joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140015890
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
xor r8d, r8d
mov r10, rdx
cmp dword [0x1400bf090], 2
jl 0x140015ae3
movdqa xmm5, xmmword [0x1400b1700]
lea rax, [r10 + 0x6e]
lea rdx, [rcx + 0x6e]
cmp rcx, rax
ja 0x1400158c5
cmp rdx, r10
jae 0x140015ae3
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm7
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm9
movdqa xmm0, xmmword [0x1400b17c0]
lea r9, [rcx + 4]
movdqa xmm3, xmmword [0x1400b17b0]
mov rdx, r10
movdqa xmm6, xmmword [0x1400b1720]
sub rdx, rcx
movdqa xmm7, xmmword [0x1400b16f0]
movdqa xmm4, xmmword [0x1400b17f0]
movdqa xmm8, xmmword [0x1400b1730]
movdqa xmm9, xmmword [0x1400b1740]
movdqa xmmword [rsp], xmm0
mov r11d, dword [rsp]
nop dword [rax + rax]
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 3
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
xorps xmm0, xmm0
pcmpgtd xmm0, xmm2
andps xmm0, xmm7
paddd xmm0, xmm2
psrad xmm0, 1
paddd xmm0, xmm0
psubd xmm2, xmm0
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm8
psubd xmm2, xmm0
movd xmm0, r11d
andps xmm2, xmm9
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx + r9 - 4]
xorps xmm2, xmm0
movd dword [r9 - 4], xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 3
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
xorps xmm0, xmm0
pcmpgtd xmm0, xmm2
andps xmm0, xmm7
paddd xmm0, xmm2
psrad xmm0, 1
paddd xmm0, xmm0
psubd xmm2, xmm0
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm8
psubd xmm2, xmm0
andps xmm2, xmm9
movd xmm0, r11d
packuswb xmm2, xmm2
lea r9, [r9 + 8]
packuswb xmm2, xmm2
add r8d, 8
paddb xmm2, xmm0
movd xmm0, dword [rdx + r9 - 8]
xorps xmm2, xmm0
movd dword [r9 - 8], xmm2
cmp r8d, 0x68
jl 0x140015930
movaps xmm9, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm7, xmmword [rsp + 0x30]
movaps xmm6, xmmword [rsp + 0x40]
cmp r8d, 0x6f
jge 0x140015b45
movsxd r9, r8d
add r9, rcx
sub r10, rcx
nop dword [rax]
mov eax, 0x22b63cbf
mov ecx, r8d
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x3b
sub ecx, eax
and ecx, 0x80000001
jge 0x140015b19
dec ecx
or ecx, 0xfffffffe
inc ecx
mov eax, 0x4325c53f
inc r8d
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x3d
sub ecx, eax
add cl, 0x32
xor cl, byte [r10 + r9]
mov byte [r9], cl
inc r9
cmp r8d, 0x6f
jl 0x140015af0
add rsp, 0x58
ret
Function at 0x140015ee0
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x1400c6758]
test rax, rax
jne 0x14001611f
xor r12d, r12d
mov dword [r11 + 0x10], r12d
mov r15d, 0xb6450664
mov dword [r11 + 0x14], r15d
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rcx, qword [rax + 0x10]
mov rsi, qword [rcx]
mov qword [rsp + 0x40], rsi
mov r10, rsi
mov qword [rsp + 0x48], rsi
mov rax, rsi
nop word [rax + rax]
movups xmm0, xmmword [rax + 0x58]
movups xmmword [rsp + 0x50], xmm0
movd eax, xmm0
sub ax, 8
mov word [rsp + 0x50], ax
test r12d, r12d
je 0x140015f97
mov rbx, qword [rsp + 0x58]
movzx eax, ax
shr rax, 1
lea rdi, [rbx + rax*2]
mov eax, 0x9b842fae
mov qword [rsp + 0x30], rbx
cmp rbx, rdi
je 0x140015f89
movzx edx, byte [rbx]
mov ecx, eax
call fcn.140002fd0
add rbx, 2
jmp 0x140015f6f
mov r10, qword [rsp + 0x48]
cmp eax, r12d
jne 0x1400160f8
mov r14, qword [rsi + 0x30]
mov qword [rsp + 0x60], r14
movsxd rax, dword [r14 + 0x3c]
mov r9, qword [rax + r14 + 0x88]
mov qword [rsp + 0xd0], r9
mov edi, r9d
add rdi, r14
mov qword [rsp + 0x68], rdi
shr r9, 0x20
mov qword [rsp + 0xc8], r9
mov dword [rsp + 0x70], r9d
cmp rdi, r14
je 0x1400160f8
mov r13d, dword [rdi + 0x18]
mov dword [rsp + 0x20], r13d
mov eax, r13d
dec r13d
mov dword [rsp + 0x20], r13d
test eax, eax
je 0x1400160f8
mov ecx, dword [rdi + 0x20]
add rcx, r14
mov ebx, dword [rcx + r13*4]
add rbx, r14
mov qword [rsp + 0x38], rbx
mov eax, 0x9b842fae
mov r8d, r13d
movzx edx, byte [rbx]
inc rbx
mov qword [rsp + 0x38], rbx
test dl, dl
jne 0x1400160df
cmp eax, r15d
jne 0x1400160da
mov ecx, dword [rdi + 0x1c]
add rcx, r14
mov eax, dword [rdi + 0x24]
add rax, r14
movzx eax, word [rax + r8*2]
mov ebx, dword [rcx + rax*4]
add rbx, r14
cmp rbx, rdi
jbe 0x140016115
mov eax, r9d
add rax, rdi
cmp rbx, rax
jae 0x140016115
mov eax, 0x9b842fae
mov dword [rsp + 0xc0], eax
mov edi, eax
mov dword [rsp + 0xc4], eax
mov qword [rsp + 0x28], rbx
movzx edx, byte [rbx]
cmp dl, 0x2e
je 0x14001608f
mov ecx, eax
call fcn.140002fd0
mov dword [rsp + 0xc0], eax
inc rbx
jmp 0x14001606f
inc rbx
mov qword [rsp + 0x28], rbx
movzx edx, byte [rbx]
test dl, dl
je 0x1400160b0
mov ecx, edi
call fcn.140002fd0
mov edi, eax
mov dword [rsp + 0xc4], eax
jmp 0x14001608f
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0xc8], rax
mov r10, qword [rsp + 0x48]
mov rsi, qword [r10]
mov qword [rsp + 0x40], rsi
mov r15d, dword [rsp + 0xcc]
mov r12d, eax
jmp 0x1400160f8
jmp 0x140015fe2
mov ecx, eax
call fcn.140002fd0
mov r9, qword [rsp + 0xc8]
mov r10, qword [rsp + 0x48]
jmp 0x14001600c
mov rsi, qword [rsi]
mov rax, rsi
mov qword [rsp + 0x40], rsi
cmp rsi, r10
je 0x140016113
cmp qword [rsi + 0x30], 0
jne 0x140015f40
xor ebx, ebx
mov qword [0x1400c6758], rbx
mov rax, rbx
mov ecx, 0x13333337
call rax
jmp 0x14001612a
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x140016910
Capabilities:
Access peb ldr_data
Encode data using xor
Get process filename
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1400c02f8]
test rax, rax
jne 0x140016afc
mov rax, qword gs:[0x60]
xor r11d, r11d
mov qword [rsp + 0x48], rbp
mov r9d, 0x1829630c
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x30], rdi
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x20], r15
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax]
mov rdi, rbp
nop dword [rax]
nop word [rax + rax]
movups xmm0, xmmword [rdi + 0x58]
movd eax, xmm0
sub ax, 8
test r11d, r11d
je 0x1400169bd
psrldq xmm0, 8
mov edx, 0xb3203f42
movq rcx, xmm0
movzx eax, ax
shr rax, 1
lea r8, [rcx + rax*2]
cmp rcx, r8
je 0x1400169b4
nop
movsx eax, byte [rcx]
add rcx, 2
xor eax, edx
imul edx, eax, 0x1000193
cmp rcx, r8
jne 0x1400169a0
cmp edx, r11d
jne 0x140016abf
mov r10, qword [rdi + 0x30]
movsxd rax, dword [r10 + 0x3c]
mov rcx, qword [rax + r10 + 0x88]
mov r15, rcx
mov ebx, ecx
shr r15, 0x20
add rbx, r10
cmp rbx, r10
je 0x140016abf
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140016abf
mov r14d, dword [rbx + 0x20]
nop dword [rax]
nop word [rax + rax]
dec r8d
mov edx, 0xb3203f42
lea rax, [r14 + r8*4]
mov ecx, dword [rax + r10]
add rcx, r10
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140016a37
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x140016a20
cmp edx, r9d
je 0x140016a43
test r8d, r8d
jne 0x140016a00
jmp 0x140016abf
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
cmp rax, rbx
jbe 0x140016ad7
lea rcx, [r15 + rbx]
cmp rax, rcx
jae 0x140016ad7
movzx ecx, byte [rax]
mov r11d, 0xb3203f42
mov r9d, r11d
cmp cl, 0x2e
je 0x140016a98
nop dword [rax]
movsx ecx, cl
inc rax
xor ecx, r11d
imul r11d, ecx, 0x1000193
movzx ecx, byte [rax]
cmp cl, 0x2e
jne 0x140016a80
movzx ecx, byte [rax + 1]
inc rax
test cl, cl
je 0x140016abb
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, r9d
imul r9d, ecx, 0x1000193
movzx ecx, byte [rax]
test cl, cl
jne 0x140016aa3
mov rdi, qword [rbp]
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rbp
je 0x140016ad5
cmp qword [rax + 0x30], 0
jne 0x140016970
xor eax, eax
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov qword [0x1400c02f8], rax
add rsp, 0x38
jmp rax
Function at 0x1400182b0
Capabilities:
Check process job object
Get process image filename

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov ecx, 0x2010
xor esi, esi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rsp + 0x90], rax
mov r14, rax
test rax, rax
je 0x1400184fd
mov rdi, rax
mov qword [rsp + 0x20], rsi
xor eax, eax
mov ecx, 0x2010
rep stosb byte [rdi], al
xor ecx, ecx
mov dword [r14 + 4], 0x400
mov r9d, 0x2010
mov r8, r14
mov edx, 3
call qword [sym.imp.KERNEL32.dll_QueryInformationJobObject]
test eax, eax
je 0x1400184f4
mov eax, dword [r14]
mov r15d, esi
mov r12d, esi
test eax, eax
je 0x1400184e8
nop dword [rax]
mov eax, r12d
mov rdi, qword [r14 + rax*8 + 8]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
cmp rdi, rax
jne 0x14001834d
inc r15d
jmp 0x1400184d9
mov r8d, edi
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x98], rax
mov rbp, rax
test rax, rax
je 0x1400184d9
mov ecx, 0x1000
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
je 0x1400184d0
mov rdi, rax
mov ecx, 0x1000
xor eax, eax
mov r8d, 0x1000
rep stosb byte [rdi], al
mov rcx, rbp
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameA]
test eax, eax
je 0x1400184c7
xorps xmm0, xmm0
mov qword [rsp + 0x40], rsi
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x48], rsi
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rbx + r8], 0
jne 0x1400183d0
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.140002390
mov r13, qword [rsp + 0x48]
lea rbp, [rsp + 0x30]
mov r14, qword [rsp + 0x30]
cmp r13, 0xf
mov rax, qword [rsp + 0x40]
cmova rbp, r14
cmp rax, 0x1d
jb 0x14001846e
lea rsi, [rax + rbp]
mov edx, 0x5c
lea r8, [rsi - 0x1c]
mov rcx, rbp
sub r8, rbp
call sub.VCRUNTIME140.dll_memchr
mov rdi, rax
test rax, rax
je 0x14001846c
nop dword [rax]
mov r8d, 0x1d
lea rdx, str.WindowsSystem32conhost.exe
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140018517
inc rdi
lea r8, [rsi - 0x1c]
sub r8, rdi
mov rcx, rdi
mov edx, 0x5c
call sub.VCRUNTIME140.dll_memchr
mov rdi, rax
test rax, rax
jne 0x140018430
xor esi, esi
mov rdi, 0xffffffffffffffff
cmp rdi, 0xffffffffffffffff
lea eax, [r15 + 1]
cmove eax, r15d
mov r15d, eax
cmp r13, 0xf
jbe 0x1400184b7
lea rdx, [r13 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x1400184af
mov r14, qword [r14 - 8]
add rdx, 0x27
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018521
mov rcx, r14
call fcn.14009f1d4
mov r14, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x98]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [r14]
inc r12d
cmp r12d, eax
jb 0x140018330
cmp r15d, eax
mov esi, 0
setne sil
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [rsp + 0xa0]
mov eax, esi
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
sub rdi, rbp
xor esi, esi
jmp 0x140018475
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140018db0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
xor r8d, r8d
mov r10, rdx
cmp dword [0x1400bf090], 2
jl 0x140019003
movdqa xmm5, xmmword [0x1400b1700]
lea rax, [r10 + 0x18]
lea rdx, [rcx + 0x18]
cmp rcx, rax
ja 0x140018de5
cmp rdx, r10
jae 0x140019003
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm7
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm9
movdqa xmm0, xmmword [0x1400b17c0]
lea r9, [rcx + 4]
movdqa xmm3, xmmword [0x1400b17b0]
mov rdx, r10
movdqa xmm6, xmmword [0x1400b1720]
sub rdx, rcx
movdqa xmm7, xmmword [0x1400b16f0]
movdqa xmm4, xmmword [0x1400b17f0]
movdqa xmm8, xmmword [0x1400b1730]
movdqa xmm9, xmmword [0x1400b1740]
movdqa xmmword [rsp], xmm0
mov r11d, dword [rsp]
nop dword [rax + rax]
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 3
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
xorps xmm0, xmm0
pcmpgtd xmm0, xmm2
andps xmm0, xmm7
paddd xmm0, xmm2
psrad xmm0, 1
paddd xmm0, xmm0
psubd xmm2, xmm0
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm8
psubd xmm2, xmm0
movd xmm0, r11d
andps xmm2, xmm9
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx + r9 - 4]
xorps xmm2, xmm0
movd dword [r9 - 4], xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 3
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
xorps xmm0, xmm0
pcmpgtd xmm0, xmm2
andps xmm0, xmm7
paddd xmm0, xmm2
psrad xmm0, 1
paddd xmm0, xmm0
psubd xmm2, xmm0
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm8
psubd xmm2, xmm0
andps xmm2, xmm9
movd xmm0, r11d
packuswb xmm2, xmm2
lea r9, [r9 + 8]
packuswb xmm2, xmm2
add r8d, 8
paddb xmm2, xmm0
movd xmm0, dword [rdx + r9 - 8]
xorps xmm2, xmm0
movd dword [r9 - 8], xmm2
cmp r8d, 0x18
jl 0x140018e50
movaps xmm9, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm7, xmmword [rsp + 0x30]
movaps xmm6, xmmword [rsp + 0x40]
cmp r8d, 0x19
jge 0x140019065
movsxd r9, r8d
add r9, rcx
sub r10, rcx
nop dword [rax]
mov eax, 0x22b63cbf
mov ecx, r8d
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x3b
sub ecx, eax
and ecx, 0x80000001
jge 0x140019039
dec ecx
or ecx, 0xfffffffe
inc ecx
mov eax, 0x4325c53f
inc r8d
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x3d
sub ecx, eax
add cl, 0x32
xor cl, byte [r10 + r9]
mov byte [r9], cl
inc r9
cmp r8d, 0x19
jl 0x140019010
add rsp, 0x58
ret
Function at 0x140019c90
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
xor r8d, r8d
mov r10, rdx
cmp dword [0x1400bf090], 2
jl 0x140019ee3
movdqa xmm5, xmmword [0x1400b1700]
lea rax, [r10 + 0x33]
lea rdx, [rcx + 0x33]
cmp rcx, rax
ja 0x140019cc5
cmp rdx, r10
jae 0x140019ee3
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm7
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm9
movdqa xmm0, xmmword [0x1400b17c0]
lea r9, [rcx + 4]
movdqa xmm3, xmmword [0x1400b17b0]
mov rdx, r10
movdqa xmm6, xmmword [0x1400b1720]
sub rdx, rcx
movdqa xmm7, xmmword [0x1400b16f0]
movdqa xmm4, xmmword [0x1400b17f0]
movdqa xmm8, xmmword [0x1400b1730]
movdqa xmm9, xmmword [0x1400b1740]
movdqa xmmword [rsp], xmm0
mov r11d, dword [rsp]
nop dword [rax + rax]
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 3
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
xorps xmm0, xmm0
pcmpgtd xmm0, xmm2
andps xmm0, xmm7
paddd xmm0, xmm2
psrad xmm0, 1
paddd xmm0, xmm0
psubd xmm2, xmm0
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm8
psubd xmm2, xmm0
movd xmm0, r11d
andps xmm2, xmm9
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx + r9 - 4]
xorps xmm2, xmm0
movd dword [r9 - 4], xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 3
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
xorps xmm0, xmm0
pcmpgtd xmm0, xmm2
andps xmm0, xmm7
paddd xmm0, xmm2
psrad xmm0, 1
paddd xmm0, xmm0
psubd xmm2, xmm0
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm8
psubd xmm2, xmm0
andps xmm2, xmm9
movd xmm0, r11d
packuswb xmm2, xmm2
lea r9, [r9 + 8]
packuswb xmm2, xmm2
add r8d, 8
paddb xmm2, xmm0
movd xmm0, dword [rdx + r9 - 8]
xorps xmm2, xmm0
movd dword [r9 - 8], xmm2
cmp r8d, 0x30
jl 0x140019d30
movaps xmm9, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm7, xmmword [rsp + 0x30]
movaps xmm6, xmmword [rsp + 0x40]
cmp r8d, 0x34
jge 0x140019f45
movsxd r9, r8d
add r9, rcx
sub r10, rcx
nop dword [rax]
mov eax, 0x22b63cbf
mov ecx, r8d
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x3b
sub ecx, eax
and ecx, 0x80000001
jge 0x140019f19
dec ecx
or ecx, 0xfffffffe
inc ecx
mov eax, 0x4325c53f
inc r8d
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x3d
sub ecx, eax
add cl, 0x32
xor cl, byte [r10 + r9]
mov byte [r9], cl
inc r9
cmp r8d, 0x34
jl 0x140019ef0
add rsp, 0x58
ret
Function at 0x14001d4a0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
xor r8d, r8d
mov r10, rdx
cmp dword [0x1400bf090], 2
jl 0x14001d6f3
movdqa xmm5, xmmword [0x1400b1700]
lea rax, [r10 + 0x1e]
lea rdx, [rcx + 0x1e]
cmp rcx, rax
ja 0x14001d4d5
cmp rdx, r10
jae 0x14001d6f3
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm7
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm9
movdqa xmm0, xmmword [0x1400b17c0]
lea r9, [rcx + 4]
movdqa xmm3, xmmword [0x1400b17b0]
mov rdx, r10
movdqa xmm6, xmmword [0x1400b1720]
sub rdx, rcx
movdqa xmm7, xmmword [0x1400b16f0]
movdqa xmm4, xmmword [0x1400b17f0]
movdqa xmm8, xmmword [0x1400b1730]
movdqa xmm9, xmmword [0x1400b1740]
movdqa xmmword [rsp], xmm0
mov r11d, dword [rsp]
nop dword [rax + rax]
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 3
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
xorps xmm0, xmm0
pcmpgtd xmm0, xmm2
andps xmm0, xmm7
paddd xmm0, xmm2
psrad xmm0, 1
paddd xmm0, xmm0
psubd xmm2, xmm0
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm8
psubd xmm2, xmm0
movd xmm0, r11d
andps xmm2, xmm9
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx + r9 - 4]
xorps xmm2, xmm0
movd dword [r9 - 4], xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 3
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
xorps xmm0, xmm0
pcmpgtd xmm0, xmm2
andps xmm0, xmm7
paddd xmm0, xmm2
psrad xmm0, 1
paddd xmm0, xmm0
psubd xmm2, xmm0
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm8
psubd xmm2, xmm0
andps xmm2, xmm9
movd xmm0, r11d
packuswb xmm2, xmm2
lea r9, [r9 + 8]
packuswb xmm2, xmm2
add r8d, 8
paddb xmm2, xmm0
movd xmm0, dword [rdx + r9 - 8]
xorps xmm2, xmm0
movd dword [r9 - 8], xmm2
cmp r8d, 0x18
jl 0x14001d540
movaps xmm9, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm7, xmmword [rsp + 0x30]
movaps xmm6, xmmword [rsp + 0x40]
cmp r8d, 0x1f
jge 0x14001d755
movsxd r9, r8d
add r9, rcx
sub r10, rcx
nop dword [rax]
mov eax, 0x22b63cbf
mov ecx, r8d
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x3b
sub ecx, eax
and ecx, 0x80000001
jge 0x14001d729
dec ecx
or ecx, 0xfffffffe
inc ecx
mov eax, 0x4325c53f
inc r8d
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x3d
sub ecx, eax
add cl, 0x32
xor cl, byte [r10 + r9]
mov byte [r9], cl
inc r9
cmp r8d, 0x1f
jl 0x14001d700
add rsp, 0x58
ret
Function at 0x14001d7a0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
xor r8d, r8d
mov r10, rdx
cmp dword [0x1400bf090], 2
jl 0x14001d9f3
movdqa xmm5, xmmword [0x1400b1700]
lea rax, [r10 + 0x1a]
lea rdx, [rcx + 0x1a]
cmp rcx, rax
ja 0x14001d7d5
cmp rdx, r10
jae 0x14001d9f3
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm7
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm9
movdqa xmm0, xmmword [0x1400b17c0]
lea r9, [rcx + 4]
movdqa xmm3, xmmword [0x1400b17b0]
mov rdx, r10
movdqa xmm6, xmmword [0x1400b1720]
sub rdx, rcx
movdqa xmm7, xmmword [0x1400b16f0]
movdqa xmm4, xmmword [0x1400b17f0]
movdqa xmm8, xmmword [0x1400b1730]
movdqa xmm9, xmmword [0x1400b1740]
movdqa xmmword [rsp], xmm0
mov r11d, dword [rsp]
nop dword [rax + rax]
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 3
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
xorps xmm0, xmm0
pcmpgtd xmm0, xmm2
andps xmm0, xmm7
paddd xmm0, xmm2
psrad xmm0, 1
paddd xmm0, xmm0
psubd xmm2, xmm0
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm8
psubd xmm2, xmm0
movd xmm0, r11d
andps xmm2, xmm9
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx + r9 - 4]
xorps xmm2, xmm0
movd dword [r9 - 4], xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 3
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
xorps xmm0, xmm0
pcmpgtd xmm0, xmm2
andps xmm0, xmm7
paddd xmm0, xmm2
psrad xmm0, 1
paddd xmm0, xmm0
psubd xmm2, xmm0
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm8
psubd xmm2, xmm0
andps xmm2, xmm9
movd xmm0, r11d
packuswb xmm2, xmm2
lea r9, [r9 + 8]
packuswb xmm2, xmm2
add r8d, 8
paddb xmm2, xmm0
movd xmm0, dword [rdx + r9 - 8]
xorps xmm2, xmm0
movd dword [r9 - 8], xmm2
cmp r8d, 0x18
jl 0x14001d840
movaps xmm9, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm7, xmmword [rsp + 0x30]
movaps xmm6, xmmword [rsp + 0x40]
cmp r8d, 0x1b
jge 0x14001da55
movsxd r9, r8d
add r9, rcx
sub r10, rcx
nop dword [rax]
mov eax, 0x22b63cbf
mov ecx, r8d
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x3b
sub ecx, eax
and ecx, 0x80000001
jge 0x14001da29
dec ecx
or ecx, 0xfffffffe
inc ecx
mov eax, 0x4325c53f
inc r8d
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x3d
sub ecx, eax
add cl, 0x32
xor cl, byte [r10 + r9]
mov byte [r9], cl
inc r9
cmp r8d, 0x1b
jl 0x14001da00
add rsp, 0x58
ret