joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400056e0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x18], 0
mov r8, rcx
je 0x140005861
xor eax, eax
cmp dword [0x140010018], 5
jl 0x140005830
movdqa xmm2, xmmword [0x14000c6d0]
mov r9, 0xfffffffffffffffe
movdqa xmm3, xmmword [0x14000c710]
mov r10d, 2
movdqa xmm4, xmmword [0x14000cd40]
sub r9, r8
movdqa xmm5, xmmword [0x14000c740]
sub r10, r8
add rcx, 4
mov rdx, 0xfffffffffffffffc
sub rdx, r8
nop dword [rax]
lea rax, [rdx + rcx]
movq xmm0, rax
movzx eax, word [rcx - 4]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, eax
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd eax, xmm1
mov word [rcx - 4], ax
lea rax, [r9 + rcx]
movq xmm0, rax
movzx eax, word [rcx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, eax
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd eax, xmm1
mov word [rcx - 2], ax
mov rax, rcx
sub rax, r8
movq xmm0, rax
movzx eax, word [rcx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, eax
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd eax, xmm1
mov word [rcx], ax
lea rax, [r10 + rcx]
movq xmm0, rax
movzx eax, word [rcx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, eax
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd eax, xmm1
mov word [rcx + 2], ax
add rcx, 8
lea rax, [rdx + rcx]
cmp rax, 0x18
jb 0x140005740
mov byte [r8 + 0x18], 0
ret
movabs r9, 0xdbaf4383c59f19cf
nop word [rax + rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x18
jb 0x140005840
mov byte [r8 + 0x18], 0
ret
Function at 0x140005870
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x90
mov rax, qword gs:[0x58]
mov ecx, 0x6cc
mov edi, 0x6d0
mov rbx, qword [rax]
mov eax, dword [rcx + rbx]
test al, 1
jne 0x1400058c2
or eax, 1
mov dword [rbx + rdi + 6], 0x10d202c
mov dword [rcx + rbx], eax
lea rcx, [0x14000b7d0]
mov dword [rbx + rdi], 0x770c8058
mov word [rbx + rdi + 4], 0x320b
call fcn.14000944c
cmp byte [rbx + rdi + 9], 0
lea rcx, [rbx + rdi]
je 0x1400058f4
xor byte [rcx], 0xd
xor byte [rcx + 1], 0xd3
xor byte [rcx + 2], 0x49
xor byte [rcx + 3], 0x25
xor byte [rcx + 4], 0x45
xor byte [rcx + 5], 0x73
xor byte [rcx + 6], 0x61
xor byte [rcx + 7], 0x65
xor byte [rcx + 8], 0xd
mov byte [rcx + 9], 0
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x14000596c
mov ecx, 0x6dc
mov edi, 0x6c0
mov eax, dword [rcx + rbx]
test al, 1
jne 0x140005938
or eax, 1
mov dword [rbx + rdi + 6], 0x135ccb8
mov dword [rcx + rbx], eax
lea rcx, [0x14000b7b0]
mov dword [rbx + rdi], 0x17ece260
mov word [rbx + rdi + 4], 0x6a77
call fcn.14000944c
cmp byte [rbx + rdi + 9], 0
lea rcx, [rbx + rdi]
je 0x1400059bf
xor byte [rcx], 0x35
xor byte [rcx + 1], 0xb1
xor byte [rcx + 2], 0xa9
xor byte [rcx + 3], 0x45
xor byte [rcx + 4], 0x39
xor byte [rcx + 5], 0x2b
xor byte [rcx + 6], 0xf5
xor byte [rcx + 7], 0x89
xor byte [rcx + 8], 0x35
mov byte [rcx + 9], 0
jmp 0x1400059bf
mov ecx, 0x6e0
mov edi, 0x6e4
mov eax, dword [rcx + rbx]
test al, 1
jne 0x14000599d
or eax, 1
mov dword [rbx + rdi + 2], 0x1738182
mov dword [rcx + rbx], eax
lea rcx, [0x14000b790]
mov word [rbx + rdi], 0xda10
call fcn.14000944c
cmp byte [rbx + rdi + 5], 0
lea rcx, [rbx + rdi]
je 0x1400059bf
xor byte [rcx], 0x45
xor byte [rcx + 1], 0x89
xor byte [rcx + 2], 0xc7
xor byte [rcx + 3], 0xd3
xor byte [rcx + 4], 0x73
mov byte [rcx + 5], 0
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov r8d, 0x64
lea rcx, [rsp + 0x20]
mov rdx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
lea rax, [rsp + 0x20]
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rax + rcx], 0
jne 0x1400059e5
inc rcx
call fcn.1400094e8
lea rcx, [rsp + 0x20]
mov r8, rax
sub r8, rcx
lea rdx, [rsp + 0x20]
nop word [rax + rax]
movzx ecx, byte [rdx]
mov byte [r8 + rdx], cl
lea rdx, [rdx + 1]
test cl, cl
jne 0x140005a10
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rdi
ret
Function at 0x140006070
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x25], 0
mov r8, rcx
je 0x1400061e1
xor eax, eax
cmp dword [0x140010018], 5
jl 0x1400061af
movdqa xmm2, xmmword [0x14000c6d0]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [0x14000c710]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x14000ce00]
sub r9, rcx
movdqa xmm5, xmmword [0x14000c740]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x20
jb 0x1400060c3
cmp rax, 0x25
jae 0x1400061dc
movabs r9, 0xefc7bf81a1d573c5
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x25
jb 0x1400061c0
mov byte [r8 + 0x25], 0
ret
Function at 0x1400061f0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1f], 0
mov r8, rcx
je 0x140006361
xor eax, eax
cmp dword [0x140010018], 5
jl 0x14000632f
movdqa xmm2, xmmword [0x14000c6d0]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [0x14000c710]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x14000c9e0]
sub r9, rcx
movdqa xmm5, xmmword [0x14000c740]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x18
jb 0x140006243
cmp rax, 0x1f
jae 0x14000635c
movabs r9, 0x750729cbe569d1dd
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x1f
jb 0x140006340
mov byte [r8 + 0x1f], 0
ret
Function at 0x140006840
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xb6], 0
mov r8, rcx
je 0x1400069c6
xor eax, eax
cmp dword [0x140010018], 5
jl 0x140006990
movdqa xmm2, xmmword [0x14000c6d0]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [0x14000c710]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x14000cd30]
sub r9, rcx
movdqa xmm5, xmmword [0x14000c740]
mov r10d, 2
sub r10, rcx
nop word [rax + rax]
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0xb0
jb 0x1400068a0
cmp rax, 0xb6
jae 0x1400069be
movabs r9, 0xd76bd737d54d5575
nop word [rax + rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0xb6
jb 0x1400069a0
mov byte [r8 + 0xb6], 0
ret
Function at 0x140007200
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x19], 0
mov r8, rcx
je 0x140007371
xor eax, eax
cmp dword [0x140010018], 5
jl 0x14000733f
movdqa xmm2, xmmword [0x14000c6d0]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [0x14000c710]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x14000c9b0]
sub r9, rcx
movdqa xmm5, xmmword [0x14000c740]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x18
jb 0x140007253
cmp rax, 0x19
jae 0x14000736c
movabs r9, 0x6f55cd957ba3590f
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x19
jb 0x140007350
mov byte [r8 + 0x19], 0
ret
Function at 0x140007380
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2f], 0
mov r8, rcx
je 0x1400074f1
xor eax, eax
cmp dword [0x140010018], 5
jl 0x1400074bf
movdqa xmm2, xmmword [0x14000c6d0]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [0x14000c710]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x14000cee0]
sub r9, rcx
movdqa xmm5, xmmword [0x14000c740]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x28
jb 0x1400073d3
cmp rax, 0x2f
jae 0x1400074ec
movabs r9, 0xffc3978bc98f5399
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x2f
jb 0x1400074d0
mov byte [r8 + 0x2f], 0
ret
Function at 0x140007500
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2d], 0
mov r8, rcx
je 0x140007671
xor eax, eax
cmp dword [0x140010018], 5
jl 0x14000763f
movdqa xmm2, xmmword [0x14000c6d0]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [0x14000c710]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x14000ce00]
sub r9, rcx
movdqa xmm5, xmmword [0x14000c740]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x28
jb 0x140007553
cmp rax, 0x2d
jae 0x14000766c
movabs r9, 0xefc7bf81a1d573c5
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x2d
jb 0x140007650
mov byte [r8 + 0x2d], 0
ret
Function at 0x140007810
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1c], 0
mov r8, rcx
je 0x140007981
xor eax, eax
cmp dword [0x140010018], 5
jl 0x14000794f
movdqa xmm2, xmmword [0x14000c6d0]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [0x14000c710]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x14000c9e0]
sub r9, rcx
movdqa xmm5, xmmword [0x14000c740]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x18
jb 0x140007863
cmp rax, 0x1c
jae 0x14000797c
movabs r9, 0x750729cbe569d1dd
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x1c
jb 0x140007960
mov byte [r8 + 0x1c], 0
ret
Function at 0x140007ad0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x7c], 0
mov r8, rcx
je 0x140007c41
xor eax, eax
cmp dword [0x140010018], 5
jl 0x140007c0f
movdqa xmm2, xmmword [0x14000c6d0]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [0x14000c710]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x14000cd30]
sub r9, rcx
movdqa xmm5, xmmword [0x14000c740]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x78
jb 0x140007b23
cmp rax, 0x7c
jae 0x140007c3c
movabs r9, 0xd76bd737d54d5575
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x7c
jb 0x140007c20
mov byte [r8 + 0x7c], 0
ret
Function at 0x140007fc0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1e], 0
mov r8, rcx
je 0x140008131
xor eax, eax
cmp dword [0x140010018], 5
jl 0x1400080ff
movdqa xmm2, xmmword [0x14000c6d0]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [0x14000c710]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x14000cad0]
sub r9, rcx
movdqa xmm5, xmmword [0x14000c740]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x18
jb 0x140008013
cmp rax, 0x1e
jae 0x14000812c
movabs r9, 0x89f52b3945a9b135
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x1e
jb 0x140008110
mov byte [r8 + 0x1e], 0
ret
Function at 0x140008140
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1a], 0
mov r8, rcx
je 0x1400082b1
xor eax, eax
cmp dword [0x140010018], 5
jl 0x14000827f
movdqa xmm2, xmmword [0x14000c6d0]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [0x14000c710]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x14000cb20]
sub r9, rcx
movdqa xmm5, xmmword [0x14000c740]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x18
jb 0x140008193
cmp rax, 0x1a
jae 0x1400082ac
movabs r9, 0x91219b1ff7f5f1d5
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x1a
jb 0x140008290
mov byte [r8 + 0x1a], 0
ret
Function at 0x140008ec0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x12], 0
mov r8, rcx
je 0x140009031
xor eax, eax
cmp dword [0x140010018], 5
jl 0x140008fff
movdqa xmm2, xmmword [0x14000c6d0]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [0x14000c710]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x14000cab0]
sub r9, rcx
movdqa xmm5, xmmword [0x14000c740]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x10
jb 0x140008f13
cmp rax, 0x12
jae 0x14000902c
movabs r9, 0x8707dd23b1c9b5ef
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x12
jb 0x140009010
mov byte [r8 + 0x12], 0
ret
Function at 0x140009040
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1a], 0
mov r8, rcx
je 0x1400091b1
xor eax, eax
cmp dword [0x140010018], 5
jl 0x14000917f
movdqa xmm2, xmmword [0x14000c6d0]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [0x14000c710]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x14000ccf0]
sub r9, rcx
movdqa xmm5, xmmword [0x14000c740]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x18
jb 0x140009093
cmp rax, 0x1a
jae 0x1400091ac
movabs r9, 0xc77f77236bad4799
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x1a
jb 0x140009190
mov byte [r8 + 0x1a], 0
ret