joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18002ffb0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x88
movaps xmmword [rsp + 0x70], xmm6
mov rax, qword [0x18021eb70]
test rax, rax
jne 0x1800301fb
movups xmm0, xmmword [0x1800fa3b0]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [0x1800fa3c0]
movups xmmword [rsp + 0x50], xmm1
movsd xmm0, qword [0x1800fa3d0]
movsd qword [rsp + 0x60], xmm0
mov eax, dword [0x1800fa3d8]
mov dword [rsp + 0x68], eax
movzx eax, byte [0x1800fa3dc]
mov byte [rsp + 0x6c], al
xor ecx, ecx
cmp dword [0x18011f090], 2
jl 0x180030134
movdqa xmm4, xmmword [0x18010ba90]
movdqa xmm3, xmmword [0x18010bf60]
movdqa xmm5, xmmword [0x18010bb30]
movdqa xmm0, xmmword [0x18010bc70]
movdqa xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x44]
movdqa xmm6, xmmword [0x18010bc10]
mov r8d, dword [rsp + 0x20]
nop
movd xmm2, ecx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 4]
xorps xmm2, xmm0
movd dword [rdx - 4], xmm2
lea eax, [rcx + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx]
xorps xmm2, xmm0
movd dword [rdx], xmm2
add ecx, 8
lea rdx, [rdx + 8]
cmp ecx, 0x28
jl 0x180030050
cmp ecx, 0x2d
jge 0x18003016c
movsxd rax, ecx
lea r8, [rsp + 0x40]
add r8, rax
nop
mov eax, 0x51eb851f
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x32
movzx eax, cl
sub al, dl
add al, 0x31
xor byte [r8], al
inc ecx
lea r8, [r8 + 1]
cmp ecx, 0x2d
jl 0x180030140
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180030190
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.180015bf0
nop
lea rcx, [rsp + 0x20]
call fcn.180031f70
mov qword [0x18021eb70], rax
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x1800301fb
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800301ef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180030208
call fcn.1800c4128
mov rax, qword [0x18021eb70]
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
ret
call fcn.1800c9fd4
int3
Function at 0x180030360
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x98
movaps xmmword [rsp + 0x80], xmm6
mov rax, qword [0x18021eb40]
test rax, rax
jne 0x1800305ab
movups xmm0, xmmword [0x1800fa320]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [0x1800fa330]
movups xmmword [rsp + 0x50], xmm1
movups xmm0, xmmword [0x1800fa340]
movups xmmword [rsp + 0x60], xmm0
movzx eax, byte [0x1800fa350]
mov byte [rsp + 0x70], al
xor ecx, ecx
cmp dword [0x18011f090], 2
jl 0x1800304e4
movdqa xmm4, xmmword [0x18010ba90]
movdqa xmm3, xmmword [0x18010bf60]
movdqa xmm5, xmmword [0x18010bb30]
movdqa xmm0, xmmword [0x18010bc70]
movdqa xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x44]
movdqa xmm6, xmmword [0x18010bc10]
mov r8d, dword [rsp + 0x20]
nop word [rax + rax]
movd xmm2, ecx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 4]
xorps xmm2, xmm0
movd dword [rdx - 4], xmm2
lea eax, [rcx + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx]
xorps xmm2, xmm0
movd dword [rdx], xmm2
add ecx, 8
lea rdx, [rdx + 8]
cmp ecx, 0x30
jl 0x180030400
cmp ecx, 0x31
jge 0x18003051c
movsxd rax, ecx
lea r8, [rsp + 0x40]
add r8, rax
nop
mov eax, 0x51eb851f
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x32
movzx eax, cl
sub al, dl
add al, 0x31
xor byte [r8], al
inc ecx
lea r8, [r8 + 1]
cmp ecx, 0x31
jl 0x1800304f0
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180030540
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.180015bf0
nop
lea rcx, [rsp + 0x20]
call fcn.180031f70
mov qword [0x18021eb40], rax
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x1800305ab
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18003059f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800305bb
call fcn.1800c4128
mov rax, qword [0x18021eb40]
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x98
ret
call fcn.1800c9fd4
int3
Function at 0x1800305d0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x78
movaps xmmword [rsp + 0x60], xmm6
mov rax, qword [0x18021eac8]
test rax, rax
jne 0x18003081b
movups xmm0, xmmword [0x1800fa358]
movups xmmword [rsp + 0x40], xmm0
movsd xmm0, qword [0x1800fa368]
movsd qword [rsp + 0x50], xmm0
mov eax, dword [str.___9N]
mov dword [rsp + 0x58], eax
movzx eax, word [0x1800fa374]
mov word [rsp + 0x5c], ax
cmp byte [0x1800fa375], 0
je 0x18003078c
xor ecx, ecx
cmp dword [0x18011f090], 2
jl 0x180030754
movdqa xmm4, xmmword [0x18010ba90]
movdqa xmm3, xmmword [0x18010bf60]
movdqa xmm5, xmmword [0x18010bb30]
movdqa xmm0, xmmword [0x18010bc70]
movdqa xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x44]
movdqa xmm6, xmmword [0x18010bc10]
mov r8d, dword [rsp + 0x20]
nop dword [rax]
movd xmm2, ecx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 4]
xorps xmm2, xmm0
movd dword [rdx - 4], xmm2
lea eax, [rcx + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx]
xorps xmm2, xmm0
movd dword [rdx], xmm2
add ecx, 8
lea rdx, [rdx + 8]
cmp ecx, 0x18
jl 0x180030670
cmp ecx, 0x1e
jge 0x18003078c
movsxd rax, ecx
lea r8, [rsp + 0x40]
add r8, rax
nop
mov eax, 0x51eb851f
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x32
movzx eax, cl
sub al, dl
add al, 0x31
xor byte [r8], al
inc ecx
lea r8, [r8 + 1]
cmp ecx, 0x1e
jl 0x180030760
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1800307b0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.180015bf0
nop
lea rcx, [rsp + 0x20]
call fcn.180031f70
mov qword [0x18021eac8], rax
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x18003081b
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18003080f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180030825
call fcn.1800c4128
mov rax, qword [0x18021eac8]
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x78
ret
call fcn.1800c9fd4
int3
Function at 0x1800308f0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x88
movaps xmmword [rsp + 0x70], xmm6
mov rax, qword [0x18021eb58]
test rax, rax
jne 0x180030b2b
movups xmm0, xmmword [str.rRGF]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [0x1800fa388]
movups xmmword [rsp + 0x50], xmm1
mov eax, dword [0x1800fa398]
mov dword [rsp + 0x60], eax
xor ecx, ecx
cmp dword [0x18011f090], 2
jl 0x180030a64
movdqa xmm4, xmmword [0x18010ba90]
movdqa xmm3, xmmword [0x18010bf60]
movdqa xmm5, xmmword [0x18010bb30]
movdqa xmm0, xmmword [0x18010bc70]
movdqa xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x44]
movdqa xmm6, xmmword [0x18010bc10]
mov r8d, dword [rsp + 0x20]
nop word [rax + rax]
movd xmm2, ecx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 4]
xorps xmm2, xmm0
movd dword [rdx - 4], xmm2
lea eax, [rcx + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx]
xorps xmm2, xmm0
movd dword [rdx], xmm2
add ecx, 8
lea rdx, [rdx + 8]
cmp ecx, 0x20
jl 0x180030980
cmp ecx, 0x24
jge 0x180030a9c
movsxd rax, ecx
lea r8, [rsp + 0x40]
add r8, rax
nop
mov eax, 0x51eb851f
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x32
movzx eax, cl
sub al, dl
add al, 0x31
xor byte [r8], al
inc ecx
lea r8, [r8 + 1]
cmp ecx, 0x24
jl 0x180030a70
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180030ac0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.180015bf0
nop
lea rcx, [rsp + 0x20]
call fcn.180031f70
mov qword [0x18021eb58], rax
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x180030b2b
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180030b1f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180030b38
call fcn.1800c4128
mov rax, qword [0x18021eb58]
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
ret
call fcn.1800c9fd4
int3
Function at 0x180030b40
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x88
movaps xmmword [rsp + 0x70], xmm6
mov rax, qword [0x18021ead0]
test rax, rax
jne 0x180030d7b
movups xmm0, xmmword [0x1800fa1e8]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [0x1800fa1f8]
movups xmmword [rsp + 0x50], xmm1
movzx eax, word [0x1800fa208]
mov word [rsp + 0x60], ax
movzx eax, byte [0x1800fa20a]
mov byte [rsp + 0x62], al
xor ecx, ecx
cmp dword [0x18011f090], 2
jl 0x180030cb6
movdqa xmm4, xmmword [0x18010ba90]
movdqa xmm3, xmmword [0x18010bf60]
movdqa xmm5, xmmword [0x18010bb30]
movdqa xmm0, xmmword [0x18010bc70]
movdqa xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x44]
movdqa xmm6, xmmword [0x18010bc10]
mov r8d, dword [rsp + 0x20]
movd xmm2, ecx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 4]
xorps xmm2, xmm0
movd dword [rdx - 4], xmm2
lea eax, [rcx + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx]
xorps xmm2, xmm0
movd dword [rdx], xmm2
add ecx, 8
lea rdx, [rdx + 8]
cmp ecx, 0x20
jl 0x180030bd2
cmp ecx, 0x23
jge 0x180030ced
movsxd rax, ecx
lea r8, [rsp + 0x40]
add r8, rax
mov eax, 0x51eb851f
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x32
movzx eax, cl
sub al, dl
add al, 0x31
xor byte [r8], al
inc ecx
lea r8, [r8 + 1]
cmp ecx, 0x23
jl 0x180030cc1
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180030d10
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.180015bf0
nop
lea rcx, [rsp + 0x20]
call fcn.180031f70
mov qword [0x18021ead0], rax
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x180030d7b
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180030d6f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180030d88
call fcn.1800c4128
mov rax, qword [0x18021ead0]
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
ret
call fcn.1800c9fd4
int3
Function at 0x180030d90
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x88
movaps xmmword [rsp + 0x70], xmm6
mov rax, qword [0x18021eb60]
test rax, rax
jne 0x180030fdb
movups xmm0, xmmword [0x1800fa288]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [0x1800fa298]
movups xmmword [rsp + 0x50], xmm1
mov eax, dword [0x1800fa2a8]
mov dword [rsp + 0x60], eax
movzx eax, word [0x1800fa2ac]
mov word [rsp + 0x64], ax
movzx eax, byte [0x1800fa2ae]
mov byte [rsp + 0x66], al
xor ecx, ecx
cmp dword [0x18011f090], 2
jl 0x180030f14
movdqa xmm4, xmmword [0x18010ba90]
movdqa xmm3, xmmword [0x18010bf60]
movdqa xmm5, xmmword [0x18010bb30]
movdqa xmm0, xmmword [0x18010bc70]
movdqa xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x44]
movdqa xmm6, xmmword [0x18010bc10]
mov r8d, dword [rsp + 0x20]
nop dword [rax]
movd xmm2, ecx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 4]
xorps xmm2, xmm0
movd dword [rdx - 4], xmm2
lea eax, [rcx + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx]
xorps xmm2, xmm0
movd dword [rdx], xmm2
add ecx, 8
lea rdx, [rdx + 8]
cmp ecx, 0x20
jl 0x180030e30
cmp ecx, 0x27
jge 0x180030f4c
movsxd rax, ecx
lea r8, [rsp + 0x40]
add r8, rax
nop
mov eax, 0x51eb851f
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x32
movzx eax, cl
sub al, dl
add al, 0x31
xor byte [r8], al
inc ecx
lea r8, [r8 + 1]
cmp ecx, 0x27
jl 0x180030f20
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180030f70
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.180015bf0
nop
lea rcx, [rsp + 0x20]
call fcn.180031f70
mov qword [0x18021eb60], rax
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x180030fdb
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180030fcf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180030fe8
call fcn.1800c4128
mov rax, qword [0x18021eb60]
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
ret
call fcn.1800c9fd4
int3
Function at 0x180031a30
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x78
movaps xmmword [rsp + 0x60], xmm6
mov rax, qword [0x18021eaf8]
test rax, rax
jne 0x180031c7b
movups xmm0, xmmword [str.sGZXQ_Y_iVZEXLo2__0_0_]
movups xmmword [rsp + 0x40], xmm0
movsd xmm0, qword [0x1800fa250]
movsd qword [rsp + 0x50], xmm0
mov eax, dword [str.____9O]
mov dword [rsp + 0x58], eax
movzx eax, word [0x1800fa25c]
mov word [rsp + 0x5c], ax
movzx eax, byte [0x1800fa25e]
mov byte [rsp + 0x5e], al
xor ecx, ecx
cmp dword [0x18011f090], 2
jl 0x180031bb4
movdqa xmm4, xmmword [0x18010ba90]
movdqa xmm3, xmmword [0x18010bf60]
movdqa xmm5, xmmword [0x18010bb30]
movdqa xmm0, xmmword [0x18010bc70]
movdqa xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x44]
movdqa xmm6, xmmword [0x18010bc10]
mov r8d, dword [rsp + 0x20]
nop dword [rax + rax]
movd xmm2, ecx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 4]
xorps xmm2, xmm0
movd dword [rdx - 4], xmm2
lea eax, [rcx + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx]
xorps xmm2, xmm0
movd dword [rdx], xmm2
add ecx, 8
lea rdx, [rdx + 8]
cmp ecx, 0x18
jl 0x180031ad0
cmp ecx, 0x1f
jge 0x180031bec
movsxd rax, ecx
lea r8, [rsp + 0x40]
add r8, rax
nop
mov eax, 0x51eb851f
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x32
movzx eax, cl
sub al, dl
add al, 0x31
xor byte [r8], al
inc ecx
lea r8, [r8 + 1]
cmp ecx, 0x1f
jl 0x180031bc0
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180031c10
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.180015bf0
nop
lea rcx, [rsp + 0x20]
call fcn.18002f570
mov qword [0x18021eaf8], rax
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x180031c7b
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180031c6f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180031c85
call fcn.1800c4128
mov rax, qword [0x18021eaf8]
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x78
ret
call fcn.1800c9fd4
int3
Function at 0x180033d20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x18011f040]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbx, rdx
mov qword [rsp + 0x20], rdx
xor edi, edi
test rcx, rcx
je 0x180033e43
cmp qword [0x18021ebf0], rdi
je 0x180033e43
mov rax, qword [0x18021ebe8]
test rax, rax
jne 0x180033d83
mov rax, qword gs:[0x60]
mov rdx, qword [rax + 0x10]
mov rax, qword [0x18021ebf0]
add rax, rdx
mov qword [0x18021ebe8], rax
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
lea rdx, [rsp + 0x30]
call rax
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x180033e26
lea rcx, [rsp + 0x40]
call fcn.180029900
nop
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 7
cmova rdx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x50]
lea r8, [rdx + rax*2]
lea rdx, [rsp + 0x40]
cmova rdx, qword [rsp + 0x40]
mov rcx, rbx
call fcn.180029e50
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x180033fa6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180033e1c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180033fc4
call fcn.1800c4128
jmp 0x180033fa6
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
xor r8d, r8d
lea rdx, [0x1800fa015]
jmp 0x180033f9e
mov rax, qword [0x1800fa4a8]
mov qword [rsp + 0x20], rax
cmp byte [0x1800fa4af], dil
je 0x180033f75
mov ecx, edi
cmp dword [0x18011f090], 2
jl 0x180033f4b
movdqa xmm4, xmmword [0x18010bf70]
movdqa xmm2, xmmword [0x18010ba90]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x18010bb20]
psubd xmm2, xmm0
andps xmm2, xmmword [0x18010bc10]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x18010bc70]
movd xmm0, dword [rsp + 0x20]
xorps xmm2, xmm0
movd dword [rsp + 0x20], xmm2
movdqa xmm2, xmmword [0x18010bab0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x18010bb20]
psubd xmm2, xmm0
andps xmm2, xmmword [0x18010bc10]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x18010bc70]
movd xmm0, dword [rsp + 0x24]
xorps xmm2, xmm0
movd dword [rsp + 0x24], xmm2
jmp 0x180033f75
lea r8, [rsp + 0x20]
mov eax, 0x5397829d
mul ecx
shr edx, 4
movsx eax, dl
imul edx, eax, 0x31
movzx eax, cl
sub al, dl
add al, 0x31
xor byte [r8], al
inc ecx
lea r8, [r8 + 1]
cmp ecx, 8
jl 0x180033f50
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
lea rax, [rsp + 0x20]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], dil
jne 0x180033f90
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.180015bf0
mov rax, rbx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1800c3d90
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
ret
call fcn.1800c9fd4
int3
Function at 0x180036140
Capabilities:
Access peb ldr_data
Encode data using xor
Encrypt data using rc4 prga
Get process filename
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x18011f040]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rax, qword gs:[0x60]
mov rbp, rcx
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov r11, rsi
nop dword [rax]
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x1800361f4
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x1800361f4
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r8d
mov edx, 0xda8c2a46
lea rax, [rdi + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x1800361ef
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x1800361d0
cmp edx, 0xcdb5c7e3
je 0x18003623e
test r8d, r8d
jne 0x1800361b0
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x18003620a
cmp qword [rax + 0x30], 0
jne 0x180036180
xor eax, eax
mov r8d, 0x30
lea rdx, [rsp + 0x20]
mov rcx, rbp
call rax
test rax, rax
je 0x180036257
mov ecx, dword [rsp + 0x44]
test cl, 0xee
sete al
test ecx, 0x101
movzx eax, al
mov ecx, 1
cmovne eax, ecx
jmp 0x180036259
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x18003620c
mov al, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1800c3d90
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret