joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140032070
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword gs:[0x58]
mov rbx, rdx
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400c58a8], eax
jle 0x140032215
lea rcx, [0x1400c58a8]
call fcn.1400bb6bc
cmp dword [0x1400c58a8], 0xffffffff
jne 0x140032215
xor eax, eax
xor ecx, ecx
cmp dword [0x1400c4098], 2
mov qword [0x1400c8cc8], rax
mov dword [0x1400c8cd0], eax
mov byte [0x1400c8cd4], al
jl 0x1400321c1
movdqa xmm2, xmmword [0x1400bee80]
mov ecx, 8
movdqa xmm4, xmmword [0x1400beee0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beea0]
psubd xmm2, xmm0
movd xmm0, dword [str.kernel32.dll]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400beed0]
xorps xmm2, xmm0
movd dword [0x1400c8cc8], xmm2
movdqa xmm2, xmmword [0x1400bee90]
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beea0]
psubd xmm2, xmm0
movd xmm0, dword [0x1400be93c]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400beed0]
xorps xmm2, xmm0
movd dword [0x1400c8ccc], xmm2
movsxd r8, ecx
lea r9, [0x140000000]
nop dword [rax + rax]
mov eax, 0x4ec4ec4f
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x34
movzx eax, cl
inc ecx
sub al, dl
add al, 0x38
xor al, byte [r8 + r9 + 0xbe937]
mov byte [r8 + r9 + 0xc8cc7], al
cmp ecx, 0xd
jl 0x1400321d0
lea rcx, [0x1400c58a8]
call fcn.1400bb650
mov eax, dword [0x1400c8cd0]
movsd xmm0, qword [0x1400c8cc8]
movsd qword [rbx], xmm0
mov dword [rbx + 8], eax
movzx eax, byte [0x1400c8cd4]
mov byte [rbx + 0xc], al
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x140032240
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword gs:[0x58]
mov rbx, rdx
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400c5358], eax
jle 0x140032425
lea rcx, [0x1400c5358]
call fcn.1400bb6bc
cmp dword [0x1400c5358], 0xffffffff
jne 0x140032425
xor eax, eax
lea r9, [0x140000000]
xor ecx, ecx
mov dword [0x1400c6d08], eax
cmp dword [0x1400c4098], 2
xorps xmm0, xmm0
movups xmmword [0x1400c6cf8], xmm0
mov word [0x1400c6d0c], ax
jl 0x1400323dc
movdqa xmm5, xmmword [0x1400bee80]
mov edx, ecx
movdqa xmm4, xmmword [0x1400beef0]
movaps xmmword [rsp + 0x30], xmm6
movdqa xmm6, xmmword [0x1400beeb0]
movaps xmmword [rsp + 0x20], xmm7
movdqa xmm7, xmmword [0x1400beec0]
nop dword [rax]
lea eax, [rcx + 4]
movd xmm2, ecx
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
paddd xmm3, xmm5
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
add ecx, 8
pmuldq xmm0, xmm4
mov eax, ecx
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
pmulld xmm0, xmm6
psubd xmm2, xmm0
movd xmm0, dword [rdx + r9 + 0xbe940]
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx + r9 + 0xc6cf0], xmm2
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
movd xmm0, dword [rdx + r9 + 0xbe944]
andps xmm3, xmm7
packuswb xmm3, xmm3
packuswb xmm3, xmm3
xorps xmm3, xmm0
movd dword [rdx + r9 + 0xc6cf4], xmm3
cmp ecx, 0x10
jl 0x1400322e0
movaps xmm7, xmmword [rsp + 0x20]
movaps xmm6, xmmword [rsp + 0x30]
cmp eax, 0x16
jge 0x140032419
movsxd r8, ecx
nop
mov eax, 0x8fb823ef
lea r8, [r8 + 1]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x39
movzx eax, cl
inc ecx
sub al, dl
xor al, byte [r8 + r9 + 0xbe947]
mov byte [r8 + r9 + 0xc6cf7], al
cmp ecx, 0x16
jl 0x1400323e0
lea rcx, [0x1400c5358]
call fcn.1400bb650
mov eax, dword [0x1400c6d08]
movups xmm0, xmmword [0x1400c6cf8]
movups xmmword [rbx], xmm0
mov dword [rbx + 0x10], eax
movzx eax, word [0x1400c6d0c]
mov word [rbx + 0x14], ax
mov rax, rbx
add rsp, 0x40
pop rbx
ret
Function at 0x140032450
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword gs:[0x58]
mov rbx, rdx
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400c62d4], eax
jle 0x140032635
lea rcx, [0x1400c62d4]
call fcn.1400bb6bc
cmp dword [0x1400c62d4], 0xffffffff
jne 0x140032635
xor eax, eax
lea r9, [0x140000000]
xor ecx, ecx
mov qword [0x1400c8ea8], rax
cmp dword [0x1400c4098], 2
xorps xmm0, xmm0
movups xmmword [0x1400c8e98], xmm0
mov word [0x1400c8eb0], ax
jl 0x1400325ec
movdqa xmm5, xmmword [0x1400bee80]
mov edx, ecx
movdqa xmm4, xmmword [0x1400beef0]
movaps xmmword [rsp + 0x30], xmm6
movdqa xmm6, xmmword [0x1400beeb0]
movaps xmmword [rsp + 0x20], xmm7
movdqa xmm7, xmmword [0x1400beec0]
nop
lea eax, [rcx + 4]
movd xmm2, ecx
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
paddd xmm3, xmm5
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
add ecx, 8
pmuldq xmm0, xmm4
mov eax, ecx
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
pmulld xmm0, xmm6
psubd xmm2, xmm0
movd xmm0, dword [rdx + r9 + 0xbe958]
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx + r9 + 0xc8e90], xmm2
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
movd xmm0, dword [rdx + r9 + 0xbe95c]
andps xmm3, xmm7
packuswb xmm3, xmm3
packuswb xmm3, xmm3
xorps xmm3, xmm0
movd dword [rdx + r9 + 0xc8e94], xmm3
cmp ecx, 0x18
jl 0x1400324f0
movaps xmm7, xmmword [rsp + 0x20]
movaps xmm6, xmmword [rsp + 0x30]
cmp eax, 0x1a
jge 0x140032629
movsxd r8, ecx
nop
mov eax, 0x8fb823ef
lea r8, [r8 + 1]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x39
movzx eax, cl
inc ecx
sub al, dl
xor al, byte [r8 + r9 + 0xbe95f]
mov byte [r8 + r9 + 0xc8e97], al
cmp ecx, 0x1a
jl 0x1400325f0
lea rcx, [0x1400c62d4]
call fcn.1400bb650
movzx eax, word [0x1400c8eb0]
movups xmm0, xmmword [0x1400c8e98]
movsd xmm1, qword [0x1400c8ea8]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
mov word [rbx + 0x18], ax
mov rax, rbx
add rsp, 0x40
pop rbx
ret
Function at 0x140032810
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword gs:[0x58]
mov rbx, rdx
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400c8390], eax
jle 0x1400329b5
lea rcx, [0x1400c8390]
call fcn.1400bb6bc
cmp dword [0x1400c8390], 0xffffffff
jne 0x1400329b5
xor eax, eax
xor ecx, ecx
cmp dword [0x1400c4098], 2
mov qword [0x1400c75e8], rax
mov dword [0x1400c75f0], eax
mov word [0x1400c75f4], ax
jl 0x140032962
movdqa xmm2, xmmword [0x1400bee80]
mov ecx, 8
movdqa xmm4, xmmword [0x1400beee0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beea0]
psubd xmm2, xmm0
movd xmm0, dword [str.EncodePointer]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400beed0]
xorps xmm2, xmm0
movd dword [0x1400c75e8], xmm2
movdqa xmm2, xmmword [0x1400bee90]
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beea0]
psubd xmm2, xmm0
movd xmm0, dword [0x1400be92c]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400beed0]
xorps xmm2, xmm0
movd dword [0x1400c75ec], xmm2
movsxd r8, ecx
lea r9, [0x140000000]
nop dword [rax]
mov eax, 0x4ec4ec4f
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x34
movzx eax, cl
inc ecx
sub al, dl
add al, 0x38
xor al, byte [r8 + r9 + 0xbe927]
mov byte [r8 + r9 + 0xc75e7], al
cmp ecx, 0xe
jl 0x140032970
lea rcx, [0x1400c8390]
call fcn.1400bb650
mov eax, dword [0x1400c75f0]
movsd xmm0, qword [0x1400c75e8]
movsd qword [rbx], xmm0
mov dword [rbx + 8], eax
movzx eax, word [0x1400c75f4]
mov word [rbx + 0xc], ax
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x1400329e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword gs:[0x58]
mov rbx, rdx
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400c5510], eax
jle 0x140032b85
lea rcx, [0x1400c5510]
call fcn.1400bb6bc
cmp dword [0x1400c5510], 0xffffffff
jne 0x140032b85
xor eax, eax
xor ecx, ecx
cmp dword [0x1400c4098], 2
mov qword [0x1400c7d00], rax
mov dword [0x1400c7d08], eax
mov byte [0x1400c7d0c], al
jl 0x140032b31
movdqa xmm2, xmmword [0x1400bee80]
mov ecx, 8
movdqa xmm4, xmmword [0x1400beee0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beea0]
psubd xmm2, xmm0
movd xmm0, dword [str.kernel32.dll]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400beed0]
xorps xmm2, xmm0
movd dword [0x1400c7d00], xmm2
movdqa xmm2, xmmword [0x1400bee90]
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beea0]
psubd xmm2, xmm0
movd xmm0, dword [0x1400be93c]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400beed0]
xorps xmm2, xmm0
movd dword [0x1400c7d04], xmm2
movsxd r8, ecx
lea r9, [0x140000000]
nop dword [rax + rax]
mov eax, 0x4ec4ec4f
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x34
movzx eax, cl
inc ecx
sub al, dl
add al, 0x38
xor al, byte [r8 + r9 + 0xbe937]
mov byte [r8 + r9 + 0xc7cff], al
cmp ecx, 0xd
jl 0x140032b40
lea rcx, [0x1400c5510]
call fcn.1400bb650
mov eax, dword [0x1400c7d08]
movsd xmm0, qword [0x1400c7d00]
movsd qword [rbx], xmm0
mov dword [rbx + 8], eax
movzx eax, byte [0x1400c7d0c]
mov byte [rbx + 0xc], al
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x140032bb0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword gs:[0x58]
mov rbx, rdx
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400ca1e4], eax
jle 0x140032d55
lea rcx, [0x1400ca1e4]
call fcn.1400bb6bc
cmp dword [0x1400ca1e4], 0xffffffff
jne 0x140032d55
xor eax, eax
xor ecx, ecx
cmp dword [0x1400c4098], 2
mov qword [0x1400c69d8], rax
mov dword [0x1400c69e0], eax
mov byte [0x1400c69e4], al
jl 0x140032cf9
movdqa xmm2, xmmword [0x1400bee80]
mov ecx, 8
movdqa xmm4, xmmword [0x1400beef0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beeb0]
psubd xmm2, xmm0
movd xmm0, dword [str.256352896548]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
xorps xmm2, xmm0
movd dword [0x1400c69d8], xmm2
movdqa xmm2, xmmword [0x1400bee90]
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beeb0]
psubd xmm2, xmm0
movd xmm0, dword [0x1400be9b4]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
xorps xmm2, xmm0
movd dword [0x1400c69dc], xmm2
movsxd r8, ecx
lea r9, [0x140000000]
nop dword [rax]
nop word [rax + rax]
mov eax, 0x8fb823ef
lea r8, [r8 + 1]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x39
movzx eax, cl
inc ecx
sub al, dl
xor al, byte [r8 + r9 + 0xbe9af]
mov byte [r8 + r9 + 0xc69d7], al
cmp ecx, 0xd
jl 0x140032d10
lea rcx, [0x1400ca1e4]
call fcn.1400bb650
mov eax, dword [0x1400c69e0]
movsd xmm0, qword [0x1400c69d8]
movsd qword [rbx], xmm0
mov dword [rbx + 8], eax
movzx eax, byte [0x1400c69e4]
mov byte [rbx + 0xc], al
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x140032d80
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword gs:[0x58]
mov rbx, rdx
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400cadf8], eax
jle 0x140032f25
lea rcx, [0x1400cadf8]
call fcn.1400bb6bc
cmp dword [0x1400cadf8], 0xffffffff
jne 0x140032f25
xor eax, eax
xor ecx, ecx
cmp dword [0x1400c4098], 2
mov qword [0x1400c5980], rax
mov dword [0x1400c5988], eax
mov word [0x1400c598c], ax
jl 0x140032eca
movdqa xmm2, xmmword [0x1400bee80]
mov ecx, 8
movdqa xmm4, xmmword [0x1400beef0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beeb0]
psubd xmm2, xmm0
movd xmm0, dword [str.1452145321253]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
xorps xmm2, xmm0
movd dword [0x1400c5980], xmm2
movdqa xmm2, xmmword [0x1400bee90]
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beeb0]
psubd xmm2, xmm0
movd xmm0, dword [0x1400be9c4]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
xorps xmm2, xmm0
movd dword [0x1400c5984], xmm2
movsxd r8, ecx
lea r9, [0x140000000]
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x8fb823ef
lea r8, [r8 + 1]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x39
movzx eax, cl
inc ecx
sub al, dl
xor al, byte [r8 + r9 + 0xbe9bf]
mov byte [r8 + r9 + 0xc597f], al
cmp ecx, 0xe
jl 0x140032ee0
lea rcx, [0x1400cadf8]
call fcn.1400bb650
mov eax, dword [0x1400c5988]
movsd xmm0, qword [0x1400c5980]
movsd qword [rbx], xmm0
mov dword [rbx + 8], eax
movzx eax, word [0x1400c598c]
mov word [rbx + 0xc], ax
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x140032fd0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword gs:[0x58]
mov rbx, rdx
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400c8a80], eax
jle 0x140033175
lea rcx, [0x1400c8a80]
call fcn.1400bb6bc
cmp dword [0x1400c8a80], 0xffffffff
jne 0x140033175
xor eax, eax
xor ecx, ecx
cmp dword [0x1400c4098], 2
mov qword [0x1400c84a0], rax
mov dword [0x1400c84a8], eax
mov byte [0x1400c84ac], al
jl 0x140033119
movdqa xmm2, xmmword [0x1400bee80]
mov ecx, 8
movdqa xmm4, xmmword [0x1400beef0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beeb0]
psubd xmm2, xmm0
movd xmm0, dword [str.145625849562]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
xorps xmm2, xmm0
movd dword [0x1400c84a0], xmm2
movdqa xmm2, xmmword [0x1400bee90]
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beeb0]
psubd xmm2, xmm0
movd xmm0, dword [0x1400be9e4]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
xorps xmm2, xmm0
movd dword [0x1400c84a4], xmm2
movsxd r8, ecx
lea r9, [0x140000000]
nop dword [rax]
nop word [rax + rax]
mov eax, 0x8fb823ef
lea r8, [r8 + 1]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x39
movzx eax, cl
inc ecx
sub al, dl
xor al, byte [r8 + r9 + 0xbe9df]
mov byte [r8 + r9 + 0xc849f], al
cmp ecx, 0xd
jl 0x140033130
lea rcx, [0x1400c8a80]
call fcn.1400bb650
mov eax, dword [0x1400c84a8]
movsd xmm0, qword [0x1400c84a0]
movsd qword [rbx], xmm0
mov dword [rbx + 8], eax
movzx eax, byte [0x1400c84ac]
mov byte [rbx + 0xc], al
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x1400331a0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword gs:[0x58]
mov rbx, rdx
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400c63d8], eax
jle 0x14003337a
lea rcx, [0x1400c63d8]
call fcn.1400bb6bc
cmp dword [0x1400c63d8], 0xffffffff
jne 0x14003337a
xor r9d, r9d
lea r10, [0x140000000]
cmp dword [0x1400c4098], 2
xorps xmm0, xmm0
movups xmmword [0x1400c5e98], xmm0
jl 0x14003332b
movdqa xmm5, xmmword [0x1400bee80]
mov ecx, r9d
movdqa xmm4, xmmword [0x1400beef0]
movaps xmmword [rsp + 0x30], xmm6
movdqa xmm6, xmmword [0x1400beeb0]
movaps xmmword [rsp + 0x20], xmm7
movdqa xmm7, xmmword [0x1400beec0]
movd xmm2, r9d
lea eax, [r9 + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
paddd xmm3, xmm5
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
add r9d, 8
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
pmulld xmm0, xmm6
psubd xmm2, xmm0
movd xmm0, dword [rcx + r10 + 0xbe9e8]
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rcx + r10 + 0xc5e90], xmm2
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
movd xmm0, dword [rcx + r10 + 0xbe9ec]
andps xmm3, xmm7
packuswb xmm3, xmm3
packuswb xmm3, xmm3
xorps xmm3, xmm0
movd dword [rcx + r10 + 0xc5e94], xmm3
cmp r9d, 0x10
jl 0x140033230
movaps xmm7, xmmword [rsp + 0x20]
movaps xmm6, xmmword [rsp + 0x30]
jmp 0x14003336e
mov r8d, r9d
nop
mov eax, 0x8fb823ef
lea r9, [r9 + 1]
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x39
movzx eax, r8b
inc r8d
sub al, cl
xor al, byte [r9 + r10 + 0xbe9ef]
mov byte [r9 + r10 + 0xc5e97], al
cmp r8d, 0x10
jl 0x140033330
lea rcx, [0x1400c63d8]
call fcn.1400bb650
movups xmm0, xmmword [0x1400c5e98]
mov rax, rbx
movups xmmword [rbx], xmm0
add rsp, 0x40
pop rbx
ret
Function at 0x140033390
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword gs:[0x58]
mov rbx, rdx
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400c70dc], eax
jle 0x140033535
lea rcx, [0x1400c70dc]
call fcn.1400bb6bc
cmp dword [0x1400c70dc], 0xffffffff
jne 0x140033535
xor eax, eax
xor ecx, ecx
cmp dword [0x1400c4098], 2
mov qword [0x1400c97d8], rax
mov dword [0x1400c97e0], eax
mov word [0x1400c97e4], ax
jl 0x1400334e2
movdqa xmm2, xmmword [0x1400bee80]
mov ecx, 8
movdqa xmm4, xmmword [0x1400beee0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beea0]
psubd xmm2, xmm0
movd xmm0, dword [str.EncodePointer]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400beed0]
xorps xmm2, xmm0
movd dword [0x1400c97d8], xmm2
movdqa xmm2, xmmword [0x1400bee90]
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beea0]
psubd xmm2, xmm0
movd xmm0, dword [0x1400be92c]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400beed0]
xorps xmm2, xmm0
movd dword [0x1400c97dc], xmm2
movsxd r8, ecx
lea r9, [0x140000000]
nop dword [rax]
mov eax, 0x4ec4ec4f
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x34
movzx eax, cl
inc ecx
sub al, dl
add al, 0x38
xor al, byte [r8 + r9 + 0xbe927]
mov byte [r8 + r9 + 0xc97d7], al
cmp ecx, 0xe
jl 0x1400334f0
lea rcx, [0x1400c70dc]
call fcn.1400bb650
mov eax, dword [0x1400c97e0]
movsd xmm0, qword [0x1400c97d8]
movsd qword [rbx], xmm0
mov dword [rbx + 8], eax
movzx eax, word [0x1400c97e4]
mov word [rbx + 0xc], ax
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x140033560
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword gs:[0x58]
mov rbx, rdx
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400c861c], eax
jle 0x140033705
lea rcx, [0x1400c861c]
call fcn.1400bb6bc
cmp dword [0x1400c861c], 0xffffffff
jne 0x140033705
xor eax, eax
xor ecx, ecx
cmp dword [0x1400c4098], 2
mov qword [0x1400c8508], rax
mov dword [0x1400c8510], eax
mov byte [0x1400c8514], al
jl 0x1400336b1
movdqa xmm2, xmmword [0x1400bee80]
mov ecx, 8
movdqa xmm4, xmmword [0x1400beee0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beea0]
psubd xmm2, xmm0
movd xmm0, dword [str.kernel32.dll]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400beed0]
xorps xmm2, xmm0
movd dword [0x1400c8508], xmm2
movdqa xmm2, xmmword [0x1400bee90]
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400beea0]
psubd xmm2, xmm0
movd xmm0, dword [0x1400be93c]
andps xmm2, xmmword [0x1400beec0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400beed0]
xorps xmm2, xmm0
movd dword [0x1400c850c], xmm2
movsxd r8, ecx
lea r9, [0x140000000]
nop dword [rax + rax]
mov eax, 0x4ec4ec4f
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x34
movzx eax, cl
inc ecx
sub al, dl
add al, 0x38
xor al, byte [r8 + r9 + 0xbe937]
mov byte [r8 + r9 + 0xc8507], al
cmp ecx, 0xd
jl 0x1400336c0
lea rcx, [0x1400c861c]
call fcn.1400bb650
mov eax, dword [0x1400c8510]
movsd xmm0, qword [0x1400c8508]
movsd qword [rbx], xmm0
mov dword [rbx + 8], eax
movzx eax, byte [0x1400c8514]
mov byte [rbx + 0xc], al
mov rax, rbx
add rsp, 0x20
pop rbx
ret