joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180002498
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x40
lea rcx, str._internal__Initialising_SDK__Memory...
call fcn.180004ac3
lea rsi, [rsp + 0x29]
movabs rax, 0x3b32212f272f42
mov qword [rsi - 1], rax
mov eax, 1
xor byte [rsp + rax + 0x28], 0x42
inc rax
cmp rax, 7
jne 0x1800024c1
xor eax, eax
mov byte [rsp + 0x2f], al
lea rcx, [rsp + 0x31]
movabs rdx, 0x662c6e6e66766c02
mov qword [rcx - 1], rdx
mov word [rcx + 7], 0x6e6e
mov byte [rcx + 9], al
mov eax, 1
xor byte [rsp + rax + 0x30], 2
inc rax
cmp rax, 0xa
jne 0x1800024f6
mov byte [rsp + 0x3a], 0
call fcn.18000c8ea
mov rcx, rax
mov rdx, rsi
call fcn.18000c941
mov qword [0x180011e38], rax
lea rcx, str._internal__SDK__Memory_:_memcpy_____0x_p
mov rdx, rax
call fcn.180004ac3
lea rcx, str._internal__Initialised_SDK__Memory_
call fcn.180004ac3
mov al, 1
add rsp, 0x40
pop rsi
ret
Function at 0x180004ac3
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rax, rcx
lea rcx, [rsp + 0x68]
mov qword [rcx], rdx
mov qword [rcx + 8], r8
mov qword [rcx + 0x10], r9
mov qword [rsp + 0x20], rcx
mov rcx, qword gs:[0x60]
mov rdx, qword [rcx + 0x18]
add rdx, 0x10
mov rdx, qword [rdx]
mov rcx, qword [rdx + 0x30]
movsxd r8, dword [rcx + 0x3c]
mov r8d, dword [rcx + r8 + 0x88]
test r8, r8
je 0x180004af8
mov r9d, dword [rcx + r8 + 0x18]
test r9, r9
je 0x180004af8
mov r10d, dword [rcx + r8 + 0x20]
add r10, rcx
lea r11, [rcx + 1]
dec r9
mov esi, r9d
mov edi, dword [r10 + rsi*4]
mov bpl, byte [rcx + rdi]
test bpl, bpl
je 0x180004b75
add rdi, r11
mov ebx, 0x5cfc5603
movsx r14d, bpl
lea ebp, [r14 - 0x41]
mov r15d, r14d
or r15d, 0x20
cmp bpl, 0x1a
cmovae r15d, r14d
xor r15d, ebx
imul ebx, r15d, 0x1000193
mov bpl, byte [rdi]
inc rdi
test bpl, bpl
jne 0x180004b41
cmp ebx, 0xd3e50a2d
je 0x180004b7f
test rsi, rsi
jne 0x180004b26
jmp 0x180004af8
mov edx, dword [rcx + r8 + 0x1c]
mov r8d, dword [rcx + r8 + 0x24]
add rdx, rcx
add r8, rcx
movzx r8d, word [r8 + rsi*2]
mov r10d, dword [rdx + r8*4]
add r10, rcx
mov r9, qword [rsp + 0x20]
lea rcx, [0x180011e40]
mov edx, 0x200
mov r8, rax
call r10
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x180004bc3
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x180004bc3
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov esi, dword [r9 + r11*4]
mov bl, byte [rax + rsi]
test bl, bl
je 0x180004c39
add rsi, r10
mov edi, 0x63fe9f9f
movsx ebx, bl
lea ebp, [rbx - 0x41]
mov r14d, ebx
or r14d, 0x20
cmp bpl, 0x1a
cmovae r14d, ebx
xor r14d, edi
imul edi, r14d, 0x1000193
mov bl, byte [rsi]
inc rsi
test bl, bl
jne 0x180004c09
cmp edi, 0xb70f790b
je 0x180004c40
test r11, r11
jne 0x180004bf0
jmp 0x180004bc3
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov edx, dword [rcx + rdx*4]
add rdx, rax
lea rsi, [0x180011e40]
mov rcx, rsi
call rdx
mov rax, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x180009a50
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xc8
movaps xmmword [rsp + 0xb0], xmm6
movaps xmm6, xmm3
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov r15, qword [rsp + 0x120]
lea rdx, [rsp + 0x42]
movaps xmm0, xmmword [0x18000f100]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x18000f110]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x18000f120]
movaps xmmword [rdx + 0x1e], xmm0
mov dword [rdx + 0x2e], 0x6b0013
mov word [rdx + 0x62], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0x6b
inc rax
cmp rax, 0x32
jne 0x180009ab4
lea r14, [rsp + 0x40]
mov word [r14 + 0x64], 0
mov rax, qword [0x180012150]
lea r12, [rsp + 0x30]
mov qword [r12], rax
mov dword [r12 + 8], 0
mov qword [rsp + 0x20], r12
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
call fcn.18000dbe0
movups xmm0, xmmword [rbx]
movaps xmmword [r14], xmm0
movups xmm0, xmmword [rdi]
movaps xmmword [r14 + 0x10], xmm0
movss dword [r14 + 0x20], xmm6
movups xmm0, xmmword [r15]
movups xmmword [r14 + 0x24], xmm0
mov rcx, qword [rsi]
mov rcx, qword [rcx + 0x268]
mov qword [r12], rcx
mov qword [r12 + 8], 0
mov qword [rsp + 0x20], r12
mov rcx, rsi
mov rdx, rax
mov r8, r14
xor r9d, r9d
call fcn.18000dbe0
movaps xmm6, xmmword [rsp + 0xb0]
add rsp, 0xc8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x180009b5e
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xa8
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
lea rdx, [rsp + 0x42]
movaps xmm0, xmmword [str.e0970_p]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x18000f140]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x18000f150]
movaps xmmword [rdx + 0x1e], xmm0
mov dword [rdx + 0x2e], 0x5e002a
mov word [rdx + 0x62], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0x5e
inc rax
cmp rax, 0x32
jne 0x180009baf
lea r14, [rsp + 0x40]
mov word [r14 + 0x64], 0
mov rax, qword [0x180012150]
lea r15, [rsp + 0x30]
mov qword [r15], rax
mov dword [r15 + 8], 0
mov qword [rsp + 0x20], r15
xor r12d, r12d
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
call fcn.18000dbe0
mov qword [r14 + 0x28], r12
xorps xmm0, xmm0
movups xmmword [r14 + 0x18], xmm0
movups xmm0, xmmword [rbx]
movaps xmmword [r14], xmm0
mov rcx, qword [rbx + 0x10]
mov qword [r14 + 0x10], rcx
mov rcx, qword [rdi]
mov rcx, qword [rcx + 0x268]
mov qword [r15], rcx
mov qword [r15 + 8], r12
mov qword [rsp + 0x20], r15
mov rcx, rdi
mov rdx, rax
mov r8, r14
xor r9d, r9d
call fcn.18000dbe0
mov rax, qword [r14 + 0x28]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [r14 + 0x18]
movups xmmword [rsi], xmm0
mov rax, rsi
add rsp, 0xa8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x180009c5c
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xc8
movaps xmmword [rsp + 0xb0], xmm6
movaps xmm6, xmm3
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov r15, qword [rsp + 0x120]
lea rdx, [rsp + 0x42]
movaps xmm0, xmmword [0x18000f160]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [str._PH_M]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x18000f180]
movaps xmmword [rdx + 0x1e], xmm0
mov dword [rdx + 0x2e], 0x5b0050
mov word [rdx + 0x32], 0x3e
mov word [rdx + 0x66], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0x3e
inc rax
cmp rax, 0x34
jne 0x180009cc6
lea r14, [rsp + 0x40]
mov word [r14 + 0x68], 0
mov rax, qword [0x180012150]
lea r12, [rsp + 0x30]
mov qword [r12], rax
mov dword [r12 + 8], 0
mov qword [rsp + 0x20], r12
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
call fcn.18000dbe0
movups xmm0, xmmword [rbx]
movaps xmmword [r14], xmm0
movups xmm0, xmmword [rdi]
movaps xmmword [r14 + 0x10], xmm0
movss dword [r14 + 0x20], xmm6
movups xmm0, xmmword [r15]
movups xmmword [r14 + 0x24], xmm0
mov rcx, qword [rsi]
mov rcx, qword [rcx + 0x268]
mov qword [r12], rcx
mov qword [r12 + 8], 0
mov qword [rsp + 0x20], r12
mov rcx, rsi
mov rdx, rax
mov r8, r14
xor r9d, r9d
call fcn.18000dbe0
movaps xmm6, xmmword [rsp + 0xb0]
add rsp, 0xc8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x180009d70
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xb8
mov rbx, r9
mov r14, r8
mov rsi, rdx
mov rdi, rcx
mov r12, qword [rsp + 0x110]
mov rdx, qword [0x1800120f0]
test rdx, rdx
jne 0x180009e2c
lea rdx, [rsp + 0x42]
movaps xmm0, xmmword [0x18000f190]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x18000f1a0]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x18000f1b0]
movaps xmmword [rdx + 0x1e], xmm0
mov dword [rdx + 0x2e], 0xc0013
mov word [rdx + 0x32], 0x69
mov word [rdx + 0x66], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0x69
inc rax
cmp rax, 0x34
jne 0x180009de2
mov word [rsp + 0xa8], 0
mov rax, qword [0x180012150]
lea rcx, [rsp + 0x30]
mov qword [rcx], rax
mov dword [rcx + 8], 0
mov qword [rsp + 0x20], rcx
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
call fcn.18000dbe0
mov rdx, rax
mov qword [0x1800120f0], rax
lea r15, [rsp + 0x40]
mov qword [r15], r14
movups xmm0, xmmword [rbx]
movups xmmword [r15 + 8], xmm0
xorps xmm0, xmm0
movups xmmword [r15 + 0x28], xmm0
movups xmm0, xmmword [r12]
movups xmmword [r15 + 0x18], xmm0
mov rax, qword [rdi]
mov rax, qword [rax + 0x268]
lea rcx, [rsp + 0x30]
mov qword [rcx], rax
mov qword [rcx + 8], 0
mov qword [rsp + 0x20], rcx
mov rcx, rdi
mov r8, r15
xor r9d, r9d
call fcn.18000dbe0
movups xmm0, xmmword [r15 + 0x28]
movups xmmword [rsi], xmm0
mov rax, rsi
add rsp, 0xb8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x180009e98
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xe8
movaps xmmword [rsp + 0xd0], xmm6
mov rdi, r9
mov rbx, r8
mov r14, rdx
mov rsi, rcx
mov rax, qword [rsp + 0x190]
mov cl, byte [rsp + 0x188]
mov r9b, byte [rsp + 0x180]
mov r10b, byte [rsp + 0x178]
mov r15, qword [rsp + 0x170]
mov rbp, qword [rsp + 0x168]
movss xmm6, dword [rsp + 0x160]
mov r12, qword [rsp + 0x158]
mov r13, qword [rsp + 0x150]
mov rdx, qword [0x1800120f8]
test rdx, rdx
jne 0x180009fbe
lea rdx, [rsp + 0x42]
movaps xmm0, xmmword [0x18000f1c0]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x18000f1d0]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x18000f1e0]
movaps xmmword [rdx + 0x1e], xmm0
mov dword [rdx + 0x2e], 0x41004d
mov word [rdx + 0x32], 0x35
mov word [rdx + 0x66], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0x35
inc rax
cmp rax, 0x34
jne 0x180009f55
mov word [rsp + 0xa8], 0
mov rax, qword [0x180012150]
lea rcx, [rsp + 0x30]
mov qword [rcx], rax
mov dword [rcx + 8], 0
mov qword [rsp + 0x20], rcx
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
call fcn.18000dbe0
mov rdx, rax
mov qword [0x1800120f8], rax
mov rax, qword [rsp + 0x190]
mov cl, byte [rsp + 0x188]
mov r9b, byte [rsp + 0x180]
mov r10b, byte [rsp + 0x178]
lea r8, [rsp + 0x40]
mov qword [r8], r14
movups xmm0, xmmword [rbx]
movups xmmword [r8 + 8], xmm0
movups xmm0, xmmword [rdi]
movups xmmword [r8 + 0x18], xmm0
movups xmm0, xmmword [r13]
movups xmmword [r8 + 0x28], xmm0
movups xmm0, xmmword [r12]
movups xmmword [r8 + 0x38], xmm0
movss dword [r8 + 0x48], xmm6
movups xmm0, xmmword [rbp]
movups xmmword [r8 + 0x4c], xmm0
movups xmm0, xmmword [r15]
movups xmmword [r8 + 0x60], xmm0
mov byte [r8 + 0x70], r10b
mov byte [r8 + 0x71], r9b
mov byte [r8 + 0x72], cl
movups xmm0, xmmword [rax]
movups xmmword [r8 + 0x74], xmm0
mov rax, qword [rsi]
mov rax, qword [rax + 0x268]
lea rcx, [rsp + 0x30]
mov qword [rcx], rax
mov qword [rcx + 8], 0
mov qword [rsp + 0x20], rcx
mov rcx, rsi
xor r9d, r9d
call fcn.18000dbe0
movaps xmm6, xmmword [rsp + 0xd0]
add rsp, 0xe8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x18000a05c
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rsi, rcx
mov rdx, qword [0x180012100]
test rdx, rdx
jne 0x18000a103
lea rdx, [rsp + 0x42]
movaps xmm0, xmmword [0x18000f1f0]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x18000f200]
movaps xmmword [rdx + 0xe], xmm0
movabs rax, 0x4a007b005f004e
mov qword [rdx + 0x1e], rax
mov dword [rdx + 0x26], 0x45005c
mov word [rdx + 0x2a], 0x2b
mov word [rdx + 0x56], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0x2b
inc rax
cmp rax, 0x2c
jne 0x18000a0b9
mov word [rsp + 0x98], 0
mov rax, qword [0x180012150]
lea rcx, [rsp + 0x30]
mov qword [rcx], rax
mov dword [rcx + 8], 0
mov qword [rsp + 0x20], rcx
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
call fcn.18000dbe0
mov rdx, rax
mov qword [0x180012100], rax
mov rax, qword [rsi]
mov rax, qword [rax + 0x268]
lea rcx, [rsp + 0x40]
mov qword [rcx], rax
mov qword [rcx + 8], 0
mov qword [rsp + 0x20], rcx
lea rdi, [rsp + 0x30]
mov rcx, rsi
mov r8, rdi
xor r9d, r9d
call fcn.18000dbe0
mov rax, qword [rdi]
add rsp, 0xa8
pop rdi
pop rsi
ret

Function at 0x18000a142
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xd0
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rdx, qword [0x180012108]
test rdx, rdx
jne 0x18000a1f5
lea rdx, [rsp + 0x42]
movaps xmm0, xmmword [0x18000f210]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x18000f220]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x18000f230]
movaps xmmword [rdx + 0x1e], xmm0
movaps xmm0, xmmword [0x18000f240]
movaps xmmword [rdx + 0x2e], xmm0
mov dword [rdx + 0x3e], 0x630006
mov word [rdx + 0x82], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0x63
inc rax
cmp rax, 0x42
jne 0x18000a1ab
mov word [rsp + 0xc4], 0
mov rax, qword [0x180012150]
lea rcx, [rsp + 0x30]
mov qword [rcx], rax
mov dword [rcx + 8], 0
mov qword [rsp + 0x20], rcx
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
call fcn.18000dbe0
mov rdx, rax
mov qword [0x180012108], rax
mov rax, qword [rbx]
mov rax, qword [rax + 0x268]
lea rcx, [rsp + 0x40]
mov qword [rcx], rax
mov qword [rcx + 8], 0
mov qword [rsp + 0x20], rcx
lea r8, [rsp + 0x30]
mov rcx, rbx
xor r9d, r9d
call fcn.18000dbe0
test rdi, rdi
je 0x18000a22f
mov eax, dword [rsp + 0x30]
mov dword [rdi], eax
test rsi, rsi
je 0x18000a23a
mov eax, dword [rsp + 0x34]
mov dword [rsi], eax
add rsp, 0xd0
pop rbx
pop rdi
pop rsi
ret
Function at 0x18000a246
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xf0
mov rdi, rdx
mov rsi, rcx
mov rdx, qword [0x180012110]
test rdx, rdx
jne 0x18000a300
lea rdx, [rsp + 0x42]
movaps xmm0, xmmword [0x18000f250]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x18000f260]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x18000f270]
movaps xmmword [rdx + 0x1e], xmm0
movaps xmm0, xmmword [0x18000f280]
movaps xmmword [rdx + 0x2e], xmm0
movaps xmm0, xmmword [0x18000f290]
movaps xmmword [rdx + 0x3e], xmm0
mov word [rdx + 0x4e], 0x7c
mov word [rdx + 0x9e], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0x7c
inc rax
cmp rax, 0x50
jne 0x18000a2b6
mov word [rsp + 0xe0], 0
mov rax, qword [0x180012150]
lea rcx, [rsp + 0x30]
mov qword [rcx], rax
mov dword [rcx + 8], 0
mov qword [rsp + 0x20], rcx
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
call fcn.18000dbe0
mov rdx, rax
mov qword [0x180012110], rax
mov rax, qword [rdi + 0x10]
lea rbx, [rsp + 0x40]
mov qword [rbx + 0x10], rax
movups xmm0, xmmword [rdi]
movaps xmmword [rbx], xmm0
mov rax, qword [rsi]
mov rax, qword [rax + 0x268]
lea rcx, [rsp + 0x30]
mov qword [rcx], rax
mov qword [rcx + 8], 0
mov qword [rsp + 0x20], rcx
mov rcx, rsi
mov r8, rbx
xor r9d, r9d
call fcn.18000dbe0
mov al, byte [rbx + 0x18]
add rsp, 0xf0
pop rbx
pop rdi
pop rsi
ret

Function at 0x18000a34e
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xf0
mov rdi, rdx
mov rsi, rcx
mov rdx, qword [0x180012118]
test rdx, rdx
jne 0x18000a409
lea rdx, [rsp + 0x42]
movaps xmm0, xmmword [0x18000f2a0]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [str.____4]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x18000f2c0]
movaps xmmword [rdx + 0x1e], xmm0
movaps xmm0, xmmword [0x18000f2d0]
movaps xmmword [rdx + 0x2e], xmm0
movaps xmm0, xmmword [0x18000f2e0]
movaps xmmword [rdx + 0x3e], xmm0
mov dword [rdx + 0x4e], 0x510035
mov word [rdx + 0xa2], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0x51
inc rax
cmp rax, 0x52
jne 0x18000a3bf
mov word [rsp + 0xe4], 0
mov rax, qword [0x180012150]
lea rcx, [rsp + 0x30]
mov qword [rcx], rax
mov dword [rcx + 8], 0
mov qword [rsp + 0x20], rcx
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
call fcn.18000dbe0
mov rdx, rax
mov qword [0x180012118], rax
mov rax, qword [rdi + 0x10]
lea rbx, [rsp + 0x40]
mov qword [rbx + 0x10], rax
movups xmm0, xmmword [rdi]
movaps xmmword [rbx], xmm0
mov rax, qword [rsi]
mov rax, qword [rax + 0x268]
lea rcx, [rsp + 0x30]
mov qword [rcx], rax
mov qword [rcx + 8], 0
mov qword [rsp + 0x20], rcx
mov rcx, rsi
mov r8, rbx
xor r9d, r9d
call fcn.18000dbe0
mov al, byte [rbx + 0x18]
add rsp, 0xf0
pop rbx
pop rdi
pop rsi
ret
Function at 0x18000a458
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xd0
mov rdi, rdx
mov rsi, rcx
mov rdx, qword [0x180012120]
test rdx, rdx
jne 0x18000a504
lea rdx, [rsp + 0x42]
movaps xmm0, xmmword [0x18000f2f0]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x18000f300]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x18000f310]
movaps xmmword [rdx + 0x1e], xmm0
movaps xmm0, xmmword [0x18000f320]
movaps xmmword [rdx + 0x2e], xmm0
mov word [rdx + 0x3e], 0x62
mov word [rdx + 0x7e], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0x62
inc rax
cmp rax, 0x40
jne 0x18000a4ba
mov word [rsp + 0xc0], 0
mov rax, qword [0x180012150]
lea rcx, [rsp + 0x30]
mov qword [rcx], rax
mov dword [rcx + 8], 0
mov qword [rsp + 0x20], rcx
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
call fcn.18000dbe0
mov rdx, rax
mov qword [0x180012120], rax
mov rax, qword [rdi + 0x10]
lea rbx, [rsp + 0x40]
mov qword [rbx + 0x10], rax
movups xmm0, xmmword [rdi]
movaps xmmword [rbx], xmm0
mov rax, qword [rsi]
mov rax, qword [rax + 0x268]
lea rcx, [rsp + 0x30]
mov qword [rcx], rax
mov qword [rcx + 8], 0
mov qword [rsp + 0x20], rcx
mov rcx, rsi
mov r8, rbx
xor r9d, r9d
call fcn.18000dbe0
mov al, byte [rbx + 0x18]
add rsp, 0xd0
pop rbx
pop rdi
pop rsi
ret

Function at 0x18000a552
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xd0
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rdx, qword [0x180012128]
test rdx, rdx
jne 0x18000a60b
lea rdx, [rsp + 0x42]
movaps xmm0, xmmword [0x18000f330]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x18000f340]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x18000f350]
movaps xmmword [rdx + 0x1e], xmm0
movaps xmm0, xmmword [0x18000f360]
movaps xmmword [rdx + 0x2e], xmm0
mov dword [rdx + 0x3e], 0x6a006b
mov word [rdx + 0x42], 4
mov word [rdx + 0x86], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 4
inc rax
cmp rax, 0x44
jne 0x18000a5c1
mov word [rsp + 0xc8], 0
mov rax, qword [0x180012150]
lea rcx, [rsp + 0x30]
mov qword [rcx], rax
mov dword [rcx + 8], 0
mov qword [rsp + 0x20], rcx
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
call fcn.18000dbe0
mov rdx, rax
mov qword [0x180012128], rax
mov rax, qword [rbx]
mov rax, qword [rax + 0x268]
lea rcx, [rsp + 0x40]
mov qword [rcx], rax
mov qword [rcx + 8], 0
mov qword [rsp + 0x20], rcx
lea r8, [rsp + 0x30]
mov rcx, rbx
xor r9d, r9d
call fcn.18000dbe0
test rdi, rdi
je 0x18000a649
movss xmm0, dword [rsp + 0x30]
movss dword [rdi], xmm0
test rsi, rsi
je 0x18000a658
movss xmm0, dword [rsp + 0x34]
movss dword [rsi], xmm0
mov al, byte [rsp + 0x38]
add rsp, 0xd0
pop rbx
pop rdi
pop rsi
ret
Function at 0x18000a668
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xc8
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
mov rdx, qword [0x180012130]
test rdx, rdx
jne 0x18000a71d
lea rdx, [rsp + 0x42]
movaps xmm0, xmmword [0x18000f370]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x18000f380]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [str.lN_xDH_N_gDHJ_BDf_]
movaps xmmword [rdx + 0x1e], xmm0
movaps xmm0, xmmword [0x18000f3a0]
movaps xmmword [rdx + 0x2e], xmm0
mov dword [rdx + 0x3e], 0x2b0045
mov word [rdx + 0x82], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0x2b
inc rax
cmp rax, 0x42
jne 0x18000a6d3
mov word [rsp + 0xc4], 0
mov rax, qword [0x180012150]
lea rcx, [rsp + 0x30]
mov qword [rcx], rax
mov dword [rcx + 8], 0
mov qword [rsp + 0x20], rcx
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
call fcn.18000dbe0
mov rdx, rax
mov qword [0x180012130], rax
xorps xmm0, xmm0
lea r14, [rsp + 0x40]
movups xmmword [r14 + 8], xmm0
xor eax, eax
mov qword [r14 + 0x18], rax
mov rcx, qword [rbx]
mov qword [r14], rcx
mov rcx, qword [rdi]
mov rcx, qword [rcx + 0x268]
lea r8, [rsp + 0x30]
mov qword [r8], rcx
mov qword [r8 + 8], rax
mov qword [rsp + 0x20], r8
mov rcx, rdi
mov r8, r14
xor r9d, r9d
call fcn.18000dbe0
mov rax, qword [r14 + 0x18]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [r14 + 8]
movups xmmword [rsi], xmm0
mov rax, rsi
add rsp, 0xc8
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x18000aac0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xe0
mov rdx, qword [0x1800121b0]
test rdx, rdx
jne 0x18000ab53
lea rdx, [rsp + 0x42]
movaps xmm0, xmmword [str.dBNFSOBZpWBWJ_P_rdFWsOBZFQ_LMWQLG]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x18000f750]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x18000f760]
movaps xmmword [rdx + 0x1e], xmm0
movaps xmm0, xmmword [0x18000f770]
movaps xmmword [rdx + 0x2e], xmm0
movabs rax, 0x510046004f004f
mov qword [rdx + 0x3e], rax
mov word [rdx + 0x46], 0x23
mov word [rdx + 0x8e], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0x23
inc rax
cmp rax, 0x48
jne 0x18000ab27
mov word [rsp + 0xd0], 0
lea rcx, [rsp + 0x30]
call fcn.180009616
mov rdx, rax
mov qword [0x1800121b0], rax
mov rcx, qword [0x1800121b8]
test rcx, rcx
jne 0x18000abd4
lea rdx, [rsp + 0x42]
movaps xmm0, xmmword [0x18000f780]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x18000f790]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x18000f7a0]
movaps xmmword [rdx + 0x1e], xmm0
movaps xmm0, xmmword [0x18000f7b0]
movaps xmmword [rdx + 0x2e], xmm0
mov word [rdx + 0x3e], 0x47
mov word [rdx + 0x7e], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0x47
inc rax
cmp rax, 0x40
jne 0x18000aba1
mov word [rsp + 0xc0], 0
lea rcx, [rsp + 0x30]
call fcn.180009616
mov rcx, rax
mov qword [0x1800121b8], rax
mov rdx, qword [0x1800121b0]
mov rax, qword [0x180011e00]
lea rsi, [rsp + 0x40]
mov qword [rsi], rax
mov dword [rsi + 8], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x268]
lea r8, [rsp + 0x30]
mov qword [r8], rax
mov qword [r8 + 8], 0
mov qword [rsp + 0x20], r8
mov r8, rsi
xor r9d, r9d
call fcn.18000dbe0
mov rax, qword [rsi + 0x10]
add rsp, 0xe0
pop rsi
ret
Function at 0x18000ac22
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xe0
mov rdx, qword [0x1800121c0]
test rdx, rdx
jne 0x18000acac
lea rdx, [rsp + 0x42]
movaps xmm0, xmmword [0x18000f7c0]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x18000f7d0]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x18000f7e0]
movaps xmmword [rdx + 0x1e], xmm0
movaps xmm0, xmmword [str._fe_b]
movaps xmmword [rdx + 0x2e], xmm0
movaps xmm0, xmmword [0x18000f800]
movaps xmmword [rdx + 0x3e], xmm0
mov word [rdx + 0x9a], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0x69
inc rax
cmp rax, 0x4e
jne 0x18000ac80
mov word [rsp + 0xdc], 0
lea rcx, [rsp + 0x30]
call fcn.180009616
mov rdx, rax
mov qword [0x1800121c0], rax
mov rcx, qword [0x1800121c8]
test rcx, rcx
jne 0x18000ad2d
lea rdx, [rsp + 0x42]
movaps xmm0, xmmword [0x18000f810]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [str.iHKLXAYrrjL_H_ALTYLYDNd]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x18000f830]
movaps xmmword [rdx + 0x1e], xmm0
movaps xmm0, xmmword [0x18000f840]
movaps xmmword [rdx + 0x2e], xmm0
mov word [rdx + 0x3e], 0x2d
mov word [rdx + 0x7e], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0x2d
inc rax
cmp rax, 0x40
jne 0x18000acfa
mov word [rsp + 0xc0], 0
lea rcx, [rsp + 0x30]
call fcn.180009616
mov rcx, rax
mov qword [0x1800121c8], rax
mov rdx, qword [0x1800121c0]
mov rax, qword [0x180011e00]
lea rsi, [rsp + 0x40]
mov qword [rsi], rax
mov dword [rsi + 8], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x268]
lea r8, [rsp + 0x30]
mov qword [r8], rax
mov qword [r8 + 8], 0
mov qword [rsp + 0x20], r8
mov r8, rsi
xor r9d, r9d
call fcn.18000dbe0
mov rax, qword [rsi + 0x10]
add rsp, 0xe0
pop rsi
ret