joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180010790
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
push rdi
sub rsp, 0xe0
mov rax, qword [0x180088060]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov rax, qword [0x18008d280]
mov rdi, rdx
mov rbx, rcx
test rax, rax
jne 0x1800109e5
cmp dword [0x180088068], 2
movups xmm0, xmmword [0x18007ae40]
movups xmm1, xmmword [0x18007ae50]
movups xmmword [rsp + 0x30], xmm0
movups xmm0, xmmword [0x18007ae60]
movups xmmword [rsp + 0x40], xmm1
movups xmm1, xmmword [str._______1xe7:1]
movups xmmword [rsp + 0x50], xmm0
movups xmm0, xmmword [0x18007ae80]
movups xmmword [rsp + 0x60], xmm1
movups xmm1, xmmword [0x18007ae90]
movups xmmword [rsp + 0x70], xmm0
movups xmmword [r11 - 0x68], xmm1
jl 0x18001097d
movdqa xmm5, xmmword [0x18007c070]
lea rcx, [rsp + 0x30]
movdqa xmm4, xmmword [0x18007c150]
mov eax, 4
movaps xmmword [r11 - 0x18], xmm6
xor edx, edx
movaps xmmword [r11 - 0x28], xmm7
movdqa xmm7, xmmword [0x18007c090]
movaps xmmword [r11 - 0x38], xmm8
movd xmm6, eax
mov eax, 0x1f
movaps xmmword [r11 - 0x48], xmm9
movdqa xmm9, xmmword [str.55555555]
movd xmm8, eax
nop dword [rax + rax]
movd xmm2, edx
lea eax, [rdx + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 0x10]
paddd xmm2, xmm5
add edx, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm9
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rcx - 0x10]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
pxor xmm3, xmm0
movq qword [rcx - 0x10], xmm3
paddd xmm2, xmm5
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm9
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rcx - 8]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
pxor xmm3, xmm0
movq qword [rcx - 8], xmm3
cmp edx, 0x30
jl 0x180010870
movaps xmm9, xmmword [rsp + 0xa0]
movaps xmm8, xmmword [rsp + 0xb0]
movaps xmm7, xmmword [rsp + 0xc0]
movaps xmm6, xmmword [rsp + 0xd0]
jmp 0x1800109c1
lea r8, [rsp + 0x30]
xor ecx, ecx
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x4bda12f7
lea r8, [r8 + 2]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul edx, eax, 0x36
movzx eax, cx
inc ecx
sub ax, dx
add ax, 0x35
xor word [r8 - 2], ax
cmp ecx, 0x30
jl 0x180010990
mov rax, qword [0x18008d170]
lea r8, [rsp + 0x30]
xor r9d, r9d
add rax, 0x45dc480
xor ecx, ecx
lea rdx, [r9 - 1]
call rax
mov qword [0x18008d280], rax
mov r10, qword [0x18008d170]
lea r8, [rsp + 0x90]
add r10, 0x45c7e30
mov qword [rsp + 0x90], rdi
xor r9d, r9d
mov qword [rsp + 0x20], 0
mov rdx, rax
mov rcx, rbx
call r10
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.18003b7e0
mov rbx, qword [rsp + 0x100]
add rsp, 0xe0
pop rdi
ret
Function at 0x18001e0c0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
cmp edx, 1
jne 0x18001e24c
call fcn.18001d580
test eax, eax
jne 0x18001e0e3
mov al, 1
add rsp, 0x30
pop rbp
ret
mov r10, qword [0x18008d3d0]
test r10, r10
jne 0x18001e1c7
mov rax, qword gs:[0x60]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdi
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov r11, rsi
nop dword [rax]
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x18001e198
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x18001e198
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r8d
mov edx, 0x4ac8c061
lea rax, [rdi + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x18001e193
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x18001e170
cmp edx, 0x556ed670
je 0x18001e254
test r8d, r8d
jne 0x18001e150
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x18001e1ae
cmp qword [rax + 0x30], 0
jne 0x18001e120
xor r10d, r10d
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x40]
mov qword [0x18008d3d0], r10
mov eax, dword [str.pDE_LH_]
lea r8, [rbp + 0x20]
movzx ecx, byte [0x180079fc6]
lea rdx, [rbp + 0x28]
mov dword [rbp + 0x20], eax
xor cl, 0x3b
movzx eax, word [0x18007b0e4]
mov r9d, 0x10
xor byte [rbp + 0x21], 0x36
xor byte [rbp + 0x22], 0x37
xor byte [rbp + 0x23], 0x38
mov word [rbp + 0x24], ax
movzx eax, byte [0x18007b0e6]
xor byte [rbp + 0x24], 0x39
xor al, 0x3b
xor byte [rbp + 0x25], 0x3a
mov byte [rbp + 0x26], al
mov eax, dword [str.PDE_LH_]
mov dword [rbp + 0x28], eax
movzx eax, word [0x180079fc4]
xor byte [rbp + 0x29], 0x36
xor byte [rbp + 0x2a], 0x37
xor byte [rbp + 0x2b], 0x38
mov word [rbp + 0x2c], ax
xor al, 0x39
xor byte [rbp + 0x2d], 0x3a
mov byte [rbp + 0x2e], cl
xor ecx, ecx
mov byte [rbp + 0x2c], al
mov byte [rbp + 0x20], 0x45
mov byte [rbp + 0x28], 0x65
call r10
xor al, al
add rsp, 0x30
pop rbp
ret
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov r10d, dword [rcx + rdx*4]
add r10, r9
jmp 0x18001e1b1
Function at 0x18001e680
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x18001e6a2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x18001e71c
mov rdi, r14
mov rcx, rbx
call fcn.1800209c0
test rax, rax
jle 0x18001e6f4
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov rax, qword [rbx + 0x38]
mov r8, rbp
mov rdx, qword [rax]
call fcn.18003dcb0
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x18001e70c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x18001e714
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x18001e6b6
sub r14, rdi
jmp 0x18001e7ff
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x18001e733
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x18001e735
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x18001e767
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.18003dcb0
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x18001e7fc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x18001e7a2
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x18001e7dd
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.18004ce7c
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x18001e7fc
cmp rbp, rax
ja 0x18001e7b0
test rbp, rbp
je 0x18001e7fc
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.18004ce7c
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
Function at 0x180021fe0
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
push rdi
sub rsp, 0xe0
mov rax, qword [0x180088060]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rax, qword [0x18008d0f8]
mov rbx, rdx
mov rdi, rcx
test rax, rax
jne 0x18002223a
movups xmm0, xmmword [0x18007a530]
xor r8d, r8d
cmp dword [0x180088068], 2
movups xmm1, xmmword [str.RPK2..__7h]
movzx eax, word [0x18007a578]
movups xmmword [rsp + 0x30], xmm0
movups xmm0, xmmword [0x18007a550]
movups xmmword [rsp + 0x50], xmm0
movsd xmm0, qword [0x18007a570]
movups xmmword [rsp + 0x40], xmm1
movups xmm1, xmmword [0x18007a560]
movsd qword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x60], xmm1
mov word [rsp + 0x78], ax
jl 0x1800221d5
movdqa xmm5, xmmword [0x18007c070]
lea rcx, [rsp + 0x30]
movdqa xmm4, xmmword [0x18007c150]
mov eax, 4
movaps xmmword [r11 - 0x18], xmm6
movaps xmmword [r11 - 0x28], xmm7
movdqa xmm7, xmmword [0x18007c090]
movaps xmmword [r11 - 0x38], xmm8
movd xmm6, eax
mov eax, 0x1f
movaps xmmword [r11 - 0x48], xmm9
movdqa xmm9, xmmword [str.55555555]
movd xmm8, eax
nop
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 0x10]
paddd xmm2, xmm5
add r8d, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm9
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rcx - 0x10]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
pxor xmm3, xmm0
movq qword [rcx - 0x10], xmm3
paddd xmm2, xmm5
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm9
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rcx - 8]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
pxor xmm3, xmm0
movq qword [rcx - 8], xmm3
cmp r8d, 0x20
jl 0x1800220c0
movaps xmm9, xmmword [rsp + 0xa0]
movaps xmm8, xmmword [rsp + 0xb0]
movaps xmm7, xmmword [rsp + 0xc0]
movaps xmm6, xmmword [rsp + 0xd0]
cmp r8d, 0x25
jge 0x180022216
movsxd rax, r8d
lea r9, [rsp + 0x30]
lea r9, [r9 + rax*2]
mov eax, 0x4bda12f7
lea r9, [r9 + 2]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x36
movzx eax, r8w
inc r8d
sub ax, cx
add ax, 0x35
xor word [r9 - 2], ax
cmp r8d, 0x25
jl 0x1800221e1
mov rax, qword [0x18008d170]
lea r8, [rsp + 0x30]
xor r9d, r9d
add rax, 0x45dc480
xor ecx, ecx
lea rdx, [r9 - 1]
call rax
mov qword [0x18008d0f8], rax
mov r10, qword [0x18008d170]
lea r8, [rsp + 0x80]
add r10, 0x45c7e30
mov qword [rsp + 0x80], 0
xor r9d, r9d
mov dword [rsp + 0x88], 0
mov rdx, rax
mov qword [rsp + 0x20], 0
mov rcx, rdi
call r10
movsd xmm0, qword [rsp + 0x80]
mov rax, rbx
mov ecx, dword [rsp + 0x88]
movsd qword [rbx], xmm0
mov dword [rbx + 8], ecx
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.18003b7e0
mov rbx, qword [rsp + 0x100]
add rsp, 0xe0
pop rdi
ret
Function at 0x18002c5a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x18002c5d4
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x18002c5c0
ret
Function at 0x180031e00
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0x90
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
movaps xmmword [rax - 0x38], xmm8
mov rbx, rcx
movups xmm0, xmmword [str.VVLfIK_PaR_21__F]
movups xmmword [rax - 0x78], xmm0
movzx eax, word [0x18007b988]
mov word [rsp + 0x30], ax
cmp byte [0x18007b989], 0
je 0x18000d5cc
xor ecx, ecx
cmp dword [0x180088068], 2
jl 0x18000d595
movdqa xmm5, xmmword [0x18007c070]
movdqa xmm4, xmmword [0x18007c150]
mov eax, 4
movd xmm6, eax
movdqa xmm7, xmmword [0x18007c090]
mov eax, 0x1f
movd xmm8, eax
movdqa xmm0, xmmword [str.5555555555555555]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x24]
mov r8d, dword [rsp + 0x40]
movd xmm2, ecx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x18007c100]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 4]
pxor xmm2, xmm0
movd dword [rdx - 4], xmm2
lea eax, [rcx + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x18007c100]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx]
pxor xmm2, xmm0
movd dword [rdx], xmm2
add ecx, 8
lea rdx, [rdx + 8]
cmp ecx, 0x10
jl 0x18000d491
cmp ecx, 0x12
jge 0x18000d5cc
movsxd rax, ecx
lea r8, [rsp + 0x20]
add r8, rax
mov eax, 0x4bda12f7
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x36
movzx eax, cl
sub al, dl
add al, 0x35
xor byte [r8], al
inc ecx
lea r8, [r8 + 1]
cmp ecx, 0x12
jl 0x18000d5a0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
lea rax, [rsp + 0x20]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x18000d5f0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.180007590
nop
lea rdx, [rsp + 0x40]
mov rcx, qword [rbx]
call fcn.180007ee0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x18000d651
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000d64c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000d66d
call fcn.18003b800
movaps xmm6, xmmword [rsp + 0x80]
movaps xmm7, xmmword [rsp + 0x70]
movaps xmm8, xmmword [rsp + 0x60]
add rsp, 0x90
pop rbx
ret
call fcn.18004d68c
int3
add rcx, 8
jmp 0x18000d400
Function at 0x180031e40
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x80
movaps xmmword [rsp + 0x70], xmm6
movaps xmmword [rsp + 0x60], xmm7
movaps xmmword [rsp + 0x50], xmm8
mov rbx, rcx
movups xmm0, xmmword [str.VVLfIK_Pa___:D]
movups xmmword [rsp + 0x20], xmm0
psrldq xmm0, 0xf
movd eax, xmm0
test al, al
je 0x18000d34c
xor ecx, ecx
cmp dword [0x180088068], 2
jl 0x18000d311
movdqa xmm5, xmmword [0x18007c070]
movdqa xmm4, xmmword [0x18007c150]
mov eax, 4
movd xmm6, eax
movdqa xmm7, xmmword [0x18007c090]
mov eax, 0x1f
movd xmm8, eax
movdqa xmm0, xmmword [str.5555555555555555]
movdqa xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x24]
mov r8d, dword [rsp + 0x30]
nop dword [rax + rax]
movd xmm2, ecx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x18007c100]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 4]
pxor xmm2, xmm0
movd dword [rdx - 4], xmm2
lea eax, [rcx + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x18007c100]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx]
pxor xmm2, xmm0
movd dword [rdx], xmm2
add ecx, 8
lea rdx, [rdx + 8]
cmp ecx, 0x10
jl 0x18000d210
jmp 0x18000d34c
lea r8, [rsp + 0x20]
nop word [rax + rax]
mov eax, 0x4bda12f7
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x36
movzx eax, cl
sub al, dl
add al, 0x35
xor byte [r8], al
inc ecx
lea r8, [r8 + 1]
cmp ecx, 0x10
jl 0x18000d320
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
lea rax, [rsp + 0x20]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x18000d370
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.180007590
nop
lea r8, [0x180088f4c]
lea rdx, [rsp + 0x30]
mov rcx, qword [rbx]
call fcn.180008460
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x18000d3d8
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000d3d3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000d3f1
call fcn.18003b800
movaps xmm6, xmmword [rsp + 0x70]
movaps xmm7, xmmword [rsp + 0x60]
movaps xmm8, xmmword [rsp + 0x50]
add rsp, 0x80
pop rbx
ret
call fcn.18004d68c
int3
add rcx, 8
jmp 0x18000d180
Function at 0x180031e80
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0x90
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
movaps xmmword [rax - 0x38], xmm8
mov rbx, rcx
movups xmm0, xmmword [str.VVLfIK_PaZ._____F]
movups xmmword [rax - 0x78], xmm0
movzx eax, word [0x18007a258]
mov word [rsp + 0x30], ax
cmp byte [0x18007a259], 0
je 0x18000d0cc
xor ecx, ecx
cmp dword [0x180088068], 2
jl 0x18000d095
movdqa xmm5, xmmword [0x18007c070]
movdqa xmm4, xmmword [0x18007c150]
mov eax, 4
movd xmm6, eax
movdqa xmm7, xmmword [0x18007c090]
mov eax, 0x1f
movd xmm8, eax
movdqa xmm0, xmmword [str.5555555555555555]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x24]
mov r8d, dword [rsp + 0x40]
movd xmm2, ecx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x18007c100]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 4]
pxor xmm2, xmm0
movd dword [rdx - 4], xmm2
lea eax, [rcx + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x18007c100]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx]
pxor xmm2, xmm0
movd dword [rdx], xmm2
add ecx, 8
lea rdx, [rdx + 8]
cmp ecx, 0x10
jl 0x18000cf91
cmp ecx, 0x12
jge 0x18000d0cc
movsxd rax, ecx
lea r8, [rsp + 0x20]
add r8, rax
mov eax, 0x4bda12f7
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x36
movzx eax, cl
sub al, dl
add al, 0x35
xor byte [r8], al
inc ecx
lea r8, [r8 + 1]
cmp ecx, 0x12
jl 0x18000d0a0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
lea rax, [rsp + 0x20]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x18000d0f0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.180007590
nop
lea r8, [0x18008d18a]
lea rdx, [rsp + 0x40]
mov rcx, qword [rbx]
call fcn.180008070
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x18000d158
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000d153
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000d174
call fcn.18003b800
movaps xmm6, xmmword [rsp + 0x80]
movaps xmm7, xmmword [rsp + 0x70]
movaps xmm8, xmmword [rsp + 0x60]
add rsp, 0x90
pop rbx
ret
call fcn.18004d68c
int3
add rcx, 8
jmp 0x18000cf00
Function at 0x180031ec0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0x90
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
movaps xmmword [rax - 0x38], xmm8
mov rbx, rcx
movups xmm0, xmmword [str.AD__IRJ___._E]
movups xmmword [rax - 0x78], xmm0
movzx eax, byte [0x18007b5f8]
mov byte [rsp + 0x30], al
xor ecx, ecx
cmp dword [0x180088068], 2
jl 0x18000ce07
movdqa xmm5, xmmword [0x18007c070]
movdqa xmm4, xmmword [0x18007c150]
mov eax, 4
movd xmm6, eax
movdqa xmm7, xmmword [0x18007c090]
mov eax, 0x1f
movd xmm8, eax
movdqa xmm0, xmmword [str.5555555555555555]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x24]
mov r8d, dword [rsp + 0x40]
movd xmm2, ecx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x18007c100]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 4]
pxor xmm2, xmm0
movd dword [rdx - 4], xmm2
lea eax, [rcx + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x18007c100]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx]
pxor xmm2, xmm0
movd dword [rdx], xmm2
add ecx, 8
lea rdx, [rdx + 8]
cmp ecx, 0x10
jl 0x18000cd03
cmp ecx, 0x11
jge 0x18000ce4c
movsxd rax, ecx
lea r8, [rsp + 0x20]
add r8, rax
nop dword [rax]
nop word [rax + rax]
mov eax, 0x4bda12f7
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x36
movzx eax, cl
sub al, dl
add al, 0x35
xor byte [r8], al
inc ecx
lea r8, [r8 + 1]
cmp ecx, 0x11
jl 0x18000ce20
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
lea rax, [rsp + 0x20]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x18000ce70
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.180007590
nop
lea r8, [0x180088f58]
lea rdx, [rsp + 0x40]
mov rcx, qword [rbx]
call fcn.180008460
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x18000ced8
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000ced3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000cef4
call fcn.18003b800
movaps xmm6, xmmword [rsp + 0x80]
movaps xmm7, xmmword [rsp + 0x70]
movaps xmm8, xmmword [rsp + 0x60]
add rsp, 0x90
pop rbx
ret
call fcn.18004d68c
int3
add rcx, 8
jmp 0x18000cc80