joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000480c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x50
mov rbx, qword [0x140010ee0]
mov rdi, qword [0x140010ef0]
mov rcx, rbx
and qword [rax - 0x20], 0
and qword [rax - 0x10], 0
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
nop dword [rax + rax]
mov esi, eax
cmp eax, 0xffffffff
je 0x1400048e9
bt eax, 0xe
jae 0x1400048e9
call qword [sym.imp.KERNEL32.dll_GetACP]
nop dword [rax + rax]
lea r8, [rsp + 0x38]
mov rcx, rbx
mov edx, eax
call fcn.140002994
mov rbx, qword [rsp + 0x38]
test eax, eax
js 0x1400048d5
call qword [sym.imp.KERNEL32.dll_GetACP]
nop dword [rax + rax]
lea r8, [rsp + 0x48]
mov rcx, rdi
mov edx, eax
call fcn.140002994
mov rdi, qword [rsp + 0x48]
test eax, eax
js 0x1400048c1
and qword [rsp + 0x20], 0
mov r9d, esi
mov r8d, 3
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.ext_ms_win_feclient_encryptedfile_l1_1_0.dll_EfsClientDuplicateEncryptionInfo]
nop dword [rax + rax]
test rdi, rdi
je 0x1400048d5
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
test rbx, rbx
je 0x1400048e9
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x14000580c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
sub rsp, 0x20
xor r9d, r9d
lea rdx, [0x14000b780]
mov rbx, rcx
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
nop dword [rax + rax]
test rax, rax
jne 0x14000583b
add rsp, 0x20
pop rbx
ret
mov rdx, rax
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_LoadResource]
Function at 0x140005948
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x14000f008]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov eax, dword [0x140010e3c]
test eax, eax
jne 0x140005a4c
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x118
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
nop dword [rax + rax]
test eax, eax
jne 0x1400059b7
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
nop dword [rax + rax]
mov ecx, dword [rsp + 0x30]
xor eax, eax
mov edx, dword [rsp + 0x24]
mov dword [0x140010e3c], eax
sub ecx, 1
je 0x140005a28
cmp ecx, 1
jne 0x140005a4c
cmp edx, 5
jne 0x140005a16
mov eax, dword [rsp + 0x28]
test eax, eax
je 0x140005a0f
sub eax, ecx
je 0x1400059f5
cmp eax, ecx
je 0x1400059eb
lea eax, [rdx + 0xf]
jmp 0x140005a6a
mov edx, FDICreate
lea ecx, [rdx - 0xf]
jmp 0x1400059fd
mov edx, 8
lea ecx, [rdx - 6]
xor eax, eax
cmp word [rsp + 0x134], cx
cmovae eax, edx
or eax, 4
jmp 0x140005a6a
mov eax, 4
jmp 0x140005a6a
cmp edx, 4
ja 0x140005a65
mov ecx, 2
mov eax, ecx
mov dword [0x140010e3c], ecx
cmp edx, 4
jne 0x140005a4c
mov ecx, dword [rsp + 0x28]
test ecx, ecx
je 0x140005a3f
cmp ecx, 0xa
je 0x140005a3f
cmp ecx, 0x5a
jne 0x140005a4c
mov ecx, 1
mov eax, ecx
mov dword [0x140010e3c], ecx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400070f0
add rsp, 0x158
ret
mov eax, 0x20
mov dword [0x140010e3c], eax
jmp 0x140005a4c

Function at 0x1400066e0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x80
mov rdi, rdx
mov r8d, 0x30
lea rdx, [rsp + 0x20]
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
nop dword [rax + rax]
test rax, rax
jne 0x140006714
lea ecx, [rax + 0x19]
int 0x29
test byte [rsp + 0x44], 0x44
je 0x140006773
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
nop dword [rax + rax]
mov r9d, dword [rsp + 0x54]
xor edx, edx
mov r8d, r9d
neg r8
and r8, rbx
lea ecx, [r9 - 1]
mov eax, ecx
and ecx, ebx
and eax, edi
add eax, ecx
dec rax
add rax, r9
div r9
xor edx, edx
mov rcx, rax
mov rax, rdi
div r9
add rcx, rax
mov eax, ecx
test ecx, ecx
je 0x140006773
lock or dword [r8], 0
add r8, r9
sub rax, 1
jne 0x140006765
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret
Function at 0x14000678c
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movsxd r8, dword [0x14000003c]
lea rdi, [0x140000000]
add r8, rdi
mov rsi, rdx
mov ebp, ecx
cmp dword [r8 + 0x84], 0xd
jbe 0x14000687a
mov r9d, dword [r8 + 0xf0]
test r9d, r9d
je 0x14000687a
movzx eax, word [r8 + 0x14]
lea rcx, [r8 + 0x18]
mov r10d, dword [r9 + rdi + 0xc]
add rcx, rax
movzx r11d, word [r8 + 6]
xor r9d, r9d
test r11d, r11d
je 0x140006813
mov r8d, dword [rcx + 0xc]
cmp r10d, r8d
jb 0x140006807
mov edx, dword [rcx + 8]
lea eax, [rdx + r8]
cmp r10d, eax
jb 0x14000684c
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x1400067f2
mov eax, dword [rsp + 0x40]
xor ebx, ebx
mov edx, dword [rsp + 0x40]
test rbx, rbx
je 0x14000687a
cmp dword [0x140010eb0], 0
jne 0x140006855
mov dword [0x140010eb0], 1
test eax, eax
js 0x140006840
mov ecx, 0x19
int 0x29
mov rcx, rbx
mov edi, edx
call fcn.1400066e0
jmp 0x140006857
mov eax, dword [rcx + 0x24]
lea rbx, [rdi + r8]
jmp 0x14000681d
mov edi, edx
mov r9, rsi
mov r8d, ebp
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
nop dword [rax + rax]
test eax, eax
jne 0x140006880
lea ecx, [rax + 0x19]
int 0x29
jmp 0x140006880
mov dword [rsi], 4
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x1400070c0
Capabilities:
Access peb ldr_data

Disassembly:
push r12
push r14
push r15
sub r12, r12
add r12, 0x60
mov r14, qword gs:[r12]
push r11
mov r11, qword [r14 + 0x10]
add r14, 0x18
mov r15, qword [r14]
mov r12, r15
add r12, 0x10
mov r14, qword [r12]
push rax
mov r12, qword [r14 + 0x30]
cmp r12, 0
cmp esp, 0
je 0x14000711a
mov r15, qword [r14 + 0x60]
mov rax, qword [r15]
and eax, 0xdf00df
mov r15, qword [r15 + 0xb]
add r15d, eax
shr r15d, 2
sub r15d, 0xc914cd2
cmp r15, 0
je 0x140007122
mov r14, qword [r14]
jmp 0x1400070eb
mov r14d, dword [r12 + 0x3c]
add r14, r12
add r14, 0x10
mov r15d, dword [r14 + 0x78]
add r15, r12
push r10
mov eax, dword [r15 + 0x20]
add rax, r12
mov r10d, dword [rax]
add r10, r12
mov r14d, dword [r10 + 0xb]
sub r14d, 0x746365
cmp r14d, 0
jne 0x140007157
jmp 0x140007165
inc rax
inc rax
inc rax
inc rax
jmp 0x14000713e
mov r14d, dword [r15 + 0x20]
sub rax, r14
sub rax, r12
shr eax, 1
mov r14d, dword [r15 + 0x24]
add r14, rax
add r14, r12
mov eax, dword [r14]
mov r14d, dword [r15 + 0x1c]
shl eax, 0x10
shr eax, 0xe
add r14, r12
add r14, rax
mov eax, dword [r14]
add rax, r12
mov r14d, 0x7a000
add r14, r11
push r12
push r11
push r14
push r10
push r10
push rax
mov rcx, r14
mov r9, rsp
mov r8d, 0x40
mov edx, 0x55000
call rax
pop r15
pop r10
pop r10
pop r14
pop r11
mov r12d, 0x10a6
push rax
movabs r15, 0x3ae00
mov eax, reloc.Cabinet.dll_FDIIsCabinet
imul r12, rax
movabs rax, 0x1073
add rax, r11
add r12, rax
call fcn.14000721c
mov r12d, 0x52c11
movabs r14, 0xba000
add r12, r11
mov r15d, 0x3b30
add r14, r11
call fcn.14000721c
pop rax
jmp 0x140007242
mov r12d, 0x8000000
mov r15d, 0x56
Function at 0x180005a90
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
xor r8d, r8d
movaps xmmword [rsp + 0x30], xmm6
cmp dword [0x18001e090], 2
mov r10, rdx
mov r9, rcx
jl 0x180005c97
movdqa xmm6, xmmword [0x18001af70]
lea rax, [rdx + 0x3e]
add rcx, 0x3e
cmp r9, rax
ja 0x180005acd
cmp rcx, rdx
jae 0x180005c97
movaps xmmword [rsp + 0x20], xmm7
movaps xmmword [rsp + 0x10], xmm8
movaps xmmword [rsp], xmm9
movdqa xmm4, xmmword [0x18001b170]
lea rcx, [r9 + 8]
movdqa xmm7, xmmword [0x18001afa0]
sub r10, r9
movdqa xmm5, xmmword [0x18001b150]
movdqa xmm8, xmmword [0x18001af90]
movdqa xmm9, xmmword [0x18001afb0]
nop
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 0x10]
paddd xmm2, xmm6
add r8d, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm5
pmuldq xmm1, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm8
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm9
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [r10 + rcx - 0x18]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
xorps xmm3, xmm0
movq qword [rcx - 0x18], xmm3
paddd xmm2, xmm6
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm5
punpckldq xmm1, xmm2
pmuldq xmm1, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm8
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm9
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [r10 + rcx - 0x10]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
xorps xmm3, xmm0
movq qword [rcx - 0x10], xmm3
cmp r8d, 0x20
jl 0x180005b10
movaps xmm9, xmmword [rsp]
movaps xmm8, xmmword [rsp + 0x10]
movaps xmm7, xmmword [rsp + 0x20]
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
sub r10, r9
nop word [rax + rax]
mov ecx, r8d
lea r9, [r9 + 2]
mov eax, 0x8fb823ef
imul r8d
add edx, r8d
inc r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x39
sub ecx, eax
mov eax, 0x51eb851f
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x32
sub ecx, eax
add cx, 0x37
xor cx, word [r10 + r9 - 2]
mov word [r9 - 2], cx
cmp r8d, 0x20
jl 0x180005ca0
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x180005d00
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
xor r8d, r8d
movaps xmmword [rsp + 0x30], xmm6
cmp dword [0x18001e090], 2
mov r10, rdx
jl 0x180005f05
movdqa xmm6, xmmword [0x18001af70]
lea rax, [r10 + 0x46]
lea rdx, [rcx + 0x46]
cmp rcx, rax
ja 0x180005d3a
cmp rdx, r10
jae 0x180005f05
movaps xmmword [rsp + 0x20], xmm7
movaps xmmword [rsp + 0x10], xmm8
movaps xmmword [rsp], xmm9
movdqa xmm4, xmmword [0x18001b170]
lea r9, [rcx + 8]
movdqa xmm7, xmmword [0x18001afa0]
mov rdx, r10
movdqa xmm5, xmmword [0x18001b150]
sub rdx, rcx
movdqa xmm8, xmmword [0x18001af90]
movdqa xmm9, xmmword [0x18001afb0]
nop
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea r9, [r9 + 0x10]
paddd xmm2, xmm6
add r8d, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm5
pmuldq xmm1, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm8
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm9
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rdx + r9 - 0x18]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
xorps xmm3, xmm0
movq qword [r9 - 0x18], xmm3
paddd xmm2, xmm6
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm5
punpckldq xmm1, xmm2
pmuldq xmm1, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm8
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm9
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rdx + r9 - 0x10]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
xorps xmm3, xmm0
movq qword [r9 - 0x10], xmm3
cmp r8d, 0x20
jl 0x180005d80
movaps xmm9, xmmword [rsp]
movaps xmm8, xmmword [rsp + 0x10]
movaps xmm7, xmmword [rsp + 0x20]
cmp r8d, 0x24
jge 0x180005f5f
movsxd rax, r8d
sub r10, rcx
lea r9, [rcx + rax*2]
nop
mov ecx, r8d
lea r9, [r9 + 2]
mov eax, 0x8fb823ef
imul r8d
add edx, r8d
inc r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x39
sub ecx, eax
mov eax, 0x51eb851f
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x32
sub ecx, eax
add cx, 0x37
xor cx, word [r10 + r9 - 2]
mov word [r9 - 2], cx
cmp r8d, 0x24
jl 0x180005f10
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x180005f70
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
xor r8d, r8d
movaps xmmword [rsp + 0x30], xmm6
cmp dword [0x18001e090], 2
mov r10, rdx
jl 0x180006175
movdqa xmm6, xmmword [0x18001af70]
lea rax, [r10 + 0x42]
lea rdx, [rcx + 0x42]
cmp rcx, rax
ja 0x180005faa
cmp rdx, r10
jae 0x180006175
movaps xmmword [rsp + 0x20], xmm7
movaps xmmword [rsp + 0x10], xmm8
movaps xmmword [rsp], xmm9
movdqa xmm4, xmmword [0x18001b170]
lea r9, [rcx + 8]
movdqa xmm7, xmmword [0x18001afa0]
mov rdx, r10
movdqa xmm5, xmmword [0x18001b150]
sub rdx, rcx
movdqa xmm8, xmmword [0x18001af90]
movdqa xmm9, xmmword [0x18001afb0]
nop
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea r9, [r9 + 0x10]
paddd xmm2, xmm6
add r8d, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm5
pmuldq xmm1, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm8
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm9
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rdx + r9 - 0x18]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
xorps xmm3, xmm0
movq qword [r9 - 0x18], xmm3
paddd xmm2, xmm6
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm5
punpckldq xmm1, xmm2
pmuldq xmm1, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm8
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm9
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rdx + r9 - 0x10]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
xorps xmm3, xmm0
movq qword [r9 - 0x10], xmm3
cmp r8d, 0x20
jl 0x180005ff0
movaps xmm9, xmmword [rsp]
movaps xmm8, xmmword [rsp + 0x10]
movaps xmm7, xmmword [rsp + 0x20]
cmp r8d, 0x22
jge 0x1800061cf
movsxd rax, r8d
sub r10, rcx
lea r9, [rcx + rax*2]
nop
mov ecx, r8d
lea r9, [r9 + 2]
mov eax, 0x8fb823ef
imul r8d
add edx, r8d
inc r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x39
sub ecx, eax
mov eax, 0x51eb851f
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x32
sub ecx, eax
add cx, 0x37
xor cx, word [r10 + r9 - 2]
mov word [r9 - 2], cx
cmp r8d, 0x22
jl 0x180006180
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x1800061e0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
xor r8d, r8d
movaps xmmword [rsp + 0x30], xmm6
cmp dword [0x18001e090], 2
mov r10, rdx
mov r9, rcx
jl 0x1800063e7
movdqa xmm6, xmmword [0x18001af70]
lea rax, [rdx + 0x4e]
add rcx, 0x4e
cmp r9, rax
ja 0x18000621d
cmp rcx, rdx
jae 0x1800063e7
movaps xmmword [rsp + 0x20], xmm7
movaps xmmword [rsp + 0x10], xmm8
movaps xmmword [rsp], xmm9
movdqa xmm4, xmmword [0x18001b170]
lea rcx, [r9 + 8]
movdqa xmm7, xmmword [0x18001afa0]
sub r10, r9
movdqa xmm5, xmmword [0x18001b150]
movdqa xmm8, xmmword [0x18001af90]
movdqa xmm9, xmmword [0x18001afb0]
nop
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 0x10]
paddd xmm2, xmm6
add r8d, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm5
pmuldq xmm1, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm8
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm9
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [r10 + rcx - 0x18]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
xorps xmm3, xmm0
movq qword [rcx - 0x18], xmm3
paddd xmm2, xmm6
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm5
punpckldq xmm1, xmm2
pmuldq xmm1, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm8
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm9
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [r10 + rcx - 0x10]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
xorps xmm3, xmm0
movq qword [rcx - 0x10], xmm3
cmp r8d, 0x28
jl 0x180006260
movaps xmm9, xmmword [rsp]
movaps xmm8, xmmword [rsp + 0x10]
movaps xmm7, xmmword [rsp + 0x20]
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
sub r10, r9
nop word [rax + rax]
mov ecx, r8d
lea r9, [r9 + 2]
mov eax, 0x8fb823ef
imul r8d
add edx, r8d
inc r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x39
sub ecx, eax
mov eax, 0x51eb851f
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x32
sub ecx, eax
add cx, 0x37
xor cx, word [r10 + r9 - 2]
mov word [r9 - 2], cx
cmp r8d, 0x28
jl 0x1800063f0
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x180006450
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
xor r8d, r8d
movaps xmmword [rsp + 0x30], xmm6
cmp dword [0x18001e090], 2
mov r10, rdx
jl 0x180006655
movdqa xmm6, xmmword [0x18001af70]
lea rax, [r10 + 0x36]
lea rdx, [rcx + 0x36]
cmp rcx, rax
ja 0x18000648a
cmp rdx, r10
jae 0x180006655
movaps xmmword [rsp + 0x20], xmm7
movaps xmmword [rsp + 0x10], xmm8
movaps xmmword [rsp], xmm9
movdqa xmm4, xmmword [0x18001b170]
lea r9, [rcx + 8]
movdqa xmm7, xmmword [0x18001afa0]
mov rdx, r10
movdqa xmm5, xmmword [0x18001b150]
sub rdx, rcx
movdqa xmm8, xmmword [0x18001af90]
movdqa xmm9, xmmword [0x18001afb0]
nop
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea r9, [r9 + 0x10]
paddd xmm2, xmm6
add r8d, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm5
pmuldq xmm1, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm8
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm9
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rdx + r9 - 0x18]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
xorps xmm3, xmm0
movq qword [r9 - 0x18], xmm3
paddd xmm2, xmm6
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm5
punpckldq xmm1, xmm2
pmuldq xmm1, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm8
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm9
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rdx + r9 - 0x10]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
xorps xmm3, xmm0
movq qword [r9 - 0x10], xmm3
cmp r8d, 0x18
jl 0x1800064d0
movaps xmm9, xmmword [rsp]
movaps xmm8, xmmword [rsp + 0x10]
movaps xmm7, xmmword [rsp + 0x20]
cmp r8d, 0x1c
jge 0x1800066af
movsxd rax, r8d
sub r10, rcx
lea r9, [rcx + rax*2]
nop
mov ecx, r8d
lea r9, [r9 + 2]
mov eax, 0x8fb823ef
imul r8d
add edx, r8d
inc r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x39
sub ecx, eax
mov eax, 0x51eb851f
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x32
sub ecx, eax
add cx, 0x37
xor cx, word [r10 + r9 - 2]
mov word [r9 - 2], cx
cmp r8d, 0x1c
jl 0x180006660
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x1800066c0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
xor r8d, r8d
movaps xmmword [rsp + 0x30], xmm6
cmp dword [0x18001e090], 2
mov r10, rdx
jl 0x1800068c5
movdqa xmm6, xmmword [0x18001af70]
lea rax, [r10 + 0x3c]
lea rdx, [rcx + 0x3c]
cmp rcx, rax
ja 0x1800066fa
cmp rdx, r10
jae 0x1800068c5
movaps xmmword [rsp + 0x20], xmm7
movaps xmmword [rsp + 0x10], xmm8
movaps xmmword [rsp], xmm9
movdqa xmm4, xmmword [0x18001b170]
lea r9, [rcx + 8]
movdqa xmm7, xmmword [0x18001afa0]
mov rdx, r10
movdqa xmm5, xmmword [0x18001b150]
sub rdx, rcx
movdqa xmm8, xmmword [0x18001af90]
movdqa xmm9, xmmword [0x18001afb0]
nop
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea r9, [r9 + 0x10]
paddd xmm2, xmm6
add r8d, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm5
pmuldq xmm1, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm8
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm9
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rdx + r9 - 0x18]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
xorps xmm3, xmm0
movq qword [r9 - 0x18], xmm3
paddd xmm2, xmm6
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm5
punpckldq xmm1, xmm2
pmuldq xmm1, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm8
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm9
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rdx + r9 - 0x10]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
xorps xmm3, xmm0
movq qword [r9 - 0x10], xmm3
cmp r8d, 0x18
jl 0x180006740
movaps xmm9, xmmword [rsp]
movaps xmm8, xmmword [rsp + 0x10]
movaps xmm7, xmmword [rsp + 0x20]
cmp r8d, 0x1f
jge 0x18000691f
movsxd rax, r8d
sub r10, rcx
lea r9, [rcx + rax*2]
nop
mov ecx, r8d
lea r9, [r9 + 2]
mov eax, 0x8fb823ef
imul r8d
add edx, r8d
inc r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x39
sub ecx, eax
mov eax, 0x51eb851f
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x32
sub ecx, eax
add cx, 0x37
xor cx, word [r10 + r9 - 2]
mov word [r9 - 2], cx
cmp r8d, 0x1f
jl 0x1800068d0
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret