joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140035120
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword gs:[0x58]
mov rbx, rdx
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400c4cc4], eax
jle 0x1400352c5
lea rcx, [0x1400c4cc4]
call fcn.1400bb6bc
cmp dword [0x1400c4cc4], 0xffffffff
jne 0x1400352c5
xor eax, eax
xor ecx, ecx
cmp dword [0x1400c4098], 2
mov qword [0x1400c7250], rax
mov dword [0x1400c7258], eax
mov byte [0x1400c725c], al
jl 0x140035269
movdqa xmm2, xmmword [0x1400bee80]
mov ecx, 8
movdqa xmm4, xmmword [0x1400beef0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beeb0]
psubd xmm2, xmm0
movd xmm0, dword [str.256352896548]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
xorps xmm2, xmm0
movd dword [0x1400c7250], xmm2
movdqa xmm2, xmmword [0x1400bee90]
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beeb0]
psubd xmm2, xmm0
movd xmm0, dword [0x1400be9b4]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
xorps xmm2, xmm0
movd dword [0x1400c7254], xmm2
movsxd r8, ecx
lea r9, [0x140000000]
nop dword [rax]
nop word [rax + rax]
mov eax, 0x8fb823ef
lea r8, [r8 + 1]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x39
movzx eax, cl
inc ecx
sub al, dl
xor al, byte [r8 + r9 + 0xbe9af]
mov byte [r8 + r9 + 0xc724f], al
cmp ecx, 0xd
jl 0x140035280
lea rcx, [0x1400c4cc4]
call fcn.1400bb650
mov eax, dword [0x1400c7258]
movsd xmm0, qword [0x1400c7250]
movsd qword [rbx], xmm0
mov dword [rbx + 8], eax
movzx eax, byte [0x1400c725c]
mov byte [rbx + 0xc], al
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x1400352f0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword gs:[0x58]
mov rbx, rdx
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400c6a40], eax
jle 0x140035495
lea rcx, [0x1400c6a40]
call fcn.1400bb6bc
cmp dword [0x1400c6a40], 0xffffffff
jne 0x140035495
xor eax, eax
xor ecx, ecx
cmp dword [0x1400c4098], 2
mov qword [0x1400c7b58], rax
mov dword [0x1400c7b60], eax
mov word [0x1400c7b64], ax
jl 0x14003543a
movdqa xmm2, xmmword [0x1400bee80]
mov ecx, 8
movdqa xmm4, xmmword [0x1400beef0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beeb0]
psubd xmm2, xmm0
movd xmm0, dword [str.1452145321253]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
xorps xmm2, xmm0
movd dword [0x1400c7b58], xmm2
movdqa xmm2, xmmword [0x1400bee90]
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beeb0]
psubd xmm2, xmm0
movd xmm0, dword [0x1400be9c4]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
xorps xmm2, xmm0
movd dword [0x1400c7b5c], xmm2
movsxd r8, ecx
lea r9, [0x140000000]
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x8fb823ef
lea r8, [r8 + 1]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x39
movzx eax, cl
inc ecx
sub al, dl
xor al, byte [r8 + r9 + 0xbe9bf]
mov byte [r8 + r9 + 0xc7b57], al
cmp ecx, 0xe
jl 0x140035450
lea rcx, [0x1400c6a40]
call fcn.1400bb650
mov eax, dword [0x1400c7b60]
movsd xmm0, qword [0x1400c7b58]
movsd qword [rbx], xmm0
mov dword [rbx + 8], eax
movzx eax, word [0x1400c7b64]
mov word [rbx + 0xc], ax
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x140035540
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword gs:[0x58]
mov rbx, rdx
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400c7c5c], eax
jle 0x1400356e5
lea rcx, [0x1400c7c5c]
call fcn.1400bb6bc
cmp dword [0x1400c7c5c], 0xffffffff
jne 0x1400356e5
xor eax, eax
xor ecx, ecx
cmp dword [0x1400c4098], 2
mov qword [0x1400c96e8], rax
mov dword [0x1400c96f0], eax
mov byte [0x1400c96f4], al
jl 0x140035689
movdqa xmm2, xmmword [0x1400bee80]
mov ecx, 8
movdqa xmm4, xmmword [0x1400beef0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beeb0]
psubd xmm2, xmm0
movd xmm0, dword [str.145625849562]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
xorps xmm2, xmm0
movd dword [0x1400c96e8], xmm2
movdqa xmm2, xmmword [0x1400bee90]
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beeb0]
psubd xmm2, xmm0
movd xmm0, dword [0x1400be9e4]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
xorps xmm2, xmm0
movd dword [0x1400c96ec], xmm2
movsxd r8, ecx
lea r9, [0x140000000]
nop dword [rax]
nop word [rax + rax]
mov eax, 0x8fb823ef
lea r8, [r8 + 1]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x39
movzx eax, cl
inc ecx
sub al, dl
xor al, byte [r8 + r9 + 0xbe9df]
mov byte [r8 + r9 + 0xc96e7], al
cmp ecx, 0xd
jl 0x1400356a0
lea rcx, [0x1400c7c5c]
call fcn.1400bb650
mov eax, dword [0x1400c96f0]
movsd xmm0, qword [0x1400c96e8]
movsd qword [rbx], xmm0
mov dword [rbx + 8], eax
movzx eax, byte [0x1400c96f4]
mov byte [rbx + 0xc], al
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x140035710
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword gs:[0x58]
mov rbx, rdx
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400c6618], eax
jle 0x1400358ea
lea rcx, [0x1400c6618]
call fcn.1400bb6bc
cmp dword [0x1400c6618], 0xffffffff
jne 0x1400358ea
xor r9d, r9d
lea r10, [0x140000000]
cmp dword [0x1400c4098], 2
xorps xmm0, xmm0
movups xmmword [0x1400c6698], xmm0
jl 0x14003589b
movdqa xmm5, xmmword [0x1400bee80]
mov ecx, r9d
movdqa xmm4, xmmword [0x1400beef0]
movaps xmmword [rsp + 0x30], xmm6
movdqa xmm6, xmmword [0x1400beeb0]
movaps xmmword [rsp + 0x20], xmm7
movdqa xmm7, xmmword [0x1400beec0]
movd xmm2, r9d
lea eax, [r9 + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
paddd xmm3, xmm5
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
add r9d, 8
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
pmulld xmm0, xmm6
psubd xmm2, xmm0
movd xmm0, dword [rcx + r10 + 0xbe9e8]
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rcx + r10 + 0xc6690], xmm2
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
movd xmm0, dword [rcx + r10 + 0xbe9ec]
andps xmm3, xmm7
packuswb xmm3, xmm3
packuswb xmm3, xmm3
xorps xmm3, xmm0
movd dword [rcx + r10 + 0xc6694], xmm3
cmp r9d, 0x10
jl 0x1400357a0
movaps xmm7, xmmword [rsp + 0x20]
movaps xmm6, xmmword [rsp + 0x30]
jmp 0x1400358de
mov r8d, r9d
nop
mov eax, 0x8fb823ef
lea r9, [r9 + 1]
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x39
movzx eax, r8b
inc r8d
sub al, cl
xor al, byte [r9 + r10 + 0xbe9ef]
mov byte [r9 + r10 + 0xc6697], al
cmp r8d, 0x10
jl 0x1400358a0
lea rcx, [0x1400c6618]
call fcn.1400bb650
movups xmm0, xmmword [0x1400c6698]
mov rax, rbx
movups xmmword [rbx], xmm0
add rsp, 0x40
pop rbx
ret
Function at 0x140035900
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword gs:[0x58]
mov rbx, rdx
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400c8630], eax
jle 0x140035aa5
lea rcx, [0x1400c8630]
call fcn.1400bb6bc
cmp dword [0x1400c8630], 0xffffffff
jne 0x140035aa5
xor eax, eax
xor ecx, ecx
cmp dword [0x1400c4098], 2
mov qword [0x1400cade0], rax
mov dword [0x1400cade8], eax
mov word [0x1400cadec], ax
jl 0x140035a52
movdqa xmm2, xmmword [0x1400bee80]
mov ecx, 8
movdqa xmm4, xmmword [0x1400beee0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beea0]
psubd xmm2, xmm0
movd xmm0, dword [str.EncodePointer]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400beed0]
xorps xmm2, xmm0
movd dword [0x1400cade0], xmm2
movdqa xmm2, xmmword [0x1400bee90]
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beea0]
psubd xmm2, xmm0
movd xmm0, dword [0x1400be92c]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400beed0]
xorps xmm2, xmm0
movd dword [0x1400cade4], xmm2
movsxd r8, ecx
lea r9, [0x140000000]
nop dword [rax]
mov eax, 0x4ec4ec4f
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x34
movzx eax, cl
inc ecx
sub al, dl
add al, 0x38
xor al, byte [r8 + r9 + 0xbe927]
mov byte [r8 + r9 + 0xcaddf], al
cmp ecx, 0xe
jl 0x140035a60
lea rcx, [0x1400c8630]
call fcn.1400bb650
mov eax, dword [0x1400cade8]
movsd xmm0, qword [0x1400cade0]
movsd qword [rbx], xmm0
mov dword [rbx + 8], eax
movzx eax, word [0x1400cadec]
mov word [rbx + 0xc], ax
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x140035ad0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword gs:[0x58]
mov rbx, rdx
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400c7de4], eax
jle 0x140035c75
lea rcx, [0x1400c7de4]
call fcn.1400bb6bc
cmp dword [0x1400c7de4], 0xffffffff
jne 0x140035c75
xor eax, eax
xor ecx, ecx
cmp dword [0x1400c4098], 2
mov qword [0x1400c9d58], rax
mov dword [0x1400c9d60], eax
mov byte [0x1400c9d64], al
jl 0x140035c21
movdqa xmm2, xmmword [0x1400bee80]
mov ecx, 8
movdqa xmm4, xmmword [0x1400beee0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beea0]
psubd xmm2, xmm0
movd xmm0, dword [str.kernel32.dll]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400beed0]
xorps xmm2, xmm0
movd dword [0x1400c9d58], xmm2
movdqa xmm2, xmmword [0x1400bee90]
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beea0]
psubd xmm2, xmm0
movd xmm0, dword [0x1400be93c]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400beed0]
xorps xmm2, xmm0
movd dword [0x1400c9d5c], xmm2
movsxd r8, ecx
lea r9, [0x140000000]
nop dword [rax + rax]
mov eax, 0x4ec4ec4f
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x34
movzx eax, cl
inc ecx
sub al, dl
add al, 0x38
xor al, byte [r8 + r9 + 0xbe937]
mov byte [r8 + r9 + 0xc9d57], al
cmp ecx, 0xd
jl 0x140035c30
lea rcx, [0x1400c7de4]
call fcn.1400bb650
mov eax, dword [0x1400c9d60]
movsd xmm0, qword [0x1400c9d58]
movsd qword [rbx], xmm0
mov dword [rbx + 8], eax
movzx eax, byte [0x1400c9d64]
mov byte [rbx + 0xc], al
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x140035ca0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword gs:[0x58]
mov rbx, rdx
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400c92a4], eax
jle 0x140035e3a
lea rcx, [0x1400c92a4]
call fcn.1400bb6bc
cmp dword [0x1400c92a4], 0xffffffff
jne 0x140035e3a
xor eax, eax
xor r9d, r9d
cmp dword [0x1400c4098], 2
mov qword [0x1400c8b08], rax
jl 0x140035ddb
movdqa xmm2, xmmword [0x1400bee80]
movdqa xmm4, xmmword [0x1400beef0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beeb0]
psubd xmm2, xmm0
movd xmm0, dword [str.ret2er2]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
xorps xmm2, xmm0
movd dword [0x1400c8b08], xmm2
movdqa xmm2, xmmword [0x1400bee90]
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beeb0]
psubd xmm2, xmm0
movd xmm0, dword [0x1400bea04]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
xorps xmm2, xmm0
movd dword [0x1400c8b0c], xmm2
jmp 0x140035e2e
mov r8d, r9d
lea r10, [0x140000000]
nop word [rax + rax]
mov eax, 0x8fb823ef
lea r9, [r9 + 1]
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x39
movzx eax, r8b
inc r8d
sub al, cl
xor al, byte [r9 + r10 + 0xbe9ff]
mov byte [r9 + r10 + 0xc8b07], al
cmp r8d, 8
jl 0x140035df0
lea rcx, [0x1400c92a4]
call fcn.1400bb650
mov rax, qword [0x1400c8b08]
mov qword [rbx], rax
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x140035fe0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword gs:[0x58]
mov rbx, rdx
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400c9e54], eax
jle 0x140036185
lea rcx, [0x1400c9e54]
call fcn.1400bb6bc
cmp dword [0x1400c9e54], 0xffffffff
jne 0x140036185
xor eax, eax
xor ecx, ecx
cmp dword [0x1400c4098], 2
mov qword [0x1400c58d0], rax
mov dword [0x1400c58d8], eax
mov byte [0x1400c58dc], al
jl 0x140036129
movdqa xmm2, xmmword [0x1400bee80]
mov ecx, 8
movdqa xmm4, xmmword [0x1400beef0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beeb0]
psubd xmm2, xmm0
movd xmm0, dword [str.kernel32.dll]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
xorps xmm2, xmm0
movd dword [0x1400c58d0], xmm2
movdqa xmm2, xmmword [0x1400bee90]
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beeb0]
psubd xmm2, xmm0
movd xmm0, dword [0x1400be93c]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
xorps xmm2, xmm0
movd dword [0x1400c58d4], xmm2
movsxd r8, ecx
lea r9, [0x140000000]
nop dword [rax]
nop word [rax + rax]
mov eax, 0x8fb823ef
lea r8, [r8 + 1]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x39
movzx eax, cl
inc ecx
sub al, dl
xor al, byte [r8 + r9 + 0xbe937]
mov byte [r8 + r9 + 0xc58cf], al
cmp ecx, 0xd
jl 0x140036140
lea rcx, [0x1400c9e54]
call fcn.1400bb650
mov eax, dword [0x1400c58d8]
movsd xmm0, qword [0x1400c58d0]
movsd qword [rbx], xmm0
mov dword [rbx + 8], eax
movzx eax, byte [0x1400c58dc]
mov byte [rbx + 0xc], al
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x1400361b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword gs:[0x58]
mov rbx, rdx
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400ca368], eax
jle 0x140036355
lea rcx, [0x1400ca368]
call fcn.1400bb6bc
cmp dword [0x1400ca368], 0xffffffff
jne 0x140036355
xor eax, eax
xor ecx, ecx
cmp dword [0x1400c4098], 2
mov qword [0x1400c7078], rax
mov dword [0x1400c7080], eax
mov word [0x1400c7084], ax
jl 0x140036302
movdqa xmm2, xmmword [0x1400bee80]
mov ecx, 8
movdqa xmm4, xmmword [0x1400beee0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beea0]
psubd xmm2, xmm0
movd xmm0, dword [str.EncodePointer]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400beed0]
xorps xmm2, xmm0
movd dword [0x1400c7078], xmm2
movdqa xmm2, xmmword [0x1400bee90]
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beea0]
psubd xmm2, xmm0
movd xmm0, dword [0x1400be92c]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400beed0]
xorps xmm2, xmm0
movd dword [0x1400c707c], xmm2
movsxd r8, ecx
lea r9, [0x140000000]
nop dword [rax]
mov eax, 0x4ec4ec4f
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x34
movzx eax, cl
inc ecx
sub al, dl
add al, 0x38
xor al, byte [r8 + r9 + 0xbe927]
mov byte [r8 + r9 + 0xc7077], al
cmp ecx, 0xe
jl 0x140036310
lea rcx, [0x1400ca368]
call fcn.1400bb650
mov eax, dword [0x1400c7080]
movsd xmm0, qword [0x1400c7078]
movsd qword [rbx], xmm0
mov dword [rbx + 8], eax
movzx eax, word [0x1400c7084]
mov word [rbx + 0xc], ax
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x140036380
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword gs:[0x58]
mov rbx, rdx
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400c703c], eax
jle 0x140036525
lea rcx, [0x1400c703c]
call fcn.1400bb6bc
cmp dword [0x1400c703c], 0xffffffff
jne 0x140036525
xor eax, eax
xor ecx, ecx
cmp dword [0x1400c4098], 2
mov qword [0x1400ca7a0], rax
mov dword [0x1400ca7a8], eax
mov byte [0x1400ca7ac], al
jl 0x1400364d1
movdqa xmm2, xmmword [0x1400bee80]
mov ecx, 8
movdqa xmm4, xmmword [0x1400beee0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beea0]
psubd xmm2, xmm0
movd xmm0, dword [str.kernel32.dll]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400beed0]
xorps xmm2, xmm0
movd dword [0x1400ca7a0], xmm2
movdqa xmm2, xmmword [0x1400bee90]
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beea0]
psubd xmm2, xmm0
movd xmm0, dword [0x1400be93c]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400beed0]
xorps xmm2, xmm0
movd dword [0x1400ca7a4], xmm2
movsxd r8, ecx
lea r9, [0x140000000]
nop dword [rax + rax]
mov eax, 0x4ec4ec4f
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x34
movzx eax, cl
inc ecx
sub al, dl
add al, 0x38
xor al, byte [r8 + r9 + 0xbe937]
mov byte [r8 + r9 + 0xca79f], al
cmp ecx, 0xd
jl 0x1400364e0
lea rcx, [0x1400c703c]
call fcn.1400bb650
mov eax, dword [0x1400ca7a8]
movsd xmm0, qword [0x1400ca7a0]
movsd qword [rbx], xmm0
mov dword [rbx + 8], eax
movzx eax, byte [0x1400ca7ac]
mov byte [rbx + 0xc], al
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x1400b0be0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x58
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x68], 0
je 0x1400b0c1e
mov r8, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x1400b0d9a
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 0x40]
cmp qword [rax], 0
je 0x1400b0c4b
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 0x58]
mov eax, dword [rax]
mov dword [rsp + 0x20], eax
jmp 0x1400b0c53
mov dword [rsp + 0x20], 0
movsxd rax, dword [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x80], 0
jle 0x1400b0d33
cmp qword [rsp + 0x28], 0
jle 0x1400b0d33
mov rax, qword [rsp + 0x28]
cmp qword [rsp + 0x80], rax
jge 0x1400b0c9e
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 0x40]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x28]
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x80]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 0x58]
mov ecx, dword [rsp + 0x28]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 0x58]
mov dword [rcx], eax
movsxd rax, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 0x40]
add rax, qword [rcx]
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 0x40]
mov qword [rcx], rax
cmp qword [rsp + 0x80], 0
jle 0x1400b0d87
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x80], 0
je 0x1400b0d87
mov rax, qword [rsp + 0x70]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x80]
mov edx, 1
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, qword [rsp + 0x80]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
add rsp, 0x58
pop rdi
pop rsi
ret