joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140033730
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword gs:[0x58]
mov rbx, rdx
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400c6a88], eax
jle 0x1400338ca
lea rcx, [0x1400c6a88]
call fcn.1400bb6bc
cmp dword [0x1400c6a88], 0xffffffff
jne 0x1400338ca
xor eax, eax
xor r9d, r9d
cmp dword [0x1400c4098], 2
mov qword [0x1400c63a0], rax
jl 0x14003386b
movdqa xmm2, xmmword [0x1400bee80]
movdqa xmm4, xmmword [0x1400beef0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beeb0]
psubd xmm2, xmm0
movd xmm0, dword [str.ret2er2]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
xorps xmm2, xmm0
movd dword [0x1400c63a0], xmm2
movdqa xmm2, xmmword [0x1400bee90]
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beeb0]
psubd xmm2, xmm0
movd xmm0, dword [0x1400bea04]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
xorps xmm2, xmm0
movd dword [0x1400c63a4], xmm2
jmp 0x1400338be
mov r8d, r9d
lea r10, [0x140000000]
nop word [rax + rax]
mov eax, 0x8fb823ef
lea r9, [r9 + 1]
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x39
movzx eax, r8b
inc r8d
sub al, cl
xor al, byte [r9 + r10 + 0xbe9ff]
mov byte [r9 + r10 + 0xc639f], al
cmp r8d, 8
jl 0x140033880
lea rcx, [0x1400c6a88]
call fcn.1400bb650
mov rax, qword [0x1400c63a0]
mov qword [rbx], rax
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x140033a70
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword gs:[0x58]
mov rbx, rdx
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400c6694], eax
jle 0x140033c15
lea rcx, [0x1400c6694]
call fcn.1400bb6bc
cmp dword [0x1400c6694], 0xffffffff
jne 0x140033c15
xor eax, eax
xor ecx, ecx
cmp dword [0x1400c4098], 2
mov qword [0x1400c5098], rax
mov dword [0x1400c50a0], eax
mov byte [0x1400c50a4], al
jl 0x140033bb9
movdqa xmm2, xmmword [0x1400bee80]
mov ecx, 8
movdqa xmm4, xmmword [0x1400beef0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beeb0]
psubd xmm2, xmm0
movd xmm0, dword [str.kernel32.dll]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
xorps xmm2, xmm0
movd dword [0x1400c5098], xmm2
movdqa xmm2, xmmword [0x1400bee90]
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beeb0]
psubd xmm2, xmm0
movd xmm0, dword [0x1400be93c]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
xorps xmm2, xmm0
movd dword [0x1400c509c], xmm2
movsxd r8, ecx
lea r9, [0x140000000]
nop dword [rax]
nop word [rax + rax]
mov eax, 0x8fb823ef
lea r8, [r8 + 1]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x39
movzx eax, cl
inc ecx
sub al, dl
xor al, byte [r8 + r9 + 0xbe937]
mov byte [r8 + r9 + 0xc5097], al
cmp ecx, 0xd
jl 0x140033bd0
lea rcx, [0x1400c6694]
call fcn.1400bb650
mov eax, dword [0x1400c50a0]
movsd xmm0, qword [0x1400c5098]
movsd qword [rbx], xmm0
mov dword [rbx + 8], eax
movzx eax, byte [0x1400c50a4]
mov byte [rbx + 0xc], al
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x140033c40
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword gs:[0x58]
mov rbx, rdx
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400c5130], eax
jle 0x140033de5
lea rcx, [0x1400c5130]
call fcn.1400bb6bc
cmp dword [0x1400c5130], 0xffffffff
jne 0x140033de5
xor eax, eax
xor ecx, ecx
cmp dword [0x1400c4098], 2
mov qword [0x1400c6318], rax
mov dword [0x1400c6320], eax
mov word [0x1400c6324], ax
jl 0x140033d92
movdqa xmm2, xmmword [0x1400bee80]
mov ecx, 8
movdqa xmm4, xmmword [0x1400beee0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beea0]
psubd xmm2, xmm0
movd xmm0, dword [str.EncodePointer]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400beed0]
xorps xmm2, xmm0
movd dword [0x1400c6318], xmm2
movdqa xmm2, xmmword [0x1400bee90]
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beea0]
psubd xmm2, xmm0
movd xmm0, dword [0x1400be92c]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400beed0]
xorps xmm2, xmm0
movd dword [0x1400c631c], xmm2
movsxd r8, ecx
lea r9, [0x140000000]
nop dword [rax]
mov eax, 0x4ec4ec4f
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x34
movzx eax, cl
inc ecx
sub al, dl
add al, 0x38
xor al, byte [r8 + r9 + 0xbe927]
mov byte [r8 + r9 + 0xc6317], al
cmp ecx, 0xe
jl 0x140033da0
lea rcx, [0x1400c5130]
call fcn.1400bb650
mov eax, dword [0x1400c6320]
movsd xmm0, qword [0x1400c6318]
movsd qword [rbx], xmm0
mov dword [rbx + 8], eax
movzx eax, word [0x1400c6324]
mov word [rbx + 0xc], ax
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x140033e10
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword gs:[0x58]
mov rbx, rdx
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400c6668], eax
jle 0x140033fb5
lea rcx, [0x1400c6668]
call fcn.1400bb6bc
cmp dword [0x1400c6668], 0xffffffff
jne 0x140033fb5
xor eax, eax
xor ecx, ecx
cmp dword [0x1400c4098], 2
mov qword [0x1400ca958], rax
mov dword [0x1400ca960], eax
mov byte [0x1400ca964], al
jl 0x140033f61
movdqa xmm2, xmmword [0x1400bee80]
mov ecx, 8
movdqa xmm4, xmmword [0x1400beee0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beea0]
psubd xmm2, xmm0
movd xmm0, dword [str.kernel32.dll]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400beed0]
xorps xmm2, xmm0
movd dword [0x1400ca958], xmm2
movdqa xmm2, xmmword [0x1400bee90]
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beea0]
psubd xmm2, xmm0
movd xmm0, dword [0x1400be93c]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400beed0]
xorps xmm2, xmm0
movd dword [0x1400ca95c], xmm2
movsxd r8, ecx
lea r9, [0x140000000]
nop dword [rax + rax]
mov eax, 0x4ec4ec4f
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x34
movzx eax, cl
inc ecx
sub al, dl
add al, 0x38
xor al, byte [r8 + r9 + 0xbe937]
mov byte [r8 + r9 + 0xca957], al
cmp ecx, 0xd
jl 0x140033f70
lea rcx, [0x1400c6668]
call fcn.1400bb650
mov eax, dword [0x1400ca960]
movsd xmm0, qword [0x1400ca958]
movsd qword [rbx], xmm0
mov dword [rbx + 8], eax
movzx eax, byte [0x1400ca964]
mov byte [rbx + 0xc], al
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x140034190
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword gs:[0x58]
mov rbx, rdx
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400c78bc], eax
jle 0x140034335
lea rcx, [0x1400c78bc]
call fcn.1400bb6bc
cmp dword [0x1400c78bc], 0xffffffff
jne 0x140034335
xor eax, eax
xor ecx, ecx
cmp dword [0x1400c4098], 2
mov qword [0x1400c7d60], rax
mov dword [0x1400c7d68], eax
mov word [0x1400c7d6c], ax
mov byte [0x1400c7d6e], al
jl 0x1400342e0
movdqa xmm2, xmmword [0x1400bee80]
mov ecx, 8
movdqa xmm4, xmmword [0x1400beef0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beeb0]
psubd xmm2, xmm0
movd xmm0, dword [str.cx22wxc2wxcwxc]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
xorps xmm2, xmm0
movd dword [0x1400c7d60], xmm2
movdqa xmm2, xmmword [0x1400bee90]
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beeb0]
psubd xmm2, xmm0
movd xmm0, dword [0x1400be90c]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
xorps xmm2, xmm0
movd dword [0x1400c7d64], xmm2
movsxd r8, ecx
lea r9, [0x140000000]
nop word [rax + rax]
mov eax, 0x8fb823ef
lea r8, [r8 + 1]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x39
movzx eax, cl
inc ecx
sub al, dl
xor al, byte [r8 + r9 + 0xbe907]
mov byte [r8 + r9 + 0xc7d5f], al
cmp ecx, 0xf
jl 0x1400342f0
lea rcx, [0x1400c78bc]
call fcn.1400bb650
mov eax, dword [0x1400c7d68]
movsd xmm0, qword [0x1400c7d60]
movsd qword [rbx], xmm0
mov dword [rbx + 8], eax
movzx eax, word [0x1400c7d6c]
mov word [rbx + 0xc], ax
movzx eax, byte [0x1400c7d6e]
mov byte [rbx + 0xe], al
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x140034410
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword gs:[0x58]
mov rbx, rdx
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400c550c], eax
jle 0x1400345b5
lea rcx, [0x1400c550c]
call fcn.1400bb6bc
cmp dword [0x1400c550c], 0xffffffff
jne 0x1400345b5
xor eax, eax
xor ecx, ecx
cmp dword [0x1400c4098], 2
mov qword [0x1400c4e60], rax
mov dword [0x1400c4e68], eax
mov word [0x1400c4e6c], ax
jl 0x140034562
movdqa xmm2, xmmword [0x1400bee80]
mov ecx, 8
movdqa xmm4, xmmword [0x1400beee0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beea0]
psubd xmm2, xmm0
movd xmm0, dword [str.EncodePointer]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400beed0]
xorps xmm2, xmm0
movd dword [0x1400c4e60], xmm2
movdqa xmm2, xmmword [0x1400bee90]
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beea0]
psubd xmm2, xmm0
movd xmm0, dword [0x1400be92c]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400beed0]
xorps xmm2, xmm0
movd dword [0x1400c4e64], xmm2
movsxd r8, ecx
lea r9, [0x140000000]
nop dword [rax]
mov eax, 0x4ec4ec4f
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x34
movzx eax, cl
inc ecx
sub al, dl
add al, 0x38
xor al, byte [r8 + r9 + 0xbe927]
mov byte [r8 + r9 + 0xc4e5f], al
cmp ecx, 0xe
jl 0x140034570
lea rcx, [0x1400c550c]
call fcn.1400bb650
mov eax, dword [0x1400c4e68]
movsd xmm0, qword [0x1400c4e60]
movsd qword [rbx], xmm0
mov dword [rbx + 8], eax
movzx eax, word [0x1400c4e6c]
mov word [rbx + 0xc], ax
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x1400345e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword gs:[0x58]
mov rbx, rdx
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400c8abc], eax
jle 0x140034785
lea rcx, [0x1400c8abc]
call fcn.1400bb6bc
cmp dword [0x1400c8abc], 0xffffffff
jne 0x140034785
xor eax, eax
xor ecx, ecx
cmp dword [0x1400c4098], 2
mov qword [0x1400c8bc8], rax
mov dword [0x1400c8bd0], eax
mov byte [0x1400c8bd4], al
jl 0x140034731
movdqa xmm2, xmmword [0x1400bee80]
mov ecx, 8
movdqa xmm4, xmmword [0x1400beee0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beea0]
psubd xmm2, xmm0
movd xmm0, dword [str.kernel32.dll]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400beed0]
xorps xmm2, xmm0
movd dword [0x1400c8bc8], xmm2
movdqa xmm2, xmmword [0x1400bee90]
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beea0]
psubd xmm2, xmm0
movd xmm0, dword [0x1400be93c]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400beed0]
xorps xmm2, xmm0
movd dword [0x1400c8bcc], xmm2
movsxd r8, ecx
lea r9, [0x140000000]
nop dword [rax + rax]
mov eax, 0x4ec4ec4f
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x34
movzx eax, cl
inc ecx
sub al, dl
add al, 0x38
xor al, byte [r8 + r9 + 0xbe937]
mov byte [r8 + r9 + 0xc8bc7], al
cmp ecx, 0xd
jl 0x140034740
lea rcx, [0x1400c8abc]
call fcn.1400bb650
mov eax, dword [0x1400c8bd0]
movsd xmm0, qword [0x1400c8bc8]
movsd qword [rbx], xmm0
mov dword [rbx + 8], eax
movzx eax, byte [0x1400c8bd4]
mov byte [rbx + 0xc], al
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x1400347b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword gs:[0x58]
mov rbx, rdx
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400c57a0], eax
jle 0x140034995
lea rcx, [0x1400c57a0]
call fcn.1400bb6bc
cmp dword [0x1400c57a0], 0xffffffff
jne 0x140034995
xor eax, eax
lea r9, [0x140000000]
xor ecx, ecx
mov dword [0x1400c54a8], eax
cmp dword [0x1400c4098], 2
xorps xmm0, xmm0
movups xmmword [0x1400c5498], xmm0
mov word [0x1400c54ac], ax
jl 0x14003494c
movdqa xmm5, xmmword [0x1400bee80]
mov edx, ecx
movdqa xmm4, xmmword [0x1400beef0]
movaps xmmword [rsp + 0x30], xmm6
movdqa xmm6, xmmword [0x1400beeb0]
movaps xmmword [rsp + 0x20], xmm7
movdqa xmm7, xmmword [0x1400beec0]
nop dword [rax]
lea eax, [rcx + 4]
movd xmm2, ecx
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
paddd xmm3, xmm5
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
add ecx, 8
pmuldq xmm0, xmm4
mov eax, ecx
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
pmulld xmm0, xmm6
psubd xmm2, xmm0
movd xmm0, dword [rdx + r9 + 0xbe940]
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx + r9 + 0xc5490], xmm2
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
movd xmm0, dword [rdx + r9 + 0xbe944]
andps xmm3, xmm7
packuswb xmm3, xmm3
packuswb xmm3, xmm3
xorps xmm3, xmm0
movd dword [rdx + r9 + 0xc5494], xmm3
cmp ecx, 0x10
jl 0x140034850
movaps xmm7, xmmword [rsp + 0x20]
movaps xmm6, xmmword [rsp + 0x30]
cmp eax, 0x16
jge 0x140034989
movsxd r8, ecx
nop
mov eax, 0x8fb823ef
lea r8, [r8 + 1]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x39
movzx eax, cl
inc ecx
sub al, dl
xor al, byte [r8 + r9 + 0xbe947]
mov byte [r8 + r9 + 0xc5497], al
cmp ecx, 0x16
jl 0x140034950
lea rcx, [0x1400c57a0]
call fcn.1400bb650
mov eax, dword [0x1400c54a8]
movups xmm0, xmmword [0x1400c5498]
movups xmmword [rbx], xmm0
mov dword [rbx + 0x10], eax
movzx eax, word [0x1400c54ac]
mov word [rbx + 0x14], ax
mov rax, rbx
add rsp, 0x40
pop rbx
ret
Function at 0x1400349c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword gs:[0x58]
mov rbx, rdx
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400c9fe4], eax
jle 0x140034ba5
lea rcx, [0x1400c9fe4]
call fcn.1400bb6bc
cmp dword [0x1400c9fe4], 0xffffffff
jne 0x140034ba5
xor eax, eax
lea r9, [0x140000000]
xor ecx, ecx
mov qword [0x1400c5860], rax
cmp dword [0x1400c4098], 2
xorps xmm0, xmm0
movups xmmword [0x1400c5850], xmm0
mov word [0x1400c5868], ax
jl 0x140034b5c
movdqa xmm5, xmmword [0x1400bee80]
mov edx, ecx
movdqa xmm4, xmmword [0x1400beef0]
movaps xmmword [rsp + 0x30], xmm6
movdqa xmm6, xmmword [0x1400beeb0]
movaps xmmword [rsp + 0x20], xmm7
movdqa xmm7, xmmword [0x1400beec0]
nop
lea eax, [rcx + 4]
movd xmm2, ecx
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
paddd xmm3, xmm5
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
add ecx, 8
pmuldq xmm0, xmm4
mov eax, ecx
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
pmulld xmm0, xmm6
psubd xmm2, xmm0
movd xmm0, dword [rdx + r9 + 0xbe958]
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx + r9 + 0xc5848], xmm2
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
movd xmm0, dword [rdx + r9 + 0xbe95c]
andps xmm3, xmm7
packuswb xmm3, xmm3
packuswb xmm3, xmm3
xorps xmm3, xmm0
movd dword [rdx + r9 + 0xc584c], xmm3
cmp ecx, 0x18
jl 0x140034a60
movaps xmm7, xmmword [rsp + 0x20]
movaps xmm6, xmmword [rsp + 0x30]
cmp eax, 0x1a
jge 0x140034b99
movsxd r8, ecx
nop
mov eax, 0x8fb823ef
lea r8, [r8 + 1]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x39
movzx eax, cl
inc ecx
sub al, dl
xor al, byte [r8 + r9 + 0xbe95f]
mov byte [r8 + r9 + 0xc584f], al
cmp ecx, 0x1a
jl 0x140034b60
lea rcx, [0x1400c9fe4]
call fcn.1400bb650
movzx eax, word [0x1400c5868]
movups xmm0, xmmword [0x1400c5850]
movsd xmm1, qword [0x1400c5860]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
mov word [rbx + 0x18], ax
mov rax, rbx
add rsp, 0x40
pop rbx
ret
Function at 0x140034d80
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword gs:[0x58]
mov rbx, rdx
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400c8350], eax
jle 0x140034f25
lea rcx, [0x1400c8350]
call fcn.1400bb6bc
cmp dword [0x1400c8350], 0xffffffff
jne 0x140034f25
xor eax, eax
xor ecx, ecx
cmp dword [0x1400c4098], 2
mov qword [0x1400ca888], rax
mov dword [0x1400ca890], eax
mov word [0x1400ca894], ax
jl 0x140034ed2
movdqa xmm2, xmmword [0x1400bee80]
mov ecx, 8
movdqa xmm4, xmmword [0x1400beee0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beea0]
psubd xmm2, xmm0
movd xmm0, dword [str.EncodePointer]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400beed0]
xorps xmm2, xmm0
movd dword [0x1400ca888], xmm2
movdqa xmm2, xmmword [0x1400bee90]
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beea0]
psubd xmm2, xmm0
movd xmm0, dword [0x1400be92c]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400beed0]
xorps xmm2, xmm0
movd dword [0x1400ca88c], xmm2
movsxd r8, ecx
lea r9, [0x140000000]
nop dword [rax]
mov eax, 0x4ec4ec4f
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x34
movzx eax, cl
inc ecx
sub al, dl
add al, 0x38
xor al, byte [r8 + r9 + 0xbe927]
mov byte [r8 + r9 + 0xca887], al
cmp ecx, 0xe
jl 0x140034ee0
lea rcx, [0x1400c8350]
call fcn.1400bb650
mov eax, dword [0x1400ca890]
movsd xmm0, qword [0x1400ca888]
movsd qword [rbx], xmm0
mov dword [rbx + 8], eax
movzx eax, word [0x1400ca894]
mov word [rbx + 0xc], ax
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x140034f50
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword gs:[0x58]
mov rbx, rdx
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400c88c4], eax
jle 0x1400350f5
lea rcx, [0x1400c88c4]
call fcn.1400bb6bc
cmp dword [0x1400c88c4], 0xffffffff
jne 0x1400350f5
xor eax, eax
xor ecx, ecx
cmp dword [0x1400c4098], 2
mov qword [0x1400c8eb8], rax
mov dword [0x1400c8ec0], eax
mov byte [0x1400c8ec4], al
jl 0x1400350a1
movdqa xmm2, xmmword [0x1400bee80]
mov ecx, 8
movdqa xmm4, xmmword [0x1400beee0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beea0]
psubd xmm2, xmm0
movd xmm0, dword [str.kernel32.dll]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400beed0]
xorps xmm2, xmm0
movd dword [0x1400c8eb8], xmm2
movdqa xmm2, xmmword [0x1400bee90]
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beea0]
psubd xmm2, xmm0
movd xmm0, dword [0x1400be93c]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400beed0]
xorps xmm2, xmm0
movd dword [0x1400c8ebc], xmm2
movsxd r8, ecx
lea r9, [0x140000000]
nop dword [rax + rax]
mov eax, 0x4ec4ec4f
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x34
movzx eax, cl
inc ecx
sub al, dl
add al, 0x38
xor al, byte [r8 + r9 + 0xbe937]
mov byte [r8 + r9 + 0xc8eb7], al
cmp ecx, 0xd
jl 0x1400350b0
lea rcx, [0x1400c88c4]
call fcn.1400bb650
mov eax, dword [0x1400c8ec0]
movsd xmm0, qword [0x1400c8eb8]
movsd qword [rbx], xmm0
mov dword [rbx + 8], eax
movzx eax, byte [0x1400c8ec4]
mov byte [rbx + 0xc], al
mov rax, rbx
add rsp, 0x20
pop rbx
ret