joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2fc4d2d70
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d3e50
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d3772
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f6108]
test eax, eax
je 0x2fc4d380a
lea rax, [0x2fc4f60e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f6110]
mov qword [rbp - 8], rax
jmp 0x2fc4d37ee
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d37e2
cmp qword [rbp - 0x10], 0
je 0x2fc4d37e2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d37a8
lea rax, [0x2fc4f60e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d380b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d3910
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d3938
mov eax, 0
jmp 0x2fc4d3986
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d3961
mov eax, 0
jmp 0x2fc4d3986
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d3981
mov eax, 0
jmp 0x2fc4d3986
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d398c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d3a0a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d3a01
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d3a01
mov rax, qword [rbp - 8]
jmp 0x2fc4d3a1f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d39d4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d1610
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d26f0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d2012
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f4108]
test eax, eax
je 0x2fc4d20aa
lea rax, [0x2fc4f40e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f4110]
mov qword [rbp - 8], rax
jmp 0x2fc4d208e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d2082
cmp qword [rbp - 0x10], 0
je 0x2fc4d2082
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d2048
lea rax, [0x2fc4f40e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d20ab
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d21b0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d21d8
mov eax, 0
jmp 0x2fc4d2226
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d2201
mov eax, 0
jmp 0x2fc4d2226
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d2221
mov eax, 0
jmp 0x2fc4d2226
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d222c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d22aa
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d22a1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d22a1
mov rax, qword [rbp - 8]
jmp 0x2fc4d22bf
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d2274
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc503e50
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc504852
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc529108]
test eax, eax
je 0x2fc5048ea
lea rax, [0x2fc5290e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc529110]
mov qword [rbp - 8], rax
jmp 0x2fc5048ce
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc5048c2
cmp qword [rbp - 0x10], 0
je 0x2fc5048c2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc504888
lea rax, [0x2fc5290e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc5048eb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc5049f0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc504a18
mov eax, 0
jmp 0x2fc504a66
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc504a41
mov eax, 0
jmp 0x2fc504a66
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc504a61
mov eax, 0
jmp 0x2fc504a66
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc504a6c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc504aea
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc504ae1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc504ae1
mov rax, qword [rbp - 8]
jmp 0x2fc504aff
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc504ab4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x63a0d058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.63a0d1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x63a0d089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x63a0d06f
add dl, dl
jne 0x63a0d096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x63a0d0f6
xor eax, eax
add dl, dl
jne 0x63a0d0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x63a0d1ad
add dl, dl
jne 0x63a0d0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x63a0d0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x63a0d0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x63a0d0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x63a0d0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x63a0d07e
mov eax, 1
add dl, dl
jne 0x63a0d106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x63a0d113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x63a0d0fb
sub eax, ebx
mov ebx, 1
jne 0x63a0d14c
mov ecx, 1
add dl, dl
jne 0x63a0d12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x63a0d13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x63a0d123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x63a0d07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x63a0d168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x63a0d175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x63a0d15d
cmp eax, 0x7d00
jae 0x63a0d19b
cmp eax, 0x500
jb 0x63a0d196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x63a0d07e
cmp eax, 0x7f
ja 0x63a0d19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x63a0d07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x63a0d1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x63a0d07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x180005980
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
xor r9d, r9d
movaps xmmword [rsp + 0x30], xmm6
cmp dword [0x18001d090], 2
mov r10, rdx
jl 0x180005b7f
movdqa xmm6, xmmword [0x180019ee0]
lea rax, [r10 + 0x3e]
lea rdx, [rcx + 0x3e]
cmp rcx, rax
ja 0x1800059ba
cmp rdx, r10
jae 0x180005b7f
movaps xmmword [rsp + 0x20], xmm7
movaps xmmword [rsp + 0x10], xmm8
movaps xmmword [rsp], xmm9
movdqa xmm4, xmmword [0x180019f30]
lea rdx, [rcx + 8]
movdqa xmm7, xmmword [0x180019f10]
sub r10, rcx
movdqa xmm5, xmmword [0x18001a0d0]
movdqa xmm8, xmmword [0x180019f00]
movdqa xmm9, xmmword [0x180019f20]
nop dword [rax + rax]
movd xmm2, r9d
lea eax, [r9 + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 0x10]
paddd xmm2, xmm6
add r9d, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm5
pmuldq xmm1, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm8
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm9
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [r10 + rdx - 0x18]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
xorps xmm3, xmm0
movq qword [rdx - 0x18], xmm3
paddd xmm2, xmm6
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm5
punpckldq xmm1, xmm2
pmuldq xmm1, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm8
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm9
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [r10 + rdx - 0x10]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
xorps xmm3, xmm0
movq qword [rdx - 0x10], xmm3
cmp r9d, 0x20
jl 0x180005a00
movaps xmm9, xmmword [rsp]
movaps xmm8, xmmword [rsp + 0x10]
movaps xmm7, xmmword [rsp + 0x20]
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
sub r10, rcx
nop dword [rax]
nop word [rax + rax]
mov r8d, r9d
lea rcx, [rcx + 2]
mov eax, 0x94f2095
imul r9d
inc r9d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x37
sub r8d, eax
mov eax, 0x4ec4ec4f
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x34
sub r8d, eax
add r8w, 0x34
xor r8w, word [rcx + r10 - 2]
mov word [rcx - 2], r8w
cmp r9d, 0x20
jl 0x180005b90
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x180005bf0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
xor r8d, r8d
movaps xmmword [rsp + 0x30], xmm6
cmp dword [0x18001d090], 2
mov r10, rdx
jl 0x180005ded
movdqa xmm6, xmmword [0x180019ee0]
lea rax, [r10 + 0x46]
lea rdx, [rcx + 0x46]
cmp rcx, rax
ja 0x180005c2a
cmp rdx, r10
jae 0x180005ded
movaps xmmword [rsp + 0x20], xmm7
movaps xmmword [rsp + 0x10], xmm8
movaps xmmword [rsp], xmm9
movdqa xmm4, xmmword [0x180019f30]
lea r9, [rcx + 8]
movdqa xmm7, xmmword [0x180019f10]
mov rdx, r10
movdqa xmm5, xmmword [0x18001a0d0]
sub rdx, rcx
movdqa xmm8, xmmword [0x180019f00]
movdqa xmm9, xmmword [0x180019f20]
nop
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea r9, [r9 + 0x10]
paddd xmm2, xmm6
add r8d, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm5
pmuldq xmm1, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm8
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm9
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rdx + r9 - 0x18]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
xorps xmm3, xmm0
movq qword [r9 - 0x18], xmm3
paddd xmm2, xmm6
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm5
punpckldq xmm1, xmm2
pmuldq xmm1, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm8
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm9
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rdx + r9 - 0x10]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
xorps xmm3, xmm0
movq qword [r9 - 0x10], xmm3
cmp r8d, 0x20
jl 0x180005c70
movaps xmm9, xmmword [rsp]
movaps xmm8, xmmword [rsp + 0x10]
movaps xmm7, xmmword [rsp + 0x20]
cmp r8d, 0x24
jge 0x180005e4b
movsxd rax, r8d
sub r10, rcx
lea r9, [rcx + rax*2]
nop word [rax + rax]
mov ecx, r8d
lea r9, [r9 + 2]
mov eax, 0x94f2095
imul r8d
inc r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x37
sub ecx, eax
mov eax, 0x4ec4ec4f
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x34
sub ecx, eax
add cx, 0x34
xor cx, word [r9 + r10 - 2]
mov word [r9 - 2], cx
cmp r8d, 0x24
jl 0x180005e00
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x180005e60
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
xor r8d, r8d
movaps xmmword [rsp + 0x30], xmm6
cmp dword [0x18001d090], 2
mov r10, rdx
jl 0x18000605d
movdqa xmm6, xmmword [0x180019ee0]
lea rax, [r10 + 0x42]
lea rdx, [rcx + 0x42]
cmp rcx, rax
ja 0x180005e9a
cmp rdx, r10
jae 0x18000605d
movaps xmmword [rsp + 0x20], xmm7
movaps xmmword [rsp + 0x10], xmm8
movaps xmmword [rsp], xmm9
movdqa xmm4, xmmword [0x180019f30]
lea r9, [rcx + 8]
movdqa xmm7, xmmword [0x180019f10]
mov rdx, r10
movdqa xmm5, xmmword [0x18001a0d0]
sub rdx, rcx
movdqa xmm8, xmmword [0x180019f00]
movdqa xmm9, xmmword [0x180019f20]
nop
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea r9, [r9 + 0x10]
paddd xmm2, xmm6
add r8d, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm5
pmuldq xmm1, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm8
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm9
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rdx + r9 - 0x18]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
xorps xmm3, xmm0
movq qword [r9 - 0x18], xmm3
paddd xmm2, xmm6
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm5
punpckldq xmm1, xmm2
pmuldq xmm1, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm8
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm9
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rdx + r9 - 0x10]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
xorps xmm3, xmm0
movq qword [r9 - 0x10], xmm3
cmp r8d, 0x20
jl 0x180005ee0
movaps xmm9, xmmword [rsp]
movaps xmm8, xmmword [rsp + 0x10]
movaps xmm7, xmmword [rsp + 0x20]
cmp r8d, 0x22
jge 0x1800060bb
movsxd rax, r8d
sub r10, rcx
lea r9, [rcx + rax*2]
nop word [rax + rax]
mov ecx, r8d
lea r9, [r9 + 2]
mov eax, 0x94f2095
imul r8d
inc r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x37
sub ecx, eax
mov eax, 0x4ec4ec4f
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x34
sub ecx, eax
add cx, 0x34
xor cx, word [r9 + r10 - 2]
mov word [r9 - 2], cx
cmp r8d, 0x22
jl 0x180006070
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x1800060d0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
xor r9d, r9d
movaps xmmword [rsp + 0x30], xmm6
cmp dword [0x18001d090], 2
mov r10, rdx
jl 0x1800062cf
movdqa xmm6, xmmword [0x180019ee0]
lea rax, [r10 + 0x4e]
lea rdx, [rcx + 0x4e]
cmp rcx, rax
ja 0x18000610a
cmp rdx, r10
jae 0x1800062cf
movaps xmmword [rsp + 0x20], xmm7
movaps xmmword [rsp + 0x10], xmm8
movaps xmmword [rsp], xmm9
movdqa xmm4, xmmword [0x180019f30]
lea rdx, [rcx + 8]
movdqa xmm7, xmmword [0x180019f10]
sub r10, rcx
movdqa xmm5, xmmword [0x18001a0d0]
movdqa xmm8, xmmword [0x180019f00]
movdqa xmm9, xmmword [0x180019f20]
nop dword [rax + rax]
movd xmm2, r9d
lea eax, [r9 + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 0x10]
paddd xmm2, xmm6
add r9d, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm5
pmuldq xmm1, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm8
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm9
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [r10 + rdx - 0x18]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
xorps xmm3, xmm0
movq qword [rdx - 0x18], xmm3
paddd xmm2, xmm6
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm5
punpckldq xmm1, xmm2
pmuldq xmm1, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm8
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm9
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [r10 + rdx - 0x10]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
xorps xmm3, xmm0
movq qword [rdx - 0x10], xmm3
cmp r9d, 0x28
jl 0x180006150
movaps xmm9, xmmword [rsp]
movaps xmm8, xmmword [rsp + 0x10]
movaps xmm7, xmmword [rsp + 0x20]
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
sub r10, rcx
nop dword [rax]
nop word [rax + rax]
mov r8d, r9d
lea rcx, [rcx + 2]
mov eax, 0x94f2095
imul r9d
inc r9d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x37
sub r8d, eax
mov eax, 0x4ec4ec4f
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x34
sub r8d, eax
add r8w, 0x34
xor r8w, word [rcx + r10 - 2]
mov word [rcx - 2], r8w
cmp r9d, 0x28
jl 0x1800062e0
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret