joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800797e8
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov r14, rdx
mov rsi, rcx
xor edx, edx
lea rcx, [rbp - 0x60]
call fcn.180069ce8
mov rax, qword [rbp - 0x58]
mov edi, 0xfde9
cmp dword [rax + 0xc], edi
jne 0x180079833
xor ebx, ebx
cmp byte [rbp - 0x48], bl
je 0x180079867
mov rax, qword [rbp - 0x60]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x180079867
call fcn.18007c514
xor ebx, ebx
test eax, eax
jne 0x180079855
cmp byte [rbp - 0x48], bl
je 0x18007984e
mov rax, qword [rbp - 0x60]
and dword [rax + 0x3a8], 0xfffffffd
mov edi, 1
jmp 0x180079867
cmp byte [rbp - 0x48], bl
je 0x180079865
mov rax, qword [rbp - 0x60]
and dword [rax + 0x3a8], 0xfffffffd
mov edi, ebx
mov r9d, edi
mov qword [rbp - 0x30], rbx
lea r8, [rbp + 0x30]
mov qword [rbp - 0x28], rbx
lea rdx, [rbp - 0x30]
mov qword [rbp - 0x20], rbx
mov rcx, rsi
mov qword [rbp - 0x18], rbx
mov qword [rbp - 0x10], rbx
mov byte [rbp - 8], bl
call fcn.18007966c
mov esi, eax
test eax, eax
je 0x1800798a3
call fcn.18007ae00
or edi, 0xffffffff
mov dword [rax], esi
jmp 0x1800798fc
mov r9d, edi
mov qword [rbp - 0x60], rbx
lea r8, [rbp + 0x30]
mov qword [rbp - 0x58], rbx
lea rdx, [rbp - 0x60]
mov qword [rbp - 0x50], rbx
mov rcx, r14
mov qword [rbp - 0x48], rbx
mov qword [rbp - 0x40], rbx
mov byte [rbp - 0x38], bl
call fcn.18007966c
mov edi, eax
test eax, eax
je 0x1800798df
call fcn.18007ae00
mov dword [rax], edi
or edi, 0xffffffff
jmp 0x1800798ee
mov rdx, qword [rbp - 0x50]
mov rcx, qword [rbp - 0x20]
call fcn.180082478
mov edi, eax
cmp byte [rbp - 0x38], bl
je 0x1800798fc
mov rcx, qword [rbp - 0x50]
call fcn.18007c2c4
cmp byte [rbp - 8], bl
je 0x18007990a
mov rcx, qword [rbp - 0x20]
call fcn.18007c2c4
lea r11, [rsp + 0x80]
mov eax, edi
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret

Function at 0x180079c48
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x180079cb7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180079cb7
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x180079cb7
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x180079cb7
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x180079cb7
cmp dword [rcx + 0x84], 0xe
jbe 0x180079cb7
cmp dword [rcx + 0xf8], 0
je 0x180079cb7
mov ecx, ebx
call fcn.180079d68
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.180079b44
nop
cmp dword [rbp + 0x20], 0
je 0x180079d05
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.180079d10
int3
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x180079c48
Function at 0x18007f018
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x1800a7870]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x18007f06f
cmp word [rdx], r13w
jne 0x18007f06f
or byte [rax + rdi*8 + 0x38], cl
jmp 0x18007f074
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x18007f199
mov r11d, 0xd
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x18007f1ba
lea r9, [rdx + 2]
cmp cx, r11w
je 0x18007f0ad
mov rdx, r9
mov word [rbx], cx
jmp 0x18007f0d4
cmp r9, r8
jae 0x18007f0e4
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x18007f08e
jmp 0x18007f199
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18007f18e
cmp dword [rsp + 0x80], esi
je 0x18007f18e
lea r8, [0x1800a7870]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x18007f166
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x18007f136
mov word [rbx], r13w
jmp 0x18007f196
mov ecx, 0xd
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x18007f143
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x18007f196
cmp word [rsp + 0x70], r13w
jne 0x18007f173
cmp rbx, r14
je 0x18007f130
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.18007ef74
cmp word [rsp + 0x70], r13w
je 0x18007f199
mov ecx, 0xd
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x1800a7870]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x18007f193
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x18007f199
Function at 0x180080dac
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x180080dc2
mov al, 1
jmp 0x180080e22
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x180080dd3
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x180080e20
mov ecx, dword [rcx + 0x18]
nop
call fcn.1800854fc
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180080e20
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x180080e20
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x180080e20
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x180080e22
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x180083cd0
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x180083d00
xor eax, eax
jmp 0x180083dc3
mov rbp, rbx
cmp word [rax], si
je 0x180083d25
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x180083d0c
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x180083d08
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.180083bf0
movsxd r14, eax
test eax, eax
jne 0x180083d63
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x180083cf9
mov rcx, r14
call fcn.18007cc00
mov rdi, rax
test rax, rax
jne 0x180083d7c
xor ecx, ecx
call fcn.18007c2c4
jmp 0x180083d58
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.180083bf0
test eax, eax
jne 0x180083dad
mov rcx, rdi
call fcn.18007c2c4
jmp 0x180083db7
xor ecx, ecx
call fcn.18007c2c4
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x18008912c
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.180069ce8
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x1800891b6
cmp byte [rbp - 0x21], r15b
je 0x1800891b1
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x1800891ec
call fcn.18007c514
test eax, eax
jne 0x1800891d8
cmp byte [rbp - 0x21], r15b
je 0x1800891d0
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x1800891ec
cmp byte [rbp - 0x21], r15b
je 0x1800891e9
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.18007966c
test eax, eax
jne 0x18008928c
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.180069ce8
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x18008922b
cmp byte [rbp - 0x21], r15b
je 0x180089260
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x180089260
call fcn.18007c514
test eax, eax
jne 0x18008924c
cmp byte [rbp - 0x21], r15b
je 0x180089245
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x180089260
cmp byte [rbp - 0x21], r15b
je 0x18008925d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.18007966c
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x18008928c
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x18008928f
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x18008929d
mov rcx, rdi
call fcn.18007c2c4
cmp byte [rbp + 0x3f], r15b
je 0x1800892ac
mov rcx, qword [rbp + 0x27]
call fcn.18007c2c4
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x18008a0f4
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.18007ef74
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.18007ef74
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x18008a244
cmp rax, 0xffffffffffffffff
je 0x18008a244
xor edi, edi
test rbp, rbp
jle 0x18008a1ef
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.18007c24c
mov rbx, rax
test rax, rax
jne 0x18008a17c
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x18008a1e5
mov edx, 0x8000
mov ecx, r14d
call fcn.180089f78
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.1800805a8
cmp eax, 0xffffffff
je 0x18008a1c5
cdqe
sub rbp, rax
test rbp, rbp
jg 0x18008a18c
mov edx, r15d
mov ecx, r14d
call fcn.180089f78
jmp 0x18008a1e5
cmp byte [rsi + 0x38], dil
je 0x18008a1dc
cmp dword [rsi + 0x34], 5
jne 0x18008a1dc
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x18008a1e5
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.18007c2c4
jmp 0x18008a258
jns 0x18008a258
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.18007ef74
cmp rax, 0xffffffffffffffff
jne 0x18008a210
cmp byte [rsi + 0x30], dil
je 0x18008a258
mov edi, dword [rsi + 0x2c]
jmp 0x18008a258
mov ecx, r14d
call fcn.1800854fc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x18008a258
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x18008a258
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x18008a251
mov eax, dword [rsi + 0x2c]
jmp 0x18008a256
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.18007ef74
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x18008ac60
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x18008ac88
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x18008ac88
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x401d28
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov eax, 0
mov byte [rbp - 1], al
movzx eax, byte [rbp - 1]
cmp eax, 4
jge 0x401dcc
jmp 0x401d52
movzx eax, byte [rbp - 1]
add eax, 1
mov byte [rbp - 1], al
jmp 0x401d34
mov eax, 0
mov byte [rbp - 2], al
movzx eax, byte [rbp - 2]
cmp eax, 4
jge 0x401dc7
jmp 0x401d78
movzx eax, byte [rbp - 2]
add eax, 1
mov byte [rbp - 2], al
jmp 0x401d5a
mov rax, qword [rbp + 0x10]
movzx ecx, byte [rbp - 2]
movsxd rcx, ecx
shl rcx, 2
add rax, rcx
movzx ecx, byte [rbp - 1]
movsxd rcx, ecx
add rax, rcx
mov rcx, qword [rbp + 0x10]
movzx edx, byte [rbp - 2]
movsxd rdx, edx
shl rdx, 2
add rcx, rdx
movzx edx, byte [rbp - 1]
movsxd rdx, edx
add rcx, rdx
movzx edx, byte [rcx]
movsxd rdx, edx
lea rcx, str.cw
add rcx, rdx
movzx edx, byte [rcx]
mov byte [rax], dl
jmp 0x401d6c
jmp 0x401d46
leave
ret

Function at 0x40309b
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov eax, 0
mov byte [rbp - 1], al
movzx eax, byte [rbp - 1]
cmp eax, 4
jge 0x40314a
jmp 0x4030d0
movzx eax, byte [rbp - 1]
add eax, 1
mov byte [rbp - 1], al
jmp 0x4030b2
mov eax, 0
mov byte [rbp - 2], al
movzx eax, byte [rbp - 2]
cmp eax, 4
jge 0x403145
jmp 0x4030f6
movzx eax, byte [rbp - 2]
add eax, 1
mov byte [rbp - 2], al
jmp 0x4030d8
mov rax, qword [rbp + 0x10]
movzx ecx, byte [rbp - 2]
movsxd rcx, ecx
shl rcx, 2
add rax, rcx
movzx ecx, byte [rbp - 1]
movsxd rcx, ecx
add rax, rcx
mov rcx, qword [rbp + 0x10]
movzx edx, byte [rbp - 2]
movsxd rdx, edx
shl rdx, 2
add rcx, rdx
movzx edx, byte [rbp - 1]
movsxd rdx, edx
add rcx, rdx
movzx edx, byte [rcx]
movsxd rdx, edx
lea rcx, [0x00416423]
add rcx, rdx
movzx edx, byte [rcx]
mov byte [rax], dl
jmp 0x4030ea
jmp 0x4030c4
leave
ret

Function at 0x4030a6
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov eax, 0
mov byte [rbp - 1], al
movzx eax, byte [rbp - 1]
cmp eax, 4
jge 0x40314a
jmp 0x4030d0
movzx eax, byte [rbp - 1]
add eax, 1
mov byte [rbp - 1], al
jmp 0x4030b2
mov eax, 0
mov byte [rbp - 2], al
movzx eax, byte [rbp - 2]
cmp eax, 4
jge 0x403145
jmp 0x4030f6
movzx eax, byte [rbp - 2]
add eax, 1
mov byte [rbp - 2], al
jmp 0x4030d8
mov rax, qword [rbp + 0x10]
movzx ecx, byte [rbp - 2]
movsxd rcx, ecx
shl rcx, 2
add rax, rcx
movzx ecx, byte [rbp - 1]
movsxd rcx, ecx
add rax, rcx
mov rcx, qword [rbp + 0x10]
movzx edx, byte [rbp - 2]
movsxd rdx, edx
shl rdx, 2
add rcx, rdx
movzx edx, byte [rbp - 1]
movsxd rdx, edx
add rcx, rdx
movzx edx, byte [rcx]
movsxd rdx, edx
lea rcx, [0x00416423]
add rcx, rdx
movzx edx, byte [rcx]
mov byte [rax], dl
jmp 0x4030ea
jmp 0x4030c4
leave
ret
Function at 0x180001fe0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x60
cmp byte [0x18008b45f], 0
mov rbx, rcx
movups xmm0, xmmword [0x18008b448]
movups xmmword [rsp + 0x30], xmm0
movsd xmm0, qword [0x18008b458]
movsd qword [rsp + 0x40], xmm0
je 0x180002194
xor r8d, r8d
cmp dword [0x180095010], 2
jl 0x180002152
movdqa xmm0, xmmword [0x18008cba0]
lea rcx, [rsp + 0x34]
movdqa xmm4, xmmword [0x18008cb20]
movdqa xmm3, xmmword [0x18008d270]
movdqa xmm5, xmmword [0x18008cb70]
movdqa xmmword [rsp + 0x20], xmm0
mov edx, dword [rsp + 0x20]
movaps xmmword [rsp + 0x50], xmm6
movdqa xmm6, xmmword [0x18008cb80]
nop dword [rax]
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 8]
paddd xmm2, xmm4
add r8d, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, edx
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 0xc]
xorps xmm2, xmm0
movd dword [rcx - 0xc], xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, edx
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 8]
xorps xmm2, xmm0
movd dword [rcx - 8], xmm2
cmp r8d, 0x18
jl 0x180002060
movaps xmm6, xmmword [rsp + 0x50]
jmp 0x180002194
lea r9, [rsp + 0x30]
nop word [rax + rax]
mov eax, 0x8fb823ef
lea r9, [r9 + 1]
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x39
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x37
xor byte [r9 - 1], al
cmp r8d, 0x18
jl 0x180002160
mov rcx, qword [0x1801aeb40]
lea rdx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov rcx, rbx
call rax
add rsp, 0x60
pop rbx
ret
Function at 0x1800021c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x60
movups xmm0, xmmword [str.T_vYKLbZP___e_3]
mov eax, dword [0x18008b8e0]
xor r8d, r8d
cmp dword [0x180095010], 2
mov rbx, rcx
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x48], eax
movsd xmm0, qword [0x18008b8d8]
movzx eax, byte [0x18008b8e4]
movsd qword [rsp + 0x40], xmm0
mov qword [rsp + 0x78], r8
mov byte [rsp + 0x4c], al
jl 0x180002348
movdqa xmm0, xmmword [0x18008cba0]
lea rcx, [rsp + 0x34]
movdqa xmm4, xmmword [0x18008cb20]
movdqa xmm3, xmmword [0x18008d270]
movdqa xmm5, xmmword [0x18008cb70]
movdqa xmmword [rsp + 0x20], xmm0
mov edx, dword [rsp + 0x20]
movaps xmmword [rsp + 0x50], xmm6
movdqa xmm6, xmmword [0x18008cb80]
nop dword [rax]
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 8]
paddd xmm2, xmm4
add r8d, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, edx
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 0xc]
xorps xmm2, xmm0
movd dword [rcx - 0xc], xmm2
movd xmm2, eax
mov eax, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, edx
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 8]
xorps xmm2, xmm0
movd dword [rcx - 8], xmm2
cmp r8d, 0x18
jl 0x180002250
movaps xmm6, xmmword [rsp + 0x50]
cmp eax, 0x1d
jge 0x180002394
movsxd rax, r8d
lea r9, [rsp + 0x30]
add r9, rax
nop dword [rax]
nop word [rax + rax]
mov eax, 0x8fb823ef
lea r9, [r9 + 1]
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x39
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x37
xor byte [r9 - 1], al
cmp r8d, 0x1d
jl 0x180002360
mov rcx, qword [0x1801aeb40]
lea rdx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
lea rdx, [rsp + 0x78]
mov rcx, rbx
call rax
add rsp, 0x60
pop rbx
ret
Function at 0x1800023c0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
cmp byte [0x18008b509], 0
movups xmm0, xmmword [0x18008b4f8]
movzx eax, word [0x18008b508]
mov word [rsp + 0x40], ax
movups xmmword [rsp + 0x30], xmm0
je 0x18000256f
xor ecx, ecx
cmp dword [0x180095010], 2
jl 0x180002533
movdqa xmm0, xmmword [0x18008cba0]
lea rdx, [rsp + 0x34]
movdqa xmm4, xmmword [0x18008cb20]
movdqa xmm3, xmmword [0x18008d270]
movdqa xmm5, xmmword [0x18008cb70]
movdqa xmmword [rsp + 0x20], xmm0
mov r8d, dword [rsp + 0x20]
movaps xmmword [rsp + 0x50], xmm6
movdqa xmm6, xmmword [0x18008cb80]
nop word [rax + rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm4
add ecx, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, r8d
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movd dword [rdx - 0xc], xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, r8d
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x10
jl 0x180002440
movaps xmm6, xmmword [rsp + 0x50]
cmp ecx, 0x12
jge 0x18000256f
movsxd rax, ecx
lea r8, [rsp + 0x30]
add r8, rax
nop
mov eax, 0x8fb823ef
lea r8, [r8 + 1]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x39
movzx eax, cl
inc ecx
sub al, dl
add al, 0x37
xor byte [r8 - 1], al
cmp ecx, 0x12
jl 0x180002540
mov rcx, qword [0x1801aeb40]
lea rdx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
call rax
add rsp, 0x68
ret