joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5f53a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5f554b
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov qword [rsp + 0x80], rax
xor ecx, ecx
jmp 0x5f53c7
inc rcx
cmp rbx, rcx
jle 0x5f553d
movzx edx, byte [rax + rcx]
cmp dl, 0x80
jb 0x5f53c4
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x80], rax
call fcn.00565500
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x58], rsi
test rsi, rsi
mov rdx, qword [rsp + 0x88]
cmovne rbx, rdx
mov rdx, qword [rsp + 0x80]
cmovne rax, rdx
mov rdx, qword [0x008ece58]
mov r8, rax
mov rax, rdx
mov r9, rbx
mov rbx, r8
mov rcx, r9
mov edi, 1
call fcn.005f1460
mov rdx, qword [rsp + 0x58]
test rdx, rdx
mov rdx, qword [rsp + 0x48]
mov esi, 0
cmovne rdx, rsi
mov r8, qword [rsp + 0x60]
mov r9d, 0
cmovne r8, r9
nop dword [rax]
test rcx, rcx
jne 0x5f552d
test rdx, rdx
je 0x5f551e
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x68], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.00403300
xorps xmm15, xmm15
mov r14, qword [0x0094d720]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x5f54e9
xor eax, eax
lea rbx, [0x007528c0]
mov ecx, 1
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x50]
lea r8, [0x006dc59c]
mov r9d, 2
mov r10, qword [rsp + 0x60]
mov r11, qword [rsp + 0x48]
call fcn.0044e900
jmp 0x5f5510
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
lea rdi, [0x00752750]
mov esi, 1
mov r8, qword [rsp + 0x60]
mov r9, qword [rsp + 0x48]
call fcn.0044e820
xor ecx, ecx
xor edi, edi
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
xor ecx, ecx
mov rdi, r9
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rax, r9
mov rbx, rsi
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
xor ecx, ecx
xor edi, edi
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004630c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.005f53a0
Function at 0x180018810
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa0
movdqa xmmword [rsp + 0x90], xmm15
movdqa xmmword [rsp + 0x80], xmm14
movdqa xmmword [rsp + 0x70], xmm13
movdqa xmmword [rsp + 0x60], xmm12
movdqa xmmword [rsp + 0x50], xmm11
movdqa xmmword [rsp + 0x40], xmm10
movdqa xmmword [rsp + 0x30], xmm9
movdqa xmmword [rsp + 0x20], xmm8
movdqa xmmword [rsp + 0x10], xmm7
movdqa xmmword [rsp], xmm6
mov rax, rcx
cmp byte [0x1800611f6], 0
jne 0x180018a81
mov r8, qword [0x18005f738]
movabs rcx, 0xe3d4a2a6160ec3a5
add rcx, r8
movabs rdx, 0xe3d4a2a6160ec3bb
add rdx, r8
movabs r9, 0xe3d4a2a6160ec3d0
add r9, r8
lea r8, [0x1800611e1]
cmp r9, r8
jbe 0x1800188c4
lea r9, [0x1800611f6]
cmp rcx, r9
jae 0x1800188c4
xor r9d, r9d
jmp 0x1800189f0
xor r9d, r9d
movdqa xmm0, xmmword [0x180050470]
pcmpeqd xmm1, xmm1
movdqa xmm2, xmmword [str._b_b_b_b]
movdqa xmm3, xmmword [0x180050490]
movdqa xmm4, xmmword [str.WWWW]
movdqa xmm5, xmmword [0x1800504b0]
movdqa xmm6, xmmword [0x1800504c0]
movdqa xmm7, xmmword [0x180050160]
movdqa xmm8, xmmword [str._n_n_n_n]
movdqa xmm9, xmmword [str.HHHH]
nop word cs:[rax + rax]
movd xmm10, dword [rdx + r9]
movdqa xmm12, xmm10
por xmm12, xmm0
movdqa xmm11, xmm10
pand xmm11, xmm0
movdqa xmm14, xmm12
pandn xmm14, xmm2
por xmm14, xmm5
movdqa xmm15, xmm10
pxor xmm15, xmm3
pand xmm15, xmm11
movdqa xmm13, xmm12
pand xmm13, xmm4
pxor xmm13, xmm14
movdqa xmm14, xmm10
pand xmm14, xmm3
pxor xmm14, xmm15
pxor xmm14, xmm6
pand xmm15, xmm3
por xmm15, xmm14
pandn xmm15, xmm13
pandn xmm13, xmm14
por xmm13, xmm15
movdqa xmm14, xmm12
pandn xmm14, xmm7
pand xmm12, xmm8
por xmm12, xmm14
pxor xmm11, xmm8
pxor xmm11, xmm12
pxor xmm10, xmm0
por xmm10, xmm11
pxor xmm10, xmm1
por xmm10, xmm13
movd xmm11, dword [rcx + r9]
pxor xmm10, xmm11
pxor xmm10, xmm9
movd dword [r9 + r8], xmm10
add r9, 4
cmp r9, 0x14
jne 0x180018920
mov r9d, 0x14
movzx r10d, byte [rdx + r9]
mov r11d, r10d
or r11b, 0xb7
mov edi, r11d
not dil
mov esi, r10d
and sil, 0xb7
mov ebp, edi
and bpl, 8
mov ebx, r10d
xor bl, 0xa1
and bl, sil
mov r14d, r11d
and r14b, 0x57
or bpl, 0xb6
xor bpl, r14b
mov r14d, r10d
and r14b, 0xa1
xor r14b, bl
xor r14b, 0xe1
or bl, r14b
xor bl, r14b
not bl
and bl, bpl
xor bl, r14b
and dil, 0x40
and r11b, 0xa
or r11b, dil
xor r11b, sil
xor r11b, 0xa
xor r10b, 0xb7
or r10b, r11b
not r10b
or r10b, bl
xor r10b, byte [rcx + r9]
xor r10b, 0x48
mov byte [r9 + r8], r10b
inc r9
cmp r9, 0x15
jne 0x1800189f0
mov byte [0x1800611f6], 1
mov qword [rax + 0x10], 0
lea rcx, [0x1800611e1]
mov qword [rax + 8], rcx
lea rcx, vtable.std::bad_array_new_length.0
mov qword [rax], rcx
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
movaps xmm11, xmmword [rsp + 0x50]
movaps xmm12, xmmword [rsp + 0x60]
movaps xmm13, xmmword [rsp + 0x70]
movaps xmm14, xmmword [rsp + 0x80]
movaps xmm15, xmmword [rsp + 0x90]
add rsp, 0xa0
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x18001e3b0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov rax, qword [0x180060b80]
xor rax, rsp
mov qword [rsp + 0x80], rax
cmp edx, 0xffffffff
je 0x18001e4dd
mov esi, edx
mov rdi, rcx
mov rax, qword [rcx + 0x40]
cmp qword [rax], 0
je 0x18001e40d
mov rax, qword [rdi + 0x58]
mov ecx, dword [rax]
test ecx, ecx
jle 0x18001e40d
dec ecx
mov dword [rax], ecx
mov rax, qword [rdi + 0x40]
mov rcx, qword [rax]
lea rdx, [rcx + 1]
mov qword [rax], rdx
mov byte [rcx], sil
jmp 0x18001e522
cmp qword [rdi + 0x80], 0
je 0x18001e4e1
mov rax, qword [rdi + 0x18]
lea rcx, [rdi + 0x70]
cmp qword [rax], rcx
jne 0x18001e447
mov ecx, dword [rdi + 0x90]
mov rdx, qword [rdi + 0x88]
mov qword [rax], rdx
mov rax, qword [rdi + 0x38]
mov qword [rax], rdx
sub ecx, edx
mov rax, qword [rdi + 0x50]
mov dword [rax], ecx
mov rcx, qword [rdi + 0x68]
test rcx, rcx
je 0x18001e4e8
mov byte [rsp + 0x5f], sil
lea rax, [rsp + 0x80]
lea r9, [rsp + 0x60]
lea rdx, [rdi + 0x74]
mov r10, qword [rcx]
lea r8, [rsp + 0x48]
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rax
lea r14, [rsp + 0x60]
mov qword [rsp + 0x28], r14
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea rbx, [rsp + 0x5f]
mov r8, rbx
call qword [r10 + 0x38]
mov ebp, 0xffffffff
cmp eax, 2
jae 0x18001e501
mov r15, qword [rsp + 0x48]
sub r15, r14
je 0x18001e4cd
mov r9, qword [rdi + 0x80]
mov edx, 1
mov rcx, r14
mov r8, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp r15, rax
jne 0x18001e520
mov byte [rdi + 0x71], 1
cmp qword [rsp + 0x50], rbx
mov eax, 0xffffffff
jmp 0x18001e51b
xor esi, esi
jmp 0x18001e522
mov esi, 0xffffffff
jmp 0x18001e522
mov rdx, qword [rdi + 0x80]
movsx ecx, sil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, 0xffffffff
cmove esi, eax
jmp 0x18001e522
cmp eax, 3
jne 0x18001e520
mov rdx, qword [rdi + 0x80]
movsx ecx, byte [rsp + 0x5f]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, 0xffffffff
cmove esi, eax
mov ebp, esi
mov esi, ebp
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.18004a580
mov eax, esi
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x18001e990
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
test r8, r8
jle 0x18001e9cb
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x68], 0
je 0x18001e9d2
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
xor esi, esi
jmp 0x18001eac9
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x18001ea25
mov rax, qword [rbx + 0x50]
movsxd r15, dword [rax]
test r15, r15
je 0x18001ea25
cmp r15, rsi
cmovae r15, rsi
mov rcx, rdi
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
add rdi, r15
mov r14, rsi
sub r14, r15
mov rax, qword [rbx + 0x50]
sub dword [rax], r15d
mov rax, qword [rbx + 0x38]
movsxd rcx, r15d
add qword [rax], rcx
cmp qword [rbx + 0x80], 0
jne 0x18001ea36
jmp 0x18001eac6
mov r14, rsi
cmp qword [rbx + 0x80], 0
je 0x18001eac6
mov rax, qword [rbx + 0x18]
lea rcx, [rbx + 0x70]
cmp qword [rax], rcx
jne 0x18001ea62
mov ecx, dword [rbx + 0x90]
mov rdx, qword [rbx + 0x88]
mov qword [rax], rdx
mov rax, qword [rbx + 0x38]
mov qword [rax], rdx
sub ecx, edx
mov rax, qword [rbx + 0x50]
mov dword [rax], ecx
mov r15, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
nop dword [rax]
cmp r14, 0x1000
jb 0x18001eaa1
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rdi
call r15
add rdi, rax
sub r14, rax
cmp rax, 0xfff
je 0x18001ea70
jmp 0x18001eac6
test r14, r14
je 0x18001eac3
mov r9, qword [rbx + 0x80]
mov edx, 1
mov rcx, rdi
mov r8, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub r14, rax
jmp 0x18001eac6
xor r14d, r14d
sub rsi, r14
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x18001eae0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x68], 0
je 0x18001eb16
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rbx + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x18001eb63
test rsi, rsi
jle 0x18001eb63
mov rax, qword [rbx + 0x58]
mov r15d, dword [rax]
test r15d, r15d
jle 0x18001eb63
cmp r15, rsi
cmovae r15, rsi
mov rdx, rdi
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
add rdi, r15
mov r14, rsi
sub r14, r15
mov rax, qword [rbx + 0x58]
sub dword [rax], r15d
mov rax, qword [rbx + 0x40]
add qword [rax], r15
test r14, r14
jg 0x18001eb6b
jmp 0x18001eb8b
mov r14, rsi
test r14, r14
jle 0x18001eb8b
mov r9, qword [rbx + 0x80]
test r9, r9
je 0x18001eb8b
mov edx, 1
mov rcx, rdi
mov r8, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub r14, rax
sub rsi, r14
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x18001ef80
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rax, qword [0x180060b80]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dil, 1
cmp qword [rcx + 0x68], 0
je 0x18001f02a
mov rsi, rcx
cmp byte [rcx + 0x71], 0
je 0x18001f02a
mov rax, qword [rsi]
mov rcx, rsi
mov edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x18001f028
mov rcx, qword [rsi + 0x68]
lea r9, [rsp + 0x50]
lea rdx, [rsi + 0x74]
mov rax, qword [rcx]
lea r8, [rsp + 0x28]
mov qword [rsp + 0x20], r8
lea rdi, [rsp + 0x30]
mov r8, rdi
call qword [rax + 0x40]
cmp eax, 3
je 0x18001f041
cmp eax, 1
je 0x18001eff7
test eax, eax
jne 0x18001f028
mov byte [rsi + 0x71], 0
mov rbx, qword [rsp + 0x28]
sub rbx, rdi
je 0x18001f01e
mov r9, qword [rsi + 0x80]
mov edx, 1
mov rcx, rdi
mov r8, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x18001f028
cmp byte [rsi + 0x71], 0
sete dil
jmp 0x18001f02a
xor edi, edi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18004a580
mov eax, edi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
mov byte [rsi + 0x71], 0
mov dil, 1
jmp 0x18001f02a

Function at 0x18001f250
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
mov rax, rcx
cmp byte [0x1800612c8], 0
jne 0x18001f35b
mov r8, qword [0x18005f890]
movabs rcx, 0x7941c5fe86336680
add rcx, r8
movabs rdx, 0x7941c5fe86336698
add rdx, r8
xor r8d, r8d
lea r9, [0x1800612bf]
nop word cs:[rax + rax]
movzx r10d, byte [rdx + r8]
mov ebp, r10d
not bpl
movzx r11d, byte [rcx + r8]
mov esi, ebp
and sil, 0x52
mov edi, r10d
and dil, 0xad
mov ebx, r11d
and bl, 0xad
and bpl, 0x12
mov r15d, r10d
and r15b, 0x40
or r15b, bpl
mov ebp, ebx
not bpl
mov r12d, ebp
and r12b, 0x6a
mov r14d, r11d
xor r14b, 0x28
and r14b, bl
or r14b, r12b
mov r12d, r11d
and r12b, 0x52
xor r14b, r12b
xor r12b, 0x52
or r15b, 0x29
or sil, dil
xor r15b, dil
xor r15b, 0x96
and r15b, sil
xor r10b, 0x52
or r10b, r15b
xor r14b, 0x38
or bl, r12b
and r12b, 0x12
mov esi, r11d
and sil, 0x40
or sil, r12b
and r11b, 4
and bpl, 0xe9
or bpl, r11b
or sil, 0xa9
xor sil, bpl
not sil
and sil, bl
or sil, r14b
xor sil, r10b
mov byte [r8 + r9], sil
inc r8
cmp r8, 9
jne 0x18001f2a0
mov byte [0x1800612c8], 1
mov qword [rax + 0x10], 0
lea rcx, [0x1800612bf]
mov qword [rax + 8], rcx
lea rcx, vtable.std::bad_cast.0
mov qword [rax], rcx
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x180021ba0
Capabilities:
Encode data using xor

Disassembly:
push rsi
mov eax, 0x84222325
sub r8, rdx
je 0x180021c3e
xor ecx, ecx
nop word cs:[rax + rax]
movzx r10d, byte [rdx + rcx]
mov r11d, r10d
not r11d
mov esi, r11d
and esi, 0xe3
mov r9d, r10d
and r9d, 0x1c
or r9d, esi
xor r9d, eax
xor r9d, 0x1c
or r9d, r11d
and r11d, 0x238e1fc3
and r10d, 0x3c
or r10d, r11d
xor r10d, 0xdc71e03c
and r10d, eax
mov eax, r10d
not eax
or eax, r9d
and r9d, 0x372583ff
xor r9d, r10d
mov r10d, eax
and r10d, 0xac30e1ff
xor r10d, r9d
or r9d, eax
not r9d
or r9d, r10d
xor r9d, 0x9b156200
imul eax, r9d, 0x1b3
inc rcx
cmp r8, rcx
jne 0x180021bc0
pop rsi
ret
Function at 0x18002c200
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
call fcn.18002e8b0
cmp eax, 0x2a
je 0x18002c24b
cmp eax, 0x2f
jne 0x18002c2b2
mov edi, 0x4803
nop dword [rax + rax]
mov rcx, rsi
call fcn.18002e8b0
inc eax
cmp eax, 0xf
jae 0x18002c230
bt edi, eax
jae 0x18002c230
mov al, 1
jmp 0x18002c4ae
lea rdi, [rsi + 0x28]
lea rbx, [rsi + 0x30]
jmp 0x18002c267
inc eax
cmp eax, 1
jbe 0x18002c2c7
mov rcx, rsi
call fcn.18002e8b0
cmp eax, 0x2a
jne 0x18002c260
mov rcx, rsi
call fcn.18002e8b0
cmp eax, 0x2f
je 0x18002c244
mov byte [rsi + 0x18], 1
dec qword [rsi + 0x20]
mov rax, qword [rsi + 0x28]
mov rcx, rdi
test rax, rax
jne 0x18002c2a0
mov rax, qword [rbx]
mov rcx, rbx
test rax, rax
je 0x18002c2a6
dec rax
mov qword [rcx], rax
cmp dword [rsi + 0x14], 0xffffffff
je 0x18002c267
dec qword [rsi + 0x40]
jmp 0x18002c267
cmp byte [0x1800614b8], 0
je 0x18002c2e0
lea r8, [0x18005fa80]
jmp 0x18002c49b
cmp byte [0x180061487], 0
je 0x18002c3fa
lea r8, [0x18005fa78]
jmp 0x18002c49b
mov rax, qword [0x18005fa70]
movabs r10, 0xb1604b86afa10b67
add r10, rax
movabs r11, 0xb1604b86afa10b52
add r11, rax
xor ecx, ecx
lea rbx, [0x180061488]
nop word [rax + rax]
mov rax, rcx
movabs rdx, 0x8618618618618619
mul rdx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
imul rax, rax, 0xffffffffffffffeb
add rax, r11
movzx r8d, byte [r10 + rcx]
movzx eax, byte [rcx + rax]
mov ebp, r8d
and bpl, 0xb
mov r15d, ebp
xor r15b, 0xb
mov edx, r8d
and dl, 0xf4
mov edi, edx
not dil
mov r14d, r8d
xor r14b, 0x64
and r14b, dl
mov r9d, ebp
xor r9b, 0x6e
mov r12d, r8d
and r12b, 4
mov r13d, edi
and r13b, 0x61
or r13b, r12b
or r13b, 0x90
xor r13b, r14b
xor r13b, 0x94
and r14b, 0x64
or r14b, r13b
xor bpl, 0x91
and bpl, r13b
not r14b
and r14b, r9b
and r8b, 0xb4
and dil, 0x40
or dil, r8b
lea r8d, [r15 + 0x40]
xor r8b, dil
or dl, r15b
not dl
or dl, r8b
not dl
or dl, bpl
or dl, r14b
mov r8d, edx
xor r8b, 0xa
mov r9d, eax
xor r9b, 1
xor dl, 0xf5
and dl, r9b
xor al, 0xfe
and al, r8b
or al, dl
mov byte [rcx + rbx], al
inc rcx
cmp rcx, 0x30
jne 0x18002c310
lea r8, [0x18005fa80]
lea r9, [0x1800614b8]
jmp 0x18002c497
mov rax, qword [0x18005fa70]
movabs r10, 0xb1604b86afa10b14
add r10, rax
movabs r11, 0xb1604b86afa10b02
add r11, rax
xor ecx, ecx
movabs rdi, 0xe38e38e38e38e38f
lea rbx, [0x180061461]
lea r8, [0x18005fa78]
lea r9, [0x180061487]
nop dword [rax]
mov rax, rcx
mul rdi
shr rdx, 3
and rdx, 0xfffffffffffffffe
lea rax, [rdx + rdx*8]
mov rdx, r11
sub rdx, rax
movzx eax, byte [r10 + rcx]
movzx edx, byte [rdx + rcx]
mov ebp, edx
xor bpl, 0xb2
xor dl, 0x4d
or dl, bpl
xor bpl, dl
not dl
or dl, bpl
mov ebp, eax
xor bpl, 0xb2
xor al, dl
xor al, 0x4d
and al, dl
or bpl, dl
not bpl
or bpl, al
mov byte [rcx + rbx], bpl
inc rcx
cmp rcx, 0x26
jne 0x18002c440
mov byte [r9], 1
movabs rax, 0xb1604b86afa0ed0b
add rax, qword [r8]
mov qword [rsi + 0x70], rax
xor eax, eax
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x18002c4c0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
movaps xmmword [rsp + 0x40], xmm8
movaps xmmword [rsp + 0x30], xmm7
movaps xmmword [rsp + 0x20], xmm6
mov edi, r9d
cmp r8, 2
jb 0x18002c6c2
mov rbx, r8
mov r14, rdx
mov rsi, rcx
mov r15d, 1
nop dword [rax + rax]
mov rcx, rsi
call fcn.18002e8b0
cmp byte [r14 + r15], al
jne 0x18002c51b
inc r15
cmp rbx, r15
jne 0x18002c500
jmp 0x18002c6c2
cmp byte [0x180061460], 0
jne 0x18002c6a8
mov rdx, qword [0x18005fa88]
movabs rax, 0x89366378803b8d1e
add rax, rdx
movabs rcx, 0x89366378803b8d2f
add rcx, rdx
movabs r8, 0x89366378803b8d3f
add r8, rdx
lea rdx, [0x180061450]
cmp r8, rdx
jbe 0x18002c5f9
lea r8, [0x180061460]
cmp rax, r8
jae 0x18002c5f9
xor r8d, r8d
nop dword [rax]
movzx ebx, byte [rcx + r8]
mov r9d, ebx
and r9b, 0x85
mov r11d, r9d
xor r11b, 0x85
mov r10d, ebx
and r10b, 0xdf
xor r10b, 0x5a
and bl, 0xa5
xor bl, 0x85
or bl, r10b
mov edi, ebx
xor dil, 0xdf
mov ebp, ebx
xor bpl, 0x20
xor bl, 0x44
or bpl, dil
and bpl, bl
xor bpl, r9b
xor bpl, 0x1e
mov ebx, edi
and bl, 0xf5
and r10b, 0xa
or r10b, bl
or dil, r11b
or r9b, 0x70
xor r9b, r10b
and r9b, dil
or r9b, bpl
xor r9b, byte [rax + r8]
xor r9b, 0x85
mov byte [r8 + rdx], r9b
inc r8
cmp r8, 0x10
jne 0x18002c580
jmp 0x18002c6a1
movups xmm7, xmmword [rcx]
movups xmm0, xmmword [rax]
movaps xmm2, xmmword [0x180050500]
movaps xmm1, xmm7
andps xmm1, xmm2
movaps xmm3, xmmword [0x180050510]
movaps xmm4, xmm7
andps xmm4, xmm3
xorps xmm4, xmmword [str.ZZZZZZZZZZZZZZZZ]
andps xmm7, xmmword [0x180050530]
movaps xmm6, xmm1
xorps xmm7, xmm2
orps xmm7, xmm4
xorps xmm3, xmm7
movaps xmm5, xmmword [str.________________DDDDDDDDDDDDDDDD]
xorps xmm5, xmm7
xorps xmm7, xmmword [0x180050550]
xorps xmm6, xmm2
movaps xmm8, xmmword [0x180050560]
xorps xmm8, xmm1
orps xmm5, xmm3
andps xmm5, xmm7
movaps xmm7, xmmword [0x180050570]
xorps xmm7, xmm1
andps xmm7, xmm5
andnps xmm5, xmm8
orps xmm5, xmm7
movaps xmm7, xmmword [0x180050300]
andps xmm7, xmm3
andps xmm4, xmmword [str._n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_npppppppppppppppp]
orps xmm4, xmm7
orps xmm3, xmm6
orps xmm1, xmmword [0x180050590]
xorps xmm1, xmm4
andps xmm1, xmm3
orps xmm1, xmm5
xorps xmm0, xmm2
xorps xmm0, xmm1
movaps xmmword [0x180061450], xmm0
mov byte [0x180061460], 1
movabs rax, 0x89366378803b6f5c
add rax, qword [0x18005fa90]
mov qword [rsi + 0x70], rax
mov edi, 0xe
mov eax, edi
movaps xmm6, xmmword [rsp + 0x20]
movaps xmm7, xmmword [rsp + 0x30]
movaps xmm8, xmmword [rsp + 0x40]
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x180033090
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp], 0xfffffffffffffffe
mov r12, rdx
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], 0
mov qword [rdx + 0x18], 0xf
mov rbx, qword [rcx + 0x38]
mov r14, qword [rcx + 0x40]
cmp rbx, r14
je 0x180033282
lea rsi, [0x18006235f]
lea rdi, [rbp - 0x18]
mov qword [rbp - 8], r12
jmp 0x180033109
mov byte [rdx + rax], r9b
mov byte [rdx + rax + 1], 0
inc rbx
cmp rbx, r14
mov r12, qword [rbp - 8]
je 0x180033282
movzx r9d, byte [rbx]
cmp r9d, 0x1f
ja 0x180033210
mov byte [rbp - 0x10], 0
mov qword [rbp - 0x18], 0
cmp byte [0x180062368], 0
jne 0x1800331c8
mov rax, qword [0x18005fcd8]
movabs rcx, 0x1c437998c41ca74b
add rcx, rax
movabs rdx, 0x1c437998c41ca76a
add rax, rdx
xor edx, edx
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
movzx r10d, byte [rcx + rdx]
mov r11d, r10d
not r11b
or r11b, r8b
not r8b
mov r15d, r8d
xor r15b, r10b
or r8b, r10b
mov r10d, r8d
mov r13d, r11d
mov r12d, r8d
xor r8b, r11b
and r15b, r11b
xor r11b, 0x11
xor r10b, 0x11
xor r13b, 0xee
and r13b, r10b
xor r12b, 0xee
and r12b, r11b
or r12b, r13b
or r15b, r8b
not r15b
or r15b, r12b
mov byte [rdx + rsi], r15b
inc rdx
cmp rdx, 9
jne 0x180033160
mov byte [0x180062368], 1
mov r12, qword [rbp - 8]
mov edx, 9
mov rcx, rdi
mov r8, rsi
call fcn.18003e690
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rcx, qword [r12 + 0x10]
mov rdx, qword [r12 + 0x18]
mov r8, rdx
sub r8, rcx
cmp r8, rax
jae 0x180033240
mov qword [rsp + 0x20], rax
mov rcx, r12
mov rdx, rax
mov r9, rdi
call fcn.18001d380
jmp 0x1800330f9
mov rax, qword [r12 + 0x10]
mov rcx, qword [r12 + 0x18]
cmp rax, rcx
jae 0x180033270
lea rdx, [rax + 1]
mov qword [r12 + 0x10], rdx
mov rdx, r12
cmp rcx, 0x10
jb 0x1800330f0
mov rdx, qword [r12]
jmp 0x1800330f0
mov r13, rax
add r13, rcx
mov qword [r12 + 0x10], r13
mov r15, r12
cmp rdx, 0x10
jb 0x180033258
mov r15, qword [r12]
add rcx, r15
mov rdx, rdi
mov r8, rax
call sub.VCRUNTIME140.dll_memmove
mov byte [r15 + r13], 0
jmp 0x1800330f9
mov edx, 1
mov rcx, r12
call fcn.18001dc90
jmp 0x1800330f9
mov rax, r12
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x180036100
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0xb0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x28], 0xfffffffffffffffe
mov rdi, rcx
mov rax, qword [rcx + 0x10]
sub rax, qword [rcx + 8]
shr rax, 3
mov byte [rbp - 0x28], 0
mov dword [rbp - 8], eax
mov rcx, qword [rcx + 0xa8]
test rcx, rcx
je 0x18003635d
mov rsi, rdx
lea r9, [rdi + 0xb8]
mov rax, qword [rcx]
lea rdx, [rbp - 8]
lea r8, [rbp - 0x28]
call qword [rax + 0x10]
mov rdx, qword [rdi + 0x38]
mov rcx, rdx
shr rcx, 5
movabs r14, 0x3800000000000000
lea r8, [rcx + r14]
test rdx, rdx
cmovns r8, rcx
mov ebx, eax
shl r8, 2
add r8, qword [rdi + 0x20]
lea rcx, [rdi + 0x20]
and edx, 0x1f
mov qword [rbp + 0x18], r8
mov qword [rbp + 0x20], rdx
lea rdx, [rbp + 0x18]
mov r8d, 1
call fcn.180026670
mov rcx, rax
shr rcx, 5
or r14, rcx
test rax, rax
cmovns r14, rcx
shl r14, 2
add r14, qword [rdi + 0x20]
and eax, 0x1f
lea rcx, [rax + 1]
mov edx, ecx
shr edx, 5
lea rdx, [r14 + rdx*4]
and ecx, 0x1f
mov qword [rbp - 8], rdx
mov qword [rbp], rcx
mov qword [rbp - 0x28], r14
mov qword [rbp - 0x20], rax
lea rcx, [rbp - 0x28]
lea rdx, [rbp - 8]
mov r8d, ebx
call fcn.180026bf0
mov byte [rbp - 8], 1
lea rdx, [rbp + 0x18]
lea r8, [rbp - 8]
mov rcx, rdi
mov r9b, 1
call fcn.180037400
mov rdx, qword [rdi + 0x10]
cmp rdx, qword [rdi + 0x18]
je 0x18003622b
mov rax, qword [rbp + 0x20]
mov qword [rdx], rax
mov rax, qword [rdi + 0x10]
add rax, 8
mov qword [rdi + 0x10], rax
cmp rsi, 0xffffffffffffffff
jne 0x180036242
jmp 0x18003626a
lea rcx, [rdi + 8]
lea r8, [rbp + 0x20]
call fcn.180037d20
mov rax, qword [rdi + 0x10]
cmp rsi, 0xffffffffffffffff
je 0x18003626a
mov rdi, qword [rax - 8]
test rdi, rdi
je 0x18003626a
movsx rax, byte [rdi]
mov ecx, 1
cmp rax, 2
ja 0x180036265
lea rcx, [0x18004feb8]
mov rcx, qword [rcx + rax*8]
cmp rcx, rsi
jb 0x18003627a
mov al, 1
add rsp, 0xb0
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
lea rcx, [rbp - 0x28]
mov rdx, rsi
call fcn.180037ed0
cmp byte [0x1800620eb], 0
jne 0x180036314
mov rax, qword [0x18005fd50]
movabs r8, 0xe3e6a7134ae26690
add r8, rax
movabs r9, 0xe3e6a7134ae2667c
add r9, rax
xor ecx, ecx
movabs r10, 0xcccccccccccccccd
lea r11, [0x1800620d3]
nop word [rax + rax]
mov rax, rcx
mul r10
shr rdx, 2
and rdx, 0xfffffffffffffffc
lea rax, [rdx + rdx*4]
mov rdx, r9
sub rdx, rax
movzx eax, byte [rdx + rcx]
xor al, byte [r8 + rcx]
mov byte [rcx + r11], al
movzx eax, byte [rdx + rcx + 1]
xor al, byte [r8 + rcx + 1]
mov byte [rcx + r11 + 1], al
add rcx, 2
cmp rcx, 0x18
jne 0x1800362d0
mov byte [0x1800620eb], 1
movabs rsi, 0xe3e6a7134ae232e1
mov rdx, qword [0x18005fd58]
add rdx, rsi
lea rcx, [rbp - 8]
lea r8, [rbp - 0x28]
call fcn.180037b40
lea rcx, [rbp - 0x60]
lea r8, [rbp - 8]
mov edx, 0x198
mov r9, rdi
call fcn.180037700
add rsi, qword [0x18005fd60]
lea rcx, [rbp - 0x60]
mov rdx, rsi
call sub.VCRUNTIME140.dll__CxxThrowException
call sub.MSVCP140.dll_void___cdecl_std::_Xbad_function_call_void_
int3