joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1804cd900
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r15
xor r10d, r10d
movsxd rbp, r8d
mov qword [rsp + 0x18], r14
mov rdi, rdx
mov r15, rcx
mov r11d, r10d
mov r9d, r10d
lea eax, [rbp - 4]
movsxd r14, eax
test eax, eax
js 0x1804cd9b4
mov rbx, rcx
lea rsi, [rdx + 3]
sub rbx, rdx
add r14, 4
shr r14, 2
lea r9d, [r14*4]
movsx eax, byte [rsi - 2]
movsx ecx, byte [rbx + rsi - 2]
lea rsi, [rsi + 4]
sub ecx, eax
mov eax, ecx
movsx ecx, byte [rbx + rsi - 5]
cdq
mov r8d, eax
movsx eax, byte [rsi - 5]
sub ecx, eax
xor r8d, edx
sub r8d, edx
mov eax, ecx
movsx ecx, byte [rbx + rsi - 7]
cdq
xor eax, edx
sub eax, edx
add r8d, eax
movsx eax, byte [rsi - 7]
sub ecx, eax
mov eax, ecx
movsx ecx, byte [rbx + rsi - 4]
cdq
xor eax, edx
sub eax, edx
add r8d, eax
movsx eax, byte [rsi - 4]
sub ecx, eax
mov eax, ecx
cdq
xor eax, edx
sub eax, edx
add r11d, eax
add r11d, r8d
sub r14, 1
jne 0x1804cd951
mov r14, qword [rsp + 0x18]
mov ecx, ebp
sub ecx, r9d
cmp r9d, ebp
jge 0x1804cda92
cmp ecx, 8
jb 0x1804cda92
cmp dword [0x1806c4ce0], 2
jl 0x1804cda92
movsxd rdx, r9d
xorps xmm4, xmm4
xorps xmm3, xmm3
and ecx, 0x80000007
jge 0x1804cd9f5
dec ecx
or ecx, 0xfffffff8
inc ecx
mov eax, ebp
sub eax, ecx
lea rcx, [rdx + rdi]
mov rdx, r15
movsxd r8, eax
sub rdx, rdi
nop word [rax + rax]
movd xmm0, dword [rcx + rdx]
add r9d, 8
movd xmm1, dword [rcx]
pmovsxbd xmm2, xmm0
pmovsxbd xmm0, xmm1
psubd xmm2, xmm0
movd xmm0, dword [rdx + rcx + 4]
pabsd xmm1, xmm2
paddd xmm1, xmm4
movdqa xmm4, xmm1
movd xmm1, dword [rcx + 4]
pmovsxbd xmm2, xmm0
pmovsxbd xmm0, xmm1
add rcx, 8
psubd xmm2, xmm0
mov rax, rcx
pabsd xmm1, xmm2
sub rax, rdi
paddd xmm1, xmm3
movdqa xmm3, xmm1
cmp rax, r8
jl 0x1804cda10
paddd xmm3, xmm4
movdqa xmm0, xmm3
psrldq xmm0, 8
paddd xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
paddd xmm3, xmm0
movd eax, xmm3
add r11d, eax
movsxd r9, r9d
mov ebx, r10d
cmp r9, rbp
jge 0x1804cdb34
mov rax, rbp
sub rax, r9
cmp rax, 2
jl 0x1804cdb01
mov r8, rbp
lea rcx, [r9 + rdi]
sub r8, r9
mov rsi, r15
sub r8, 2
sub rsi, rdi
shr r8, 1
inc r8
lea r9, [r9 + r8*2]
nop dword [rax + rax]
movsx eax, byte [rcx]
movsx edx, byte [rcx + rsi]
lea rcx, [rcx + 2]
sub edx, eax
mov eax, edx
cdq
xor eax, edx
sub eax, edx
movsx edx, byte [rcx + rsi - 1]
add r10d, eax
movsx eax, byte [rcx - 1]
sub edx, eax
mov eax, edx
cdq
xor eax, edx
sub eax, edx
add ebx, eax
sub r8, 1
jne 0x1804cdad0
cmp r9, rbp
jge 0x1804cdb1a
movsx eax, byte [r9 + r15]
movsx ecx, byte [r9 + rdi]
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
add r11d, eax
lea eax, [rbx + r10]
add eax, r11d
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
pop r15
pop rdi
ret
mov rbx, qword [rsp + 0x20]
mov eax, r11d
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
pop r15
pop rdi
ret
Function at 0x1804cdb50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
xor r8d, r8d
mov qword [rsp + 0x10], rdi
movsxd rdi, edx
mov rsi, rcx
mov r10d, r8d
mov r9d, r8d
lea eax, [rdi - 4]
movsxd r11, eax
test eax, eax
js 0x1804cdbca
add r11, 4
lea rbx, [rcx + 2]
shr r11, 2
lea r9d, [r11*4]
nop dword [rax + rax]
movsx eax, byte [rbx - 2]
lea rbx, [rbx + 4]
cdq
mov ecx, eax
movsx eax, byte [rbx - 5]
xor ecx, edx
sub ecx, edx
cdq
xor eax, edx
sub eax, edx
add ecx, eax
movsx eax, byte [rbx - 3]
cdq
xor eax, edx
sub eax, edx
add ecx, eax
movsx eax, byte [rbx - 4]
cdq
xor eax, edx
sub eax, edx
add r10d, eax
add r10d, ecx
sub r11, 1
jne 0x1804cdb90
mov ecx, edi
sub ecx, r9d
cmp r9d, edi
jge 0x1804cdc84
cmp ecx, 8
jb 0x1804cdc84
cmp dword [0x1806c4ce0], 2
jl 0x1804cdc84
movsxd rdx, r9d
xorps xmm4, xmm4
xorps xmm3, xmm3
and ecx, 0x80000007
jge 0x1804cdc06
dec ecx
or ecx, 0xfffffff8
inc ecx
mov eax, edi
sub eax, ecx
lea rcx, [rsi + 4]
add rcx, rdx
movsxd r11, eax
mov rdx, 0xfffffffffffffffc
sub rdx, rsi
nop
movd xmm0, dword [rcx - 4]
lea rcx, [rcx + 8]
pmovsxbd xmm1, xmm0
movd xmm0, dword [rcx - 8]
lea rax, [rdx + rcx]
pabsd xmm2, xmm1
add r9d, 8
paddd xmm2, xmm4
movdqa xmm4, xmm2
pmovsxbd xmm1, xmm0
pabsd xmm2, xmm1
paddd xmm2, xmm3
movdqa xmm3, xmm2
cmp rax, r11
jl 0x1804cdc20
paddd xmm3, xmm4
movdqa xmm0, xmm3
psrldq xmm0, 8
paddd xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
paddd xmm3, xmm0
movd eax, xmm3
add r10d, eax
movsxd rcx, r9d
mov r11d, r8d
mov r9, rdi
mov rdi, qword [rsp + 0x10]
cmp rcx, r9
jge 0x1804cdcf1
mov rax, r9
sub rax, rcx
cmp rax, 2
jl 0x1804cdcd2
lea rbx, [r9 - 1]
nop word [rax + rax]
movsx eax, byte [rsi + rcx]
cdq
xor eax, edx
sub eax, edx
add r8d, eax
movsx eax, byte [rsi + rcx + 1]
cdq
add rcx, 2
xor eax, edx
sub eax, edx
add r11d, eax
cmp rcx, rbx
jl 0x1804cdcb0
cmp rcx, r9
jge 0x1804cdce3
movsx eax, byte [rcx + rsi]
cdq
xor eax, edx
sub eax, edx
add r10d, eax
lea eax, [r11 + r8]
add eax, r10d
mov rbx, qword [rsp + 0x18]
pop rsi
ret
mov rbx, qword [rsp + 0x18]
mov eax, r10d
pop rsi
ret
Function at 0x1804ce190
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r15
xor r10d, r10d
movsxd rbp, r8d
mov qword [rsp + 0x18], r14
mov rbx, rdx
mov r15, rcx
mov r11d, r10d
mov r9d, r10d
lea eax, [rbp - 4]
movsxd r14, eax
test eax, eax
js 0x1804ce244
mov rdi, rcx
lea rsi, [rdx + 3]
sub rdi, rdx
add r14, 4
shr r14, 2
lea r9d, [r14*4]
movzx eax, byte [rsi - 3]
movzx ecx, byte [rdi + rsi - 3]
lea rsi, [rsi + 4]
sub ecx, eax
mov eax, ecx
movzx ecx, byte [rdi + rsi - 6]
cdq
mov r8d, eax
movzx eax, byte [rsi - 6]
sub ecx, eax
xor r8d, edx
sub r8d, edx
mov eax, ecx
movzx ecx, byte [rdi + rsi - 5]
cdq
xor eax, edx
sub eax, edx
add r8d, eax
movzx eax, byte [rsi - 5]
sub ecx, eax
mov eax, ecx
movzx ecx, byte [rdi + rsi - 4]
cdq
xor eax, edx
sub eax, edx
add r8d, eax
movzx eax, byte [rsi - 4]
sub ecx, eax
mov eax, ecx
cdq
xor eax, edx
sub eax, edx
add r11d, eax
add r11d, r8d
sub r14, 1
jne 0x1804ce1e1
mov r14, qword [rsp + 0x18]
mov ecx, ebp
sub ecx, r9d
cmp r9d, ebp
jge 0x1804ce2e7
cmp ecx, 0x20
jb 0x1804ce2e7
movsxd rdx, r9d
xorps xmm3, xmm3
xorps xmm2, xmm2
and ecx, 0x8000001f
jge 0x1804ce278
dec ecx
or ecx, 0xffffffe0
inc ecx
mov eax, ebp
sub eax, ecx
lea rcx, [rdx + rbx]
mov rdx, r15
movsxd r8, eax
sub rdx, rbx
nop dword [rax]
movdqu xmm0, xmmword [rcx]
add r9d, 0x20
movdqu xmm1, xmmword [rcx + rdx]
psadbw xmm1, xmm0
movdqu xmm0, xmmword [rcx + 0x10]
paddd xmm1, xmm3
movdqa xmm3, xmm1
movdqu xmm1, xmmword [rdx + rcx + 0x10]
add rcx, 0x20
mov rax, rcx
psadbw xmm1, xmm0
sub rax, rbx
paddd xmm1, xmm2
movdqa xmm2, xmm1
cmp rax, r8
jl 0x1804ce290
paddd xmm2, xmm3
movdqa xmm0, xmm2
psrldq xmm0, 8
paddd xmm2, xmm0
movd eax, xmm2
add r11d, eax
movsxd r9, r9d
mov edi, r10d
cmp r9, rbp
jge 0x1804ce384
mov rax, rbp
sub rax, r9
cmp rax, 2
jl 0x1804ce351
mov r8, rbp
lea rcx, [r9 + rbx]
sub r8, r9
mov rsi, r15
sub r8, 2
sub rsi, rbx
shr r8, 1
inc r8
lea r9, [r9 + r8*2]
movzx eax, byte [rcx]
movzx edx, byte [rcx + rsi]
lea rcx, [rcx + 2]
sub edx, eax
mov eax, edx
cdq
xor eax, edx
sub eax, edx
movzx edx, byte [rcx + rsi - 1]
add r10d, eax
movzx eax, byte [rcx - 1]
sub edx, eax
mov eax, edx
cdq
xor eax, edx
sub eax, edx
add edi, eax
sub r8, 1
jne 0x1804ce320
cmp r9, rbp
jge 0x1804ce36a
movzx eax, byte [r9 + r15]
movzx ecx, byte [r9 + rbx]
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
add r11d, eax
lea eax, [rdi + r10]
add eax, r11d
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
pop r15
pop rdi
ret
mov rbx, qword [rsp + 0x20]
mov eax, r11d
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
pop r15
pop rdi
ret
Function at 0x1804d6c50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
push r15
xor r9d, r9d
movsxd rdi, r8d
mov rbp, rdx
lea r15, [0x1805c6f30]
mov r14, rcx
mov esi, r9d
mov r11d, r9d
lea eax, [rdi - 4]
movsxd r8, eax
test eax, eax
js 0x1804d6d10
mov rbx, rcx
lea r10, [rdx + 3]
sub rbx, rdx
add r8, 4
shr r8, 2
lea esi, [r8*4]
nop dword [rax]
movzx eax, byte [r10 - 3]
movzx ecx, byte [rbx + r10 - 3]
lea r10, [r10 + 4]
xor rcx, rax
movzx eax, byte [r10 - 6]
movzx edx, byte [rcx + r15]
movzx ecx, byte [rbx + r10 - 6]
xor rcx, rax
movzx eax, byte [rcx + r15]
movzx ecx, byte [rbx + r10 - 5]
add edx, eax
movzx eax, byte [r10 - 5]
xor rcx, rax
movzx eax, byte [rcx + r15]
movzx ecx, byte [rbx + r10 - 4]
add edx, eax
movzx eax, byte [r10 - 4]
xor rcx, rax
movzx eax, byte [rcx + r15]
add r11d, eax
add r11d, edx
sub r8, 1
jne 0x1804d6cb0
movsxd r10, esi
mov ebx, r9d
mov rsi, rdi
cmp r10, rdi
jge 0x1804d6da2
mov rax, rdi
sub rax, r10
cmp rax, 2
jl 0x1804d6d7f
mov r8, rsi
lea rax, [r10 + rbp]
sub r8, r10
mov rdi, r14
sub r8, 2
sub rdi, rbp
shr r8, 1
inc r8
lea r10, [r10 + r8*2]
nop dword [rax]
movzx ecx, byte [rax]
movzx edx, byte [rax + rdi]
lea rax, [rax + 2]
xor rdx, rcx
movzx ecx, byte [rdx + r15]
movzx edx, byte [rdi + rax - 1]
add r9d, ecx
movzx ecx, byte [rax - 1]
xor rdx, rcx
movzx ecx, byte [rdx + r15]
add ebx, ecx
sub r8, 1
jne 0x1804d6d50
cmp r10, rsi
jge 0x1804d6d99
movzx ecx, byte [r10 + rbp]
movzx edx, byte [r10 + r14]
xor rdx, rcx
movzx ecx, byte [rdx + r15]
add r11d, ecx
lea eax, [rbx + r9]
add eax, r11d
jmp 0x1804d6da5
mov eax, r11d
mov rbx, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
pop r15
pop r14
ret
Function at 0x1804d6dd0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
push r15
xor r9d, r9d
movsxd rdi, r8d
mov rbp, rdx
lea r15, [0x1805c6d30]
mov r14, rcx
mov esi, r9d
mov r11d, r9d
lea eax, [rdi - 4]
movsxd r8, eax
test eax, eax
js 0x1804d6e90
mov rbx, rcx
lea r10, [rdx + 3]
sub rbx, rdx
add r8, 4
shr r8, 2
lea esi, [r8*4]
nop dword [rax]
movzx eax, byte [r10 - 3]
movzx ecx, byte [rbx + r10 - 3]
lea r10, [r10 + 4]
xor rcx, rax
movzx eax, byte [r10 - 6]
movzx edx, byte [rcx + r15]
movzx ecx, byte [rbx + r10 - 6]
xor rcx, rax
movzx eax, byte [rcx + r15]
movzx ecx, byte [rbx + r10 - 5]
add edx, eax
movzx eax, byte [r10 - 5]
xor rcx, rax
movzx eax, byte [rcx + r15]
movzx ecx, byte [rbx + r10 - 4]
add edx, eax
movzx eax, byte [r10 - 4]
xor rcx, rax
movzx eax, byte [rcx + r15]
add r11d, eax
add r11d, edx
sub r8, 1
jne 0x1804d6e30
movsxd r10, esi
mov ebx, r9d
mov rsi, rdi
cmp r10, rdi
jge 0x1804d6f22
mov rax, rdi
sub rax, r10
cmp rax, 2
jl 0x1804d6eff
mov r8, rsi
lea rax, [r10 + rbp]
sub r8, r10
mov rdi, r14
sub r8, 2
sub rdi, rbp
shr r8, 1
inc r8
lea r10, [r10 + r8*2]
nop dword [rax]
movzx ecx, byte [rax]
movzx edx, byte [rax + rdi]
lea rax, [rax + 2]
xor rdx, rcx
movzx ecx, byte [rdx + r15]
movzx edx, byte [rdi + rax - 1]
add r9d, ecx
movzx ecx, byte [rax - 1]
xor rdx, rcx
movzx ecx, byte [rdx + r15]
add ebx, ecx
sub r8, 1
jne 0x1804d6ed0
cmp r10, rsi
jge 0x1804d6f19
movzx ecx, byte [r10 + rbp]
movzx edx, byte [r10 + r14]
xor rdx, rcx
movzx ecx, byte [rdx + r15]
add r11d, ecx
lea eax, [rbx + r9]
add eax, r11d
jmp 0x1804d6f25
mov eax, r11d
mov rbx, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
pop r15
pop r14
ret
Function at 0x1804e3d10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
cmp byte [0x1806d5877], 0
mov r14, r9
movaps xmmword [rsp + 0x40], xmm6
mov rbx, r8
jne 0x1804e3d43
cmp byte [0x1806d58d8], 0
jne 0x1804e3d43
xor al, al
jmp 0x1804e3d45
mov al, 1
movsd xmm6, qword [rsp + 0xb0]
mov edi, dword [rsp + 0xa8]
movsxd rbp, dword [rsp + 0xa0]
cvtpd2ps xmm6, xmm6
test edi, edi
je 0x1804e3efd
mov r11, qword [rsp + 0x90]
mov qword [rsp + 0x70], r12
mov r12d, 0xff
mov qword [rsp + 0x78], r15
mov r15, qword [rsp + 0x98]
movaps xmmword [rsp + 0x30], xmm7
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm9
movaps xmmword [rsp], xmm10
nop
dec edi
xor ecx, ecx
test al, al
je 0x1804e3e7c
lea edx, [rbp - 8]
movaps xmm5, xmm6
shufps xmm5, xmm5, 0
xorps xmm7, xmm7
test edx, edx
js 0x1804e3e7c
movdqa xmm8, xmmword [0x180601c30]
mov r8, rbx
movdqa xmm9, xmmword [0x180601f70]
sub r8, r11
movdqa xmm10, xmmword [0x180601d10]
add edx, 8
shr rdx, 3
mov r9, r11
lea rcx, [rdx*8]
nop dword [rax]
nop dword [rax + rax]
movq xmm4, qword [r8 + r9]
movaps xmm1, xmm5
punpcklbw xmm4, xmm7
lea r9, [r9 + 8]
movdqa xmm0, xmm4
punpcklwd xmm0, xmm7
cvtdq2ps xmm0, xmm0
divps xmm1, xmm0
movdqa xmm0, xmm4
pcmpeqw xmm4, xmm7
punpckhwd xmm0, xmm7
cvtps2dq xmm3, xmm1
movaps xmm1, xmm5
psubd xmm3, xmm8
cvtdq2ps xmm0, xmm0
divps xmm1, xmm0
cvtps2dq xmm2, xmm1
psubd xmm2, xmm8
packssdw xmm3, xmm2
psubw xmm3, xmm9
movdqa xmm1, xmm3
pxor xmm1, xmm7
pand xmm1, xmm4
pxor xmm1, xmm3
movdqa xmm0, xmm1
psubusw xmm0, xmm10
psubusw xmm1, xmm0
packuswb xmm1, xmm1
movq qword [r9 - 8], xmm1
sub rdx, 1
jne 0x1804e3e00
cmp rcx, rbp
jge 0x1804e3ecf
mov r10, rbx
lea r8, [rcx + r11]
sub r10, r11
mov r9, rbp
sub r9, rcx
movzx ecx, byte [r8 + r10]
test cl, cl
je 0x1804e3ec1
movzx ecx, cl
movaps xmm1, xmm6
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
divss xmm1, xmm0
cvtss2si edx, xmm1
cmp edx, r12d
jbe 0x1804e3ec3
xor ecx, ecx
test edx, edx
cmovg ecx, r12d
movzx edx, cl
jmp 0x1804e3ec3
xor dl, dl
mov byte [r8], dl
inc r8
sub r9, 1
jne 0x1804e3e91
add rbx, r14
add r11, r15
test edi, edi
jne 0x1804e3da0
movaps xmm10, xmmword [rsp]
movaps xmm9, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm7, xmmword [rsp + 0x30]
mov r15, qword [rsp + 0x78]
mov r12, qword [rsp + 0x70]
movaps xmm6, xmmword [rsp + 0x40]
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1804e3f20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
cmp byte [0x1806d5877], 0
mov r12, r9
movaps xmmword [rsp + 0x40], xmm6
mov rdi, r8
mov r13, rdx
mov rbx, rcx
jne 0x1804e3f5e
cmp byte [0x1806d58d8], 0
jne 0x1804e3f5e
xor al, al
jmp 0x1804e3f60
mov al, 1
movsd xmm6, qword [rsp + 0xc0]
movsxd r15, dword [rsp + 0xb0]
mov ebp, dword [rsp + 0xb8]
mov r14, r15
cvtpd2ps xmm6, xmm6
test ebp, ebp
je 0x1804e4157
mov qword [rsp + 0x80], rsi
mov rsi, qword [rsp + 0xa0]
movaps xmmword [rsp + 0x30], xmm7
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm9
movaps xmmword [rsp], xmm10
nop dword [rax]
dec ebp
xor ecx, ecx
test al, al
je 0x1804e40ac
lea edx, [r15 - 8]
movaps xmm5, xmm6
shufps xmm5, xmm5, 0
xorps xmm7, xmm7
test edx, edx
js 0x1804e40ac
movdqa xmm8, xmmword [0x180601c30]
mov r8, rbx
movdqa xmm9, xmmword [0x180601f70]
mov r9, rsi
movdqa xmm10, xmmword [0x180601d10]
sub r8, rdi
sub r9, rdi
add edx, 8
shr rdx, 3
mov r10, rdi
lea rcx, [rdx*8]
nop dword [rax + rax]
movq xmm2, qword [r8 + r10]
movq xmm4, qword [r10]
lea r10, [r10 + 8]
punpcklbw xmm4, xmm7
punpcklbw xmm2, xmm7
movdqa xmm0, xmm2
punpckhwd xmm2, xmm7
punpcklwd xmm0, xmm7
cvtdq2ps xmm1, xmm0
movdqa xmm0, xmm4
mulps xmm1, xmm5
punpcklwd xmm0, xmm7
cvtdq2ps xmm0, xmm0
divps xmm1, xmm0
movdqa xmm0, xmm4
pcmpeqw xmm4, xmm7
punpckhwd xmm0, xmm7
cvtps2dq xmm3, xmm1
cvtdq2ps xmm0, xmm0
psubd xmm3, xmm8
cvtdq2ps xmm1, xmm2
mulps xmm1, xmm5
divps xmm1, xmm0
cvtps2dq xmm1, xmm1
psubd xmm1, xmm8
packssdw xmm3, xmm1
psubw xmm3, xmm9
movdqa xmm1, xmm3
pxor xmm1, xmm7
pand xmm1, xmm4
pxor xmm1, xmm3
movdqa xmm0, xmm1
psubusw xmm0, xmm10
psubusw xmm1, xmm0
packuswb xmm1, xmm1
movq qword [r9 + r10 - 8], xmm1
sub rdx, 1
jne 0x1804e4010
cmp rcx, r14
jge 0x1804e4123
mov r10, rdi
lea r8, [rcx + rbx]
mov r11, rsi
sub r10, rbx
sub r11, rbx
mov r9, r14
sub r9, rcx
mov r15d, 0xff
nop dword [rax]
movzx edx, byte [r10 + r8]
test dl, dl
je 0x1804e410c
movzx ecx, byte [r8]
movd xmm2, ecx
cvtdq2ps xmm2, xmm2
movzx ecx, dl
movd xmm0, ecx
mulss xmm2, xmm6
cvtdq2ps xmm0, xmm0
divss xmm2, xmm0
cvtss2si edx, xmm2
cmp edx, r15d
jbe 0x1804e410e
xor ecx, ecx
test edx, edx
cmovg ecx, r15d
movzx edx, cl
jmp 0x1804e410e
xor dl, dl
mov byte [r11 + r8], dl
inc r8
sub r9, 1
jne 0x1804e40d0
mov r15d, dword [rsp + 0xb0]
add rsi, qword [rsp + 0xa8]
add rbx, r13
add rdi, r12
test ebp, ebp
jne 0x1804e3fb0
movaps xmm10, xmmword [rsp]
movaps xmm9, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm7, xmmword [rsp + 0x30]
mov rsi, qword [rsp + 0x80]
movaps xmm6, xmmword [rsp + 0x40]
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140009870
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x70
mov rax, qword [0x140016050]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x20], rax
call fcn.14000a7f0
test rax, rax
jne 0x1400098b5
xor al, al
jmp 0x140009990
cmp qword [rsp + 0x88], 0
jne 0x1400098df
mov eax, dword [rsp + 0x80]
lea rdx, [rsp + 0x20]
mov ecx, eax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jge 0x1400098df
xor al, al
jmp 0x140009990
mov rax, qword [rsp + 0x90]
and rax, 0xfffffffffffff000
mov rcx, qword [rsp + 0xa8]
mov qword [rcx], rax
mov rax, qword [rsp + 0xa0]
mov qword [rax], 0
mov rax, qword [rsp + 0x98]
mov dword [rax], 0
lea rax, [rsp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeAttachProcess]
nop
mov rdx, qword [rsp + 0x98]
mov rax, qword [rsp + 0xa8]
mov rcx, qword [rax]
call fcn.140008fc0
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xa8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x28]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xa0]
mov qword [rcx], rax
call qword [sym.imp.ntoskrnl.exe_KeDetachProcess]
cmp qword [rsp + 0x88], 0
jne 0x14000998c
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x14000998e
xor al, al
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140012a60
add rsp, 0x70
pop rdi
ret
Function at 0x140009e90
Capabilities:
Find process by pid

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rsi
push rdi
sub rsp, 0x58
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x20], 0xc0000001
cmp qword [rsp + 0x78], 0
jne 0x140009edf
mov eax, dword [rsp + 0x70]
lea rdx, [rsp + 0x38]
mov ecx, eax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jge 0x140009edf
xor al, al
jmp 0x14000a03b
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_KeAttachProcess]
nop
mov rcx, qword [rsp + 0x80]
call fcn.140009a80
movzx eax, al
test eax, eax
je 0x140009ffa
mov eax, dword [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
lea rax, [rcx + rax - 1]
mov rcx, rax
call fcn.140009a80
movzx eax, al
test eax, eax
je 0x140009ffa
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x30], rax
cmp dword [0x140020c5c], 0
je 0x140009f57
call fcn.1400024f0
call fcn.14000fe00
cmp dword [0x140020c5c], 0
jne 0x140009f71
movabs rax, 0x8000000000000000
cmp qword [rsp + 0x30], rax
jae 0x140009f90
mov eax, dword [rsp + 0x88]
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x30]
mov ecx, eax
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x20], 0
jmp 0x140009fcd
lfence
mov r8d, dword [rsp + 0x88]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
call fcn.14000ade0
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x88]
cmp dword [rsp + 0x28], eax
je 0x140009fc5
mov dword [rsp + 0x20], 0xc0000001
jmp 0x140009fcd
mov dword [rsp + 0x20], 0
cmp dword [0x140020c5c], 0
je 0x140009ffa
call fcn.14000fec0
mov qword [rsp + 0x48], rax
call fcn.14000fe60
call fcn.140002500
cmp qword [rsp + 0x48], 0
je 0x140009ffa
mov dword [rsp + 0x20], 0xc0000001
call qword [sym.imp.ntoskrnl.exe_KeDetachProcess]
jmp 0x14000a00a
cmp qword [rsp + 0x78], 0
jne 0x14000a01d
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
cmp dword [rsp + 0x20], 0
jl 0x14000a02e
mov dword [rsp + 0x24], 1
jmp 0x14000a036
mov dword [rsp + 0x24], 0
movzx eax, byte [rsp + 0x24]
add rsp, 0x58
pop rdi
pop rsi
ret
Function at 0x14000a390
Capabilities:
Find process by pid

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rsi
push rdi
sub rsp, 0x98
mov rax, qword [0x140016050]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 0xc0000001
cmp qword [rsp + 0x30], 0
jne 0x14000a3fa
mov eax, dword [rsp + 0xb0]
lea rdx, [rsp + 0x30]
mov ecx, eax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jge 0x14000a3fa
xor al, al
jmp 0x14000a5df
lea rax, [rsp + 0x58]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_KeAttachProcess]
nop
mov rcx, qword [rsp + 0xc0]
call fcn.140009a80
movzx eax, al
test eax, eax
je 0x14000a59b
mov eax, dword [rsp + 0xc8]
mov rcx, qword [rsp + 0xc0]
lea rax, [rcx + rax - 1]
mov rcx, rax
call fcn.140009a80
movzx eax, al
test eax, eax
je 0x14000a59b
mov dword [rsp + 0x24], 0
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x48], rax
cmp dword [0x140020c5c], 0
jne 0x14000a48a
cmp dword [0x140020c1c], 0
je 0x14000a4c0
call fcn.1400024f0
cmp dword [0x140020c5c], 0
je 0x14000a49d
call fcn.14000fe00
cmp dword [0x140020c1c], 0
je 0x14000a4c0
call fcn.140002a90
btr rax, 0x10
mov rcx, rax
call fcn.140002b90
mov dword [rsp + 0x24], 1
cmp dword [0x140020c5c], 0
jne 0x14000a51f
cmp dword [0x140020c1c], 0
jne 0x14000a4e3
movabs rax, 0x8000000000000000
cmp qword [rsp + 0x40], rax
jb 0x14000a51f
mov r8d, dword [rsp + 0xc8]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call fcn.14000ade0
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0xc8]
cmp dword [rsp + 0x38], eax
je 0x14000a515
mov dword [rsp + 0x20], 0xc0000001
jmp 0x14000a51d
mov dword [rsp + 0x20], 0
jmp 0x14000a53c
mov eax, dword [rsp + 0xc8]
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov ecx, eax
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x20], 0
cmp dword [0x140020c5c], 0
jne 0x14000a54c
cmp dword [rsp + 0x24], 0
je 0x14000a59b
mov qword [rsp + 0x50], 0
cmp dword [rsp + 0x24], 0
je 0x14000a56e
call fcn.140002a90
bts rax, 0x10
mov rcx, rax
call fcn.140002b90
cmp dword [0x140020c5c], 0
je 0x14000a586
call fcn.14000fec0
mov qword [rsp + 0x50], rax
call fcn.14000fe60
call fcn.140002500
cmp qword [rsp + 0x50], 0
je 0x14000a59b
mov dword [rsp + 0x20], 0xc0000001
call qword [sym.imp.ntoskrnl.exe_KeDetachProcess]
jmp 0x14000a5ab
cmp qword [rsp + 0xb8], 0
jne 0x14000a5c1
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
cmp dword [rsp + 0x20], 0
jl 0x14000a5d2
mov dword [rsp + 0x28], 1
jmp 0x14000a5da
mov dword [rsp + 0x28], 0
movzx eax, byte [rsp + 0x28]
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140012a60
add rsp, 0x98
pop rdi
pop rsi
ret
Function at 0x14000a7f0
Capabilities:
Check os version

Disassembly:
sub rsp, 0x168
mov rax, qword [0x140016050]
xor rax, rsp
mov qword [rsp + 0x150], rax
cmp qword [0x140016118], 0
jne 0x14000a8d5
mov dword [rsp + 0x30], 0x114
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlGetVersion]
test eax, eax
je 0x14000a835
xor eax, eax
jmp 0x14000a8dc
cmp dword [rsp + 0x34], 0xa
jb 0x14000a8c4
cmp dword [rsp + 0x3c], 0x3839
jb 0x14000a8c4
call fcn.140002ab0
and rax, 0xfffffffffffff000
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetVirtualForPhysical]
mov qword [rsp + 0x28], rax
movabs rax, 0xffffff8000000000
mov rcx, qword [rsp + 0x28]
and rcx, rax
mov rax, rcx
mov qword [0x140016118], rax
movabs rax, 0x7ffffffff8
mov rcx, qword [0x140016118]
add rcx, rax
mov rax, rcx
mov qword [0x140020c40], rax
movabs rax, 0x7b7ffffff8
mov rcx, qword [0x140016118]
add rcx, rax
mov rax, rcx
mov qword [0x140020c48], rax
jmp 0x14000a8d5
movabs rax, 0xfffff68000000000
mov qword [0x140016118], rax
mov rax, qword [0x140016118]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140012a60
add rsp, 0x168
ret