joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800094d0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov rax, qword [0x18005ffd0]
test rax, rax
jne 0x18000969d
mov eax, dword [0x180050100]
xor ecx, ecx
cmp dword [0x18005a0d0], 2
movsd xmm0, qword [0x1800500f8]
mov dword [rsp + 0x38], eax
movzx eax, byte [0x180050104]
mov qword [rsp + 0x50], rbx
mov byte [rsp + 0x3c], al
mov qword [rsp + 0x40], rdi
movsd qword [rsp + 0x30], xmm0
jl 0x18000961b
movdqa xmm2, xmmword [0x180051840]
mov ecx, 8
movdqa xmm4, xmmword [0x180051a80]
movdqa xmm1, xmm2
movdqa xmm3, xmmword [0x180051850]
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x180051880]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [0x1800500f8]
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x1800518d0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1800518f0]
xorps xmm2, xmm0
punpckldq xmm1, xmm3
movd dword [rsp + 0x30], xmm2
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x180051880]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [rsp + 0x34]
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1800518d0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1800518f0]
xorps xmm2, xmm0
movd dword [rsp + 0x34], xmm2
movsxd rax, ecx
lea r8, [rsp + 0x30]
add r8, rax
nop word [rax + rax]
mov eax, 0x4bda12f7
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x36
movzx eax, cl
inc ecx
sub al, dl
add al, 0x34
xor byte [r8 - 1], al
cmp ecx, 0xd
jl 0x180009630
lea rcx, [rsp + 0x30]
call fcn.1800137d0
mov rcx, qword [0x18005f918]
mov r9, rax
mov rdi, rax
call fcn.18000ef00
mov edx, 2
mov rcx, rdi
mov rbx, rax
call fcn.18004c45c
mov rdi, qword [rsp + 0x40]
mov rax, rbx
mov qword [0x18005ffd0], rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x48
ret
Function at 0x1800096b0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x78
mov rax, qword [0x1800600d8]
test rax, rax
jne 0x1800098c0
movups xmm0, xmmword [0x18004fe48]
movzx eax, byte [0x18004fe58]
xor ecx, ecx
cmp dword [0x18005a0d0], 2
mov qword [rsp + 0x80], rbx
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x70], rdi
mov byte [rsp + 0x50], al
jl 0x180009839
movdqa xmm0, xmmword [0x1800518f0]
lea rdx, [rsp + 0x44]
movdqa xmm5, xmmword [0x180051840]
movdqa xmm4, xmmword [0x180051a80]
movdqa xmmword [rsp + 0x30], xmm0
mov r8d, dword [rsp + 0x30]
movaps xmmword [rsp + 0x60], xmm6
movdqa xmm6, xmmword [0x180051880]
nop dword [rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x1800518d0]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1800518d0]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x10
jl 0x180009730
movaps xmm6, xmmword [rsp + 0x60]
cmp ecx, 0x11
jge 0x18000987d
movsxd rax, ecx
lea r8, [rsp + 0x40]
add r8, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x4bda12f7
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x36
movzx eax, cl
inc ecx
sub al, dl
add al, 0x34
xor byte [r8 - 1], al
cmp ecx, 0x11
jl 0x180009850
lea rcx, [rsp + 0x40]
call fcn.1800137d0
mov rcx, qword [0x18005f918]
mov r9, rax
mov rdi, rax
call fcn.18000ef00
mov edx, 2
mov rcx, rdi
mov rbx, rax
call fcn.18004c45c
mov rdi, qword [rsp + 0x70]
mov rax, rbx
mov qword [0x1800600d8], rbx
mov rbx, qword [rsp + 0x80]
add rsp, 0x78
ret
Function at 0x18000a1c0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x78
mov rax, qword [0x18005ffc8]
test rax, rax
jne 0x18000a3d0
movups xmm0, xmmword [0x18004fea8]
movzx eax, byte [0x18004feb8]
xor ecx, ecx
cmp dword [0x18005a0d0], 2
mov qword [rsp + 0x80], rbx
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x70], rdi
mov byte [rsp + 0x50], al
jl 0x18000a349
movdqa xmm0, xmmword [0x1800518f0]
lea rdx, [rsp + 0x44]
movdqa xmm5, xmmword [0x180051840]
movdqa xmm4, xmmword [0x180051a80]
movdqa xmmword [rsp + 0x30], xmm0
mov r8d, dword [rsp + 0x30]
movaps xmmword [rsp + 0x60], xmm6
movdqa xmm6, xmmword [0x180051880]
nop dword [rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x1800518d0]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1800518d0]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x10
jl 0x18000a240
movaps xmm6, xmmword [rsp + 0x60]
cmp ecx, 0x11
jge 0x18000a38d
movsxd rax, ecx
lea r8, [rsp + 0x40]
add r8, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x4bda12f7
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x36
movzx eax, cl
inc ecx
sub al, dl
add al, 0x34
xor byte [r8 - 1], al
cmp ecx, 0x11
jl 0x18000a360
lea rcx, [rsp + 0x40]
call fcn.1800137d0
mov rcx, qword [0x18005f918]
mov r9, rax
mov rdi, rax
call fcn.18000ef00
mov edx, 2
mov rcx, rdi
mov rbx, rax
call fcn.18004c45c
mov rdi, qword [rsp + 0x70]
mov rax, rbx
mov qword [0x18005ffc8], rbx
mov rbx, qword [rsp + 0x80]
add rsp, 0x78
ret
Function at 0x18000a3e0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x78
mov rax, qword [0x180060000]
test rax, rax
jne 0x18000a610
cmp byte [0x18004fffb], 0
movups xmm0, xmmword [0x18004ffe0]
mov eax, dword [0x18004fff8]
mov qword [rsp + 0x80], rbx
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x70], rdi
movsd xmm0, qword [0x18004fff0]
movsd qword [rsp + 0x50], xmm0
mov dword [rsp + 0x58], eax
je 0x18000a5cd
xor ecx, ecx
cmp dword [0x18005a0d0], 2
jl 0x18000a589
movdqa xmm0, xmmword [0x1800518f0]
lea rdx, [rsp + 0x44]
movdqa xmm5, xmmword [0x180051840]
movdqa xmm4, xmmword [0x180051a80]
movdqa xmmword [rsp + 0x30], xmm0
mov r8d, dword [rsp + 0x30]
movaps xmmword [rsp + 0x60], xmm6
movdqa xmm6, xmmword [0x180051880]
nop word [rax + rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x1800518d0]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1800518d0]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x18
jl 0x18000a480
movaps xmm6, xmmword [rsp + 0x60]
cmp ecx, 0x1c
jge 0x18000a5cd
movsxd rax, ecx
lea r8, [rsp + 0x40]
add r8, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x4bda12f7
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x36
movzx eax, cl
inc ecx
sub al, dl
add al, 0x34
xor byte [r8 - 1], al
cmp ecx, 0x1c
jl 0x18000a5a0
lea rcx, [rsp + 0x40]
call fcn.1800137d0
mov rcx, qword [0x18005f918]
mov r9, rax
mov rdi, rax
call fcn.18000ef00
mov edx, 2
mov rcx, rdi
mov rbx, rax
call fcn.18004c45c
mov rdi, qword [rsp + 0x70]
mov rax, rbx
mov qword [0x180060000], rbx
mov rbx, qword [rsp + 0x80]
add rsp, 0x78
ret
Function at 0x18000aa50
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
sub rsp, 0x88
mov rax, qword [0x18005ffe8]
test rax, rax
jne 0x18000ac73
movups xmm0, xmmword [str.X_BVuYVX_K]
mov eax, dword [0x18004ff00]
xor ecx, ecx
cmp dword [0x18005a0d0], 2
movups xmm1, xmmword [0x18004fef0]
mov qword [r11 + 8], rbx
movups xmmword [rsp + 0x40], xmm0
mov qword [r11 - 8], rdi
movups xmmword [rsp + 0x50], xmm1
mov dword [rsp + 0x60], eax
jl 0x18000abe9
movdqa xmm0, xmmword [0x1800518f0]
lea rdx, [r11 - 0x44]
movdqa xmm5, xmmword [0x180051840]
movdqa xmm4, xmmword [0x180051a80]
movdqa xmmword [rsp + 0x30], xmm0
mov r8d, dword [rsp + 0x30]
movaps xmmword [rsp + 0x70], xmm6
movdqa xmm6, xmmword [0x180051880]
nop word [rax + rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x1800518d0]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1800518d0]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x20
jl 0x18000aae0
movaps xmm6, xmmword [rsp + 0x70]
cmp ecx, 0x24
jge 0x18000ac2d
movsxd rax, ecx
lea r8, [rsp + 0x40]
add r8, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x4bda12f7
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x36
movzx eax, cl
inc ecx
sub al, dl
add al, 0x34
xor byte [r8 - 1], al
cmp ecx, 0x24
jl 0x18000ac00
lea rcx, [rsp + 0x40]
call fcn.1800137d0
mov rcx, qword [0x18005f918]
mov r9, rax
mov rdi, rax
call fcn.18000ef00
mov edx, 2
mov rcx, rdi
mov rbx, rax
call fcn.18004c45c
mov rdi, qword [rsp + 0x80]
mov rax, rbx
mov qword [0x18005ffe8], rbx
mov rbx, qword [rsp + 0x90]
add rsp, 0x88
ret
Function at 0x18000ef00
Capabilities:
Encode data using xor
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x18005a080]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rax, qword [0x180060038]
mov rdi, r9
mov rbx, rcx
test rax, rax
jne 0x18000f132
mov eax, dword [0x18004ff54]
xor ecx, ecx
mov dword [rsp + 0x30], eax
movzx eax, word [0x18004ff58]
xor byte [rsp + 0x31], 0x35
xor byte [rsp + 0x32], 0x36
xor byte [rsp + 0x33], 0x37
mov word [rsp + 0x34], ax
xor al, 0x38
xor byte [rsp + 0x35], 0x39
mov byte [rsp + 0x34], al
mov byte [rsp + 0x30], 0x46
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rsp + 0x30]
call fcn.180013420
mov qword [0x180060038], rax
test rax, rax
jne 0x18000f132
lea rdx, [rsp + 0x30]
call fcn.18000f1a0
mov r10, rax
cmp byte [rax + 7], 0
je 0x18000f0dd
xor ecx, ecx
cmp dword [0x18005a0d0], 2
jl 0x18000f09f
movdqa xmm2, xmmword [0x180051840]
movdqa xmm4, xmmword [0x180051a80]
movdqa xmm1, xmm2
movdqa xmm3, xmmword [0x180051850]
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x180051880]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [rax]
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x1800518d0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1800518f0]
xorps xmm2, xmm0
punpckldq xmm1, xmm3
movd dword [rax], xmm2
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x180051880]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [rax + 4]
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1800518d0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1800518f0]
xorps xmm2, xmm0
movd dword [rax + 4], xmm2
jmp 0x18000f0dd
mov r8, r10
nop dword [rax]
nop word [rax + rax]
mov eax, 0x4bda12f7
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x36
movzx eax, cl
inc ecx
sub al, dl
add al, 0x34
xor byte [r8 - 1], al
cmp ecx, 8
jl 0x18000f0b0
lea rdx, [rsp + 0x38]
call fcn.18000f180
movzx ecx, byte [rax + 9]
test cl, cl
je 0x18000f118
xor byte [rax], 0x34
xor byte [rax + 1], 0x35
xor byte [rax + 2], 0x36
xor byte [rax + 3], 0x37
xor byte [rax + 4], 0x38
xor byte [rax + 5], 0x39
xor byte [rax + 6], 0x3a
xor byte [rax + 7], 0x3b
xor byte [rax + 8], 0x3c
xor cl, 0x3d
mov byte [rax + 9], cl
xor r9d, r9d
mov r8, r10
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov qword [rsp + 0x48], rax
xor ecx, ecx
xor eax, eax
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x58], rax
xor r9d, r9d
lea rax, [rsp + 0x48]
mov qword [rsp + 0x50], rbx
lea rdx, [rcx - 1]
mov qword [rsp + 0x20], rax
mov r8, rdi
call fcn.1800454f0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.18004c400
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
Function at 0x18000f1b0
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x78
mov rax, qword [0x18005a080]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rax, qword [0x18005ffc0]
mov rbp, r9
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
test rax, rax
jne 0x18000f3e2
mov eax, dword [0x18004ff54]
xor ecx, ecx
mov dword [rsp + 0x30], eax
movzx eax, word [0x18004ff58]
xor byte [rsp + 0x31], 0x35
xor byte [rsp + 0x32], 0x36
xor byte [rsp + 0x33], 0x37
mov word [rsp + 0x34], ax
xor al, 0x38
xor byte [rsp + 0x35], 0x39
mov byte [rsp + 0x34], al
mov byte [rsp + 0x30], 0x46
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rsp + 0x30]
call fcn.180013420
mov qword [0x18005ffc0], rax
test rax, rax
jne 0x18000f3e2
lea rdx, [rsp + 0x30]
call fcn.18000f1a0
mov r10, rax
cmp byte [rax + 7], 0
je 0x18000f38d
xor ecx, ecx
cmp dword [0x18005a0d0], 2
jl 0x18000f354
movdqa xmm2, xmmword [0x180051840]
movdqa xmm4, xmmword [0x180051a80]
movdqa xmm1, xmm2
movdqa xmm3, xmmword [0x180051850]
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x180051880]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [rax]
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x1800518d0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1800518f0]
xorps xmm2, xmm0
punpckldq xmm1, xmm3
movd dword [rax], xmm2
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x180051880]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [rax + 4]
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1800518d0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1800518f0]
xorps xmm2, xmm0
movd dword [rax + 4], xmm2
jmp 0x18000f38d
mov r8, r10
nop word [rax + rax]
mov eax, 0x4bda12f7
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x36
movzx eax, cl
inc ecx
sub al, dl
add al, 0x34
xor byte [r8 - 1], al
cmp ecx, 8
jl 0x18000f360
lea rdx, [rsp + 0x38]
call fcn.18000f180
movzx ecx, byte [rax + 9]
test cl, cl
je 0x18000f3c8
xor byte [rax], 0x34
xor byte [rax + 1], 0x35
xor byte [rax + 2], 0x36
xor byte [rax + 3], 0x37
xor byte [rax + 4], 0x38
xor byte [rax + 5], 0x39
xor byte [rax + 6], 0x3a
xor byte [rax + 7], 0x3b
xor byte [rax + 8], 0x3c
xor cl, 0x3d
mov byte [rax + 9], cl
xor r9d, r9d
mov r8, r10
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov qword [rsp + 0x48], rax
xor ecx, ecx
xor eax, eax
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x58], rax
xor r9d, r9d
lea rax, [rsp + 0x48]
mov qword [rsp + 0x50], rbx
mov r8, rbp
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov rcx, rdi
call fcn.1800454f0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.18004c400
add rsp, 0x78
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18000f490
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x78
mov rax, qword [0x1800600f8]
test rax, rax
jne 0x18000f6c0
cmp byte [0x1800501c9], 0
movups xmm0, xmmword [0x1800501b0]
movzx eax, word [0x1800501c8]
mov qword [rsp + 0x80], rbx
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x70], rdi
movsd xmm0, qword [0x1800501c0]
movsd qword [rsp + 0x50], xmm0
mov word [rsp + 0x58], ax
je 0x18000f67d
xor ecx, ecx
cmp dword [0x18005a0d0], 2
jl 0x18000f639
movdqa xmm0, xmmword [0x1800518f0]
lea rdx, [rsp + 0x44]
movdqa xmm5, xmmword [0x180051840]
movdqa xmm4, xmmword [0x180051a80]
movdqa xmmword [rsp + 0x30], xmm0
mov r8d, dword [rsp + 0x30]
movaps xmmword [rsp + 0x60], xmm6
movdqa xmm6, xmmword [0x180051880]
nop dword [rax + rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x1800518d0]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1800518d0]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x18
jl 0x18000f530
movaps xmm6, xmmword [rsp + 0x60]
cmp ecx, 0x1a
jge 0x18000f67d
movsxd rax, ecx
lea r8, [rsp + 0x40]
add r8, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x4bda12f7
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x36
movzx eax, cl
inc ecx
sub al, dl
add al, 0x34
xor byte [r8 - 1], al
cmp ecx, 0x1a
jl 0x18000f650
lea rcx, [rsp + 0x40]
call fcn.1800137d0
mov rcx, qword [0x18005f918]
mov r9, rax
mov rdi, rax
call fcn.18000ef00
mov edx, 2
mov rcx, rdi
mov rbx, rax
call fcn.18004c45c
mov rdi, qword [rsp + 0x70]
mov rax, rbx
mov qword [0x1800600f8], rbx
mov rbx, qword [rsp + 0x80]
add rsp, 0x78
ret
Function at 0x18000f6d0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x78
mov rax, qword [0x180060138]
test rax, rax
jne 0x18000f900
movups xmm0, xmmword [0x1800501f8]
mov eax, dword [0x180050210]
xor ecx, ecx
cmp dword [0x18005a0d0], 2
movups xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x58], eax
movsd xmm0, qword [0x180050208]
movzx eax, byte [0x180050214]
mov qword [rsp + 0x80], rbx
movsd qword [rsp + 0x50], xmm0
mov qword [rsp + 0x70], rdi
mov byte [rsp + 0x5c], al
jl 0x18000f879
movdqa xmm0, xmmword [0x1800518f0]
lea rdx, [rsp + 0x44]
movdqa xmm5, xmmword [0x180051840]
movdqa xmm4, xmmword [0x180051a80]
movdqa xmmword [rsp + 0x30], xmm0
mov r8d, dword [rsp + 0x30]
movaps xmmword [rsp + 0x60], xmm6
movdqa xmm6, xmmword [0x180051880]
nop dword [rax]
nop dword [rax + rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x1800518d0]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1800518d0]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x18
jl 0x18000f770
movaps xmm6, xmmword [rsp + 0x60]
cmp ecx, 0x1d
jge 0x18000f8bd
movsxd rax, ecx
lea r8, [rsp + 0x40]
add r8, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x4bda12f7
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x36
movzx eax, cl
inc ecx
sub al, dl
add al, 0x34
xor byte [r8 - 1], al
cmp ecx, 0x1d
jl 0x18000f890
lea rcx, [rsp + 0x40]
call fcn.1800137d0
mov rcx, qword [0x18005f918]
mov r9, rax
mov rdi, rax
call fcn.18000ef00
mov edx, 2
mov rcx, rdi
mov rbx, rax
call fcn.18004c45c
mov rdi, qword [rsp + 0x70]
mov rax, rbx
mov qword [0x180060138], rbx
mov rbx, qword [rsp + 0x80]
add rsp, 0x78
ret