joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18002daa0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
sub rsp, 0xb8
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
movaps xmmword [rax - 0x38], xmm8
mov rax, qword [0x180211b48]
test rax, rax
jne 0x18002dd1b
movups xmm0, xmmword [0x1800ed310]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [0x1800ed320]
movups xmmword [rsp + 0x60], xmm1
mov eax, dword [0x1800ed330]
mov dword [rsp + 0x70], eax
xor ecx, ecx
cmp dword [0x180112028], 2
jl 0x18002dc4c
movdqa xmm5, xmmword [0x1800feda0]
movdqa xmm4, xmmword [0x1800ff280]
mov eax, 5
movd xmm6, eax
movdqa xmm7, xmmword [0x1800fee40]
mov eax, 0x1f
movd xmm8, eax
movdqa xmm0, xmmword [0x1800fef30]
movdqa xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x54]
mov r8d, dword [rsp + 0x20]
nop dword [rax + rax]
movd xmm2, ecx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x1800fef10]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 4]
pxor xmm2, xmm0
movd dword [rdx - 4], xmm2
lea eax, [rcx + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x1800fef10]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx]
pxor xmm2, xmm0
movd dword [rdx], xmm2
add ecx, 8
lea rdx, [rdx + 8]
cmp ecx, 0x20
jl 0x18002db40
cmp ecx, 0x24
jge 0x18002dc8e
movsxd rax, ecx
lea r8, [rsp + 0x50]
add r8, rax
nop word [rax + rax]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x38
movzx eax, cl
sub al, dl
add al, 0x34
xor byte [r8], al
inc ecx
lea r8, [r8 + 1]
cmp ecx, 0x24
jl 0x18002dc60
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
lea rax, [rsp + 0x50]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x18002dcb0
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.180013d70
nop
lea rcx, [rsp + 0x30]
call fcn.18002f0b0
mov qword [0x180211b48], rax
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x18002dd1b
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002dd0f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002dd36
call fcn.1800b7ba8
mov rax, qword [0x180211b48]
lea r11, [rsp + 0xb8]
movaps xmm6, xmmword [r11 - 0x18]
movaps xmm7, xmmword [r11 - 0x28]
movaps xmm8, xmmword [r11 - 0x38]
mov rsp, r11
ret
call fcn.1800be590
int3
Function at 0x18002dd40
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
sub rsp, 0xb8
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
movaps xmmword [rax - 0x38], xmm8
mov rax, qword [0x180211ac8]
test rax, rax
jne 0x18002dfcb
movups xmm0, xmmword [0x1800ed3e0]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [0x1800ed3f0]
movups xmmword [rsp + 0x60], xmm1
movzx eax, word [0x1800ed400]
mov word [rsp + 0x70], ax
movzx eax, byte [0x1800ed402]
mov byte [rsp + 0x72], al
xor ecx, ecx
cmp dword [0x180112028], 2
jl 0x18002defc
movdqa xmm5, xmmword [0x1800feda0]
movdqa xmm4, xmmword [0x1800ff280]
mov eax, 5
movd xmm6, eax
movdqa xmm7, xmmword [0x1800fee40]
mov eax, 0x1f
movd xmm8, eax
movdqa xmm0, xmmword [0x1800fef30]
movdqa xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x54]
mov r8d, dword [rsp + 0x20]
nop dword [rax + rax]
movd xmm2, ecx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x1800fef10]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 4]
pxor xmm2, xmm0
movd dword [rdx - 4], xmm2
lea eax, [rcx + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x1800fef10]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx]
pxor xmm2, xmm0
movd dword [rdx], xmm2
add ecx, 8
lea rdx, [rdx + 8]
cmp ecx, 0x20
jl 0x18002ddf0
cmp ecx, 0x23
jge 0x18002df3e
movsxd rax, ecx
lea r8, [rsp + 0x50]
add r8, rax
nop word [rax + rax]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x38
movzx eax, cl
sub al, dl
add al, 0x34
xor byte [r8], al
inc ecx
lea r8, [r8 + 1]
cmp ecx, 0x23
jl 0x18002df10
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
lea rax, [rsp + 0x50]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x18002df60
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.180013d70
nop
lea rcx, [rsp + 0x30]
call fcn.18002f0b0
mov qword [0x180211ac8], rax
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x18002dfcb
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002dfbf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002dfe6
call fcn.1800b7ba8
mov rax, qword [0x180211ac8]
lea r11, [rsp + 0xb8]
movaps xmm6, xmmword [r11 - 0x18]
movaps xmm7, xmmword [r11 - 0x28]
movaps xmm8, xmmword [r11 - 0x38]
mov rsp, r11
ret
call fcn.1800be590
int3
Function at 0x18002dff0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
sub rsp, 0xb8
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
movaps xmmword [rax - 0x38], xmm8
mov rax, qword [0x180211b50]
test rax, rax
jne 0x18002e27b
movups xmm0, xmmword [str.wYWDK]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [0x1800ed4c0]
movups xmmword [rsp + 0x60], xmm1
mov eax, dword [0x1800ed4d0]
mov dword [rsp + 0x70], eax
movzx eax, word [0x1800ed4d4]
mov word [rsp + 0x74], ax
movzx eax, byte [0x1800ed4d6]
mov byte [rsp + 0x76], al
xor ecx, ecx
cmp dword [0x180112028], 2
jl 0x18002e1ae
movdqa xmm5, xmmword [0x1800feda0]
movdqa xmm4, xmmword [0x1800ff280]
mov eax, 5
movd xmm6, eax
movdqa xmm7, xmmword [0x1800fee40]
mov eax, 0x1f
movd xmm8, eax
movdqa xmm0, xmmword [0x1800fef30]
movdqa xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x54]
mov r8d, dword [rsp + 0x20]
movd xmm2, ecx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x1800fef10]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 4]
pxor xmm2, xmm0
movd dword [rdx - 4], xmm2
lea eax, [rcx + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x1800fef10]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx]
pxor xmm2, xmm0
movd dword [rdx], xmm2
add ecx, 8
lea rdx, [rdx + 8]
cmp ecx, 0x20
jl 0x18002e0a2
cmp ecx, 0x27
jge 0x18002e1ee
movsxd rax, ecx
lea r8, [rsp + 0x50]
add r8, rax
nop dword [rax]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x38
movzx eax, cl
sub al, dl
add al, 0x34
xor byte [r8], al
inc ecx
lea r8, [r8 + 1]
cmp ecx, 0x27
jl 0x18002e1c0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
lea rax, [rsp + 0x50]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x18002e210
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.180013d70
nop
lea rcx, [rsp + 0x30]
call fcn.18002f0b0
mov qword [0x180211b50], rax
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x18002e27b
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002e26f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002e296
call fcn.1800b7ba8
mov rax, qword [0x180211b50]
lea r11, [rsp + 0xb8]
movaps xmm6, xmmword [r11 - 0x18]
movaps xmm7, xmmword [r11 - 0x28]
movaps xmm8, xmmword [r11 - 0x38]
mov rsp, r11
ret
call fcn.1800be590
int3
Function at 0x18002e390
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
sub rsp, 0xa8
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
movaps xmmword [rax - 0x38], xmm8
mov rax, qword [0x180211ad0]
test rax, rax
jne 0x18002e60b
movups xmm0, xmmword [0x1800ed368]
movups xmmword [rsp + 0x30], xmm0
mov eax, dword [0x1800ed378]
mov dword [rsp + 0x40], eax
movzx eax, byte [0x1800ed37c]
mov byte [rsp + 0x44], al
xor ecx, ecx
cmp dword [0x180112028], 2
jl 0x18002e53c
movdqa xmm5, xmmword [0x1800feda0]
movdqa xmm4, xmmword [0x1800ff280]
mov eax, 5
movd xmm6, eax
movdqa xmm7, xmmword [0x1800fee40]
mov eax, 0x1f
movd xmm8, eax
movdqa xmm0, xmmword [0x1800fef30]
movdqa xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x34]
mov r8d, dword [rsp + 0x20]
nop word [rax + rax]
movd xmm2, ecx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x1800fef10]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 4]
pxor xmm2, xmm0
movd dword [rdx - 4], xmm2
lea eax, [rcx + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x1800fef10]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx]
pxor xmm2, xmm0
movd dword [rdx], xmm2
add ecx, 8
lea rdx, [rdx + 8]
cmp ecx, 0x10
jl 0x18002e430
cmp ecx, 0x15
jge 0x18002e57e
movsxd rax, ecx
lea r8, [rsp + 0x30]
add r8, rax
nop word [rax + rax]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x38
movzx eax, cl
sub al, dl
add al, 0x34
xor byte [r8], al
inc ecx
lea r8, [r8 + 1]
cmp ecx, 0x15
jl 0x18002e550
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x58], xmm1
lea rax, [rsp + 0x30]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x18002e5a0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x48]
call fcn.180013d70
nop
lea rcx, [rsp + 0x48]
call fcn.18002c660
mov qword [0x180211ad0], rax
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x18002e60b
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002e5ff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002e629
call fcn.1800b7ba8
mov rax, qword [0x180211ad0]
movaps xmm6, xmmword [rsp + 0x90]
movaps xmm7, xmmword [rsp + 0x80]
movaps xmm8, xmmword [rsp + 0x70]
add rsp, 0xa8
ret
call fcn.1800be590
int3
Function at 0x18002e630
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
sub rsp, 0xa8
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
movaps xmmword [rax - 0x38], xmm8
mov rax, qword [0x180211ae0]
test rax, rax
jne 0x18002e8ab
movups xmm0, xmmword [0x1800ed408]
movups xmmword [rsp + 0x30], xmm0
mov eax, dword [0x1800ed418]
mov dword [rsp + 0x40], eax
movzx eax, byte [0x1800ed41c]
mov byte [rsp + 0x44], al
xor ecx, ecx
cmp dword [0x180112028], 2
jl 0x18002e7dc
movdqa xmm5, xmmword [0x1800feda0]
movdqa xmm4, xmmword [0x1800ff280]
mov eax, 5
movd xmm6, eax
movdqa xmm7, xmmword [0x1800fee40]
mov eax, 0x1f
movd xmm8, eax
movdqa xmm0, xmmword [0x1800fef30]
movdqa xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x34]
mov r8d, dword [rsp + 0x20]
nop word [rax + rax]
movd xmm2, ecx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x1800fef10]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 4]
pxor xmm2, xmm0
movd dword [rdx - 4], xmm2
lea eax, [rcx + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x1800fef10]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx]
pxor xmm2, xmm0
movd dword [rdx], xmm2
add ecx, 8
lea rdx, [rdx + 8]
cmp ecx, 0x10
jl 0x18002e6d0
cmp ecx, 0x15
jge 0x18002e81e
movsxd rax, ecx
lea r8, [rsp + 0x30]
add r8, rax
nop word [rax + rax]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x38
movzx eax, cl
sub al, dl
add al, 0x34
xor byte [r8], al
inc ecx
lea r8, [r8 + 1]
cmp ecx, 0x15
jl 0x18002e7f0
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x58], xmm1
lea rax, [rsp + 0x30]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x18002e840
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x48]
call fcn.180013d70
nop
lea rcx, [rsp + 0x48]
call fcn.18002c660
mov qword [0x180211ae0], rax
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x18002e8ab
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002e89f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002e8c9
call fcn.1800b7ba8
mov rax, qword [0x180211ae0]
movaps xmm6, xmmword [rsp + 0x90]
movaps xmm7, xmmword [rsp + 0x80]
movaps xmm8, xmmword [rsp + 0x70]
add rsp, 0xa8
ret
call fcn.1800be590
int3
Function at 0x18002e8d0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x98
movaps xmmword [rsp + 0x80], xmm6
movaps xmmword [rsp + 0x70], xmm7
movaps xmmword [rsp + 0x60], xmm8
mov rax, qword [0x180211b20]
test rax, rax
jne 0x18002eb3b
movups xmm0, xmmword [str.rZDCtVYZPmR9_0Cv___PTlQ_F_3]
movups xmmword [rsp + 0x20], xmm0
psrldq xmm0, 0xf
movd eax, xmm0
test al, al
je 0x18002eaae
xor ecx, ecx
cmp dword [0x180112028], 2
jl 0x18002ea79
movdqa xmm5, xmmword [0x1800feda0]
movdqa xmm4, xmmword [0x1800ff280]
mov eax, 5
movd xmm6, eax
movdqa xmm7, xmmword [0x1800fee40]
mov eax, 0x1f
movd xmm8, eax
movdqa xmm0, xmmword [0x1800fef30]
movdqa xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x24]
mov r8d, dword [rsp + 0x30]
nop dword [rax]
movd xmm2, ecx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x1800fef10]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 4]
pxor xmm2, xmm0
movd dword [rdx - 4], xmm2
lea eax, [rcx + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x1800fef10]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx]
pxor xmm2, xmm0
movd dword [rdx], xmm2
add ecx, 8
lea rdx, [rdx + 8]
cmp ecx, 0x10
jl 0x18002e970
jmp 0x18002eaae
lea r8, [rsp + 0x20]
nop
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x38
movzx eax, cl
sub al, dl
add al, 0x34
xor byte [r8], al
inc ecx
lea r8, [r8 + 1]
cmp ecx, 0x10
jl 0x18002ea80
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
lea rax, [rsp + 0x20]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x18002ead0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.180013d70
nop
lea rcx, [rsp + 0x40]
call fcn.18002c660
mov qword [0x180211b20], rax
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x18002eb3b
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002eb2f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002eb56
call fcn.1800b7ba8
mov rax, qword [0x180211b20]
movaps xmm6, xmmword [rsp + 0x80]
movaps xmm7, xmmword [rsp + 0x70]
movaps xmm8, xmmword [rsp + 0x60]
add rsp, 0x98
ret
call fcn.1800be590
int3
Function at 0x18002ee20
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
sub rsp, 0xa8
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
movaps xmmword [rax - 0x38], xmm8
mov rax, qword [0x180211b40]
test rax, rax
jne 0x18002f08b
movups xmm0, xmmword [str.v___PTkX_T]
movups xmmword [rsp + 0x30], xmm0
movzx eax, byte [0x1800ed2f8]
mov byte [rsp + 0x40], al
xor ecx, ecx
cmp dword [0x180112028], 2
jl 0x18002efbc
movdqa xmm5, xmmword [0x1800feda0]
movdqa xmm4, xmmword [0x1800ff280]
mov eax, 5
movd xmm6, eax
movdqa xmm7, xmmword [0x1800fee40]
mov eax, 0x1f
movd xmm8, eax
movdqa xmm0, xmmword [0x1800fef30]
movdqa xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x34]
mov r8d, dword [rsp + 0x20]
movd xmm2, ecx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x1800fef10]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 4]
pxor xmm2, xmm0
movd dword [rdx - 4], xmm2
lea eax, [rcx + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x1800fef10]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx]
pxor xmm2, xmm0
movd dword [rdx], xmm2
add ecx, 8
lea rdx, [rdx + 8]
cmp ecx, 0x10
jl 0x18002eeb0
cmp ecx, 0x11
jge 0x18002effe
movsxd rax, ecx
lea r8, [rsp + 0x30]
add r8, rax
nop word [rax + rax]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x38
movzx eax, cl
sub al, dl
add al, 0x34
xor byte [r8], al
inc ecx
lea r8, [r8 + 1]
cmp ecx, 0x11
jl 0x18002efd0
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x58], xmm1
lea rax, [rsp + 0x30]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x18002f020
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x48]
call fcn.180013d70
nop
lea rcx, [rsp + 0x48]
call fcn.18002c660
mov qword [0x180211b40], rax
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x18002f08b
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002f07f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002f0a9
call fcn.1800b7ba8
mov rax, qword [0x180211b40]
movaps xmm6, xmmword [rsp + 0x90]
movaps xmm7, xmmword [rsp + 0x80]
movaps xmm8, xmmword [rsp + 0x70]
add rsp, 0xa8
ret
call fcn.1800be590
int3
Function at 0x1800330c0
Capabilities:
Access peb ldr_data
Encode data using xor
Encrypt data using rc4 prga
Get process filename
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x180112020]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rax, qword gs:[0x60]
mov rbp, rcx
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov r11, rsi
nop dword [rax]
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x180033174
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x180033174
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r8d
mov edx, 0x15ade0b6
lea rax, [rdi + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x18003316f
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x180033150
cmp edx, 0xbec43653
je 0x1800331c1
test r8d, r8d
jne 0x180033130
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x18003318a
cmp qword [rax + 0x30], 0
jne 0x180033100
xor eax, eax
mov r8d, 0x30
lea rdx, [rsp + 0x20]
mov rcx, rbp
call rax
test rax, rax
je 0x1800331da
mov ecx, dword [rsp + 0x44]
test cl, 0xee
sete al
test ecx, 0x101
movzx ecx, al
mov eax, 1
cmovne ecx, eax
movzx eax, cl
jmp 0x1800331dc
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x18003318c
mov al, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1800b7800
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret