joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140028e90
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword gs:[0x58]
mov rbx, rdx
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400c6500], eax
jle 0x140029075
lea rcx, [0x1400c6500]
call fcn.1400bb6bc
cmp dword [0x1400c6500], 0xffffffff
jne 0x140029075
xor eax, eax
lea r9, [0x140000000]
xor ecx, ecx
mov qword [0x1400c9578], rax
cmp dword [0x1400c4098], 2
xorps xmm0, xmm0
movups xmmword [0x1400c9568], xmm0
mov word [0x1400c9580], ax
jl 0x14002902c
movdqa xmm5, xmmword [0x1400bee80]
mov edx, ecx
movdqa xmm4, xmmword [0x1400beef0]
movaps xmmword [rsp + 0x30], xmm6
movdqa xmm6, xmmword [0x1400beeb0]
movaps xmmword [rsp + 0x20], xmm7
movdqa xmm7, xmmword [0x1400beec0]
nop
lea eax, [rcx + 4]
movd xmm2, ecx
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
paddd xmm3, xmm5
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
add ecx, 8
pmuldq xmm0, xmm4
mov eax, ecx
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
pmulld xmm0, xmm6
psubd xmm2, xmm0
movd xmm0, dword [rdx + r9 + 0xbe958]
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx + r9 + 0xc9560], xmm2
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
movd xmm0, dword [rdx + r9 + 0xbe95c]
andps xmm3, xmm7
packuswb xmm3, xmm3
packuswb xmm3, xmm3
xorps xmm3, xmm0
movd dword [rdx + r9 + 0xc9564], xmm3
cmp ecx, 0x18
jl 0x140028f30
movaps xmm7, xmmword [rsp + 0x20]
movaps xmm6, xmmword [rsp + 0x30]
cmp eax, 0x1a
jge 0x140029069
movsxd r8, ecx
nop
mov eax, 0x8fb823ef
lea r8, [r8 + 1]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x39
movzx eax, cl
inc ecx
sub al, dl
xor al, byte [r8 + r9 + 0xbe95f]
mov byte [r8 + r9 + 0xc9567], al
cmp ecx, 0x1a
jl 0x140029030
lea rcx, [0x1400c6500]
call fcn.1400bb650
movzx eax, word [0x1400c9580]
movups xmm0, xmmword [0x1400c9568]
movsd xmm1, qword [0x1400c9578]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
mov word [rbx + 0x18], ax
mov rax, rbx
add rsp, 0x40
pop rbx
ret
Function at 0x140029250
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword gs:[0x58]
mov rbx, rdx
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400c8b04], eax
jle 0x1400293f5
lea rcx, [0x1400c8b04]
call fcn.1400bb6bc
cmp dword [0x1400c8b04], 0xffffffff
jne 0x1400293f5
xor eax, eax
xor ecx, ecx
cmp dword [0x1400c4098], 2
mov qword [0x1400c7660], rax
mov dword [0x1400c7668], eax
mov word [0x1400c766c], ax
jl 0x1400293a2
movdqa xmm2, xmmword [0x1400bee80]
mov ecx, 8
movdqa xmm4, xmmword [0x1400beee0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beea0]
psubd xmm2, xmm0
movd xmm0, dword [str.EncodePointer]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400beed0]
xorps xmm2, xmm0
movd dword [0x1400c7660], xmm2
movdqa xmm2, xmmword [0x1400bee90]
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beea0]
psubd xmm2, xmm0
movd xmm0, dword [0x1400be92c]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400beed0]
xorps xmm2, xmm0
movd dword [0x1400c7664], xmm2
movsxd r8, ecx
lea r9, [0x140000000]
nop dword [rax]
mov eax, 0x4ec4ec4f
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x34
movzx eax, cl
inc ecx
sub al, dl
add al, 0x38
xor al, byte [r8 + r9 + 0xbe927]
mov byte [r8 + r9 + 0xc765f], al
cmp ecx, 0xe
jl 0x1400293b0
lea rcx, [0x1400c8b04]
call fcn.1400bb650
mov eax, dword [0x1400c7668]
movsd xmm0, qword [0x1400c7660]
movsd qword [rbx], xmm0
mov dword [rbx + 8], eax
movzx eax, word [0x1400c766c]
mov word [rbx + 0xc], ax
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x140029420
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword gs:[0x58]
mov rbx, rdx
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400c72e8], eax
jle 0x1400295c5
lea rcx, [0x1400c72e8]
call fcn.1400bb6bc
cmp dword [0x1400c72e8], 0xffffffff
jne 0x1400295c5
xor eax, eax
xor ecx, ecx
cmp dword [0x1400c4098], 2
mov qword [0x1400c6db0], rax
mov dword [0x1400c6db8], eax
mov byte [0x1400c6dbc], al
jl 0x140029571
movdqa xmm2, xmmword [0x1400bee80]
mov ecx, 8
movdqa xmm4, xmmword [0x1400beee0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beea0]
psubd xmm2, xmm0
movd xmm0, dword [str.kernel32.dll]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400beed0]
xorps xmm2, xmm0
movd dword [0x1400c6db0], xmm2
movdqa xmm2, xmmword [0x1400bee90]
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beea0]
psubd xmm2, xmm0
movd xmm0, dword [0x1400be93c]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400beed0]
xorps xmm2, xmm0
movd dword [0x1400c6db4], xmm2
movsxd r8, ecx
lea r9, [0x140000000]
nop dword [rax + rax]
mov eax, 0x4ec4ec4f
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x34
movzx eax, cl
inc ecx
sub al, dl
add al, 0x38
xor al, byte [r8 + r9 + 0xbe937]
mov byte [r8 + r9 + 0xc6daf], al
cmp ecx, 0xd
jl 0x140029580
lea rcx, [0x1400c72e8]
call fcn.1400bb650
mov eax, dword [0x1400c6db8]
movsd xmm0, qword [0x1400c6db0]
movsd qword [rbx], xmm0
mov dword [rbx + 8], eax
movzx eax, byte [0x1400c6dbc]
mov byte [rbx + 0xc], al
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x1400295f0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword gs:[0x58]
mov rbx, rdx
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400c7dd4], eax
jle 0x140029795
lea rcx, [0x1400c7dd4]
call fcn.1400bb6bc
cmp dword [0x1400c7dd4], 0xffffffff
jne 0x140029795
xor eax, eax
xor ecx, ecx
cmp dword [0x1400c4098], 2
mov qword [0x1400c63e8], rax
mov dword [0x1400c63f0], eax
mov byte [0x1400c63f4], al
jl 0x140029739
movdqa xmm2, xmmword [0x1400bee80]
mov ecx, 8
movdqa xmm4, xmmword [0x1400beef0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beeb0]
psubd xmm2, xmm0
movd xmm0, dword [str.256352896548]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
xorps xmm2, xmm0
movd dword [0x1400c63e8], xmm2
movdqa xmm2, xmmword [0x1400bee90]
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beeb0]
psubd xmm2, xmm0
movd xmm0, dword [0x1400be9b4]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
xorps xmm2, xmm0
movd dword [0x1400c63ec], xmm2
movsxd r8, ecx
lea r9, [0x140000000]
nop dword [rax]
nop word [rax + rax]
mov eax, 0x8fb823ef
lea r8, [r8 + 1]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x39
movzx eax, cl
inc ecx
sub al, dl
xor al, byte [r8 + r9 + 0xbe9af]
mov byte [r8 + r9 + 0xc63e7], al
cmp ecx, 0xd
jl 0x140029750
lea rcx, [0x1400c7dd4]
call fcn.1400bb650
mov eax, dword [0x1400c63f0]
movsd xmm0, qword [0x1400c63e8]
movsd qword [rbx], xmm0
mov dword [rbx + 8], eax
movzx eax, byte [0x1400c63f4]
mov byte [rbx + 0xc], al
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x1400297c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword gs:[0x58]
mov rbx, rdx
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400c59d4], eax
jle 0x140029965
lea rcx, [0x1400c59d4]
call fcn.1400bb6bc
cmp dword [0x1400c59d4], 0xffffffff
jne 0x140029965
xor eax, eax
xor ecx, ecx
cmp dword [0x1400c4098], 2
mov qword [0x1400c6d88], rax
mov dword [0x1400c6d90], eax
mov word [0x1400c6d94], ax
jl 0x14002990a
movdqa xmm2, xmmword [0x1400bee80]
mov ecx, 8
movdqa xmm4, xmmword [0x1400beef0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beeb0]
psubd xmm2, xmm0
movd xmm0, dword [str.1452145321253]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
xorps xmm2, xmm0
movd dword [0x1400c6d88], xmm2
movdqa xmm2, xmmword [0x1400bee90]
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beeb0]
psubd xmm2, xmm0
movd xmm0, dword [0x1400be9c4]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
xorps xmm2, xmm0
movd dword [0x1400c6d8c], xmm2
movsxd r8, ecx
lea r9, [0x140000000]
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x8fb823ef
lea r8, [r8 + 1]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x39
movzx eax, cl
inc ecx
sub al, dl
xor al, byte [r8 + r9 + 0xbe9bf]
mov byte [r8 + r9 + 0xc6d87], al
cmp ecx, 0xe
jl 0x140029920
lea rcx, [0x1400c59d4]
call fcn.1400bb650
mov eax, dword [0x1400c6d90]
movsd xmm0, qword [0x1400c6d88]
movsd qword [rbx], xmm0
mov dword [rbx + 8], eax
movzx eax, word [0x1400c6d94]
mov word [rbx + 0xc], ax
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x140029a10
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword gs:[0x58]
mov rbx, rdx
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400c9480], eax
jle 0x140029bb5
lea rcx, [0x1400c9480]
call fcn.1400bb6bc
cmp dword [0x1400c9480], 0xffffffff
jne 0x140029bb5
xor eax, eax
xor ecx, ecx
cmp dword [0x1400c4098], 2
mov qword [0x1400c5488], rax
mov dword [0x1400c5490], eax
mov byte [0x1400c5494], al
jl 0x140029b59
movdqa xmm2, xmmword [0x1400bee80]
mov ecx, 8
movdqa xmm4, xmmword [0x1400beef0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beeb0]
psubd xmm2, xmm0
movd xmm0, dword [str.145625849562]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
xorps xmm2, xmm0
movd dword [0x1400c5488], xmm2
movdqa xmm2, xmmword [0x1400bee90]
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beeb0]
psubd xmm2, xmm0
movd xmm0, dword [0x1400be9e4]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
xorps xmm2, xmm0
movd dword [0x1400c548c], xmm2
movsxd r8, ecx
lea r9, [0x140000000]
nop dword [rax]
nop word [rax + rax]
mov eax, 0x8fb823ef
lea r8, [r8 + 1]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x39
movzx eax, cl
inc ecx
sub al, dl
xor al, byte [r8 + r9 + 0xbe9df]
mov byte [r8 + r9 + 0xc5487], al
cmp ecx, 0xd
jl 0x140029b70
lea rcx, [0x1400c9480]
call fcn.1400bb650
mov eax, dword [0x1400c5490]
movsd xmm0, qword [0x1400c5488]
movsd qword [rbx], xmm0
mov dword [rbx + 8], eax
movzx eax, byte [0x1400c5494]
mov byte [rbx + 0xc], al
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x140029be0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword gs:[0x58]
mov rbx, rdx
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400ca79c], eax
jle 0x140029dba
lea rcx, [0x1400ca79c]
call fcn.1400bb6bc
cmp dword [0x1400ca79c], 0xffffffff
jne 0x140029dba
xor r9d, r9d
lea r10, [0x140000000]
cmp dword [0x1400c4098], 2
xorps xmm0, xmm0
movups xmmword [0x1400c60e8], xmm0
jl 0x140029d6b
movdqa xmm5, xmmword [0x1400bee80]
mov ecx, r9d
movdqa xmm4, xmmword [0x1400beef0]
movaps xmmword [rsp + 0x30], xmm6
movdqa xmm6, xmmword [0x1400beeb0]
movaps xmmword [rsp + 0x20], xmm7
movdqa xmm7, xmmword [0x1400beec0]
movd xmm2, r9d
lea eax, [r9 + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
paddd xmm3, xmm5
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
add r9d, 8
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
pmulld xmm0, xmm6
psubd xmm2, xmm0
movd xmm0, dword [rcx + r10 + 0xbe9e8]
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rcx + r10 + 0xc60e0], xmm2
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
movd xmm0, dword [rcx + r10 + 0xbe9ec]
andps xmm3, xmm7
packuswb xmm3, xmm3
packuswb xmm3, xmm3
xorps xmm3, xmm0
movd dword [rcx + r10 + 0xc60e4], xmm3
cmp r9d, 0x10
jl 0x140029c70
movaps xmm7, xmmword [rsp + 0x20]
movaps xmm6, xmmword [rsp + 0x30]
jmp 0x140029dae
mov r8d, r9d
nop
mov eax, 0x8fb823ef
lea r9, [r9 + 1]
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x39
movzx eax, r8b
inc r8d
sub al, cl
xor al, byte [r9 + r10 + 0xbe9ef]
mov byte [r9 + r10 + 0xc60e7], al
cmp r8d, 0x10
jl 0x140029d70
lea rcx, [0x1400ca79c]
call fcn.1400bb650
movups xmm0, xmmword [0x1400c60e8]
mov rax, rbx
movups xmmword [rbx], xmm0
add rsp, 0x40
pop rbx
ret
Function at 0x140029dd0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword gs:[0x58]
mov rbx, rdx
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400c7328], eax
jle 0x140029f75
lea rcx, [0x1400c7328]
call fcn.1400bb6bc
cmp dword [0x1400c7328], 0xffffffff
jne 0x140029f75
xor eax, eax
xor ecx, ecx
cmp dword [0x1400c4098], 2
mov qword [0x1400c7960], rax
mov dword [0x1400c7968], eax
mov word [0x1400c796c], ax
jl 0x140029f22
movdqa xmm2, xmmword [0x1400bee80]
mov ecx, 8
movdqa xmm4, xmmword [0x1400beee0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beea0]
psubd xmm2, xmm0
movd xmm0, dword [str.EncodePointer]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400beed0]
xorps xmm2, xmm0
movd dword [0x1400c7960], xmm2
movdqa xmm2, xmmword [0x1400bee90]
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beea0]
psubd xmm2, xmm0
movd xmm0, dword [0x1400be92c]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400beed0]
xorps xmm2, xmm0
movd dword [0x1400c7964], xmm2
movsxd r8, ecx
lea r9, [0x140000000]
nop dword [rax]
mov eax, 0x4ec4ec4f
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x34
movzx eax, cl
inc ecx
sub al, dl
add al, 0x38
xor al, byte [r8 + r9 + 0xbe927]
mov byte [r8 + r9 + 0xc795f], al
cmp ecx, 0xe
jl 0x140029f30
lea rcx, [0x1400c7328]
call fcn.1400bb650
mov eax, dword [0x1400c7968]
movsd xmm0, qword [0x1400c7960]
movsd qword [rbx], xmm0
mov dword [rbx + 8], eax
movzx eax, word [0x1400c796c]
mov word [rbx + 0xc], ax
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x140029fa0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword gs:[0x58]
mov rbx, rdx
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400c6fd8], eax
jle 0x14002a145
lea rcx, [0x1400c6fd8]
call fcn.1400bb6bc
cmp dword [0x1400c6fd8], 0xffffffff
jne 0x14002a145
xor eax, eax
xor ecx, ecx
cmp dword [0x1400c4098], 2
mov qword [0x1400ca480], rax
mov dword [0x1400ca488], eax
mov byte [0x1400ca48c], al
jl 0x14002a0f1
movdqa xmm2, xmmword [0x1400bee80]
mov ecx, 8
movdqa xmm4, xmmword [0x1400beee0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beea0]
psubd xmm2, xmm0
movd xmm0, dword [str.kernel32.dll]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400beed0]
xorps xmm2, xmm0
movd dword [0x1400ca480], xmm2
movdqa xmm2, xmmword [0x1400bee90]
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beea0]
psubd xmm2, xmm0
movd xmm0, dword [0x1400be93c]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400beed0]
xorps xmm2, xmm0
movd dword [0x1400ca484], xmm2
movsxd r8, ecx
lea r9, [0x140000000]
nop dword [rax + rax]
mov eax, 0x4ec4ec4f
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x34
movzx eax, cl
inc ecx
sub al, dl
add al, 0x38
xor al, byte [r8 + r9 + 0xbe937]
mov byte [r8 + r9 + 0xca47f], al
cmp ecx, 0xd
jl 0x14002a100
lea rcx, [0x1400c6fd8]
call fcn.1400bb650
mov eax, dword [0x1400ca488]
movsd xmm0, qword [0x1400ca480]
movsd qword [rbx], xmm0
mov dword [rbx + 8], eax
movzx eax, byte [0x1400ca48c]
mov byte [rbx + 0xc], al
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x14002a170
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword gs:[0x58]
mov rbx, rdx
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400c97fc], eax
jle 0x14002a30a
lea rcx, [0x1400c97fc]
call fcn.1400bb6bc
cmp dword [0x1400c97fc], 0xffffffff
jne 0x14002a30a
xor eax, eax
xor r9d, r9d
cmp dword [0x1400c4098], 2
mov qword [0x1400c9a10], rax
jl 0x14002a2ab
movdqa xmm2, xmmword [0x1400bee80]
movdqa xmm4, xmmword [0x1400beef0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beeb0]
psubd xmm2, xmm0
movd xmm0, dword [str.ret2er2]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
xorps xmm2, xmm0
movd dword [0x1400c9a10], xmm2
movdqa xmm2, xmmword [0x1400bee90]
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beeb0]
psubd xmm2, xmm0
movd xmm0, dword [0x1400bea04]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
xorps xmm2, xmm0
movd dword [0x1400c9a14], xmm2
jmp 0x14002a2fe
mov r8d, r9d
lea r10, [0x140000000]
nop word [rax + rax]
mov eax, 0x8fb823ef
lea r9, [r9 + 1]
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x39
movzx eax, r8b
inc r8d
sub al, cl
xor al, byte [r9 + r10 + 0xbe9ff]
mov byte [r9 + r10 + 0xc9a0f], al
cmp r8d, 8
jl 0x14002a2c0
lea rcx, [0x1400c97fc]
call fcn.1400bb650
mov rax, qword [0x1400c9a10]
mov qword [rbx], rax
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x14002a4b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword gs:[0x58]
mov rbx, rdx
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400ca314], eax
jle 0x14002a655
lea rcx, [0x1400ca314]
call fcn.1400bb6bc
cmp dword [0x1400ca314], 0xffffffff
jne 0x14002a655
xor eax, eax
xor ecx, ecx
cmp dword [0x1400c4098], 2
mov qword [0x1400c5770], rax
mov dword [0x1400c5778], eax
mov byte [0x1400c577c], al
jl 0x14002a5f9
movdqa xmm2, xmmword [0x1400bee80]
mov ecx, 8
movdqa xmm4, xmmword [0x1400beef0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beeb0]
psubd xmm2, xmm0
movd xmm0, dword [str.kernel32.dll]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
xorps xmm2, xmm0
movd dword [0x1400c5770], xmm2
movdqa xmm2, xmmword [0x1400bee90]
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beeb0]
psubd xmm2, xmm0
movd xmm0, dword [0x1400be93c]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
xorps xmm2, xmm0
movd dword [0x1400c5774], xmm2
movsxd r8, ecx
lea r9, [0x140000000]
nop dword [rax]
nop word [rax + rax]
mov eax, 0x8fb823ef
lea r8, [r8 + 1]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x39
movzx eax, cl
inc ecx
sub al, dl
xor al, byte [r8 + r9 + 0xbe937]
mov byte [r8 + r9 + 0xc576f], al
cmp ecx, 0xd
jl 0x14002a610
lea rcx, [0x1400ca314]
call fcn.1400bb650
mov eax, dword [0x1400c5778]
movsd xmm0, qword [0x1400c5770]
movsd qword [rbx], xmm0
mov dword [rbx + 8], eax
movzx eax, byte [0x1400c577c]
mov byte [rbx + 0xc], al
mov rax, rbx
add rsp, 0x20
pop rbx
ret