joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180188430
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
movabs rbp, 0xaaaaaaaaaaaaaaab
lea r10, [r9 + 2]
mov rax, rbp
mov rdi, rdx
mul r10
xor r11d, r11d
movabs rax, 0x8000000000000000
mov rbx, rdx
shr rbx, 1
shl rbx, 2
cmp rbx, rax
ja 0x1801885a5
cmp r9, 0xfffffffffffffffd
jae 0x1801885a5
cmp rdi, rbx
jb 0x1801885a5
mov qword [rsp + 0x10], rsi
lea rsi, [0x18006dae0]
cmp r9, 3
jb 0x180188528
mov rax, rbp
mul r9
mov r10, rdx
shr r10, 1
imul rax, r10, 0xfffffffffffffffd
lea r11d, [r10*4]
add r9, rax
nop word [rax + rax]
movzx eax, byte [r8]
shr rax, 2
movzx eax, byte [rax + rsi]
mov byte [rcx], al
movzx edx, byte [r8]
movzx eax, byte [r8 + 1]
and edx, 3
shr rax, 4
shl rdx, 4
or rdx, rax
movzx eax, byte [rdx + rsi]
mov byte [rcx + 1], al
movzx edx, byte [r8 + 1]
movzx eax, byte [r8 + 2]
and edx, 0xf
shr rax, 6
shl rdx, 2
or rdx, rax
movzx eax, byte [rdx + rsi]
mov byte [rcx + 2], al
movzx eax, byte [r8 + 2]
add r8, 3
and eax, 0x3f
movzx eax, byte [rax + rsi]
mov byte [rcx + 3], al
add rcx, 4
sub r10, 1
jne 0x1801884c0
test r9, r9
je 0x180188585
movzx eax, byte [r8]
shr rax, 2
movzx eax, byte [rax + rsi]
mov byte [rcx], al
movzx edx, byte [r8]
and edx, 3
shl rdx, 4
cmp r9, 1
jne 0x180188557
movzx eax, byte [rdx + rsi]
mov byte [rcx + 1], al
mov al, 0x3d
jmp 0x180188576
movzx eax, byte [r8 + 1]
shr rax, 4
or rax, rdx
movzx eax, byte [rax + rsi]
mov byte [rcx + 1], al
movzx eax, byte [r8 + 1]
and eax, 0xf
movzx eax, byte [rsi + rax*4]
mov byte [rcx + 2], al
mov byte [rcx + 3], 0x3d
add rcx, 4
add r11d, 4
mov rsi, qword [rsp + 0x10]
lea rdx, [rbx + 1]
mov eax, r11d
cmp rdi, rdx
jb 0x1801885a8
mov byte [rcx], 0
mov rbx, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
pop rdi
ret
mov eax, r11d
mov rbx, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
pop rdi
ret
Function at 0x1801911c0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x278
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov edi, dword [rcx + 0xe0]
xor esi, esi
xor r15d, r15d
movsxd rbp, edx
mov r13, r9
mov r12, r8
mov rbx, rcx
test edi, edi
je 0x180191327
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x208
call fcn.18020be10
xor r14d, r14d
test edi, edi
jle 0x18019133f
lea ecx, [rbp + 1]
mov dword [rsp + 0x30], ecx
nop dword [rax]
mov eax, 2
mov dword [rsp + 0x44], 0x1388
cmp edi, eax
mov qword [rsp + 0x58], rbp
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 1
cmovb eax, edi
xor r9d, r9d
mov dword [rsp + 0x40], eax
xor r8d, r8d
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_select]
mov r15d, eax
test eax, eax
jle 0x1801912c4
lea rdx, [rsp + 0x50]
mov rcx, rbp
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x1801912fd
xor r9d, r9d
mov r8d, r13d
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_recv]
mov esi, eax
test eax, eax
jns 0x18019133b
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2746
jne 0x1801912fd
mov rax, qword [rbx]
mov dl, 1
mov rcx, rbx
call qword [rax + 0x20]
mov eax, 0xfffffffe
jmp 0x18019136c
jne 0x1801912fd
lea rax, [rsp + 0x34]
mov dword [rsp + 0x38], 0
lea r9, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov edx, 0xffff
mov dword [rsp + 0x34], 4
mov r8d, 0x1007
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
js 0x180191315
mov edi, dword [rbx + 0xe0]
add r14d, 2
cmp r14d, edi
jge 0x18019133b
mov ecx, dword [rsp + 0x30]
jmp 0x180191230
mov rax, qword [rbx]
mov dl, 1
mov rcx, rbx
mov esi, 0xffffffff
call qword [rax + 0x20]
jmp 0x18019134e
mov rcx, rbp
xor r9d, r9d
mov r8d, r13d
mov rdx, r12
call qword [sym.imp.WS2_32.dll_recv]
mov esi, eax
test esi, esi
jg 0x18019136a
mov rax, qword [rbx]
mov dl, 1
mov rcx, rbx
call qword [rax + 0x20]
test esi, esi
jns 0x180191355
mov dword [rbx + 0x10], 0x67
test r15d, r15d
jle 0x180191363
test esi, esi
jne 0x180191363
lea eax, [rsi - 2]
jmp 0x18019136c
mov eax, 0xffffffff
jmp 0x18019136c
mov eax, esi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1801e67e0
add rsp, 0x278
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180197cd0
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x18
lea rdx, [rdx*8]
mov r10, r9
mov rax, rdx
mov byte [rsp], dl
shr rax, 8
mov byte [rsp + 1], al
mov rax, rdx
shr rax, 0x10
mov byte [rsp + 2], al
mov rax, rdx
shr rax, 0x18
mov byte [rsp + 3], al
mov rax, rdx
shr rax, 0x20
mov byte [rsp + 4], al
mov rax, rdx
shr rax, 0x28
mov byte [rsp + 5], al
mov rax, rdx
shr rax, 0x30
mov byte [rsp + 6], al
shr rdx, 0x38
mov byte [rsp + 7], dl
lea rdx, [r8*8]
mov rax, rdx
mov byte [rsp + 8], dl
shr rax, 8
mov r8d, 7
mov byte [rsp + 9], al
mov rax, rdx
shr rax, 0x10
mov byte [rsp + 0xa], al
mov rax, rdx
shr rax, 0x18
mov byte [rsp + 0xb], al
mov rax, rdx
shr rax, 0x20
mov byte [rsp + 0xc], al
mov rax, rdx
shr rax, 0x28
mov byte [rsp + 0xd], al
mov rax, rdx
shr rax, 0x30
mov byte [rsp + 0xe], al
movzx eax, byte [r9]
shr rdx, 0x38
add rax, 3
mov byte [rsp + 0xf], dl
add rax, rax
movdqu xmm2, xmmword [rsp]
pxor xmm2, xmmword [rcx + rax*8]
nop dword [rax]
movzx edx, byte [r10]
movdqa xmm1, xmm2
movzx eax, dl
shr al, 3
dec al
and al, 1
shl al, 3
movzx r9d, al
lea rax, [rdx + 4]
add rax, rax
add rdx, 3
add rdx, rdx
movdqu xmm0, xmmword [rcx + rdx*8]
aesenc xmm0, xmmword [rcx + rax*8]
lea rax, [r9 + 4]
add rax, rax
movdqu xmmword [rcx + rax*8], xmm0
movzx edx, byte [r10]
lea rax, [rdx + 3]
add rdx, 2
add rax, rax
add rdx, rdx
movdqu xmm0, xmmword [rcx + rdx*8]
aesenc xmm0, xmmword [rcx + rax*8]
lea rax, [r9 + 3]
add rax, rax
movdqu xmmword [rcx + rax*8], xmm0
movzx eax, byte [r10]
lea rdx, [rax + 2]
inc rax
add rax, rax
add rdx, rdx
movdqu xmm0, xmmword [rcx + rax*8]
lea rax, [r9 + 2]
aesenc xmm0, xmmword [rcx + rdx*8]
add rax, rax
movdqu xmmword [rcx + rax*8], xmm0
movzx eax, byte [r10]
lea rdx, [rax + 1]
add rax, rax
add rdx, rdx
movdqu xmm0, xmmword [rcx + rax*8]
lea rax, [r9 + 1]
aesenc xmm0, xmmword [rcx + rdx*8]
add rax, rax
movdqu xmmword [rcx + rax*8], xmm0
movzx edx, byte [r10]
mov eax, edx
add rax, rax
pxor xmm1, xmmword [rcx + rax*8]
lea rax, [rdx + 4]
add rax, rax
movdqu xmm0, xmmword [rcx + rax*8]
mov eax, r9d
add rax, rax
aesenc xmm0, xmm1
movdqu xmmword [rcx + rax*8], xmm0
mov byte [r10], r9b
sub r8, 1
jne 0x180197da0
lea rax, [r9 + 1]
mov r8d, r9d
add r8, r8
lea rdx, [r9 + 2]
add rdx, rdx
add rax, rax
movdqu xmm0, xmmword [rcx + rax*8]
pxor xmm0, xmmword [rcx + rdx*8]
pxor xmm0, xmmword [rcx + r8*8]
movdqu xmmword [rcx + r8*8], xmm0
movzx r8d, byte [r10]
mov r9d, r8d
add r9, r9
lea rdx, [r8 + 4]
add rdx, rdx
lea rax, [r8 + 3]
add rax, rax
movdqu xmm0, xmmword [rcx + rdx*8]
pxor xmm0, xmmword [rcx + rax*8]
pxor xmm0, xmmword [rcx + r9*8]
movdqu xmmword [rcx + r9*8], xmm0
add rsp, 0x18
ret
Function at 0x180197ef0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rsp + 0x30], rax
movzx r10d, byte [r8]
lea rbp, [rcx*8]
lea r15, [rdx*8]
mov rbx, r9
mov r14, r8
mov r13d, 7
lea eax, [r10*2 + 6]
xor rbp, qword [r9 + rax*8]
lea eax, [r10 + r10]
xor r15, qword [r9 + rax*8 + 0x38]
nop dword [rax + rax]
movzx ecx, byte [r14]
movzx eax, cl
shr al, 3
dec al
lea rdx, [rcx + 4]
and al, 1
shl al, 3
add rcx, 3
movzx esi, al
shl rdx, 4
shl rcx, 4
add rdx, rbx
add rcx, rbx
lea eax, [rsi*2 + 8]
lea r8, [rbx + rax*8]
call fcn.180198b60
movzx ecx, byte [r14]
mov edi, esi
shl rdi, 4
add rdi, rbx
lea rdx, [rcx + 3]
add rcx, 2
shl rcx, 4
shl rdx, 4
lea r8, [rdi + 0x30]
add rcx, rbx
add rdx, rbx
call fcn.180198b60
movzx eax, byte [r14]
lea r8, [rdi + 0x20]
lea r9d, [rax + rax]
lea eax, [r9 + 4]
lea rdx, [rbx + rax*8]
lea eax, [r9 + 2]
lea rcx, [rbx + rax*8]
call fcn.180198b60
movzx r9d, byte [r14]
lea r8, [rdi + 0x10]
lea eax, [r9*2 + 2]
lea rdx, [rbx + rax*8]
lea eax, [r9 + r9]
lea rcx, [rbx + rax*8]
call fcn.180198b60
movzx edx, byte [r14]
mov rax, rbp
mov r8, rdi
lea ecx, [rdx + rdx]
add edx, edx
xor rax, qword [rbx + rcx*8]
mov rcx, r15
mov qword [rsp + 0x20], rax
xor rcx, qword [rbx + rdx*8 + 8]
lea eax, [rdx + 8]
mov qword [rsp + 0x28], rcx
lea rdx, [rsp + 0x20]
lea rcx, [rbx + rax*8]
call fcn.180198b60
mov byte [r14], sil
sub r13, 1
jne 0x180197f50
lea eax, [rsi + rsi]
lea r8, [rbx + rax*8]
lea ecx, [rsi*2 + 4]
lea eax, [rsi + rsi]
mov rax, qword [rbx + rax*8 + 0x10]
xor rax, qword [rbx + rcx*8]
xor qword [r8], rax
movzx ecx, byte [r14]
add rcx, rcx
mov rax, qword [rbx + rcx*8 + 0x28]
xor rax, qword [rbx + rcx*8 + 0x18]
xor qword [rbx + rcx*8 + 8], rax
movzx r8d, byte [r14]
lea eax, [r8 + r8]
lea r9, [rbx + rax*8]
lea ecx, [r8*2 + 6]
lea eax, [r8*2 + 8]
mov rax, qword [rbx + rax*8]
xor rax, qword [rbx + rcx*8]
xor qword [r9], rax
movzx ecx, byte [r14]
add rcx, rcx
mov rax, qword [rbx + rcx*8 + 0x48]
xor rax, qword [rbx + rcx*8 + 0x38]
xor qword [rbx + rcx*8 + 8], rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1801e67e0
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180198370
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov byte [rcx], 0
mov rbx, rdx
mov rax, qword [r8]
mov r10, r8
xor rax, qword [r9]
mov r14, rcx
mov qword [rdx], rax
mov rbp, r9
movzx eax, byte [rcx]
mov r15d, 0xa
mov rdx, qword [r9 + 8]
add rax, rax
xor rdx, qword [r8 + 8]
mov qword [rbx + rax*8 + 8], rdx
movzx eax, byte [rcx]
movaps xmm0, xmmword [0x18029b6f0]
inc rax
add rax, rax
movups xmmword [rbx + rax*8], xmm0
movzx eax, byte [rcx]
movaps xmm0, xmmword [0x18029b6e0]
add rax, 2
add rax, rax
movups xmmword [rbx + rax*8], xmm0
movzx r8d, byte [rcx]
lea eax, [r8*2 + 4]
mov rdx, qword [rbx + rax*8]
lea eax, [r8*2 + 6]
xor rdx, qword [r10]
mov qword [rbx + rax*8], rdx
movzx ecx, byte [rcx]
add rcx, rcx
mov rax, qword [rbx + rcx*8 + 0x28]
xor rax, qword [r10 + 8]
mov qword [rbx + rcx*8 + 0x38], rax
movzx r8d, byte [r14]
lea eax, [r8 + r8]
mov rdx, qword [rbx + rax*8 + 0x10]
lea eax, [r8*2 + 8]
xor rdx, qword [r10]
mov qword [rbx + rax*8], rdx
movzx ecx, byte [r14]
add rcx, rcx
mov rax, qword [rbx + rcx*8 + 0x18]
xor rax, qword [r10 + 8]
mov qword [rbx + rcx*8 + 0x48], rax
movdqu xmm6, xmmword [r10]
movdqu xmm0, xmmword [r9]
pxor xmm6, xmm0
movzx ecx, byte [r14]
movdqu xmm0, xmmword [rbp]
movzx eax, cl
shr al, 3
lea rdx, [rcx + 4]
dec al
add rcx, 3
shl rdx, 4
and al, 1
shl rcx, 4
shl al, 3
pxor xmm0, xmm6
movzx esi, al
add rdx, rbx
add rcx, rbx
movdqa xmm6, xmm0
lea r8, [rsi + 4]
shl r8, 4
add r8, rbx
call fcn.180198b60
movzx ecx, byte [r14]
mov edi, esi
shl rdi, 4
add rdi, rbx
lea rdx, [rcx + 3]
add rcx, 2
shl rcx, 4
shl rdx, 4
lea r8, [rdi + 0x30]
add rcx, rbx
add rdx, rbx
call fcn.180198b60
movzx eax, byte [r14]
lea r8, [rdi + 0x20]
lea r9d, [rax + rax]
lea eax, [r9 + 4]
lea rdx, [rbx + rax*8]
lea eax, [r9 + 2]
lea rcx, [rbx + rax*8]
call fcn.180198b60
movzx r9d, byte [r14]
lea r8, [rdi + 0x10]
lea eax, [r9*2 + 2]
lea rdx, [rbx + rax*8]
lea eax, [r9 + r9]
lea rcx, [rbx + rax*8]
call fcn.180198b60
movzx edx, byte [r14]
movq rax, xmm0
psrldq xmm0, 8
mov r8, rdi
lea ecx, [rdx + rdx]
add edx, edx
xor rax, qword [rbx + rcx*8]
mov qword [rsp + 0x20], rax
movq rax, xmm0
xor rax, qword [rbx + rdx*8 + 8]
mov qword [rsp + 0x28], rax
lea eax, [rdx + 8]
lea rdx, [rsp + 0x20]
lea rcx, [rbx + rax*8]
call fcn.180198b60
mov byte [r14], sil
sub r15, 1
jne 0x180198460
xor eax, eax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1801e67e0
mov rbx, qword [rsp + 0x90]
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1801985a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movzx r9d, byte [r8]
mov r11, rcx
movzx eax, r9b
shr al, 3
dec al
and al, 1
shl al, 3
movzx r10d, al
lea rax, [r9 + 4]
add rax, rax
add r9, 3
add r9, r9
movdqu xmm0, xmmword [rcx + r9*8]
aesenc xmm0, xmmword [rcx + rax*8]
lea rax, [r10 + 4]
add rax, rax
movdqu xmmword [rcx + rax*8], xmm0
movzx ecx, byte [r8]
lea rax, [rcx + 3]
add rcx, 2
add rax, rax
add rcx, rcx
movdqu xmm0, xmmword [r11 + rcx*8]
aesenc xmm0, xmmword [r11 + rax*8]
lea rax, [r10 + 3]
add rax, rax
movdqu xmmword [r11 + rax*8], xmm0
movzx eax, byte [r8]
lea rcx, [rax + 2]
inc rax
add rax, rax
add rcx, rcx
movdqu xmm0, xmmword [r11 + rax*8]
lea rax, [r10 + 2]
aesenc xmm0, xmmword [r11 + rcx*8]
add rax, rax
movdqu xmmword [r11 + rax*8], xmm0
movzx eax, byte [r8]
lea rcx, [rax + 1]
add rax, rax
add rcx, rcx
movdqu xmm0, xmmword [r11 + rax*8]
lea rax, [r10 + 1]
aesenc xmm0, xmmword [r11 + rcx*8]
add rax, rax
movdqu xmmword [r11 + rax*8], xmm0
movzx ecx, byte [r8]
mov eax, ecx
add rax, rax
movdqu xmm1, xmmword [r11 + rax*8]
lea rax, [rcx + 4]
pxor xmm1, xmmword [rdx]
add rax, rax
movdqu xmm0, xmmword [r11 + rax*8]
mov eax, r10d
add rax, rax
aesenc xmm0, xmm1
movdqu xmmword [r11 + rax*8], xmm0
mov byte [r8], r10b
ret
Function at 0x1801987d0
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions
Encrypt data using rc4 prga

Disassembly:
push rbx
push rdi
sub rsp, 0x48
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rdi, r9
mov qword [rsp + 0x20], 0
mov r9, r8
mov qword [rsp + 0x28], 0
lea rax, [r8 + 0xf]
and r9d, 0xf
shr rax, 4
mov r11, rdx
mov rbx, rcx
test rax, rax
je 0x180198961
xor r8d, r8d
lea r10, [rax - 1]
test r10, r10
je 0x18019891d
nop dword [rax]
movzx ecx, byte [rdi]
mov rax, r8
add rax, rax
inc r8
movdqu xmm1, xmmword [r11 + rax*8]
movzx eax, cl
shr al, 3
dec al
and al, 1
shl al, 3
movzx edx, al
lea rax, [rcx + 4]
add rax, rax
add rcx, 3
add rcx, rcx
movdqu xmm0, xmmword [rbx + rcx*8]
aesenc xmm0, xmmword [rbx + rax*8]
lea rax, [rdx + 4]
add rax, rax
movdqu xmmword [rbx + rax*8], xmm0
movzx ecx, byte [rdi]
lea rax, [rcx + 3]
add rcx, 2
add rax, rax
add rcx, rcx
movdqu xmm0, xmmword [rbx + rcx*8]
aesenc xmm0, xmmword [rbx + rax*8]
lea rax, [rdx + 3]
add rax, rax
movdqu xmmword [rbx + rax*8], xmm0
movzx eax, byte [rdi]
lea rcx, [rax + 2]
inc rax
add rax, rax
add rcx, rcx
movdqu xmm0, xmmword [rbx + rax*8]
lea rax, [rdx + 2]
aesenc xmm0, xmmword [rbx + rcx*8]
add rax, rax
movdqu xmmword [rbx + rax*8], xmm0
movzx eax, byte [rdi]
lea rcx, [rax + 1]
add rax, rax
add rcx, rcx
movdqu xmm0, xmmword [rbx + rax*8]
lea rax, [rdx + 1]
aesenc xmm0, xmmword [rbx + rcx*8]
add rax, rax
movdqu xmmword [rbx + rax*8], xmm0
movzx ecx, byte [rdi]
mov eax, ecx
add rax, rax
pxor xmm1, xmmword [rbx + rax*8]
lea rax, [rcx + 4]
add rax, rax
movdqu xmm0, xmmword [rbx + rax*8]
mov eax, edx
add rax, rax
aesenc xmm0, xmm1
movdqu xmmword [rbx + rax*8], xmm0
mov byte [rdi], dl
cmp r8, r10
jb 0x180198830
add r8, r8
lea rax, [r11 + r8*8]
test r9, r9
je 0x180198947
mov r8, r9
lea rcx, [rsp + 0x20]
mov rdx, rax
call fcn.18020b760
movdqu xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
jmp 0x180198951
movdqu xmm0, xmmword [rax]
movdqu xmmword [rsp + 0x20], xmm0
mov r8, rdi
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1801985a0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1801e67e0
add rsp, 0x48
pop rdi
pop rbx
ret
Function at 0x180198980
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r13
push r14
push r15
sub rsp, 0x78
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbp, rdx
lea rax, [rdx + 0xf]
shr rax, 4
and ebp, 0xf
mov r14, r9
mov r15, r8
mov r13, rcx
test rax, rax
je 0x180198b43
mov qword [rsp + 0x70], rbx
xor ebx, ebx
mov qword [rsp + 0x58], r12
lea r12, [rax - 1]
test r12, r12
je 0x180198af1
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x60], rdi
nop
movzx ecx, byte [r15]
mov rax, rbx
add rax, rax
lea rdx, [rcx + 4]
movups xmm0, xmmword [r13 + rax*8]
movzx eax, cl
shl rdx, 4
shr al, 3
add rcx, 3
dec al
shl rcx, 4
and al, 1
add rdx, r14
shl al, 3
add rcx, r14
movzx esi, al
movups xmmword [rsp + 0x20], xmm0
lea r8, [rsi + 4]
shl r8, 4
add r8, r14
call fcn.180198b60
movzx ecx, byte [r15]
mov edi, esi
shl rdi, 4
add rdi, r14
lea rdx, [rcx + 3]
add rcx, 2
shl rcx, 4
shl rdx, 4
lea r8, [rdi + 0x30]
add rcx, r14
add rdx, r14
call fcn.180198b60
movzx eax, byte [r15]
lea r8, [rdi + 0x20]
lea r9d, [rax + rax]
lea eax, [r9 + 4]
lea rdx, [r14 + rax*8]
lea eax, [r9 + 2]
lea rcx, [r14 + rax*8]
call fcn.180198b60
movzx r9d, byte [r15]
lea r8, [rdi + 0x10]
lea eax, [r9*2 + 2]
lea rdx, [r14 + rax*8]
lea eax, [r9 + r9]
lea rcx, [r14 + rax*8]
call fcn.180198b60
movzx edx, byte [r15]
movq rax, xmm0
psrldq xmm0, 8
mov r8, rdi
lea ecx, [rdx + rdx]
add edx, edx
xor rax, qword [r14 + rcx*8]
mov qword [rsp + 0x30], rax
movq rax, xmm0
xor rax, qword [r14 + rdx*8 + 8]
mov qword [rsp + 0x38], rax
lea eax, [rdx + 8]
lea rdx, [rsp + 0x30]
lea rcx, [r14 + rax*8]
call fcn.180198b60
inc rbx
mov byte [r15], sil
cmp rbx, r12
jb 0x1801989e0
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov r12, qword [rsp + 0x58]
shl rbx, 4
add rbx, r13
test rbp, rbp
je 0x180198b26
mov r8, rbp
mov qword [rsp + 0x20], 0
mov rdx, rbx
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x20]
call fcn.18020b760
jmp 0x180198b2e
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x20], xmm0
lea r8, [rsp + 0x20]
mov rdx, r14
mov rcx, r15
call fcn.1801986a0
mov rbx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1801e67e0
add rsp, 0x78
pop r15
pop r14
pop r13
pop rbp
ret
Function at 0x180199040
Capabilities:
Encode data using xor

Disassembly:
push rdi
mov r8, qword [rdx + 0x30]
mov rdi, rcx
mov r10, qword [rdx]
mov r9, qword [rdx + 8]
mov r11, qword [rdx + 0x10]
mov rax, qword [rdx + 0x18]
mov qword [rsp + 0x10], rbx
mov rbx, qword [rdx + 0x28]
shl rbx, 0x38
dec r8
cmp r8, 6
ja case.default.0x18019908a
mov qword [rsp + 0x18], rsi
lea rsi, section.__wibu05
mov ecx, dword [rsi + r8*4 + 0x14922c]
add rcx, rsi
mov rsi, qword [rsp + 0x18]
jmp rcx
movzx ecx, byte [rdx + 0x26]
shl rcx, 0x30
or rbx, rcx
movzx ecx, byte [rdx + 0x25]
shl rcx, 0x28
or rbx, rcx
movzx ecx, byte [rdx + 0x24]
shl rcx, 0x20
or rbx, rcx
movzx ecx, byte [rdx + 0x23]
shl rcx, 0x18
or rbx, rcx
movzx ecx, byte [rdx + 0x22]
shl rcx, 0x10
or rbx, rcx
movzx ecx, byte [rdx + 0x21]
shl rcx, 8
or rbx, rcx
movzx ecx, byte [rdx + 0x20]
or rbx, rcx
xor rax, rbx
mov ecx, 2
nop dword [rax]
add r10, r9
add r11, rax
rol r9, 0xd
xor r9, r10
rol rax, 0x10
xor rax, r11
rol r10, 0x20
add r11, r9
add r10, rax
rol r9, 0x11
rol rax, 0x15
xor r9, r11
xor rax, r10
rol r11, 0x20
sub rcx, 1
jne 0x1801990e0
xor r10, rbx
mov r8d, 4
mov rbx, qword [rsp + 0x10]
xor r11, 0xee
mov ecx, r8d
nop
add r10, r9
add r11, rax
rol r9, 0xd
xor r9, r10
rol rax, 0x10
xor rax, r11
rol r10, 0x20
add r11, r9
add r10, rax
rol r9, 0x11
rol rax, 0x15
xor r9, r11
xor rax, r10
rol r11, 0x20
sub rcx, 1
jne 0x180199130
mov rdx, rax
xor rdx, r11
xor rdx, r9
xor rdx, r10
mov ecx, edx
mov byte [rdi], dl
shr ecx, 8
mov byte [rdi + 1], cl
mov ecx, edx
shr ecx, 0x10
mov byte [rdi + 2], cl
mov ecx, edx
shr ecx, 0x18
shr rdx, 0x20
mov byte [rdi + 3], cl
mov ecx, edx
shr ecx, 8
mov byte [rdi + 5], cl
mov ecx, edx
shr ecx, 0x10
mov byte [rdi + 4], dl
shr edx, 0x18
mov byte [rdi + 6], cl
xor r9, 0xdd
mov byte [rdi + 7], dl
add r10, r9
add r11, rax
rol r9, 0xd
xor r9, r10
rol rax, 0x10
xor rax, r11
rol r10, 0x20
add r11, r9
add r10, rax
rol r9, 0x11
rol rax, 0x15
xor r9, r11
xor rax, r10
rol r11, 0x20
sub r8, 1
jne 0x1801991b0
xor rax, r11
xor rax, r9
xor rax, r10
mov ecx, eax
mov byte [rdi + 8], al
shr ecx, 8
mov byte [rdi + 9], cl
mov ecx, eax
shr ecx, 0x10
mov byte [rdi + 0xa], cl
mov ecx, eax
shr ecx, 0x18
shr rax, 0x20
mov byte [rdi + 0xb], cl
mov ecx, eax
shr ecx, 8
mov byte [rdi + 0xd], cl
mov ecx, eax
shr ecx, 0x10
mov byte [rdi + 0xc], al
shr eax, 0x18
mov byte [rdi + 0xf], al
mov byte [rdi + 0xe], cl
pop rdi
ret
Function at 0x180199350
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
add qword [rcx + 0x28], r8
mov r12, r8
mov rax, qword [rcx + 0x30]
mov r14, rdx
mov rsi, qword [rcx]
mov r15, rcx
mov rdi, qword [rcx + 8]
mov rbp, qword [rcx + 0x10]
mov rbx, qword [rcx + 0x18]
mov r8, qword [rcx + 0x28]
test rax, rax
je 0x18019946d
add rcx, 0x20
mov r13d, 8
sub r13, rax
add rcx, rax
cmp r12, r13
jae 0x1801993bf
mov r8, r12
call fcn.18020b760
add qword [r15 + 0x30], r12
jmp 0x180199551
mov r8, r13
call fcn.18020b760
movzx eax, byte [r15 + 0x26]
add r14, r13
movzx ecx, byte [r15 + 0x27]
sub r12, r13
shl rcx, 8
or rcx, rax
movzx eax, byte [r15 + 0x25]
shl rcx, 8
or rcx, rax
movzx eax, byte [r15 + 0x24]
shl rcx, 8
or rcx, rax
movzx eax, byte [r15 + 0x23]
shl rcx, 8
or rcx, rax
movzx eax, byte [r15 + 0x22]
shl rcx, 8
or rcx, rax
movzx eax, byte [r15 + 0x21]
shl rcx, 8
or rcx, rax
movzx eax, byte [r15 + 0x20]
shl rcx, 8
or rcx, rax
mov eax, 2
xor rbx, rcx
nop
add rsi, rdi
add rbp, rbx
rol rdi, 0xd
xor rdi, rsi
rol rbx, 0x10
xor rbx, rbp
rol rsi, 0x20
add rbp, rdi
add rsi, rbx
rol rdi, 0x11
rol rbx, 0x15
xor rdi, rbp
xor rbx, rsi
rol rbp, 0x20
sub rax, 1
jne 0x180199430
mov r8, qword [r15 + 0x28]
xor rsi, rcx
and r8d, 7
mov rdx, r14
sub rdx, r8
mov qword [r15 + 0x30], r8
add rdx, r12
cmp r14, rdx
je 0x180199536
nop word [rax + rax]
movzx eax, byte [r14 + 6]
movzx ecx, byte [r14 + 7]
shl rcx, 8
or rcx, rax
movzx eax, byte [r14 + 5]
shl rcx, 8
or rcx, rax
movzx eax, byte [r14 + 4]
shl rcx, 8
or rcx, rax
movzx eax, byte [r14 + 3]
shl rcx, 8
or rcx, rax
movzx eax, byte [r14 + 2]
shl rcx, 8
or rcx, rax
movzx eax, byte [r14 + 1]
shl rcx, 8
or rcx, rax
movzx eax, byte [r14]
shl rcx, 8
or rcx, rax
mov eax, 2
xor rbx, rcx
add rsi, rdi
add rbp, rbx
rol rdi, 0xd
xor rdi, rsi
rol rbx, 0x10
xor rbx, rbp
rol rsi, 0x20
add rbp, rdi
add rsi, rbx
rol rdi, 0x11
rol rbx, 0x15
xor rdi, rbp
xor rbx, rsi
rol rbp, 0x20
sub rax, 1
jne 0x1801994f0
xor rsi, rcx
add r14, 8
cmp r14, rdx
jne 0x180199490
lea rcx, [r15 + 0x20]
mov qword [r15], rsi
mov rdx, r14
mov qword [r15 + 8], rdi
mov qword [r15 + 0x10], rbp
mov qword [r15 + 0x18], rbx
call fcn.18020b760
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret