joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1402b5670
Capabilities:
Encode data using xor

Disassembly:
push rax
cmp dword [0x140384a70], 1
je 0x1402b56c2
mov r9, rdx
xor ecx, ecx
movabs r10, 0x97b425ed097b425f
nop dword [rax]
mov rax, rcx
mul r10
shr rdx, 4
imul eax, edx, 0xffffffe5
movzx edx, byte [r8 + rcx + 0x1b]
add eax, ecx
cdqe
xor dl, byte [r8 + rax]
mov byte [r9 + rcx], dl
add rcx, 1
cmp ecx, 0x1d
jne 0x1402b5690
mov dword [0x140384a70], 1
pop rax
ret

Function at 0x1402b56d0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rax
cmp dword [0x140384a84], 1
je 0x1402b573d
mov r9, rdx
mov ecx, send
xor r10d, r10d
movabs r11, 0xe38e38e38e38e38f
mov rsi, r8
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r10
mul r11
shr rdx, 3
and rdx, 0xfffffffffffffffe
lea rax, [rdx + rdx*8]
neg rax
movzx edx, byte [r8 + rcx]
xor dl, byte [rsi + rax]
mov byte [r9 + rcx - 0x12], dl
add rcx, 1
add rsi, 1
add r10, 1
cmp ecx, 0x20
jne 0x1402b5700
mov dword [0x140384a84], 1
add rsp, 8
pop rsi
ret

Function at 0x1402b5750
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rax
cmp dword [0x140384a98], 1
je 0x1402b57b6
mov r9, rdx
mov ecx, 0x1e
xor r10d, r10d
movabs r11, 0x8888888888888889
mov rsi, r8
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r10
mul r11
shr rdx, 4
imul rax, rdx, 0xffffffffffffffe2
movzx edx, byte [r8 + rcx]
xor dl, byte [rsi + rax]
mov byte [r9 + rcx - 0x1e], dl
add rcx, 1
add rsi, 1
add r10, 1
cmp ecx, 0x2b
jne 0x1402b5780
mov dword [0x140384a98], 1
add rsp, 8
pop rsi
ret

Function at 0x1402b57c0
Capabilities:
Encode data using xor

Disassembly:
push rax
cmp dword [0x140384ab0], 1
je 0x1402b5818
mov r9, rdx
xor ecx, ecx
movabs r10, 0xe38e38e38e38e38f
nop dword [rax]
mov rax, rcx
mul r10
shr rdx, 4
add edx, edx
lea r11d, [rdx + rdx*8]
movzx edx, byte [r8 + rcx + 0x12]
mov eax, ecx
sub eax, r11d
cdqe
xor dl, byte [r8 + rax]
mov byte [r9 + rcx], dl
add rcx, 1
cmp ecx, 0x14
jne 0x1402b57e0
mov dword [0x140384ab0], 1
pop rax
ret

Function at 0x1402b5820
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rax
cmp dword [0x140384ac0], 1
je 0x1402b588c
mov r9, rdx
mov ecx, 0x18
xor r10d, r10d
movabs r11, 0xaaaaaaaaaaaaaaab
mov rsi, r8
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r10
mul r11
shr rdx, 1
and rdx, 0xfffffffffffffff8
lea rax, [rdx + rdx*2]
neg rax
movzx edx, byte [r8 + rcx]
xor dl, byte [rsi + rax]
mov byte [r9 + rcx - 0x18], dl
add rcx, 1
add rsi, 1
add r10, 1
cmp ecx, 0x22
jne 0x1402b5850
mov dword [0x140384ac0], 1
add rsp, 8
pop rsi
ret

Function at 0x1402b58a0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rax
cmp dword [0x140384ac8], 1
je 0x1402b5912
mov r9, rdx
mov ecx, 0x19
xor r10d, r10d
movabs r11, 0x47ae147ae147ae15
mov rsi, r8
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r10
mul r11
mov rax, r10
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
imul rax, rax, 0xffffffffffffffe7
movzx edx, byte [r8 + rcx]
xor dl, byte [rsi + rax]
mov byte [r9 + rcx - 0x19], dl
add rcx, 1
add rsi, 1
add r10, 1
cmp ecx, 0x1d
jne 0x1402b58d0
mov dword [0x140384ac8], 1
add rsp, 8
pop rsi
ret
Function at 0x1402b5920
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rax
cmp dword [0x140384ad0], 1
je 0x1402b598d
mov r9, rdx
mov ecx, socket
xor r10d, r10d
movabs r11, 0xcccccccccccccccd
mov rsi, r8
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r10
mul r11
shr rdx, 2
and rdx, 0xfffffffffffffffc
lea rax, [rdx + rdx*4]
neg rax
movzx edx, byte [r8 + rcx]
xor dl, byte [rsi + rax]
mov byte [r9 + rcx - 0x14], dl
add rcx, 1
add rsi, 1
add r10, 1
cmp ecx, 0x16
jne 0x1402b5950
mov dword [0x140384ad0], 1
add rsp, 8
pop rsi
ret

Function at 0x1402b59a0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rax
cmp dword [0x140384adc], 1
je 0x1402b5a12
mov r9, rdx
mov ecx, socket
xor r10d, r10d
movabs r11, 0x8618618618618619
mov rsi, r8
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r10
mul r11
mov rax, r10
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
imul rax, rax, 0xffffffffffffffeb
movzx edx, byte [r8 + rcx]
xor dl, byte [rsi + rax]
mov byte [r9 + rcx - 0x15], dl
add rcx, 1
add rsi, 1
add r10, 1
cmp ecx, 0x1c
jne 0x1402b59d0
mov dword [0x140384adc], 1
add rsp, 8
pop rsi
ret

Function at 0x1402b5a20
Capabilities:
Encode data using xor

Disassembly:
push rax
cmp dword [0x140384af4], 1
je 0x1402b5a79
mov r9, rdx
xor ecx, ecx
movabs r10, 0xf0f0f0f0f0f0f0f1
nop dword [rax]
mov rax, rcx
mul r10
shr rdx, 4
mov eax, edx
shl eax, 4
add eax, edx
movzx r11d, byte [r8 + rcx + 0x11]
mov edx, ecx
sub edx, eax
movsxd rax, edx
xor r11b, byte [r8 + rax]
mov byte [r9 + rcx], r11b
add rcx, 1
cmp ecx, 0x14
jne 0x1402b5a40
mov dword [0x140384af4], 1
pop rax
ret

Function at 0x1402b5a80
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rax
cmp dword [0x140384b04], 1
je 0x1402b5ae6
mov r9, rdx
mov ecx, 0x1e
xor r10d, r10d
movabs r11, 0x8888888888888889
mov rsi, r8
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r10
mul r11
shr rdx, 4
imul rax, rdx, 0xffffffffffffffe2
movzx edx, byte [r8 + rcx]
xor dl, byte [rsi + rax]
mov byte [r9 + rcx - 0x1e], dl
add rcx, 1
add rsi, 1
add r10, 1
cmp ecx, 0x28
jne 0x1402b5ab0
mov dword [0x140384b04], 1
add rsp, 8
pop rsi
ret

Function at 0x1402b5af0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rax
cmp dword [0x140384b10], 1
je 0x1402b5b62
mov r9, rdx
mov ecx, 0x19
xor r10d, r10d
movabs r11, 0x47ae147ae147ae15
mov rsi, r8
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r10
mul r11
mov rax, r10
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
imul rax, rax, 0xffffffffffffffe7
movzx edx, byte [r8 + rcx]
xor dl, byte [rsi + rax]
mov byte [r9 + rcx - 0x19], dl
add rcx, 1
add rsi, 1
add r10, 1
cmp ecx, 0x1e
jne 0x1402b5b20
mov dword [0x140384b10], 1
add rsp, 8
pop rsi
ret
Function at 0x1402b5b70
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rax
cmp dword [0x140384b1c], 1
je 0x1402b5bdc
mov r9, rdx
mov ecx, 0x18
xor r10d, r10d
movabs r11, 0xaaaaaaaaaaaaaaab
mov rsi, r8
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r10
mul r11
shr rdx, 1
and rdx, 0xfffffffffffffff8
lea rax, [rdx + rdx*2]
neg rax
movzx edx, byte [r8 + rcx]
xor dl, byte [rsi + rax]
mov byte [r9 + rcx - 0x18], dl
add rcx, 1
add rsi, 1
add r10, 1
cmp ecx, 0x1e
jne 0x1402b5ba0
mov dword [0x140384b1c], 1
add rsp, 8
pop rsi
ret

Function at 0x1402b5bf0
Capabilities:
Encode data using xor

Disassembly:
push rax
cmp dword [0x140384b28], 1
je 0x1402b5c20
xor eax, eax
nop dword [rax]
movzx ecx, byte [r8 + rax + 0x10]
xor cl, byte [r8 + rax]
mov byte [rdx + rax], cl
add rax, 1
cmp eax, 7
jne 0x1402b5c00
mov dword [0x140384b28], 1
pop rax
ret

Function at 0x1402b5c30
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rax
cmp dword [0x140384b34], 1
je 0x1402b5c9d
mov r9, rdx
mov ecx, send
xor r10d, r10d
movabs r11, 0xe38e38e38e38e38f
mov rsi, r8
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r10
mul r11
shr rdx, 3
and rdx, 0xfffffffffffffffe
lea rax, [rdx + rdx*8]
neg rax
movzx edx, byte [r8 + rcx]
xor dl, byte [rsi + rax]
mov byte [r9 + rcx - 0x12], dl
add rcx, 1
add rsi, 1
add r10, 1
cmp ecx, 0x19
jne 0x1402b5c60
mov dword [0x140384b34], 1
add rsp, 8
pop rsi
ret

Function at 0x1402b5cb0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rax
cmp dword [0x140384b40], 1
je 0x1402b5d22
mov r9, rdx
mov ecx, 0x19
xor r10d, r10d
movabs r11, 0x47ae147ae147ae15
mov rsi, r8
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r10
mul r11
mov rax, r10
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
imul rax, rax, 0xffffffffffffffe7
movzx edx, byte [r8 + rcx]
xor dl, byte [rsi + rax]
mov byte [r9 + rcx - 0x19], dl
add rcx, 1
add rsi, 1
add r10, 1
cmp ecx, 0x21
jne 0x1402b5ce0
mov dword [0x140384b40], 1
add rsp, 8
pop rsi
ret

Function at 0x1402b5d30
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rax
cmp dword [0x140384b50], 1
je 0x1402b5da2
mov r9, rdx
mov ecx, reloc.WS2_32.dll_socket
xor r10d, r10d
movabs r11, 0x642c8590b21642c9
mov rsi, r8
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r10
mul r11
mov rax, r10
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
imul rax, rax, 0xffffffffffffffe9
movzx edx, byte [r8 + rcx]
xor dl, byte [rsi + rax]
mov byte [r9 + rcx - 0x17], dl
add rcx, 1
add rsi, 1
add r10, 1
cmp ecx, 0x20
jne 0x1402b5d60
mov dword [0x140384b50], 1
add rsp, 8
pop rsi
ret

Function at 0x1402b5db0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rax
cmp dword [0x140384b60], 1
je 0x1402b5e1f
mov r9, rdx
mov ecx, send
xor r10d, r10d
movabs r11, 0xf0f0f0f0f0f0f0f1
mov rsi, r8
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r10
mul r11
shr rdx, 4
mov rax, rdx
shl rax, 4
add rax, rdx
neg rax
movzx edx, byte [r8 + rcx]
xor dl, byte [rsi + rax]
mov byte [r9 + rcx - 0x11], dl
add rcx, 1
add rsi, 1
add r10, 1
cmp ecx, 0x1b
jne 0x1402b5de0
mov dword [0x140384b60], 1
add rsp, 8
pop rsi
ret
Function at 0x1402b5e30
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rax
cmp dword [0x140384b74], 1
je 0x1402b5e9c
mov r9, rdx
mov ecx, 0x18
xor r10d, r10d
movabs r11, 0xaaaaaaaaaaaaaaab
mov rsi, r8
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r10
mul r11
shr rdx, 1
and rdx, 0xfffffffffffffff8
lea rax, [rdx + rdx*2]
neg rax
movzx edx, byte [r8 + rcx]
xor dl, byte [rsi + rax]
mov byte [r9 + rcx - 0x18], dl
add rcx, 1
add rsi, 1
add r10, 1
cmp ecx, 0x26
jne 0x1402b5e60
mov dword [0x140384b74], 1
add rsp, 8
pop rsi
ret

Function at 0x1402b5eb0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rax
cmp dword [0x140384b80], 1
je 0x1402b5f16
mov r9, rdx
mov ecx, reloc.WS2_32.dll_send
xor r10d, r10d
movabs r11, 0xd79435e50d79435f
mov rsi, r8
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r10
mul r11
shr rdx, 4
imul rax, rdx, 0xffffffffffffffed
movzx edx, byte [r8 + rcx]
xor dl, byte [rsi + rax]
mov byte [r9 + rcx - 0x13], dl
add rcx, 1
add rsi, 1
add r10, 1
cmp ecx, 0x18
jne 0x1402b5ee0
mov dword [0x140384b80], 1
add rsp, 8
pop rsi
ret

Function at 0x1402b5f20
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rax
cmp dword [0x140384b88], 1
je 0x1402b5f8c
mov r9, rdx
mov ecx, 0x18
xor r10d, r10d
movabs r11, 0xaaaaaaaaaaaaaaab
mov rsi, r8
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r10
mul r11
shr rdx, 1
and rdx, 0xfffffffffffffff8
lea rax, [rdx + rdx*2]
neg rax
movzx edx, byte [r8 + rcx]
xor dl, byte [rsi + rax]
mov byte [r9 + rcx - 0x18], dl
add rcx, 1
add rsi, 1
add r10, 1
cmp ecx, 0x1b
jne 0x1402b5f50
mov dword [0x140384b88], 1
add rsp, 8
pop rsi
ret

Function at 0x1402b5fa0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rax
cmp dword [0x140384b90], 1
je 0x1402b6006
mov r9, rdx
mov ecx, reloc.WS2_32.dll_send
xor r10d, r10d
movabs r11, 0xd79435e50d79435f
mov rsi, r8
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r10
mul r11
shr rdx, 4
imul rax, rdx, 0xffffffffffffffed
movzx edx, byte [r8 + rcx]
xor dl, byte [rsi + rax]
mov byte [r9 + rcx - 0x13], dl
add rcx, 1
add rsi, 1
add r10, 1
cmp ecx, 0x16
jne 0x1402b5fd0
mov dword [0x140384b90], 1
add rsp, 8
pop rsi
ret

Function at 0x1402b6010
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rax
cmp dword [0x140384b98], 1
je 0x1402b6088
mov r9, rdx
mov ecx, 0x1f
xor r10d, r10d
movabs r11, 0x842108421084211
mov rsi, r8
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r10
mul r11
mov rax, r10
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
mov rdx, rax
shl rdx, 5
sub rax, rdx
movzx edx, byte [r8 + rcx]
xor dl, byte [rsi + rax]
mov byte [r9 + rcx - 0x1f], dl
add rcx, 1
add rsi, 1
add r10, 1
cmp ecx, 0x22
jne 0x1402b6040
mov dword [0x140384b98], 1
add rsp, 8
pop rsi
ret
Function at 0x1402b6090
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rax
cmp dword [0x140384ba0], 1
je 0x1402b60f6
mov r9, rdx
mov ecx, 0x1b
xor r10d, r10d
movabs r11, 0x97b425ed097b425f
mov rsi, r8
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r10
mul r11
shr rdx, 4
imul rax, rdx, 0xffffffffffffffe5
movzx edx, byte [r8 + rcx]
xor dl, byte [rsi + rax]
mov byte [r9 + rcx - 0x1b], dl
add rcx, 1
add rsi, 1
add r10, 1
cmp ecx, 0x1f
jne 0x1402b60c0
mov dword [0x140384ba0], 1
add rsp, 8
pop rsi
ret

Function at 0x1402b6100
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rax
cmp dword [0x140384ba8], 1
je 0x1402b616c
mov r9, rdx
mov ecx, 0x18
xor r10d, r10d
movabs r11, 0xaaaaaaaaaaaaaaab
mov rsi, r8
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r10
mul r11
shr rdx, 1
and rdx, 0xfffffffffffffff8
lea rax, [rdx + rdx*2]
neg rax
movzx edx, byte [r8 + rcx]
xor dl, byte [rsi + rax]
mov byte [r9 + rcx - 0x18], dl
add rcx, 1
add rsi, 1
add r10, 1
cmp ecx, 0x1c
jne 0x1402b6130
mov dword [0x140384ba8], 1
add rsp, 8
pop rsi
ret

Function at 0x1402b6180
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rax
cmp dword [0x140384bb0], 1
je 0x1402b61ec
mov r9, rdx
mov ecx, 0x18
xor r10d, r10d
movabs r11, 0xaaaaaaaaaaaaaaab
mov rsi, r8
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r10
mul r11
shr rdx, 1
and rdx, 0xfffffffffffffff8
lea rax, [rdx + rdx*2]
neg rax
movzx edx, byte [r8 + rcx]
xor dl, byte [rsi + rax]
mov byte [r9 + rcx - 0x18], dl
add rcx, 1
add rsi, 1
add r10, 1
cmp ecx, 0x1c
jne 0x1402b61b0
mov dword [0x140384bb0], 1
add rsp, 8
pop rsi
ret

Function at 0x1402b6200
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rax
cmp dword [0x140384bb8], 1
je 0x1402b6272
mov r9, rdx
mov ecx, socket
xor r10d, r10d
movabs r11, 0x8618618618618619
mov rsi, r8
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r10
mul r11
mov rax, r10
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
imul rax, rax, 0xffffffffffffffeb
movzx edx, byte [r8 + rcx]
xor dl, byte [rsi + rax]
mov byte [r9 + rcx - 0x15], dl
add rcx, 1
add rsi, 1
add r10, 1
cmp ecx, 0x19
jne 0x1402b6230
mov dword [0x140384bb8], 1
add rsp, 8
pop rsi
ret

Function at 0x1402b6280
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rax
cmp dword [0x140384bc0], 1
je 0x1402b62f2
mov r9, rdx
mov ecx, 0x19
xor r10d, r10d
movabs r11, 0x47ae147ae147ae15
mov rsi, r8
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r10
mul r11
mov rax, r10
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
imul rax, rax, 0xffffffffffffffe7
movzx edx, byte [r8 + rcx]
xor dl, byte [rsi + rax]
mov byte [r9 + rcx - 0x19], dl
add rcx, 1
add rsi, 1
add r10, 1
cmp ecx, 0x1d
jne 0x1402b62b0
mov dword [0x140384bc0], 1
add rsp, 8
pop rsi
ret
Function at 0x1402b6300
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rax
cmp dword [0x140384bcc], 1
je 0x1402b6372
mov r9, rdx
mov ecx, reloc.WS2_32.dll_socket
xor r10d, r10d
movabs r11, 0x642c8590b21642c9
mov rsi, r8
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r10
mul r11
mov rax, r10
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
imul rax, rax, 0xffffffffffffffe9
movzx edx, byte [r8 + rcx]
xor dl, byte [rsi + rax]
mov byte [r9 + rcx - 0x17], dl
add rcx, 1
add rsi, 1
add r10, 1
cmp ecx, 0x1d
jne 0x1402b6330
mov dword [0x140384bcc], 1
add rsp, 8
pop rsi
ret

Function at 0x1402b6380
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rax
cmp dword [0x140384bd4], 1
je 0x1402b63f2
mov r9, rdx
mov ecx, reloc.WS2_32.dll_socket
xor r10d, r10d
movabs r11, 0x642c8590b21642c9
mov rsi, r8
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r10
mul r11
mov rax, r10
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
imul rax, rax, 0xffffffffffffffe9
movzx edx, byte [r8 + rcx]
xor dl, byte [rsi + rax]
mov byte [r9 + rcx - 0x17], dl
add rcx, 1
add rsi, 1
add r10, 1
cmp ecx, 0x1b
jne 0x1402b63b0
mov dword [0x140384bd4], 1
add rsp, 8
pop rsi
ret

Function at 0x1402b6400
Capabilities:
Encode data using xor

Disassembly:
push rax
cmp dword [0x140384be0], 1
je 0x1402b6430
xor eax, eax
nop dword [rax]
movzx ecx, byte [r8 + rax + 0x10]
xor cl, byte [r8 + rax]
mov byte [rdx + rax], cl
add rax, 1
cmp eax, 6
jne 0x1402b6410
mov dword [0x140384be0], 1
pop rax
ret

Function at 0x1402b6440
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rax
cmp dword [0x140384bec], 1
je 0x1402b64b2
mov r9, rdx
mov ecx, 0x19
xor r10d, r10d
movabs r11, 0x47ae147ae147ae15
mov rsi, r8
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r10
mul r11
mov rax, r10
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
imul rax, rax, 0xffffffffffffffe7
movzx edx, byte [r8 + rcx]
xor dl, byte [rsi + rax]
mov byte [r9 + rcx - 0x19], dl
add rcx, 1
add rsi, 1
add r10, 1
cmp ecx, 0x1f
jne 0x1402b6470
mov dword [0x140384bec], 1
add rsp, 8
pop rsi
ret

Function at 0x1402b64c0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rax
cmp dword [0x140384bf8], 1
je 0x1402b6526
mov r9, rdx
mov ecx, socket
xor r10d, r10d
movabs r11, 0x2e8ba2e8ba2e8ba3
mov rsi, r8
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r10
mul r11
shr rdx, 2
imul rax, rdx, 0xffffffffffffffea
movzx edx, byte [r8 + rcx]
xor dl, byte [rsi + rax]
mov byte [r9 + rcx - 0x16], dl
add rcx, 1
add rsi, 1
add r10, 1
cmp ecx, 0x1b
jne 0x1402b64f0
mov dword [0x140384bf8], 1
add rsp, 8
pop rsi
ret

Function at 0x1402b6530
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rax
cmp dword [0x140384c00], 1
je 0x1402b659d
mov r9, rdx
mov ecx, send
xor r10d, r10d
movabs r11, 0xe38e38e38e38e38f
mov rsi, r8
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r10
mul r11
shr rdx, 3
and rdx, 0xfffffffffffffffe
lea rax, [rdx + rdx*8]
neg rax
movzx edx, byte [r8 + rcx]
xor dl, byte [rsi + rax]
mov byte [r9 + rcx - 0x12], dl
add rcx, 1
add rsi, 1
add r10, 1
cmp ecx, 0x15
jne 0x1402b6560
mov dword [0x140384c00], 1
add rsp, 8
pop rsi
ret
Function at 0x1402b65b0
Capabilities:
Encode data using xor

Disassembly:
push rax
cmp dword [0x140384c0c], 1
je 0x1402b65e0
xor eax, eax
nop dword [rax]
movzx ecx, byte [r8 + rax + 0x10]
xor cl, byte [r8 + rax]
mov byte [rdx + rax], cl
add rax, 1
cmp eax, 7
jne 0x1402b65c0
mov dword [0x140384c0c], 1
pop rax
ret

Function at 0x1402b65f0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rax
cmp dword [0x140384c14], 1
je 0x1402b6662
mov r9, rdx
mov ecx, socket
xor r10d, r10d
movabs r11, 0x8618618618618619
mov rsi, r8
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r10
mul r11
mov rax, r10
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
imul rax, rax, 0xffffffffffffffeb
movzx edx, byte [r8 + rcx]
xor dl, byte [rsi + rax]
mov byte [r9 + rcx - 0x15], dl
add rcx, 1
add rsi, 1
add r10, 1
cmp ecx, 0x19
jne 0x1402b6620
mov dword [0x140384c14], 1
add rsp, 8
pop rsi
ret

Function at 0x1402b6670
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rax
cmp dword [0x140384c24], 1
je 0x1402b66dd
mov r9, rdx
mov ecx, socket
xor r10d, r10d
movabs r11, 0xcccccccccccccccd
mov rsi, r8
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r10
mul r11
shr rdx, 2
and rdx, 0xfffffffffffffffc
lea rax, [rdx + rdx*4]
neg rax
movzx edx, byte [r8 + rcx]
xor dl, byte [rsi + rax]
mov byte [r9 + rcx - 0x14], dl
add rcx, 1
add rsi, 1
add r10, 1
cmp ecx, 0x1e
jne 0x1402b66a0
mov dword [0x140384c24], 1
add rsp, 8
pop rsi
ret

Function at 0x1402b66f0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rax
cmp dword [0x140384c2c], 1
je 0x1402b6768
mov r9, rdx
mov ecx, 0x1f
xor r10d, r10d
movabs r11, 0x842108421084211
mov rsi, r8
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r10
mul r11
mov rax, r10
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
mov rdx, rax
shl rdx, 5
sub rax, rdx
movzx edx, byte [r8 + rcx]
xor dl, byte [rsi + rax]
mov byte [r9 + rcx - 0x1f], dl
add rcx, 1
add rsi, 1
add r10, 1
cmp ecx, 0x23
jne 0x1402b6720
mov dword [0x140384c2c], 1
add rsp, 8
pop rsi
ret

Function at 0x1402b6770
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rax
cmp dword [0x140384c34], 1
je 0x1402b67dc
mov r9, rdx
mov ecx, 0x18
xor r10d, r10d
movabs r11, 0xaaaaaaaaaaaaaaab
mov rsi, r8
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r10
mul r11
shr rdx, 1
and rdx, 0xfffffffffffffff8
lea rax, [rdx + rdx*2]
neg rax
movzx edx, byte [r8 + rcx]
xor dl, byte [rsi + rax]
mov byte [r9 + rcx - 0x18], dl
add rcx, 1
add rsi, 1
add r10, 1
cmp ecx, 0x1c
jne 0x1402b67a0
mov dword [0x140384c34], 1
add rsp, 8
pop rsi
ret

Function at 0x1402b67f0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rax
cmp dword [0x140384c3c], 1
je 0x1402b685f
mov r9, rdx
mov ecx, send
xor r10d, r10d
movabs r11, 0xf0f0f0f0f0f0f0f1
mov rsi, r8
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r10
mul r11
shr rdx, 4
mov rax, rdx
shl rax, 4
add rax, rdx
neg rax
movzx edx, byte [r8 + rcx]
xor dl, byte [rsi + rax]
mov byte [r9 + rcx - 0x11], dl
add rcx, 1
add rsi, 1
add r10, 1
cmp ecx, 0x15
jne 0x1402b6820
mov dword [0x140384c3c], 1
add rsp, 8
pop rsi
ret
Function at 0x1402f5f90
Capabilities:
Connect socket
Send data
Send data on socket

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x160
mov rax, qword [0x140367bb8]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rsi, rcx
mov r14d, edx
mov rcx, qword [0x14038aae8]
test rcx, rcx
jne 0x1402f5fe3
movzx edx, word [0x14038ac24]
test dx, dx
je 0x1402f5fe3
lea rcx, [0x14038ab20]
call fcn.1402f6da0
test al, al
je 0x1402f6059
mov rcx, qword [0x14038aae8]
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [0x14038aaf0]
call qword [sym.imp.WS2_32.dll_connect]
mov dword [0x14038ab00], eax
cmp eax, 0xffffffff
jne 0x1402f6073
cmp qword [0x14038aae8], 0
jne 0x1402f6073
movzx edx, word [0x14038ac24]
test dx, dx
je 0x1402f6073
lea rcx, [0x14038ab20]
call fcn.1402f6da0
mov rcx, qword [0x14038aae8]
test al, al
je 0x1402f6053
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [0x14038aaf0]
call qword [sym.imp.WS2_32.dll_connect]
mov dword [0x14038ab00], eax
cmp eax, 0xffffffff
jne 0x1402f6073
mov rcx, qword [0x14038aae8]
call qword [sym.imp.WS2_32.dll_closesocket]
xor ebx, ebx
mov dword [0x14038ab00], 0xffffffff
mov qword [0x14038aae8], rbx
xor al, al
jmp 0x1402f61d0
lea eax, [r14 - 1]
mov qword [rsp + 0x188], rbp
xor ebx, ebx
mov qword [rsp + 0x190], rdi
mov rdi, qword [rsi]
test eax, 0xfffffffd
je 0x1402f612b
movabs rax, 0x6addaf8cef1b7c1
xor edx, edx
mov qword [rdi], rax
mov r8d, 0x104
mov rcx, qword [rsi + 8]
sub rcx, qword [rsi]
mov qword [rdi + 0x10], rcx
add rcx, 0xfffffffffffffff8
mov rax, qword [rsi + 0x10]
mov qword [rax], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], rbx
call sub.VCRUNTIME140.dll_memset
mov r9d, dword [0x14038ae64]
lea r8, [rsp + 0x40]
lea rdx, [0x14038ad60]
lea rcx, [0x14038ae80]
call fcn.1402f9a50
movsxd rax, dword [0x14038ae64]
lea r8, [rdi + 0x20]
mov rdx, qword [rdi + 0x10]
lea r9, [rsp + 0x30]
mov rcx, qword [rsi + 0x10]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call fcn.1402f8980
mov rbp, qword [rsp + 0x30]
add rbp, 0x20
mov qword [rdi + 0x10], rbx
jmp 0x1402f616c
movabs rax, 0xc1a6f29ed6b6c38
mov qword [rdi], rax
mov rax, qword [rsi + 8]
sub rax, qword [rsi]
add rax, 0xffffffffffffffe8
mov qword [rdi + 0x10], rax
je 0x1402f6168
nop dword [rax]
mov rax, qword [rsi + 0x10]
movzx ecx, byte [rbx + rax]
mov byte [rdi + rbx + 0x20], cl
inc rbx
mov rax, qword [rdi + 0x10]
cmp rbx, rax
jb 0x1402f6150
lea rbp, [rax + 0x20]
mov qword [rdi + 0x18], rbp
lea rcx, [0x14038aac0]
mov rbx, qword [0x14038aae8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor r9d, r9d
mov r8d, ebp
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_send]
mov rcx, qword [rsi]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rdi, qword [rsp + 0x190]
lea eax, [r14 - 3]
mov rbp, qword [rsp + 0x188]
cmp eax, 1
ja 0x1402f61ce
cmp byte [0x140367b4c], 5
jne 0x1402f61ce
shl byte [0x140367b4d], 4
mov byte [0x140367b4c], 6
mov al, 1
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1402fa650
add rsp, 0x160
pop r14
pop rsi
pop rbx
ret