joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18019f8c0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rdi, rcx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r14, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
cmp rdi, 0x40000000
jbe 0x18019f900
lea rax, [rdi - 0x40000000]
cmp r14, rax
cmovb r14, rax
mov rsi, qword [0x18031e480]
lea r15, [rdi + 0x40000000]
cmp rcx, r15
cmovbe r15, rcx
sub r15, 0xfff
test rsi, rsi
je 0x18019f93e
cmp rsi, r14
jb 0x18019f936
cmp rsi, r15
jae 0x18019f936
cmp qword [rsi + 8], 0
jne 0x18019fb07
mov rsi, qword [rsi]
test rsi, rsi
jne 0x18019f921
mov qword [rsp + 0xa0], rbx
mov rbx, rdi
mov qword [rsp + 0xa8], rbp
mov qword [rsp + 0xb0], r12
mov r12d, 0x40
cmp rdi, r14
jb 0x18019f9d2
nop dword [rax]
nop dword [rax + rax]
mov ebp, dword [rsp + 0x48]
mov rax, rbx
xor edx, edx
div rbp
sub rbx, rdx
sub rbx, rbp
cmp rbx, r14
jb 0x18019f9c9
nop word [rax + rax]
mov r8d, 0x30
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18019f9c9
cmp dword [rsp + 0x70], 0x10000
je 0x18019fa4b
mov rbx, qword [rsp + 0x58]
cmp rbx, rbp
jb 0x18019f9c9
sub rbx, rbp
cmp rbx, r14
jae 0x18019f990
test rsi, rsi
jne 0x18019fab0
cmp rdi, r15
ja 0x18019faef
nop dword [rax + rax]
mov ebp, dword [rsp + 0x48]
xor edx, edx
mov rax, rdi
mov ebx, ebp
div rbp
mov eax, ebp
sub rax, rdx
add rax, rdi
mov rdi, rax
cmp rax, r15
ja 0x18019faef
mov r8d, 0x30
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18019faef
cmp dword [rsp + 0x70], 0x10000
je 0x18019fa81
xor edx, edx
lea edi, [rbp - 1]
add rdi, qword [rsp + 0x68]
add rdi, qword [rsp + 0x50]
mov rax, rdi
div rbx
sub rdi, rdx
cmp rdi, r15
jbe 0x18019fa02
jmp 0x18019faef
test rbx, rbx
je 0x18019f9c9
mov r9d, r12d
mov edx, 0x1000
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x18019fab0
cmp rbx, r14
jae 0x18019f970
jmp 0x18019f9d2
test rdi, rdi
je 0x18019faef
mov r9d, r12d
mov edx, 0x1000
mov r8d, 0x3000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x18019fab0
cmp rdi, r15
jbe 0x18019f9e0
jmp 0x18019faef
xor edx, edx
lea rcx, [rsi + 0x40]
mov dword [rsi + 0x10], edx
nop dword [rax]
mov qword [rcx], rdx
mov rax, rcx
mov qword [rsi + 8], rcx
add r12, 0x40
add rcx, 0x40
mov rdx, rax
cmp r12, 0xfc0
jbe 0x18019fac0
mov rax, qword [0x18031e480]
mov qword [rsi], rax
mov qword [0x18031e480], rsi
mov r12, qword [rsp + 0xb0]
mov rbp, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0xa0]
mov rax, rsi
mov rsi, qword [rsp + 0xb8]
add rsp, 0x80
pop r15
pop r14
pop rdi
ret
Function at 0x1801a0a60
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1801a0a9a
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1801a0a9f
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1801a0ae8
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x180271d90]
cmp byte [rcx + rax], 0
je 0x1801a0ae8
dec r8
sub rdx, 1
jne 0x1801a0ace
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x1800105e0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov rax, qword [0x18004ba80]
xor rax, rsp
mov qword [rsp + 0x80], rax
cmp edx, 0xffffffff
je 0x18001070d
mov esi, edx
mov rdi, rcx
mov rax, qword [rcx + 0x40]
cmp qword [rax], 0
je 0x18001063d
mov rax, qword [rdi + 0x58]
mov ecx, dword [rax]
test ecx, ecx
jle 0x18001063d
dec ecx
mov dword [rax], ecx
mov rax, qword [rdi + 0x40]
mov rcx, qword [rax]
lea rdx, [rcx + 1]
mov qword [rax], rdx
mov byte [rcx], sil
jmp 0x180010752
cmp qword [rdi + 0x80], 0
je 0x180010711
mov rax, qword [rdi + 0x18]
lea rcx, [rdi + 0x70]
cmp qword [rax], rcx
jne 0x180010677
mov ecx, dword [rdi + 0x90]
mov rdx, qword [rdi + 0x88]
mov qword [rax], rdx
mov rax, qword [rdi + 0x38]
mov qword [rax], rdx
sub ecx, edx
mov rax, qword [rdi + 0x50]
mov dword [rax], ecx
mov rcx, qword [rdi + 0x68]
test rcx, rcx
je 0x180010718
mov byte [rsp + 0x5f], sil
lea rax, [rsp + 0x80]
lea r9, [rsp + 0x60]
lea rdx, [rdi + 0x74]
mov r10, qword [rcx]
lea r8, [rsp + 0x48]
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rax
lea r14, [rsp + 0x60]
mov qword [rsp + 0x28], r14
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea rbx, [rsp + 0x5f]
mov r8, rbx
call qword [r10 + 0x38]
mov ebp, 0xffffffff
cmp eax, 2
jae 0x180010731
mov r15, qword [rsp + 0x48]
sub r15, r14
je 0x1800106fd
mov r9, qword [rdi + 0x80]
mov edx, 1
mov rcx, r14
mov r8, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp r15, rax
jne 0x180010750
mov byte [rdi + 0x71], 1
cmp qword [rsp + 0x50], rbx
mov eax, 0xffffffff
jmp 0x18001074b
xor esi, esi
jmp 0x180010752
mov esi, 0xffffffff
jmp 0x180010752
mov rdx, qword [rdi + 0x80]
movsx ecx, sil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, 0xffffffff
cmove esi, eax
jmp 0x180010752
cmp eax, 3
jne 0x180010750
mov rdx, qword [rdi + 0x80]
movsx ecx, byte [rsp + 0x5f]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, 0xffffffff
cmove esi, eax
mov ebp, esi
mov esi, ebp
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.180037810
mov eax, esi
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x180010bc0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
test r8, r8
jle 0x180010bfb
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x68], 0
je 0x180010c02
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
xor esi, esi
jmp 0x180010cf9
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x180010c55
mov rax, qword [rbx + 0x50]
movsxd r15, dword [rax]
test r15, r15
je 0x180010c55
cmp r15, rsi
cmovae r15, rsi
mov rcx, rdi
mov r8, r15
call fcn.180039140
add rdi, r15
mov r14, rsi
sub r14, r15
mov rax, qword [rbx + 0x50]
sub dword [rax], r15d
mov rax, qword [rbx + 0x38]
movsxd rcx, r15d
add qword [rax], rcx
cmp qword [rbx + 0x80], 0
jne 0x180010c66
jmp 0x180010cf6
mov r14, rsi
cmp qword [rbx + 0x80], 0
je 0x180010cf6
mov rax, qword [rbx + 0x18]
lea rcx, [rbx + 0x70]
cmp qword [rax], rcx
jne 0x180010c92
mov ecx, dword [rbx + 0x90]
mov rdx, qword [rbx + 0x88]
mov qword [rax], rdx
mov rax, qword [rbx + 0x38]
mov qword [rax], rdx
sub ecx, edx
mov rax, qword [rbx + 0x50]
mov dword [rax], ecx
mov r15, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
nop dword [rax]
cmp r14, 0x1000
jb 0x180010cd1
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rdi
call r15
add rdi, rax
sub r14, rax
cmp rax, 0xfff
je 0x180010ca0
jmp 0x180010cf6
test r14, r14
je 0x180010cf3
mov r9, qword [rbx + 0x80]
mov edx, 1
mov rcx, rdi
mov r8, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub r14, rax
jmp 0x180010cf6
xor r14d, r14d
sub rsi, r14
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x180010d10
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x68], 0
je 0x180010d46
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rbx + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x180010d93
test rsi, rsi
jle 0x180010d93
mov rax, qword [rbx + 0x58]
mov r15d, dword [rax]
test r15d, r15d
jle 0x180010d93
cmp r15, rsi
cmovae r15, rsi
mov rdx, rdi
mov r8, r15
call fcn.180039140
add rdi, r15
mov r14, rsi
sub r14, r15
mov rax, qword [rbx + 0x58]
sub dword [rax], r15d
mov rax, qword [rbx + 0x40]
add qword [rax], r15
test r14, r14
jg 0x180010d9b
jmp 0x180010dbb
mov r14, rsi
test r14, r14
jle 0x180010dbb
mov r9, qword [rbx + 0x80]
test r9, r9
je 0x180010dbb
mov edx, 1
mov rcx, rdi
mov r8, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub r14, rax
sub rsi, r14
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1800111b0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rax, qword [0x18004ba80]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dil, 1
cmp qword [rcx + 0x68], 0
je 0x18001125a
mov rsi, rcx
cmp byte [rcx + 0x71], 0
je 0x18001125a
mov rax, qword [rsi]
mov rcx, rsi
mov edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x180011258
mov rcx, qword [rsi + 0x68]
lea r9, [rsp + 0x50]
lea rdx, [rsi + 0x74]
mov rax, qword [rcx]
lea r8, [rsp + 0x28]
mov qword [rsp + 0x20], r8
lea rdi, [rsp + 0x30]
mov r8, rdi
call qword [rax + 0x40]
cmp eax, 3
je 0x180011271
cmp eax, 1
je 0x180011227
test eax, eax
jne 0x180011258
mov byte [rsi + 0x71], 0
mov rbx, qword [rsp + 0x28]
sub rbx, rdi
je 0x18001124e
mov r9, qword [rsi + 0x80]
mov edx, 1
mov rcx, rdi
mov r8, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x180011258
cmp byte [rsi + 0x71], 0
sete dil
jmp 0x18001125a
xor edi, edi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180037810
mov eax, edi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
mov byte [rsi + 0x71], 0
mov dil, 1
jmp 0x18001125a

Function at 0x180014200
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
mov rcx, r8
sub rcx, rdx
je 0x180014222
mov rax, rdx
not rax
add rax, r8
jne 0x18001422c
mov eax, 0x84222325
xor r8d, r8d
jmp 0x1800142ac
mov eax, 0x84222325
jmp 0x1800142e5
mov r9, rcx
and r9, 0xfffffffffffffffe
mov eax, 0x84222325
xor r8d, r8d
nop dword [rax + rax]
movzx r10d, byte [rdx + r8]
mov r11d, r10d
not r11d
mov esi, r11d
and esi, 0x3f
mov edi, r10d
and edi, 0xffffffc0
or edi, esi
xor edi, eax
not eax
xor edi, 0xc0
or edi, r11d
or eax, r10d
xor eax, edi
imul eax, eax, 0x1b3
movzx r10d, byte [rdx + r8 + 1]
mov r11d, r10d
not r11d
mov esi, r11d
and esi, 0x3f
mov edi, r10d
and edi, 0xffffffc0
or edi, esi
xor edi, eax
not eax
xor edi, 0xc0
or edi, r11d
or eax, r10d
xor eax, edi
imul eax, eax, 0x1b3
add r8, 2
cmp r9, r8
jne 0x180014240
test cl, 1
je 0x1800142e5
movzx ecx, byte [rdx + r8]
mov edx, ecx
not edx
mov r8d, edx
and r8d, 0x3f
mov r9d, ecx
and r9d, 0xffffffc0
or r9d, r8d
xor r9d, eax
not eax
xor r9d, 0xc0
or r9d, edx
or eax, ecx
xor eax, r9d
imul eax, eax, 0x1b3
pop rdi
pop rsi
ret
Function at 0x18001cd50
Capabilities:
Encode data using xor

Disassembly:
add rcx, 0x20
jmp fcn.18000aae0

Function at 0x18001dd90
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
cmp qword [rcx + 0x20], 0
je 0x18001de2c
movabs rdi, 0x100002600
nop
mov rcx, rsi
call fcn.1800203f0
mov eax, dword [rsi + 0x14]
cmp rax, 0x20
ja 0x18001ddf7
bt rdi, rax
jb 0x18001ddb0
jmp 0x18001ddf7
mov rcx, rsi
call fcn.18001e070
test al, al
je 0x18001df25
mov rcx, rsi
call fcn.1800203f0
mov eax, dword [rsi + 0x14]
cmp rax, 0x20
ja 0x18001ddf7
bt rdi, rax
jb 0x18001dde0
cmp eax, 0x2f
jne 0x18001de02
cmp byte [rsi + 0x10], 0
jne 0x18001ddd0
inc eax
cmp eax, 0x7e
ja case.0x18001de1b.1
lea rcx, [0x18003f7cc]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
mov rcx, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp fcn.18001fb60
mov rcx, rsi
call fcn.1800203f0
cmp eax, 0xef
jne 0x18001df32
mov rcx, rsi
call fcn.1800203f0
cmp eax, 0xbb
jne 0x18001de61
mov rcx, rsi
call fcn.1800203f0
cmp eax, 0xbf
je 0x18001dda5
cmp byte [0x18004c08f], 0
jne 0x18001df10
mov rax, qword [str.m_]
movabs r8, 0x641348d65e53efcd
add r8, rax
movabs r9, 0x641348d65e53efbb
add r9, rax
xor ecx, ecx
movabs r10, 0xe38e38e38e38e38f
lea r11, [0x18004c062]
nop word cs:[rax + rax]
mov rax, rcx
mul r10
shr rdx, 3
and rdx, 0xfffffffffffffffe
lea rax, [rdx + rdx*8]
mov rdx, r9
sub rdx, rax
movzx eax, byte [r8 + rcx]
movzx edx, byte [rdx + rcx]
mov ebx, eax
xor bl, 0xa
mov edi, eax
and dil, 2
xor al, 8
and al, bl
xor al, dil
mov ebx, edx
xor bl, 0xf5
mov edi, edx
xor dil, 8
and dil, bl
and dl, 0xfd
xor dl, 8
or dl, dil
xor dl, al
mov byte [rcx + r11], dl
inc rcx
cmp rcx, 0x2d
jne 0x18001deb0
mov byte [0x18004c08f], 1
movabs rax, 0x641348d65e53dcf3
add rax, qword [0x18004a988]
mov qword [rsi + 0x70], rax
mov eax, 0xe
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov byte [rsi + 0x18], 1
dec qword [rsi + 0x20]
mov rax, qword [rsi + 0x28]
test rax, rax
je 0x18001df49
lea rcx, [rsi + 0x28]
jmp 0x18001df56
mov rax, qword [rsi + 0x30]
test rax, rax
je 0x18001df5c
lea rcx, [rsi + 0x30]
dec rax
mov qword [rcx], rax
cmp dword [rsi + 0x14], 0xffffffff
je 0x18001dda5
dec qword [rsi + 0x40]
jmp 0x18001dda5
mov eax, 0xf
jmp 0x18001df2a
movabs rcx, 0x641348d65e53f018
add rcx, qword [str.m_]
call fcn.180033910
movabs rax, 0x641348d65e53dcf3
add rax, qword [0x18004a9a8]
jmp 0x18001df21
mov rcx, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp fcn.18001e540
mov eax, 0xd
jmp 0x18001df2a
mov eax, 0xc
jmp 0x18001df2a
mov eax, 8
jmp 0x18001df2a
mov eax, 0xa
jmp 0x18001df2a
mov byte [rsp + 0x24], 0x65
mov dword [rsp + 0x20], 0x736c6166
lea rdx, [rsp + 0x20]
mov r8d, 5
mov rcx, rsi
mov r9d, 2
call fcn.18001e3d0
jmp 0x18001df2a
mov dword [rsp + 0x28], 0x6c6c756e
lea rdx, [rsp + 0x28]
mov r8d, 4
mov rcx, rsi
mov r9d, 3
call fcn.18001e3d0
jmp 0x18001df2a
mov dword [rsp + 0x2c], 0x65757274
lea rdx, [rsp + 0x2c]
mov r8d, 4
mov rcx, rsi
mov r9d, 1
call fcn.18001e3d0
jmp 0x18001df2a
mov eax, 9
jmp 0x18001df2a
mov eax, 0xb
jmp 0x18001df2a
Function at 0x18001e3d0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov edi, r9d
cmp r8, 2
jb 0x18001e52b
mov rbx, r8
mov r14, rdx
mov rsi, rcx
mov r15d, 1
nop word [rax + rax]
mov rcx, rsi
call fcn.1800203f0
cmp byte [r14 + r15], al
jne 0x18001e41b
inc r15
cmp rbx, r15
jne 0x18001e400
jmp 0x18001e52b
cmp byte [0x18004c0a0], 0
jne 0x18001e511
mov rdx, qword [0x18004a9c8]
movabs rax, 0x5f4b9357a4d2c96c
add rax, rdx
movabs rcx, 0x5f4b9357a4d2c97f
add rcx, rdx
movabs r8, 0x5f4b9357a4d2c98f
add r8, rdx
lea rdx, [0x18004c090]
cmp r8, rdx
jbe 0x18001e4be
lea r8, [0x18004c0a0]
cmp rax, r8
jae 0x18001e4be
xor r8d, r8d
nop word cs:[rax + rax]
movzx r9d, byte [rcx + r8]
movzx r10d, byte [rax + r8]
not r10b
mov r11d, r9d
or r11b, r10b
and r10b, r9b
mov r9d, r11d
and r9b, 0x33
xor r9b, r10b
and r11b, 0xcc
or r11b, 0x23
xor r11b, r9b
xor r11b, 0xdc
mov byte [r8 + rdx], r11b
inc r8
cmp r8, 0x10
jne 0x18001e480
jmp 0x18001e50a
movdqu xmm0, xmmword [rcx]
movdqu xmm1, xmmword [rax]
pcmpeqd xmm2, xmm2
pxor xmm2, xmm1
por xmm2, xmm0
pandn xmm1, xmm0
movdqa xmm0, xmmword [str.3333333333333333]
pand xmm0, xmm2
pxor xmm0, xmm1
pand xmm2, xmmword [0x18003d660]
por xmm2, xmmword [0x18003d670]
pxor xmm2, xmm0
pxor xmm2, xmmword [0x18003d680]
movdqa xmmword [0x18004c090], xmm2
mov byte [0x18004c0a0], 1
movabs rax, 0x5f4b9357a4d2b647
add rax, qword [str.I_n2l]
mov qword [rsi + 0x70], rax
mov edi, 0xe
mov eax, edi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x180020890
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
movzx r9d, byte [rcx + 0x14]
lea rbx, [rcx + 0x50]
mov rax, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x68]
cmp rax, rcx
jae 0x1800208d6
lea rdx, [rax + 1]
mov qword [rsi + 0x60], rdx
mov rdx, rbx
cmp rcx, 0x10
jb 0x1800208cb
mov rdx, qword [rsi + 0x50]
mov byte [rdx + rax], r9b
mov byte [rdx + rax + 1], 0
jmp 0x1800208e3
mov edx, 1
mov rcx, rbx
call fcn.18000fa30
mov r14, qword [rdi]
mov bpl, 1
cmp r14, qword [rdi + 8]
jne 0x180020913
jmp 0x180020967
mov byte [rdx + rax], r9b
mov byte [rdx + rax + 1], 0
add r14, 8
cmp r14, qword [rdi + 8]
je 0x180020967
mov rcx, rsi
call fcn.1800203f0
mov r9d, dword [rsi + 0x14]
cmp dword [r14], r9d
jg 0x180020974
cmp r9d, dword [r14 + 4]
jg 0x180020974
mov rax, qword [rsi + 0x60]
mov rcx, qword [rsi + 0x68]
cmp rax, rcx
jae 0x180020950
lea rdx, [rax + 1]
mov qword [rsi + 0x60], rdx
mov rdx, rbx
cmp rcx, 0x10
jb 0x180020900
mov rdx, qword [rsi + 0x50]
jmp 0x180020900
mov edx, 1
mov rcx, rbx
call fcn.18000fa30
add r14, 8
cmp r14, qword [rdi + 8]
jne 0x180020913
mov eax, ebp
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
cmp byte [0x18004cb95], 0
jne 0x1800209ee
mov rax, qword [0x18004ab58]
movabs r8, 0x2435342479c26e85
add r8, rax
movabs r9, 0x2435342479c26e6b
add r9, rax
xor ecx, ecx
movabs r10, 0x4ec4ec4ec4ec4ec5
lea r11, [0x18004cb6f]
mov rax, rcx
mul r10
shr rdx, 3
imul rax, rdx, 0xffffffffffffffe6
add rax, r9
movzx edx, byte [rcx + rax]
xor dl, byte [r8 + rcx]
mov byte [rcx + r11], dl
movzx eax, byte [rcx + rax + 1]
xor al, byte [r8 + rcx + 1]
mov byte [rcx + r11 + 1], al
add rcx, 2
cmp rcx, 0x26
jne 0x1800209b1
mov byte [0x18004cb95], 1
movabs rax, 0x2435342479c2494a
add rax, qword [0x18004ab60]
mov qword [rsi + 0x70], rax
xor ebp, ebp
jmp 0x180020967
Function at 0x1800324c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
cmp byte [0x18004be6e], 0
jne 0x180032529
xor r8d, r8d
movabs r9, 0x97b425ed097b425f
lea r10, [0x18004be47]
nop
mov rax, r8
mul r9
shr rdx, 4
imul rax, rdx, 0xffffffffffffffe5
lea rdx, [rcx + r8]
movzx r11d, byte [rcx + r8 + 0x1b]
movzx eax, byte [rax + rdx]
mov edx, r11d
xor dl, 0xdb
mov ebx, eax
xor bl, 0xdb
xor r11b, 0x24
and r11b, bl
xor al, 0x24
and al, dl
or al, r11b
mov byte [r8 + r10], al
inc r8
cmp r8, 0x27
jne 0x1800324e0
mov byte [0x18004be6e], 1
pop rbx
ret

Function at 0x180032530
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
movdqa xmmword [rsp + 0x20], xmm8
movdqa xmmword [rsp + 0x10], xmm7
movdqa xmmword [rsp], xmm6
cmp byte [0x18004be80], 0
jne 0x180032748
lea rdx, [rcx + 0x2e]
lea rax, [0x18004be70]
cmp rdx, rax
jbe 0x18003263e
lea rdx, [0x18004be80]
cmp rcx, rdx
jae 0x18003263e
xor edx, edx
nop dword [rax]
movzx r10d, byte [rcx + rdx]
movzx r8d, byte [rcx + rdx + 0x1e]
mov r11d, r10d
not r11b
and r11b, 0x91
mov r9d, r10d
xor r9b, 0x6e
or r9b, r11b
mov r11d, r8d
and r11b, 0x91
mov ebx, r8d
or bl, 0x91
xor r11b, 0xdf
and r11b, bl
mov ebx, r8d
and bl, 0x20
mov esi, r8d
xor sil, 0x6e
xor r8b, 0x91
or r8b, sil
not r8b
or r8b, bl
or r8b, r11b
mov r11d, r10d
or r11b, 0x6e
mov esi, r11d
and sil, 0x19
and r10b, 0x80
or sil, r10b
lea edi, [rsi - 0x80]
mov ebx, r9d
mov ebp, r11d
and bpl, 0x55
or bpl, r10b
xor bpl, r9b
and r11b, r9b
and r9b, 0x19
or bl, 0x19
xor bl, r9b
mov r9d, ebx
not r9b
xor sil, 0x7f
and sil, r9b
and bl, dil
xor bpl, 0x2a
or r11b, bpl
not r11b
or r11b, bl
or r11b, sil
xor r11b, r8b
mov byte [rdx + rax], r11b
inc rdx
cmp rdx, 0x10
jne 0x180032580
jmp 0x180032741
movdqu xmm3, xmmword [rcx]
movdqu xmm0, xmmword [rcx + 0x1e]
movdqa xmm4, xmmword [0x18003d890]
movdqa xmm5, xmm3
pandn xmm5, xmm4
movdqa xmm1, xmmword [str.nnnnnnnnnnnnnnnn]
movdqa xmm2, xmm3
pxor xmm2, xmm1
por xmm2, xmm5
movdqa xmm5, xmm0
pand xmm5, xmm4
movdqa xmm6, xmm0
por xmm6, xmm4
pxor xmm5, xmmword [0x18003d8b0]
pand xmm5, xmm6
movdqa xmm6, xmmword [0x18003d8c0]
pand xmm6, xmm0
movdqa xmm7, xmm0
pxor xmm7, xmm1
pxor xmm0, xmm4
por xmm0, xmm7
pcmpeqd xmm4, xmm4
pxor xmm0, xmm4
por xmm0, xmm6
por xmm0, xmm5
por xmm1, xmm3
movdqa xmm5, xmmword [0x18003d8d0]
movdqa xmm6, xmm1
pand xmm6, xmm5
movdqa xmm7, xmmword [0x18003d8e0]
pand xmm3, xmm7
por xmm6, xmm3
pxor xmm7, xmm6
movdqa xmm8, xmm2
pand xmm8, xmm5
por xmm5, xmm2
pxor xmm5, xmm8
pxor xmm6, xmmword [0x18003d8f0]
movdqa xmm8, xmm5
pandn xmm8, xmm6
pand xmm5, xmm7
por xmm5, xmm8
movdqa xmm6, xmmword [str.UUUUUUUUUUUUUUUU]
pand xmm6, xmm1
por xmm6, xmm3
pxor xmm6, xmm2
pxor xmm6, xmmword [0x18003d910]
pand xmm1, xmm2
por xmm1, xmm6
pxor xmm1, xmm4
por xmm1, xmm5
pxor xmm1, xmm0
movdqa xmmword [0x18004be70], xmm1
mov byte [0x18004be80], 1
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x180032cf0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
movdqa xmmword [rsp + 0x10], xmm7
movdqa xmmword [rsp], xmm6
cmp byte [0x18004bf31], 0
jne 0x180032ebd
lea rdx, [rcx + 0x25]
lea rax, [0x18004bf20]
cmp rdx, rax
jbe 0x180032d32
lea rdx, [0x18004bf31]
cmp rcx, rdx
jae 0x180032d32
xor edx, edx
jmp 0x180032e20
movdqu xmm1, xmmword [rcx]
movdqa xmm3, xmmword [0x18003d560]
movdqa xmm4, xmm1
por xmm4, xmm3
pcmpeqd xmm2, xmm2
movdqa xmm0, xmm4
pxor xmm0, xmm2
movdqa xmm5, xmm1
pand xmm5, xmm3
movdqa xmm6, xmmword [str._f_f_f_f_f_f_f_f_f_f_f_f_f_f_f_f]
por xmm0, xmm6
pand xmm6, xmm1
por xmm6, xmmword [0x18003d980]
pxor xmm6, xmm0
movdqa xmm0, xmmword [0x18003d990]
por xmm0, xmm5
pxor xmm0, xmm6
movdqa xmm6, xmm4
pandn xmm6, xmmword [str.llllllllllllllll]
movdqa xmm7, xmmword [0x18003d9b0]
pand xmm4, xmm7
por xmm4, xmm6
pxor xmm5, xmm7
pxor xmm5, xmm4
pxor xmm1, xmm3
por xmm1, xmm5
pxor xmm0, xmmword [0x18003d9c0]
movdqa xmm3, xmm0
pxor xmm3, xmm1
por xmm0, xmm1
pxor xmm0, xmm2
por xmm0, xmm3
movdqa xmm1, xmmword [0x18003d9d0]
pand xmm1, xmm0
por xmm1, xmmword [str.00000000000000001111111111111111]
movdqu xmm2, xmmword [rcx + 0x14]
movdqa xmm3, xmmword [0x18003d9f0]
pand xmm3, xmm0
pxor xmm3, xmm1
pand xmm0, xmmword [0x18003d550]
por xmm0, xmm3
pxor xmm0, xmm2
pxor xmm0, xmmword [0x18003d680]
movdqa xmmword [0x18004bf20], xmm0
mov edx, 0x10
nop dword [rax]
movzx r9d, byte [rcx + rdx]
mov r10d, r9d
or r10b, 0x13
mov r11d, r10d
not r11b
mov esi, r9d
and sil, 0x13
mov ebx, r11d
or bl, 0xc
mov edi, r9d
and dil, 0xc
or dil, 0xe0
lea r8d, [rsi - 0x3c]
xor r8b, dil
xor r8b, bl
and r11b, 0x6c
and r10b, 0x90
or r10b, r11b
xor r10b, sil
xor r10b, 0x90
xor r9b, 0x13
or r9b, r10b
xor r8b, 0xdb
mov r10d, r8d
xor r10b, r9b
or r8b, r9b
not r8b
or r8b, r10b
mov r9d, r8d
and r9b, 0xca
or r9b, 0x30
mov r10d, r8d
and r10b, 0x31
xor r10b, r9b
and r8b, 4
or r8b, r10b
xor r8b, byte [rcx + rdx + 0x14]
xor r8b, 0xdc
mov byte [rdx + rax], r8b
inc rdx
cmp rdx, 0x11
jne 0x180032e20
mov byte [0x18004bf31], 1
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret