joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000d1c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140040040]
xor rax, rsp
mov qword [rsp + 0x40], rax
movsd xmm0, qword [str.8pXPWY]
xor r9d, r9d
cmp byte [0x140035d43], r9b
mov eax, dword [0x140035d40]
mov rsi, qword [0x140041480]
movsd qword [rsp + 0x30], xmm0
mov dword [rsp + 0x38], eax
je 0x14000d35d
cmp dword [0x140040098], 2
mov ecx, r9d
jl 0x14000d31d
movdqa xmm2, xmmword [0x140036070]
mov ecx, 8
movdqa xmm4, xmmword [0x1400360d0]
movdqa xmm1, xmm2
movdqa xmm3, xmmword [0x140036080]
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x140036090]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [str.8pXPWY]
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x1400360b0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.2222222222222222]
xorps xmm2, xmm0
punpckldq xmm1, xmm3
movd dword [rsp + 0x30], xmm2
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x140036090]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [rsp + 0x34]
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400360b0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.2222222222222222]
xorps xmm2, xmm0
movd dword [rsp + 0x34], xmm2
movsxd rax, ecx
lea r8, [rsp + 0x30]
add r8, rax
nop dword [rax + rax]
mov eax, 0x4bda12f7
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x36
movzx eax, cl
inc ecx
sub al, dl
add al, 0x32
xor byte [r8 - 1], al
cmp ecx, 0xc
jl 0x14000d330
mov dword [rsp + 0x28], r9d
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r9
mov rbp, 0xffffffffffffffff
mov r9d, ebp
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov eax, 2
mul rbx
cmovo rax, rbp
mov rcx, rax
call fcn.14002e0cc
mov r9d, ebp
mov dword [rsp + 0x28], ebx
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r9, rdi
xor r8d, r8d
mov edx, 0xc2
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, rdi
call fcn.14002dd70
mov al, 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14002dd50
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x14000d400
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x140040040]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov eax, dword [0x140035360]
xor r9d, r9d
cmp dword [0x140040098], 2
mov ecx, r9d
movups xmm0, xmmword [0x140035340]
mov rsi, qword [0x140041480]
movups xmm1, xmmword [0x140035350]
mov dword [rsp + 0x60], eax
movzx eax, byte [0x140035364]
movups xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x64], al
movups xmmword [rsp + 0x50], xmm1
jl 0x14000d5b9
movdqa xmm0, xmmword [str.2222222222222222]
lea rdx, [rsp + 0x40]
movdqa xmm5, xmmword [0x140036070]
movdqa xmm4, xmmword [0x1400360d0]
movdqa xmmword [rsp + 0x30], xmm0
mov r8d, dword [rsp + 0x30]
movaps xmmword [rsp + 0x70], xmm6
movdqa xmm6, xmmword [0x140036090]
nop dword [rax]
nop word [rax + rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x1400360b0]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 8], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400360b0]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 4]
xorps xmm2, xmm0
movd dword [rdx - 4], xmm2
cmp ecx, 0x20
jl 0x14000d4b0
movaps xmm6, xmmword [rsp + 0x70]
cmp ecx, 0x25
jge 0x14000d5fd
movsxd rax, ecx
lea r8, [rsp + 0x40]
add r8, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x4bda12f7
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x36
movzx eax, cl
inc ecx
sub al, dl
add al, 0x32
xor byte [r8 - 1], al
cmp ecx, 0x25
jl 0x14000d5d0
mov dword [rsp + 0x28], r9d
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], r9
mov rbp, 0xffffffffffffffff
mov r9d, ebp
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov eax, 2
mul rbx
cmovo rax, rbp
mov rcx, rax
call fcn.14002e0cc
mov r9d, ebp
mov dword [rsp + 0x28], ebx
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r9, rdi
xor r8d, r8d
mov edx, 0xc2
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, rdi
call fcn.14002dd70
mov al, 1
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14002dd50
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14000d6a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140040040]
xor rax, rsp
mov qword [rsp + 0x40], rax
movsd xmm0, qword [0x1400358b8]
xor r9d, r9d
cmp byte [0x1400358c3], r9b
mov eax, dword [0x1400358c0]
mov rsi, qword [0x140041480]
movsd qword [rsp + 0x30], xmm0
mov dword [rsp + 0x38], eax
je 0x14000d83d
cmp dword [0x140040098], 2
mov ecx, r9d
jl 0x14000d7fd
movdqa xmm2, xmmword [0x140036070]
mov ecx, 8
movdqa xmm4, xmmword [0x1400360d0]
movdqa xmm1, xmm2
movdqa xmm3, xmmword [0x140036080]
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x140036090]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [0x1400358b8]
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x1400360b0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.2222222222222222]
xorps xmm2, xmm0
punpckldq xmm1, xmm3
movd dword [rsp + 0x30], xmm2
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x140036090]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [rsp + 0x34]
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400360b0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.2222222222222222]
xorps xmm2, xmm0
movd dword [rsp + 0x34], xmm2
movsxd rax, ecx
lea r8, [rsp + 0x30]
add r8, rax
nop dword [rax + rax]
mov eax, 0x4bda12f7
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x36
movzx eax, cl
inc ecx
sub al, dl
add al, 0x32
xor byte [r8 - 1], al
cmp ecx, 0xc
jl 0x14000d810
mov dword [rsp + 0x28], r9d
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r9
mov rbp, 0xffffffffffffffff
mov r9d, ebp
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov eax, 2
mul rbx
cmovo rax, rbp
mov rcx, rax
call fcn.14002e0cc
mov r9d, ebp
mov dword [rsp + 0x28], ebx
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r9, rdi
xor r8d, r8d
mov edx, 0xc2
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, rdi
call fcn.14002dd70
mov al, 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14002dd50
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x14000dbb0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140040040]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov eax, dword [0x1400356e8]
xor r9d, r9d
cmp dword [0x140040098], 2
mov ecx, r9d
movsd xmm0, qword [0x1400356e0]
mov rsi, qword [0x140041480]
mov dword [rsp + 0x38], eax
movzx eax, word [0x1400356ec]
mov word [rsp + 0x3c], ax
movzx eax, byte [0x1400356ee]
mov byte [rsp + 0x3e], al
movsd qword [rsp + 0x30], xmm0
jl 0x14000dd17
movdqa xmm2, xmmword [0x140036070]
mov ecx, 8
movdqa xmm4, xmmword [0x1400360d0]
movdqa xmm1, xmm2
movdqa xmm3, xmmword [0x140036080]
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x140036090]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [0x1400356e0]
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x1400360b0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.2222222222222222]
xorps xmm2, xmm0
punpckldq xmm1, xmm3
movd dword [rsp + 0x30], xmm2
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x140036090]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [rsp + 0x34]
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400360b0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.2222222222222222]
xorps xmm2, xmm0
movd dword [rsp + 0x34], xmm2
movsxd rax, ecx
lea r8, [rsp + 0x30]
add r8, rax
nop dword [rax]
nop word [rax + rax]
mov eax, 0x4bda12f7
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x36
movzx eax, cl
inc ecx
sub al, dl
add al, 0x32
xor byte [r8 - 1], al
cmp ecx, 0xf
jl 0x14000dd30
mov dword [rsp + 0x28], r9d
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r9
mov rbp, 0xffffffffffffffff
mov r9d, ebp
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov eax, 2
mul rbx
cmovo rax, rbp
mov rcx, rax
call fcn.14002e0cc
mov r9d, ebp
mov dword [rsp + 0x28], ebx
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r9, rdi
xor r8d, r8d
mov edx, 0xc2
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, rdi
call fcn.14002dd70
mov al, 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14002dd50
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x14000e0b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x140040040]
xor rax, rsp
mov qword [rsp + 0x58], rax
movzx eax, word [0x140035338]
xor r9d, r9d
cmp dword [0x140040098], 2
mov ecx, r9d
movups xmm0, xmmword [str.8__TDCMI]
mov rsi, qword [0x140041480]
mov word [rsp + 0x50], ax
movzx eax, byte [0x14003533a]
mov byte [rsp + 0x52], al
movups xmmword [rsp + 0x40], xmm0
jl 0x14000e259
movdqa xmm0, xmmword [str.2222222222222222]
lea rdx, [rsp + 0x40]
movdqa xmm5, xmmword [0x140036070]
movdqa xmm4, xmmword [0x1400360d0]
movdqa xmmword [rsp + 0x30], xmm0
mov r8d, dword [rsp + 0x30]
movaps xmmword [rsp + 0x60], xmm6
movdqa xmm6, xmmword [0x140036090]
nop word [rax + rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x1400360b0]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 8], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400360b0]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 4]
xorps xmm2, xmm0
movd dword [rdx - 4], xmm2
cmp ecx, 0x10
jl 0x14000e150
movaps xmm6, xmmword [rsp + 0x60]
cmp ecx, 0x13
jge 0x14000e29d
movsxd rax, ecx
lea r8, [rsp + 0x40]
add r8, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x4bda12f7
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x36
movzx eax, cl
inc ecx
sub al, dl
add al, 0x32
xor byte [r8 - 1], al
cmp ecx, 0x13
jl 0x14000e270
mov dword [rsp + 0x28], r9d
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], r9
mov rbp, 0xffffffffffffffff
mov r9d, ebp
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov eax, 2
mul rbx
cmovo rax, rbp
mov rcx, rax
call fcn.14002e0cc
mov r9d, ebp
mov dword [rsp + 0x28], ebx
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r9, rdi
xor r8d, r8d
mov edx, 0xc2
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, rdi
call fcn.14002dd70
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14002dd50
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14000e340
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x140040040]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov eax, dword [0x140035eb8]
xor r9d, r9d
cmp dword [0x140040098], 2
mov ecx, r9d
movups xmm0, xmmword [str.a__B]
mov rsi, qword [0x140041480]
movups xmm1, xmmword [0x140035ea8]
mov dword [rsp + 0x60], eax
movzx eax, word [0x140035ebc]
movups xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x64], ax
movups xmmword [rsp + 0x50], xmm1
jl 0x14000e4f9
movdqa xmm0, xmmword [str.2222222222222222]
lea rdx, [rsp + 0x40]
movdqa xmm5, xmmword [0x140036070]
movdqa xmm4, xmmword [0x1400360d0]
movdqa xmmword [rsp + 0x30], xmm0
mov r8d, dword [rsp + 0x30]
movaps xmmword [rsp + 0x70], xmm6
movdqa xmm6, xmmword [0x140036090]
nop dword [rax]
nop word [rax + rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x1400360b0]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 8], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400360b0]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 4]
xorps xmm2, xmm0
movd dword [rdx - 4], xmm2
cmp ecx, 0x20
jl 0x14000e3f0
movaps xmm6, xmmword [rsp + 0x70]
cmp ecx, 0x26
jge 0x14000e53d
movsxd rax, ecx
lea r8, [rsp + 0x40]
add r8, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x4bda12f7
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x36
movzx eax, cl
inc ecx
sub al, dl
add al, 0x32
xor byte [r8 - 1], al
cmp ecx, 0x26
jl 0x14000e510
mov dword [rsp + 0x28], r9d
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], r9
mov rbp, 0xffffffffffffffff
mov r9d, ebp
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov eax, 2
mul rbx
cmovo rax, rbp
mov rcx, rax
call fcn.14002e0cc
mov r9d, ebp
mov dword [rsp + 0x28], ebx
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r9, rdi
xor r8d, r8d
mov edx, 0xc2
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, rdi
call fcn.14002dd70
mov al, 1
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14002dd50
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14000e8b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x140040040]
xor rax, rsp
mov qword [rsp + 0x50], rax
movups xmm0, xmmword [str.8rde]
mov rsi, qword [0x140041480]
xor r9d, r9d
movups xmmword [rsp + 0x40], xmm0
psrldq xmm0, 0xf
movd eax, xmm0
test al, al
je 0x14000ea7d
cmp dword [0x140040098], 2
jl 0x14000ea46
movdqa xmm0, xmmword [str.2222222222222222]
lea rcx, [rsp + 0x40]
movdqa xmm5, xmmword [0x140036070]
mov edx, r9d
movdqa xmm4, xmmword [0x1400360d0]
movdqa xmmword [rsp + 0x30], xmm0
mov r8d, dword [rsp + 0x30]
movaps xmmword [rsp + 0x60], xmm6
movdqa xmm6, xmmword [0x140036090]
nop
movd xmm2, edx
lea eax, [rdx + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add edx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x1400360b0]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rcx - 8]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rcx - 8], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400360b0]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
cmp edx, 0x10
jl 0x14000e940
movaps xmm6, xmmword [rsp + 0x60]
jmp 0x14000ea7d
lea r8, [rsp + 0x40]
mov ecx, r9d
nop
mov eax, 0x4bda12f7
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x36
movzx eax, cl
inc ecx
sub al, dl
add al, 0x32
xor byte [r8 - 1], al
cmp ecx, 0x10
jl 0x14000ea50
mov dword [rsp + 0x28], r9d
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], r9
mov rbp, 0xffffffffffffffff
mov r9d, ebp
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov eax, 2
mul rbx
cmovo rax, rbp
mov rcx, rax
call fcn.14002e0cc
mov r9d, ebp
mov dword [rsp + 0x28], ebx
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r9, rdi
xor r8d, r8d
mov edx, 0xc2
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, rdi
call fcn.14002dd70
mov al, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14002dd50
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14000eb20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x140040040]
xor rax, rsp
mov qword [rsp + 0x68], rax
movups xmm0, xmmword [0x140035e60]
mov eax, dword [0x140035e80]
xor r9d, r9d
cmp dword [0x140040098], 2
mov ecx, r9d
movups xmm1, xmmword [0x140035e70]
mov rsi, qword [0x140041480]
movups xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x60], eax
movups xmmword [rsp + 0x50], xmm1
jl 0x14000ecc9
movdqa xmm0, xmmword [str.2222222222222222]
lea rdx, [rsp + 0x40]
movdqa xmm5, xmmword [0x140036070]
movdqa xmm4, xmmword [0x1400360d0]
movdqa xmmword [rsp + 0x30], xmm0
mov r8d, dword [rsp + 0x30]
movaps xmmword [rsp + 0x70], xmm6
movdqa xmm6, xmmword [0x140036090]
nop word [rax + rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x1400360b0]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 8], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400360b0]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 4]
xorps xmm2, xmm0
movd dword [rdx - 4], xmm2
cmp ecx, 0x20
jl 0x14000ebc0
movaps xmm6, xmmword [rsp + 0x70]
cmp ecx, 0x24
jge 0x14000ed0d
movsxd rax, ecx
lea r8, [rsp + 0x40]
add r8, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x4bda12f7
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x36
movzx eax, cl
inc ecx
sub al, dl
add al, 0x32
xor byte [r8 - 1], al
cmp ecx, 0x24
jl 0x14000ece0
mov dword [rsp + 0x28], r9d
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], r9
mov rbp, 0xffffffffffffffff
mov r9d, ebp
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov eax, 2
mul rbx
cmovo rax, rbp
mov rcx, rax
call fcn.14002e0cc
mov r9d, ebp
mov dword [rsp + 0x28], ebx
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r9, rdi
xor r8d, r8d
mov edx, 0xc2
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, rdi
call fcn.14002dd70
mov al, 1
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14002dd50
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret