmm15, xmm9
movdqu xmm11, xmmword [rbx + r12]
movdqa xmm12, xmm10
movdqu xmm13, xmmword [rbx + r13]
pxor xmm10, xmm15
pxor xmm11, xmm10
pxor xmm8, xmm2
pxor xmm2, xmm10
pxor xmm12, xmm11
pxor xmm8, xmm3
pxor xmm3, xmm11
pxor xmm13, xmm12
pxor xmm8, xmm4
pxor xmm4, xmm12
pxor xmm8, xmm5
pxor xmm5, xmm13
movups xmm0, xmmword [r11 + 0x20]
pxor xmm10, xmm9
pxor xmm11, xmm9
pxor xmm12, xmm9
pxor xmm13, xmm9
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [r11 + 0x30]
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [r11 + 0x40]
jmp 0x180192fc0
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x180192fc0
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [r11 + 0x10]
mov rax, r10
aesenclast xmm2, xmm10
aesenclast xmm3, xmm11
aesenclast xmm4, xmm12
aesenclast xmm5, xmm13
repz ret
Function at 0x180193040
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
pxor xmm7, xmm15
pxor xmm7, xmm9
pxor xmm8, xmm2
pxor xmm2, xmm7
movups xmm0, xmmword [r11 + 0x20]
aesenc xmm2, xmm1
movups xmm1, xmmword [r11 + 0x30]
pxor xmm7, xmm9
aesenc xmm2, xmm0
movups xmm0, xmmword [r11 + 0x40]
jmp 0x180193080
aesenc xmm2, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x180193080
aesenc xmm2, xmm1
movups xmm1, xmmword [r11 + 0x10]
mov rax, r10
aesenclast xmm2, xmm7
repz ret

Function at 0x180193460
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
pxor xmm15, xmm9
movdqu xmm11, xmmword [rbx + r12]
movdqa xmm12, xmm10
movdqu xmm13, xmmword [rbx + r13]
movdqa xmm14, xmm10
pxor xmm10, xmm15
movdqu xmm15, xmmword [rbx + r14]
pxor xmm11, xmm10
pxor xmm2, xmm10
pxor xmm12, xmm11
pxor xmm3, xmm11
pxor xmm13, xmm12
pxor xmm4, xmm12
pxor xmm14, xmm13
pxor xmm5, xmm13
pxor xmm15, xmm14
pxor xmm6, xmm14
pxor xmm7, xmm15
movups xmm0, xmmword [r11 + 0x20]
lea r12, [r8 + 1]
lea r13, [r8 + 3]
lea r14, [r8 + 5]
add r8, 6
pxor xmm10, xmm9
bsf r12, r12
bsf r13, r13
bsf r14, r14
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
pxor xmm11, xmm9
pxor xmm12, xmm9
aesdec xmm6, xmm1
pxor xmm13, xmm9
pxor xmm14, xmm9
aesdec xmm7, xmm1
movups xmm1, xmmword [r11 + 0x30]
pxor xmm15, xmm9
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
movups xmm0, xmmword [r11 + 0x40]
shl r12, 4
shl r13, 4
jmp 0x180193560
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x180193560
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm1, xmmword [r11 + 0x10]
shl r14, 4
aesdeclast xmm2, xmm10
movdqu xmm10, xmmword [rbx]
mov rax, r10
aesdeclast xmm3, xmm11
aesdeclast xmm4, xmm12
aesdeclast xmm5, xmm13
aesdeclast xmm6, xmm14
aesdeclast xmm7, xmm15
repz ret
Function at 0x180193600
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
pxor xmm15, xmm9
movdqu xmm11, xmmword [rbx + r12]
movdqa xmm12, xmm10
movdqu xmm13, xmmword [rbx + r13]
pxor xmm10, xmm15
pxor xmm11, xmm10
pxor xmm2, xmm10
pxor xmm12, xmm11
pxor xmm3, xmm11
pxor xmm13, xmm12
pxor xmm4, xmm12
pxor xmm5, xmm13
movups xmm0, xmmword [r11 + 0x20]
pxor xmm10, xmm9
pxor xmm11, xmm9
pxor xmm12, xmm9
pxor xmm13, xmm9
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [r11 + 0x30]
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [r11 + 0x40]
jmp 0x1801936a0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1801936a0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [r11 + 0x10]
mov rax, r10
aesdeclast xmm2, xmm10
aesdeclast xmm3, xmm11
aesdeclast xmm4, xmm12
aesdeclast xmm5, xmm13
repz ret

Function at 0x180193720
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
pxor xmm7, xmm15
pxor xmm7, xmm9
pxor xmm2, xmm7
movups xmm0, xmmword [r11 + 0x20]
aesdec xmm2, xmm1
movups xmm1, xmmword [r11 + 0x30]
pxor xmm7, xmm9
aesdec xmm2, xmm0
movups xmm0, xmmword [r11 + 0x40]
jmp 0x180193760
aesdec xmm2, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x180193760
aesdec xmm2, xmm1
movups xmm1, xmmword [r11 + 0x10]
mov rax, r10
aesdeclast xmm2, xmm7
repz ret
Function at 0x1801941c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 8
call fcn.180194230
shl edx, 4
test eax, eax
jne 0x180194226
lea rcx, [r8 + rdx + 0x10]
movups xmm0, xmmword [r8]
movups xmm1, xmmword [rcx]
movups xmmword [rcx], xmm0
movups xmmword [r8], xmm1
lea r8, [r8 + 0x10]
lea rcx, [rcx - 0x10]
movups xmm0, xmmword [r8]
movups xmm1, xmmword [rcx]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea r8, [r8 + 0x10]
lea rcx, [rcx - 0x10]
movups xmmword [rcx + 0x10], xmm0
movups xmmword [r8 - 0x10], xmm1
cmp rcx, r8
ja 0x1801941eb
movups xmm0, xmmword [r8]
aesimc xmm0, xmm0
pxor xmm1, xmm1
movups xmmword [rcx], xmm0
pxor xmm0, xmm0
add rsp, 8
repz ret
Function at 0x180195530
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r13
mov eax, 0x20
call fcn.18014c9d0
sub rsp, rax
mov r13, qword [rcx + 0x160]
xor eax, eax
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
mov qword [rcx], rax
mov qword [rcx + 8], rax
mov qword [rcx + 0x40], rax
mov qword [rcx + 0x48], rax
mov qword [rcx + 0x30], rax
mov qword [rcx + 0x38], rax
mov qword [rcx + 0x170], rax
cmp r8, 0xc
jne 0x180195593
mov rax, qword [rdx]
lea edi, [r8 - 0xb]
mov qword [rcx], rax
mov eax, dword [rdx + 8]
mov byte [rcx + 0xf], 1
mov dword [rcx + 8], eax
jmp 0x180195679
mov qword [rsp + 0x58], r14
mov r14, r8
cmp r8, 0x10
jb 0x180195636
mov qword [rsp + 0x50], r12
mov r12, r8
mov rdi, rdx
shr r12, 4
sub rdi, rcx
mov qword [rsp + 0x60], r15
mov rax, r12
add rdi, 2
imul rax, rax, 0xfffffffffffffff0
add rsi, rax
mov rax, r12
shl rax, 4
add rbp, rax
nop word [rax + rax]
mov rcx, rbx
mov edx, 4
nop dword [rax + rax]
movzx eax, byte [rdi + rcx - 2]
add rcx, 4
xor byte [rcx - 4], al
movzx eax, byte [rdi + rcx - 5]
xor byte [rcx - 3], al
movzx eax, byte [rdi + rcx - 4]
xor byte [rcx - 2], al
movzx eax, byte [rdi + rcx - 3]
xor byte [rcx - 1], al
dec rdx
jne 0x1801955f0
lea rdx, [rbx + 0x60]
mov rcx, rbx
call r13
add rdi, 0x10
dec r12
jne 0x1801955e0
mov r15, qword [rsp + 0x60]
mov r12, qword [rsp + 0x50]
test rsi, rsi
je 0x18019565a
mov rcx, rbx
sub rbp, rbx
movzx eax, byte [rcx + rbp]
inc rcx
xor byte [rcx - 1], al
dec rsi
jne 0x180195641
lea rdx, [rbx + 0x60]
mov rcx, rbx
call r13
shl r14, 3
lea rdx, [rbx + 0x60]
mov rcx, rbx
bswap r14
xor qword [rbx + 8], r14
call r13
mov edi, dword [rbx + 0xc]
mov r14, qword [rsp + 0x58]
bswap edi
mov r8, qword [rbx + 0x180]
lea rdx, [rbx + 0x20]
mov rcx, rbx
call qword [rbx + 0x178]
inc edi
bswap edi
mov dword [rbx + 0xc], edi
add rsp, 0x20
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1801956a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r13
mov eax, 0x20
call fcn.18014c9d0
sub rsp, rax
cmp qword [rcx + 0x38], 0
mov r13, qword [rcx + 0x168]
mov rbx, r8
mov r8, qword [rcx + 0x160]
mov rbp, rdx
mov rdi, rcx
je 0x1801956e7
mov eax, 0xfffffffe
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop rdi
pop rbp
ret
mov rax, qword [rcx + 0x30]
lea rcx, [rbx + rax]
movabs rax, 0x2000000000000000
cmp rcx, rax
ja 0x1801957bb
cmp rcx, rbx
jb 0x1801957bb
mov qword [rsp + 0x40], rsi
mov esi, dword [rdi + 0x174]
mov qword [rdi + 0x30], rcx
test esi, esi
je 0x18019574d
nop
test rbx, rbx
je 0x18019573e
movzx eax, byte [rbp]
mov ecx, esi
inc rbp
xor byte [rcx + rdi + 0x40], al
dec rbx
inc esi
and esi, 0xf
jne 0x180195720
jmp 0x180195742
test esi, esi
jne 0x1801957a0
lea rdx, [rdi + 0x60]
lea rcx, [rdi + 0x40]
call r8
mov qword [rsp + 0x48], r12
mov r12, rbx
and r12, 0xfffffffffffffff0
je 0x180195772
lea rdx, [rdi + 0x60]
lea rcx, [rdi + 0x40]
mov r9, r12
mov r8, rbp
call r13
add rbp, r12
sub rbx, r12
mov r12, qword [rsp + 0x48]
test rbx, rbx
je 0x1801957a0
mov esi, ebx
lea rcx, [rdi + 0x40]
sub rbp, rdi
nop word [rax + rax]
movzx eax, byte [rcx + rbp - 0x40]
inc rcx
xor byte [rcx - 1], al
dec rbx
jne 0x180195790
mov dword [rdi + 0x174], esi
mov rsi, qword [rsp + 0x40]
xor eax, eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop rdi
pop rbp
ret
or eax, 0xffffffff
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop rdi
pop rbp
ret
Function at 0x180195dd0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
mov eax, 0x60
call fcn.18014c9d0
sub rsp, rax
mov rax, qword [rcx + 0x180]
mov rbx, qword [rcx + 0x160]
mov rdi, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rcx + 0x168]
mov rsi, r9
mov qword [rsp + 0x38], rax
mov rax, qword [rcx + 0x38]
mov r12, r8
lea rcx, [r9 + rax]
movabs rax, 0xfffffffe0
mov r13, rdx
cmp rcx, rax
ja 0x18019603d
cmp rcx, r9
jb 0x18019603d
cmp dword [rdi + 0x174], 0
mov qword [rsp + 0x98], rbp
mov qword [rdi + 0x38], rcx
mov qword [rsp + 0x58], r14
je 0x180195e62
lea rdx, [rdi + 0x60]
lea rcx, [rdi + 0x40]
call rbx
mov dword [rdi + 0x174], 0
mov r14d, dword [rdi + 0xc]
lea rax, [rdi + 0x170]
mov ebp, dword [rax]
bswap r14d
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x90], ebp
test ebp, ebp
je 0x180195ec6
test rsi, rsi
je 0x180195eb4
mov ecx, ebp
inc r12
inc r13
movzx eax, byte [rcx + rdi + 0x10]
dec rsi
xor al, byte [r13 - 1]
mov byte [r12 - 1], al
xor byte [rcx + rdi + 0x40], al
inc ebp
and ebp, 0xf
mov dword [rsp + 0x90], ebp
jne 0x180195e82
jmp 0x180195ebc
test ebp, ebp
jne 0x18019601b
lea rdx, [rdi + 0x60]
lea rcx, [rdi + 0x40]
call rbx
mov r10, qword [rsp + 0xb0]
mov qword [rsp + 0x50], r15
cmp rsi, 0xc00
jb 0x180195f75
movabs rax, 0xaaaaaaaaaaaaaaab
mul rsi
mov rbx, rdx
shr rbx, 0xb
mov rax, rbx
imul rax, rax, 0xfffffffffffff400
add rsi, rax
mov qword [rsp + 0xa8], rsi
mov rsi, qword [rsp + 0x30]
nop
mov r9, rsi
mov r8d, 0xc0
mov rdx, r12
mov rcx, r13
mov qword [rsp + 0x20], rdi
call r10
add r14d, 0xc0
lea rdx, [rdi + 0x60]
mov eax, r14d
lea rcx, [rdi + 0x40]
mov r9d, 0xc00
bswap eax
mov r8, r12
mov dword [rdi + 0xc], eax
call qword [rsp + gethostname]
mov r10, qword [rsp + 0xb0]
add r12, 0xc00
add r13, 0xc00
dec rbx
jne 0x180195f10
mov rsi, qword [rsp + 0xa8]
mov ebp, dword [rsp + 0x90]
mov r15, rsi
and r15, 0xfffffffffffffff0
je 0x180195fc1
mov r9, qword [rsp + 0x30]
mov rbx, r15
mov rdx, r12
shr rbx, 4
mov rcx, r13
mov qword [rsp + 0x20], rdi
mov r8, rbx
call r10
add r14d, ebx
lea rdx, [rdi + 0x60]
mov eax, r14d
lea rcx, [rdi + 0x40]
mov r9, r15
bswap eax
mov r8, r12
add r13, r15
mov dword [rdi + 0xc], eax
sub rsi, r15
call qword [rsp + gethostname]
add r12, r15
mov r15, qword [rsp + 0x50]
test rsi, rsi
je 0x18019601b
mov r8, qword [rsp + 0x30]
lea rdx, [rdi + 0x10]
mov rcx, rdi
call qword [rdi + 0x178]
inc r14d
movsxd rdx, ebp
bswap r14d
add rdx, r13
sub r12, r13
mov dword [rdi + 0xc], r14d
sub rdi, r13
add ebp, esi
nop word [rax + rax]
movzx eax, byte [rdx]
movzx ecx, byte [rdi + rdx + 0x10]
inc rdx
xor ecx, eax
mov byte [r12 + rdx - 1], cl
xor byte [rdi + rdx + 0x3f], cl
dec rsi
jne 0x180196000
mov rax, qword [rsp + 0x40]
mov r14, qword [rsp + 0x58]
mov dword [rax], ebp
mov rbp, qword [rsp + 0x98]
xor eax, eax
add rsp, 0x60
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
or eax, 0xffffffff
add rsp, 0x60
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x180196050
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
mov eax, 0x50
call fcn.18014c9d0
sub rsp, rax
mov rax, qword [rcx + 0x180]
mov rbx, qword [rcx + 0x160]
mov rsi, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rcx + 0x168]
mov rdi, r9
mov qword [rsp + 0x38], rax
mov rax, qword [rcx + 0x38]
mov r13, r8
lea rcx, [r9 + rax]
movabs rax, 0xfffffffe0
mov r12, rdx
cmp rcx, rax
ja 0x1801962bd
cmp rcx, r9
jb 0x1801962bd
cmp dword [rsi + 0x174], 0
mov qword [rsp + 0x88], rbp
mov qword [rsi + 0x38], rcx
mov qword [rsp + 0x48], r14
je 0x1801960e2
lea rdx, [rsi + 0x60]
lea rcx, [rsi + 0x40]
call rbx
mov dword [rsi + 0x174], 0
mov ebp, dword [rsi + 0x170]
mov r14d, dword [rsi + 0xc]
bswap r14d
mov dword [rsp + 0x80], ebp
test ebp, ebp
je 0x180196146
nop word [rax + rax]
test rdi, rdi
je 0x180196134
movzx edx, byte [r12]
mov ecx, ebp
inc r13
movzx eax, byte [rcx + rsi + 0x10]
inc r12
dec rdi
xor al, dl
mov byte [r13 - 1], al
xor byte [rcx + rsi + 0x40], dl
inc ebp
and ebp, 0xf
mov dword [rsp + 0x80], ebp
jne 0x180196100
jmp 0x18019613c
test ebp, ebp
jne 0x18019629c
lea rdx, [rsi + 0x60]
lea rcx, [rsi + 0x40]
call rbx
mov qword [rsp + 0x40], r15
mov r15, qword [rsp + 0xa0]
cmp rdi, 0xc00
jb 0x1801961ef
movabs rax, 0xaaaaaaaaaaaaaaab
mul rdi
mov rbx, rdx
shr rbx, 0xb
mov rax, rbx
imul rax, rax, 0xfffffffffffff400
add rdi, rax
mov qword [rsp + 0x98], rdi
nop dword [rax]
lea rdx, [rsi + 0x60]
lea rcx, [rsi + 0x40]
mov r9d, 0xc00
mov r8, r12
call qword [rsp + gethostname]
mov r9, qword [rsp + 0x30]
mov r8d, 0xc0
mov rdx, r13
mov rcx, r12
mov qword [rsp + 0x20], rsi
call r15
add r14d, 0xc0
add r13, 0xc00
mov eax, r14d
add r12, 0xc00
dec rbx
bswap eax
mov dword [rsi + 0xc], eax
jne 0x180196190
mov rdi, qword [rsp + 0x98]
mov ebp, dword [rsp + 0x80]
mov r15, rdi
and r15, 0xfffffffffffffff0
je 0x18019623f
lea rdx, [rsi + 0x60]
lea rcx, [rsi + 0x40]
mov rbx, r15
mov r9, r15
mov r8, r12
shr rbx, 4
call qword [rsp + gethostname]
mov r9, qword [rsp + 0x30]
mov r8, rbx
mov rdx, r13
mov rcx, r12
mov qword [rsp + 0x20], rsi
call qword [rsp + 0xa0]
add r14d, ebx
add r13, r15
mov eax, r14d
add r12, r15
sub rdi, r15
bswap eax
mov dword [rsi + 0xc], eax
mov r15, qword [rsp + 0x40]
test rdi, rdi
je 0x18019629c
mov r8, qword [rsp + 0x30]
lea rdx, [rsi + 0x10]
mov rcx, rsi
call qword [rsi + 0x178]
inc r14d
movsxd rax, ebp
bswap r14d
sub r12, rsi
sub r13, rsi
mov dword [rsi + 0xc], r14d
lea rdx, [rax + rsi + 0x40]
add ebp, edi
nop word [rax + rax]
movzx ecx, byte [r12 + rdx - 0x40]
movzx eax, byte [rdx - 0x30]
inc rdx
xor byte [rdx - 1], cl
xor al, cl
dec rdi
mov byte [r13 + rdx - 0x41], al
jne 0x180196280
mov r14, qword [rsp + 0x48]
mov dword [rsi + 0x170], ebp
mov rbp, qword [rsp + 0x88]
xor eax, eax
add rsp, 0x50
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
or eax, 0xffffffff
add rsp, 0x50
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret