joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140060940
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
sub rsp, 0x68
mov rax, qword [0x140137c00]
xor rax, rsp
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x28]
call fcn.140003310
nop
mov rax, qword [rsp + 0x28]
mov rdx, qword [rax + 0x30]
lea rcx, [rsp + 0x38]
call fcn.1400031a0
nop
lea rcx, [rsp + 0x38]
call fcn.140003210
movzx eax, al
test eax, eax
je 0x1400609d9
lea rcx, [rsp + 0x38]
call fcn.140003250
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x24], 0
je 0x1400609d9
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.140003270
mov rcx, rax
call fcn.140003c50
cmp eax, 0xf8f45725
jne 0x1400609d7
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.1400032b0
jmp 0x1400609f0
jmp 0x140060991
lea rcx, [rsp + 0x28]
call fcn.140003380
movzx eax, al
test eax, eax
jne 0x14006095e
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400d0100
add rsp, 0x68
ret

Function at 0x140061b00
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
sub rsp, 0x68
mov rax, qword [0x140137c00]
xor rax, rsp
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x28]
call fcn.140003310
nop
mov rax, qword [rsp + 0x28]
mov rdx, qword [rax + 0x30]
lea rcx, [rsp + 0x38]
call fcn.1400031a0
nop
lea rcx, [rsp + 0x38]
call fcn.140003210
movzx eax, al
test eax, eax
je 0x140061b99
lea rcx, [rsp + 0x38]
call fcn.140003250
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x24], 0
je 0x140061b99
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.140003270
mov rcx, rax
call fcn.140003c50
cmp eax, 0x53b2070f
jne 0x140061b97
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.1400032b0
jmp 0x140061bb0
jmp 0x140061b51
lea rcx, [rsp + 0x28]
call fcn.140003380
movzx eax, al
test eax, eax
jne 0x140061b1e
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400d0100
add rsp, 0x68
ret
Function at 0x14006d670
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x140137c00]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], 0
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x20]
call fcn.14006d510
mov rcx, rax
call fcn.14006e5f0
mov r8, rax
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x40]
call fcn.1400dcea4
nop
cmp qword [rsp + 0x40], 0
je 0x14006d756
mov r8d, 2
xor edx, edx
mov rcx, qword [rsp + 0x40]
call fcn.1400dc86c
mov rcx, qword [rsp + 0x40]
call fcn.1400dc310
mov dword [rsp + 0x24], eax
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x40]
call fcn.1400dc86c
movsxd rax, dword [rsp + 0x24]
mov rdx, rax
mov rcx, qword [rsp + 0x70]
call fcn.14001e1a0
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x70]
call fcn.1400030f0
mov qword [rsp + 0x30], rax
movsxd rax, dword [rsp + 0x24]
mov r9, qword [rsp + 0x28]
mov r8d, 1
mov rdx, rax
mov rcx, qword [rsp + 0x30]
call fcn.1400dd1b4
mov rcx, qword [rsp + 0x40]
call fcn.1400dc4cc
mov al, 1
jmp 0x14006d758
xor al, al
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400d0100
add rsp, 0x58
ret

Function at 0x14006d770
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x140137c00]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
lea r8, [0x14011f524]
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x38]
call fcn.1400dcefc
nop
cmp qword [rsp + 0x38], 0
je 0x14006d843
mov r8d, 2
xor edx, edx
mov rcx, qword [rsp + 0x38]
call fcn.1400dc86c
mov rcx, qword [rsp + 0x38]
call fcn.1400dc310
mov dword [rsp + 0x20], eax
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x38]
call fcn.1400dc86c
movsxd rax, dword [rsp + 0x20]
mov rdx, rax
mov rcx, qword [rsp + 0x70]
call fcn.14001e1a0
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x70]
call fcn.1400030f0
mov qword [rsp + 0x30], rax
movsxd rax, dword [rsp + 0x20]
mov r9, qword [rsp + 0x28]
mov r8d, 1
mov rdx, rax
mov rcx, qword [rsp + 0x30]
call fcn.1400dd1b4
mov rcx, qword [rsp + 0x38]
call fcn.1400dc4cc
mov al, 1
jmp 0x14006d845
xor al, al
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400d0100
add rsp, 0x58
ret
Function at 0x14006fe50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x68
cmp qword [rsp + 0x70], 0
je 0x14006fe85
cmp qword [rsp + 0x80], 0
je 0x14006fe85
cmp qword [rsp + 0x90], 0
jne 0x14006fe8c
xor eax, eax
jmp 0x140070023
mov ecx, 0x100
call fcn.1400d04c4
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov r8, qword [rsp + 0x28]
mov edx, dword [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
call fcn.140070030
test eax, eax
jne 0x14006fec9
xor eax, eax
jmp 0x140070023
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x24], 0
jmp 0x14006fef5
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x78]
cmp dword [rsp + 0x24], eax
jge 0x14006ffd6
mov eax, dword [rsp + 0x20]
inc eax
cdq
and edx, 0xff
add eax, edx
and eax, 0xff
sub eax, edx
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
movzx eax, byte [rcx + rax]
add eax, dword [rsp + 0x30]
cdq
and edx, 0xff
add eax, edx
and eax, 0xff
sub eax, edx
mov dword [rsp + 0x30], eax
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
movsxd rcx, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
add rdx, rcx
mov rcx, rdx
mov rdx, rax
call fcn.140070130
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x70]
movzx eax, byte [rcx + rax]
mov dword [rsp + 0x34], eax
movsxd rcx, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
movzx ecx, byte [rdx + rcx]
movsxd rdx, dword [rsp + 0x30]
mov r8, qword [rsp + 0x28]
movzx edx, byte [r8 + rdx]
add ecx, edx
mov eax, ecx
cdq
and edx, 0xff
add eax, edx
and eax, 0xff
sub eax, edx
cdqe
mov rcx, qword [rsp + 0x28]
movzx eax, byte [rcx + rax]
mov ecx, dword [rsp + 0x34]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov rdx, qword [rsp + 0x90]
mov byte [rdx + rcx], al
jmp 0x14006feeb
mov rax, qword [rsp + 0x98]
mov ecx, dword [rsp + 0x78]
mov dword [rax], ecx
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
call fcn.1400d0120
cmp qword [rsp + 0x38], 0
jne 0x14007000b
mov qword [rsp + 0x50], 0
jmp 0x14007001e
mov qword [rsp + 0x28], 0x8123
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x50], rax
mov eax, 0xffffffff
add rsp, 0x68
ret
Function at 0x140078a00
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x14013b778]
mov rbx, rcx
test rax, rax
jne 0x140078baa
cmp byte [0x1401257c5], 0
mov r9, qword [0x14013b728]
movsd xmm0, qword [str.hbZRDPie__HZK]
movsd qword [rsp + 0x20], xmm0
mov rax, qword [r9]
mov r10, qword [rax + 8]
mov eax, dword [0x1401257c0]
mov dword [rsp + 0x28], eax
movzx eax, word [0x1401257c4]
mov word [rsp + 0x2c], ax
je 0x140078b8d
xor ecx, ecx
cmp dword [0x140137c60], 2
jl 0x140078b4c
movdqa xmm2, xmmword [0x140126610]
mov ecx, 8
movdqa xmm4, xmmword [0x140126740]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x140126630]
psubd xmm2, xmm0
movd xmm0, dword [str.hbZRDPie__HZK]
andps xmm2, xmmword [0x1401266c0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1401266f0]
xorps xmm2, xmm0
movd dword [rsp + 0x20], xmm2
movdqa xmm2, xmmword [0x140126620]
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x140126630]
psubd xmm2, xmm0
movd xmm0, dword [rsp + 0x24]
andps xmm2, xmmword [0x1401266c0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1401266f0]
xorps xmm2, xmm0
movd dword [rsp + 0x24], xmm2
movsxd rax, ecx
lea r8, [rsp + 0x20]
add r8, rax
nop word [rax + rax]
mov eax, 0x5397829d
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x31
movzx eax, cl
inc ecx
sub al, dl
add al, 0x30
xor byte [r8 - 1], al
cmp ecx, 0xe
jl 0x140078b60
lea r8, [0x14013b778]
mov rcx, r9
lea rdx, [rsp + 0x20]
call r10
test al, al
je 0x140078bb5
mov rax, qword [0x14013b778]
mov rcx, rbx
add rsp, 0x30
pop rbx
jmp rax
add rsp, 0x30
pop rbx
ret
Function at 0x140078bc0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
mov r10, qword [0x14013b780]
mov ebx, r9d
mov edi, r8d
mov esi, edx
mov ebp, ecx
test r10, r10
je 0x140078c0c
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x20], rax
call r10
jmp 0x140078e02
cmp byte [0x1401257d9], 0
mov rcx, qword [0x14013b728]
movups xmm0, xmmword [str.hbZRDPbR_MexNX_K_A]
mov rax, qword [rcx]
movups xmmword [rsp + 0x40], xmm0
mov r10, qword [rax + 8]
movzx eax, word [0x1401257d8]
mov word [rsp + 0x50], ax
je 0x140078dc1
xor r8d, r8d
cmp dword [0x140137c60], 2
jl 0x140078d80
movdqa xmm0, xmmword [0x1401266f0]
lea rdx, [rsp + 0x44]
movdqa xmm4, xmmword [0x140126610]
movdqa xmm3, xmmword [0x140126740]
movdqa xmm5, xmmword [0x140126630]
movdqa xmmword [rsp + 0x30], xmm0
mov r9d, dword [rsp + 0x30]
movaps xmmword [rsp + 0x60], xmm6
movdqa xmm6, xmmword [0x1401266c0]
nop dword [rax]
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm4
add r8d, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, r9d
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movd dword [rdx - 0xc], xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, r9d
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp r8d, 0x10
jl 0x140078c90
movaps xmm6, xmmword [rsp + 0x60]
cmp r8d, 0x12
jge 0x140078dc1
movsxd rax, r8d
lea r9, [rsp + 0x40]
add r9, rax
nop dword [rax + rax]
mov eax, 0x5397829d
lea r9, [r9 + 1]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x31
movzx eax, r8b
inc r8d
sub al, dl
add al, 0x30
xor byte [r9 - 1], al
cmp r8d, 0x12
jl 0x140078d90
lea r8, [0x14013b780]
lea rdx, [rsp + 0x40]
call r10
test al, al
je 0x140078e00
mov rax, qword [rsp + 0xa8]
mov r9d, ebx
mov qword [rsp + 0x28], rax
mov r8d, edi
mov rax, qword [rsp + 0xa0]
mov edx, esi
mov ecx, ebp
mov qword [rsp + 0x20], rax
call qword [0x14013b780]
jmp 0x140078e02
xor eax, eax
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140078e20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x14013b7a8]
mov rbx, rdx
mov rdi, rcx
test rax, rax
jne 0x14007900b
mov rcx, qword [0x14013b728]
xor r8d, r8d
cmp dword [0x140137c60], 2
movups xmm0, xmmword [str.hbZRDPbR_MehYIjZ85B]
mov rax, qword [rcx]
movups xmmword [rsp + 0x30], xmm0
mov r10, qword [rax + 8]
movzx eax, word [0x140125808]
mov word [rsp + 0x40], ax
movzx eax, byte [0x14012580a]
mov byte [rsp + 0x42], al
jl 0x140078fb0
movdqa xmm0, xmmword [0x1401266f0]
lea rdx, [rsp + 0x34]
movdqa xmm4, xmmword [0x140126610]
movdqa xmm3, xmmword [0x140126740]
movdqa xmm5, xmmword [0x140126630]
movdqa xmmword [rsp + 0x20], xmm0
mov r9d, dword [rsp + 0x20]
movaps xmmword [rsp + 0x50], xmm6
movdqa xmm6, xmmword [0x1401266c0]
nop
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm4
add r8d, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, r9d
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movd dword [rdx - 0xc], xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, r9d
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp r8d, 0x10
jl 0x140078ec0
movaps xmm6, xmmword [rsp + 0x50]
cmp r8d, 0x13
jge 0x140078ff1
movsxd rax, r8d
lea r9, [rsp + 0x30]
add r9, rax
nop dword [rax + rax]
mov eax, 0x5397829d
lea r9, [r9 + 1]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x31
movzx eax, r8b
inc r8d
sub al, dl
add al, 0x30
xor byte [r9 - 1], al
cmp r8d, 0x13
jl 0x140078fc0
lea r8, [0x14013b7a8]
lea rdx, [rsp + 0x30]
call r10
test al, al
je 0x140079013
mov rax, qword [0x14013b7a8]
mov rdx, rbx
mov rcx, rdi
call rax
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x140079020
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x14013b788]
mov rbx, rdx
mov rdi, rcx
test rax, rax
jne 0x14007920b
mov rcx, qword [0x14013b728]
xor r8d, r8d
cmp dword [0x140137c60], 2
movups xmm0, xmmword [str.hbZRDPbR_MehYIxP.5B]
mov rax, qword [rcx]
movups xmmword [rsp + 0x30], xmm0
mov r10, qword [rax + 8]
movzx eax, word [0x1401257f0]
mov word [rsp + 0x40], ax
movzx eax, byte [0x1401257f2]
mov byte [rsp + 0x42], al
jl 0x1400791b0
movdqa xmm0, xmmword [0x1401266f0]
lea rdx, [rsp + 0x34]
movdqa xmm4, xmmword [0x140126610]
movdqa xmm3, xmmword [0x140126740]
movdqa xmm5, xmmword [0x140126630]
movdqa xmmword [rsp + 0x20], xmm0
mov r9d, dword [rsp + 0x20]
movaps xmmword [rsp + 0x50], xmm6
movdqa xmm6, xmmword [0x1401266c0]
nop
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm4
add r8d, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, r9d
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movd dword [rdx - 0xc], xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, r9d
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp r8d, 0x10
jl 0x1400790c0
movaps xmm6, xmmword [rsp + 0x50]
cmp r8d, 0x13
jge 0x1400791f1
movsxd rax, r8d
lea r9, [rsp + 0x30]
add r9, rax
nop dword [rax + rax]
mov eax, 0x5397829d
lea r9, [r9 + 1]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x31
movzx eax, r8b
inc r8d
sub al, dl
add al, 0x30
xor byte [r9 - 1], al
cmp r8d, 0x13
jl 0x1400791c0
lea r8, [0x14013b788]
lea rdx, [rsp + 0x30]
call r10
test al, al
je 0x140079213
mov rax, qword [0x14013b788]
mov rdx, rbx
mov rcx, rdi
call rax
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x140079220
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x14013b7b0]
mov ebx, edx
mov rdi, rcx
test rax, rax
jne 0x1400793fa
cmp byte [0x140125787], 0
movups xmm0, xmmword [0x140125770]
mov r9, qword [0x14013b728]
movups xmmword [rsp + 0x30], xmm0
mov rax, qword [r9]
movsd xmm0, qword [0x140125780]
movsd qword [rsp + 0x40], xmm0
mov r10, qword [rax + 8]
je 0x1400793dd
xor ecx, ecx
cmp dword [0x140137c60], 2
jl 0x1400793a8
movdqa xmm0, xmmword [0x1401266f0]
lea rdx, [rsp + 0x34]
movdqa xmm4, xmmword [0x140126610]
movdqa xmm3, xmmword [0x140126740]
movdqa xmm5, xmmword [0x140126630]
movdqa xmmword [rsp + 0x20], xmm0
mov r8d, dword [rsp + 0x20]
movaps xmmword [rsp + 0x50], xmm6
movdqa xmm6, xmmword [0x1401266c0]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm4
add ecx, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, r8d
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movd dword [rdx - 0xc], xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, r8d
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x18
jl 0x1400792c0
movaps xmm6, xmmword [rsp + 0x50]
jmp 0x1400793dd
lea r8, [rsp + 0x30]
nop dword [rax]
mov eax, 0x5397829d
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x31
movzx eax, cl
inc ecx
sub al, dl
add al, 0x30
xor byte [r8 - 1], al
cmp ecx, 0x18
jl 0x1400793b0
lea r8, [0x14013b7b0]
mov rcx, r9
lea rdx, [rsp + 0x30]
call r10
test al, al
je 0x140079401
mov rax, qword [0x14013b7b0]
mov edx, ebx
mov rcx, rdi
call rax
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x140079410
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x14013b7d0]
mov ebx, edx
mov rdi, rcx
test rax, rax
jne 0x1400795ea
cmp byte [0x140125827], 0
movups xmm0, xmmword [str.hbZRDPbR_MehYIjZ85]
mov r9, qword [0x14013b728]
movups xmmword [rsp + 0x30], xmm0
mov rax, qword [r9]
movsd xmm0, qword [0x140125820]
movsd qword [rsp + 0x40], xmm0
mov r10, qword [rax + 8]
je 0x1400795cd
xor ecx, ecx
cmp dword [0x140137c60], 2
jl 0x140079598
movdqa xmm0, xmmword [0x1401266f0]
lea rdx, [rsp + 0x34]
movdqa xmm4, xmmword [0x140126610]
movdqa xmm3, xmmword [0x140126740]
movdqa xmm5, xmmword [0x140126630]
movdqa xmmword [rsp + 0x20], xmm0
mov r8d, dword [rsp + 0x20]
movaps xmmword [rsp + 0x50], xmm6
movdqa xmm6, xmmword [0x1401266c0]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm4
add ecx, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, r8d
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movd dword [rdx - 0xc], xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, r8d
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x18
jl 0x1400794b0
movaps xmm6, xmmword [rsp + 0x50]
jmp 0x1400795cd
lea r8, [rsp + 0x30]
nop dword [rax]
mov eax, 0x5397829d
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x31
movzx eax, cl
inc ecx
sub al, dl
add al, 0x30
xor byte [r8 - 1], al
cmp ecx, 0x18
jl 0x1400795a0
lea r8, [0x14013b7d0]
mov rcx, r9
lea rdx, [rsp + 0x30]
call r10
test al, al
je 0x1400795f1
mov rax, qword [0x14013b7d0]
mov edx, ebx
mov rcx, rdi
call rax
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x140079600
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
mov r10, qword [0x14013b7c0]
mov ebx, r9d
mov edi, r8d
mov esi, edx
mov ebp, ecx
test r10, r10
je 0x14007963f
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x20], rax
call r10
jmp 0x140079815
mov rcx, qword [0x14013b728]
xor r8d, r8d
cmp dword [0x140137c60], 2
movups xmm0, xmmword [0x140125838]
mov rax, qword [rcx]
movups xmmword [rsp + 0x40], xmm0
mov r10, qword [rax + 8]
movzx eax, byte [0x140125848]
mov byte [rsp + 0x50], al
jl 0x1400797a1
movdqa xmm0, xmmword [0x1401266f0]
lea rdx, [rsp + 0x44]
movdqa xmm4, xmmword [0x140126610]
movdqa xmm3, xmmword [0x140126740]
movdqa xmm5, xmmword [0x140126630]
movdqa xmmword [rsp + 0x30], xmm0
mov r9d, dword [rsp + 0x30]
movaps xmmword [rsp + 0x60], xmm6
movdqa xmm6, xmmword [0x1401266c0]
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm4
add r8d, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, r9d
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movd dword [rdx - 0xc], xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, r9d
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp r8d, 0x10
jl 0x1400796b1
movaps xmm6, xmmword [rsp + 0x60]
cmp r8d, 0x11
jge 0x1400797e1
movsxd rax, r8d
lea r9, [rsp + 0x40]
add r9, rax
nop dword [rax]
mov eax, 0x5397829d
lea r9, [r9 + 1]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x31
movzx eax, r8b
inc r8d
sub al, dl
add al, 0x30
xor byte [r9 - 1], al
cmp r8d, 0x11
jl 0x1400797b0
lea r8, [0x14013b7c0]
lea rdx, [rsp + 0x40]
call r10
test al, al
je 0x140079813
mov rax, qword [rsp + 0xa0]
mov r9d, ebx
mov r8d, edi
mov qword [rsp + 0x20], rax
mov edx, esi
mov ecx, ebp
call qword [0x14013b7c0]
jmp 0x140079815
xor eax, eax
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret