joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180005d40
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x24], 0
mov r8, rcx
je 0x180005ea5
xor eax, eax
cmp dword [0x1801a9090], 5
jl 0x180005e6c
movdqa xmm2, xmmword [0x1801a2bd0]
lea rdx, [rcx + 8]
movdqa xmm3, xmmword [0x1801a2c20]
movdqa xmm4, xmmword [0x1801a31e0]
movdqa xmm5, xmmword [0x1801a2c40]
lea rcx, [rax + 2]
movq xmm0, rax
punpcklqdq xmm0, xmm0
lea rdx, [rdx + 0x10]
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm0, xmm4, xmm0
pshufb xmm0, xmm5
pmovsxbw xmm1, xmm0
movd xmm0, dword [rdx - 0x18]
xorps xmm1, xmm0
movq xmm0, rcx
punpcklqdq xmm0, xmm0
lea rcx, [rax + 4]
paddq xmm0, xmm2
movd dword [rdx - 0x18], xmm1
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm0, xmm4, xmm0
pshufb xmm0, xmm5
pmovsxbw xmm1, xmm0
movd xmm0, dword [rdx - 0x14]
xorps xmm1, xmm0
movq xmm0, rcx
punpcklqdq xmm0, xmm0
lea rcx, [rax + 6]
paddq xmm0, xmm2
movd dword [rdx - 0x14], xmm1
andps xmm0, xmm3
add rax, 8
psllq xmm0, 3
vpsrlvq xmm0, xmm4, xmm0
pshufb xmm0, xmm5
pmovsxbw xmm1, xmm0
movd xmm0, dword [rdx - 0x10]
xorps xmm1, xmm0
movq xmm0, rcx
punpcklqdq xmm0, xmm0
lea rcx, [rax + 4]
movd dword [rdx - 0x10], xmm1
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm0, xmm4, xmm0
pshufb xmm0, xmm5
pmovsxbw xmm1, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm1, xmm0
movd dword [rdx - 0xc], xmm1
cmp rcx, 0x14
jb 0x180005d80
cmp rax, 0x12
jae 0x180005ea0
movabs r9, 0x29b373e58fe16903
nop word [rax + rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
movsx ecx, dl
xor word [r8 + rax*2], cx
inc rax
cmp rax, 0x12
jb 0x180005e80
mov byte [r8 + 0x24], 0
ret

Function at 0x180005eb0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x14], 0
mov r8, rcx
je 0x180005fd6
xor eax, eax
cmp dword [0x1801a9090], 5
jl 0x180005fa7
movdqa xmm5, xmmword [0x1801a3e00]
movdqa xmm3, xmmword [0x1801a2c40]
movdqa xmm4, xmmword [0x1801a2bd0]
movdqa xmm0, xmm4
psllq xmm4, 3
psllq xmm0, 3
vpsrlvq xmm1, xmm5, xmm0
movd xmm0, dword [rcx]
pshufb xmm1, xmm3
pmovsxbw xmm2, xmm1
xorps xmm2, xmm0
movdqa xmm0, xmmword [0x1801a2be0]
movd dword [rcx], xmm2
psllq xmm0, 3
vpsrlvq xmm1, xmm5, xmm0
movd xmm0, dword [rcx + 4]
pshufb xmm1, xmm3
pmovsxbw xmm2, xmm1
xorps xmm2, xmm0
movdqa xmm0, xmmword [0x1801a2bf0]
movd dword [rcx + 4], xmm2
psllq xmm0, 3
vpsrlvq xmm1, xmm5, xmm0
movd xmm0, dword [rcx + 8]
pshufb xmm1, xmm3
pmovsxbw xmm2, xmm1
xorps xmm2, xmm0
movdqa xmm0, xmmword [0x1801a2c10]
movd dword [rcx + 8], xmm2
psllq xmm0, 3
vpsrlvq xmm1, xmm5, xmm0
movd xmm0, dword [rcx + 0xc]
pshufb xmm1, xmm3
pmovsxbw xmm2, xmm1
xorps xmm2, xmm0
movd dword [rcx + 0xc], xmm2
vpsrlvq xmm0, xmm5, xmm4
pshufb xmm0, xmm3
pmovsxbw xmm1, xmm0
movd xmm0, dword [rcx + 0x10]
xorps xmm1, xmm0
movd dword [rcx + 0x10], xmm1
mov byte [rcx + 0x14], al
ret
movabs r9, 0x89d75571bba92fd7
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
movsx ecx, dl
xor word [r8 + rax*2], cx
inc rax
cmp rax, 0xa
jb 0x180005fb1
mov byte [r8 + 0x14], 0
ret
Function at 0x180005fe0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x18], 0
mov r8, rcx
je 0x180006161
xor eax, eax
cmp dword [0x1801a9090], 5
jl 0x180006130
movdqa xmm2, xmmword [0x1801a2bd0]
mov r9, 0xfffffffffffffffe
movdqa xmm3, xmmword [0x1801a2c20]
mov r10d, 2
movdqa xmm4, xmmword [0x1801a3cb0]
sub r9, r8
movdqa xmm5, xmmword [0x1801a2c40]
sub r10, r8
add rcx, 4
mov rdx, 0xfffffffffffffffc
sub rdx, r8
nop dword [rax]
lea rax, [rdx + rcx]
movq xmm0, rax
movzx eax, word [rcx - 4]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, eax
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd eax, xmm1
mov word [rcx - 4], ax
lea rax, [r9 + rcx]
movq xmm0, rax
movzx eax, word [rcx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, eax
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd eax, xmm1
mov word [rcx - 2], ax
mov rax, rcx
sub rax, r8
movq xmm0, rax
movzx eax, word [rcx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, eax
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd eax, xmm1
mov word [rcx], ax
lea rax, [r10 + rcx]
movq xmm0, rax
movzx eax, word [rcx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, eax
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd eax, xmm1
mov word [rcx + 2], ax
add rcx, 8
lea rax, [rdx + rcx]
cmp rax, 0x18
jb 0x180006040
mov byte [r8 + 0x18], 0
ret
movabs r9, 0x7fad1dcd7b5fc9bd
nop word [rax + rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x18
jb 0x180006140
mov byte [r8 + 0x18], 0
ret
Function at 0x180006170
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x34], 0
mov r8, rcx
je 0x1800062e1
xor eax, eax
cmp dword [0x1801a9090], 5
jl 0x1800062af
movdqa xmm2, xmmword [0x1801a2bd0]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [0x1801a2c20]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x1801a31c0]
sub r9, rcx
movdqa xmm5, xmmword [0x1801a2c40]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x30
jb 0x1800061c3
cmp rax, 0x34
jae 0x1800062dc
movabs r9, 0x297b45a773fb0941
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x34
jb 0x1800062c0
mov byte [r8 + 0x34], 0
ret
Function at 0x1800062f0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x35], 0
mov r8, rcx
je 0x180006461
xor eax, eax
cmp dword [0x1801a9090], 5
jl 0x18000642f
movdqa xmm2, xmmword [0x1801a2bd0]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [0x1801a2c20]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x1801a2d10]
sub r9, rcx
movdqa xmm5, xmmword [0x1801a2c40]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x30
jb 0x180006343
cmp rax, 0x35
jae 0x18000645c
movabs r9, 0x7638735893bd55d
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x35
jb 0x180006440
mov byte [r8 + 0x35], 0
ret
Function at 0x180006470
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2c], 0
mov r8, rcx
je 0x1800065d5
xor eax, eax
cmp dword [0x1801a9090], 5
jl 0x18000659c
movdqa xmm2, xmmword [0x1801a2bd0]
lea rdx, [rcx + 8]
movdqa xmm3, xmmword [0x1801a2c20]
movdqa xmm4, xmmword [0x1801a4070]
movdqa xmm5, xmmword [0x1801a2c40]
lea rcx, [rax + 2]
movq xmm0, rax
punpcklqdq xmm0, xmm0
lea rdx, [rdx + 0x10]
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm0, xmm4, xmm0
pshufb xmm0, xmm5
pmovsxbw xmm1, xmm0
movd xmm0, dword [rdx - 0x18]
xorps xmm1, xmm0
movq xmm0, rcx
punpcklqdq xmm0, xmm0
lea rcx, [rax + 4]
paddq xmm0, xmm2
movd dword [rdx - 0x18], xmm1
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm0, xmm4, xmm0
pshufb xmm0, xmm5
pmovsxbw xmm1, xmm0
movd xmm0, dword [rdx - 0x14]
xorps xmm1, xmm0
movq xmm0, rcx
punpcklqdq xmm0, xmm0
lea rcx, [rax + 6]
paddq xmm0, xmm2
movd dword [rdx - 0x14], xmm1
andps xmm0, xmm3
add rax, 8
psllq xmm0, 3
vpsrlvq xmm0, xmm4, xmm0
pshufb xmm0, xmm5
pmovsxbw xmm1, xmm0
movd xmm0, dword [rdx - 0x10]
xorps xmm1, xmm0
movq xmm0, rcx
punpcklqdq xmm0, xmm0
lea rcx, [rax + 4]
movd dword [rdx - 0x10], xmm1
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm0, xmm4, xmm0
pshufb xmm0, xmm5
pmovsxbw xmm1, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm1, xmm0
movd dword [rdx - 0xc], xmm1
cmp rcx, 0x14
jb 0x1800064b0
cmp rax, 0x16
jae 0x1800065d0
movabs r9, 0xa31121ed077965d7
nop word [rax + rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
movsx ecx, dl
xor word [r8 + rax*2], cx
inc rax
cmp rax, 0x16
jb 0x1800065b0
mov byte [r8 + 0x2c], 0
ret
Function at 0x1800065e0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x64], 0
mov r8, rcx
je 0x180006751
xor eax, eax
cmp dword [0x1801a9090], 5
jl 0x18000671f
movdqa xmm2, xmmword [0x1801a2bd0]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [0x1801a2c20]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x1801a36c0]
sub r9, rcx
movdqa xmm5, xmmword [0x1801a2c40]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x60
jb 0x180006633
cmp rax, 0x64
jae 0x18000674c
movabs r9, 0x53e3576943d5e9a7
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x64
jb 0x180006730
mov byte [r8 + 0x64], 0
ret
Function at 0x180006760
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x27], 0
mov r8, rcx
je 0x1800068d1
xor eax, eax
cmp dword [0x1801a9090], 5
jl 0x18000689f
movdqa xmm2, xmmword [0x1801a2bd0]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [0x1801a2c20]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x1801a4610]
sub r9, rcx
movdqa xmm5, xmmword [0x1801a2c40]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x20
jb 0x1800067b3
cmp rax, 0x27
jae 0x1800068cc
movabs r9, 0xdfafb5419f490ddb
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x27
jb 0x1800068b0
mov byte [r8 + 0x27], 0
ret
Function at 0x1800068e0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x20], 0
mov r8, rcx
je 0x180006a55
xor eax, eax
cmp dword [0x1801a9090], 5
jl 0x180006a1c
movdqa xmm2, xmmword [0x1801a2bd0]
mov edx, 4
movdqa xmm3, xmmword [0x1801a2c20]
add rcx, 8
movdqa xmm4, xmmword [0x1801a4540]
movdqa xmm5, xmmword [0x1801a2c40]
nop word [rax + rax]
lea rax, [rdx - 4]
movq xmm0, rax
lea rcx, [rcx + 0x10]
punpcklqdq xmm0, xmm0
lea rax, [rdx - 2]
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm0, xmm4, xmm0
pshufb xmm0, xmm5
pmovsxbw xmm1, xmm0
movd xmm0, dword [rcx - 0x18]
xorps xmm1, xmm0
movq xmm0, rax
punpcklqdq xmm0, xmm0
lea rax, [rdx + 2]
paddq xmm0, xmm2
movd dword [rcx - 0x18], xmm1
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm0, xmm4, xmm0
pshufb xmm0, xmm5
pmovsxbw xmm1, xmm0
movd xmm0, dword [rcx - 0x14]
xorps xmm1, xmm0
movq xmm0, rdx
punpcklqdq xmm0, xmm0
add rdx, 8
paddq xmm0, xmm2
movd dword [rcx - 0x14], xmm1
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm0, xmm4, xmm0
pshufb xmm0, xmm5
pmovsxbw xmm1, xmm0
movd xmm0, dword [rcx - 0x10]
xorps xmm1, xmm0
movq xmm0, rax
punpcklqdq xmm0, xmm0
lea rax, [rdx - 4]
movd dword [rcx - 0x10], xmm1
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm0, xmm4, xmm0
pshufb xmm0, xmm5
pmovsxbw xmm1, xmm0
movd xmm0, dword [rcx - 0xc]
xorps xmm1, xmm0
movd dword [rcx - 0xc], xmm1
cmp rax, 0x10
jb 0x180006930
mov byte [r8 + 0x20], 0
ret
movabs r9, 0xdbaf4383c59f19cf
nop word [rax + rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
movsx ecx, dl
xor word [r8 + rax*2], cx
inc rax
cmp rax, 0x10
jb 0x180006a30
mov byte [r8 + 0x20], 0
ret
Function at 0x180006a60
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x41], 0
mov r8, rcx
je 0x180006bd1
xor eax, eax
cmp dword [0x1801a9090], 5
jl 0x180006b9f
movdqa xmm2, xmmword [0x1801a2bd0]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [0x1801a2c20]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x1801a4410]
sub r9, rcx
movdqa xmm5, xmmword [0x1801a2c40]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x40
jb 0x180006ab3
cmp rax, 0x41
jae 0x180006bcc
movabs r9, 0xcd15890f1fef9f7d
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x41
jb 0x180006bb0
mov byte [r8 + 0x41], 0
ret

Function at 0x180006be0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1801a9040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x180006cb3
cmp byte [rcx + 0x71], 0
je 0x180006cb3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x180006caf
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180006c74
sub eax, 1
je 0x180006c78
cmp eax, 2
jne 0x180006caf
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18019d6f0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x180006ca6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x180006caf
cmp byte [rbx + 0x71], 0
sete al
jmp 0x180006c5c
xor al, al
jmp 0x180006c5c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18019d6f0
add rsp, 0x60
pop rbx
ret
Function at 0x180006f90
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x3b], 0
mov r8, rcx
je 0x180007101
xor eax, eax
cmp dword [0x1801a9090], 5
jl 0x1800070cf
movdqa xmm2, xmmword [0x1801a2bd0]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [0x1801a2c20]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x1801a49f0]
sub r9, rcx
movdqa xmm5, xmmword [0x1801a2c40]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x38
jb 0x180006fe3
cmp rax, 0x3b
jae 0x1800070fc
movabs r9, 0xffc3978bc98f5399
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x3b
jb 0x1800070e0
mov byte [r8 + 0x3b], 0
ret
Function at 0x180185150
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x20], 0
mov r8, rcx
je 0x1801852d1
xor eax, eax
cmp dword [0x1801a9090], 5
jl 0x1801852a0
movdqa xmm2, xmmword [0x1801a2bd0]
mov r9, 0xfffffffffffffffe
movdqa xmm3, xmmword [0x1801a2c20]
mov r10d, 2
movdqa xmm4, xmmword [0x1801a4650]
sub r9, r8
movdqa xmm5, xmmword [0x1801a2c40]
sub r10, r8
add rcx, 4
mov rdx, 0xfffffffffffffffc
sub rdx, r8
nop dword [rax]
lea rax, [rdx + rcx]
movq xmm0, rax
movzx eax, word [rcx - 4]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, eax
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd eax, xmm1
mov word [rcx - 4], ax
lea rax, [r9 + rcx]
movq xmm0, rax
movzx eax, word [rcx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, eax
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd eax, xmm1
mov word [rcx - 2], ax
mov rax, rcx
sub rax, r8
movq xmm0, rax
movzx eax, word [rcx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, eax
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd eax, xmm1
mov word [rcx], ax
lea rax, [r10 + rcx]
movq xmm0, rax
movzx eax, word [rcx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, eax
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd eax, xmm1
mov word [rcx + 2], ax
add rcx, 8
lea rax, [rdx + rcx]
cmp rax, 0x20
jb 0x1801851b0
mov byte [r8 + 0x20], 0
ret
movabs r9, 0xe357e1df0b07fb99
nop word [rax + rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x20
jb 0x1801852b0
mov byte [r8 + 0x20], 0
ret
Function at 0x1801852e0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1c], 0
mov r8, rcx
je 0x180185451
xor eax, eax
cmp dword [0x1801a9090], 5
jl 0x18018541f
movdqa xmm2, xmmword [0x1801a2bd0]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [0x1801a2c20]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x1801a4180]
sub r9, rcx
movdqa xmm5, xmmword [0x1801a2c40]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x18
jb 0x180185333
cmp rax, 0x1c
jae 0x18018544c
movabs r9, 0xaf3baf5be5c303a9
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x1c
jb 0x180185430
mov byte [r8 + 0x1c], 0
ret
Function at 0x180185460
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x43], 0
mov r8, rcx
je 0x1801855d1
xor eax, eax
cmp dword [0x1801a9090], 5
jl 0x18018559f
movdqa xmm2, xmmword [0x1801a2bd0]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [0x1801a2c20]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x1801a2dd0]
sub r9, rcx
movdqa xmm5, xmmword [0x1801a2c40]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x40
jb 0x1801854b3
cmp rax, 0x43
jae 0x1801855cc
movabs r9, 0xbb75737333b31e9
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x43
jb 0x1801855b0
mov byte [r8 + 0x43], 0
ret