joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140014640
Capabilities:
Encode data using base64

Disassembly:
mov r8, rcx
test rcx, rcx
je case.default.0x14001466e
mov rax, qword [rcx]
test rax, rax
je case.default.0x14001466e
mov eax, dword [rax + 8]
dec eax
cmp eax, 6
ja case.default.0x14001466e
lea r9, [0x140000000]
cdqe
mov ecx, dword [r9 + rax*4 + 0x146a4]
add rcx, r9
jmp rcx
mov rcx, qword [r8 + 8]
jmp fcn.14003fda0
mov rcx, qword [r8 + 8]
jmp fcn.14003eef0
mov rcx, qword [r8 + 8]
jmp fcn.140041460
mov rcx, qword [r8 + 8]
jmp fcn.140019310
mov rcx, qword [r8 + 8]
jmp fcn.140024e00
mov eax, 0xffffaf00
ret

Function at 0x1400146c0
Capabilities:
Hash data using sha1
Hash data using sha224
Hash data using sha256

Disassembly:
push rbx
mov r10, r9
mov r11, r8
mov rbx, rdx
test rcx, rcx
je case.default.0x1400146f5
mov eax, dword [rcx + 8]
dec eax
cmp eax, 6
ja case.default.0x1400146f5
lea rdx, [0x140000000]
cdqe
mov ecx, dword [rdx + rax*4 + 0x1477c]
add rcx, rdx
jmp rcx
mov r8, r10
mov rdx, r11
mov rcx, rbx
pop rbx
jmp fcn.14003ff10
mov r8, r10
mov rdx, r11
mov rcx, rbx
pop rbx
jmp fcn.14003f130
mov r8, r10
mov rdx, r11
mov rcx, rbx
pop rbx
jmp fcn.1400415f0
mov r9d, 1
mov r8, r10
mov rdx, r11
mov rcx, rbx
pop rbx
jmp fcn.1400194f0
xor r9d, r9d
mov r8, r10
mov rdx, r11
mov rcx, rbx
pop rbx
jmp fcn.1400194f0
mov r9d, 1
mov r8, r10
mov rdx, r11
mov rcx, rbx
pop rbx
jmp fcn.140025160
xor r9d, r9d
mov r8, r10
mov rdx, r11
mov rcx, rbx
pop rbx
jmp fcn.140025160
mov eax, 0xffffaf00
pop rbx
ret
Function at 0x1400147a0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x70
mov rax, qword [0x1400c9948]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, r8
mov r14, rdx
mov rdi, rcx
test rcx, rcx
je 0x1400149ec
mov rcx, qword [rcx]
test rcx, rcx
je 0x1400149ec
mov rbp, qword [rdi + 0x10]
test rbp, rbp
je 0x1400149ec
movzx eax, byte [rcx + 0xd]
cmp r8, rax
jbe 0x1400148b3
mov rcx, rdi
call fcn.140014360
mov ebx, eax
test eax, eax
jne 0x1400149cd
mov r8, rsi
mov rdx, r14
mov rcx, rdi
call fcn.1400145c0
mov ebx, eax
test eax, eax
jne 0x1400149cd
mov rax, qword [rdi]
test rax, rax
je case.default.0x140014849
mov eax, dword [rax + 8]
dec eax
cmp eax, 6
ja case.default.0x140014849
lea rdx, [0x140000000]
cdqe
mov ecx, dword [rdx + rax*4 + 0x14a0c]
add rcx, rdx
jmp rcx
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x20]
call fcn.14003fda0
jmp 0x140014899
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x20]
call fcn.14003eef0
jmp 0x140014899
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x20]
call fcn.140041460
jmp 0x140014899
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x20]
call fcn.140019310
jmp 0x140014899
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x20]
call fcn.140024e00
mov ebx, eax
test eax, eax
jne 0x1400149cd
mov rcx, qword [rdi]
lea r14, [rsp + 0x20]
mov rbp, qword [rdi + 0x10]
movzx esi, byte [rcx + 0xc]
movzx r8d, byte [rcx + 0xd]
mov edx, 0x36
mov rcx, rbp
lea rbx, [r8 + rbp]
call fcn.140080540
mov rax, qword [rdi]
mov edx, 0x5c
mov rcx, rbx
movzx r8d, byte [rax + 0xd]
call fcn.140080540
xor eax, eax
test rsi, rsi
je 0x1400149aa
cmp rsi, 0x10
jb 0x14001497b
lea rdx, [rbx - 1]
lea r8, [r14 - 1]
add rdx, rsi
add r8, rsi
cmp rbx, r8
ja 0x14001490b
cmp rdx, r14
jae 0x14001497b
lea rcx, [rbp - 1]
add rcx, rsi
cmp rbx, rcx
ja 0x14001491c
cmp rdx, rbp
jae 0x14001497b
cmp rbp, r8
ja 0x140014926
cmp rcx, r14
jae 0x14001497b
mov rdx, rsi
and rdx, 0xfffffffffffffff0
mov r8, r14
mov r9, rbx
sub r8, rbp
mov rcx, rbp
sub r9, rbp
nop dword [rax]
movdqu xmm0, xmmword [rcx]
add rax, 0x10
movdqu xmm2, xmmword [r8 + rcx]
lea rcx, [rcx + 0x10]
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmm0, xmmword [r9 + rcx - 0x10]
movdqu xmmword [rcx - 0x10], xmm1
pxor xmm2, xmm0
movdqu xmmword [r9 + rcx - 0x10], xmm2
cmp rax, rdx
jb 0x140014940
cmp rax, rsi
jae 0x1400149aa
mov rcx, rbp
lea r8, [r14 + rax]
sub rcx, r14
sub rbx, r14
sub rsi, rax
nop dword [rax + rax]
movzx eax, byte [r8]
xor byte [rcx + r8], al
movzx eax, byte [r8]
xor byte [rbx + r8], al
lea r8, [r8 + 1]
sub rsi, 1
jne 0x140014990
mov rcx, rdi
call fcn.140014360
mov ebx, eax
test eax, eax
jne 0x1400149cd
mov rax, qword [rdi]
mov rdx, rbp
mov rcx, rdi
movzx r8d, byte [rax + 0xd]
call fcn.1400145c0
mov ebx, eax
mov rax, qword [fcn.140080540]
lea rcx, [rsp + 0x20]
xor edx, edx
lea r8d, [rdx + 0x40]
call rax
mov eax, ebx
jmp 0x1400149f1
mov ebx, 0xffffaf00
jmp 0x1400149cd
mov eax, 0xffffaf00
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400946f0
add rsp, 0x70
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14001c180
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r13
sub rsp, 0x18
mov rbp, qword [rcx + 8]
mov r13, r8
cmp rbp, qword [rdx + 8]
je 0x14001c1a2
mov eax, 0xfffffffc
add rsp, 0x18
pop r13
pop rbp
ret
mov eax, dword [rdx]
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rdi
mov edi, dword [rcx]
sar eax, 1
sar edi, 1
and eax, 1
and edi, 1
xor eax, edi
mov esi, eax
and esi, edi
mov dword [r8], esi
test rbp, rbp
je 0x14001c28f
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x10], r12
lea r12, [rbp - 1]
mov qword [rsp + 8], r14
mov r14, qword [rcx + 0x10]
mov rcx, qword [rdx + 0x10]
mov qword [rsp], r15
mov r15d, 1
sub r15d, edi
sub r14, rcx
lea r12, [rcx + r12*8]
nop dword [rax + rax]
mov r11, qword [r12]
mov r8d, 1
mov rbx, qword [r14 + r12]
lea r12, [r12 - 8]
mov rcx, rbx
sub r8d, eax
shr rcx, 0x3f
mov r10, r11
xor r10, rbx
mov rdx, r11
sub rdx, rbx
mov r9, r10
sub rbx, r11
shr r10, 0x3f
and ecx, r10d
shr rdx, 0x3f
shr rbx, 0x3f
not r9
shr r9, 0x3f
and edx, r9d
shr r11, 0x3f
or edx, ecx
and ebx, r9d
or eax, edx
and r11d, r10d
or ebx, r11d
and r8d, edx
and r8d, edi
mov ecx, 1
sub ecx, eax
or eax, ebx
and ecx, r15d
and ecx, ebx
or ecx, r8d
or esi, ecx
sub rbp, 1
jne 0x14001c200
mov r15, qword [rsp]
mov r14, qword [rsp + 8]
mov r12, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x30]
mov dword [r13], esi
mov rdi, qword [rsp + 0x40]
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x18
pop r13
pop rbp
ret
Function at 0x14003f130
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x1400c9948]
xor rax, rsp
mov qword [rsp + 0x80], rax
xorps xmm0, xmm0
mov dword [rsp + 0x28], 0x67452301
mov rdi, r8
mov dword [rsp + 0x2c], 0xefcdab89
mov r8, rdx
mov dword [rsp + 0x30], 0x98badcfe
mov rdx, rcx
mov dword [rsp + 0x34], 0x10325476
xor eax, eax
mov dword [rsp + 0x38], 0xc3d2e1f0
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
movups xmmword [rsp + 0x3c], xmm0
movups xmmword [rsp + 0x4c], xmm0
movups xmmword [rsp + 0x5c], xmm0
movups xmmword [rsp + 0x6c], xmm0
call fcn.14003ee10
mov ebx, eax
test eax, eax
jne 0x14003f1bd
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.14003eef0
mov ebx, eax
mov rax, qword [fcn.140080540]
lea rcx, [rsp + 0x20]
xor edx, edx
lea r8d, [rdx + 0x5c]
call rax
mov eax, ebx
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400946f0
mov rbx, qword [rsp + 0xb8]
add rsp, 0x90
pop rdi
ret
Function at 0x1400415f0
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x1400c9948]
xor rax, rsp
mov qword [rsp + 0x80], rax
xorps xmm0, xmm0
mov dword [rsp + 0x28], 0x67452301
mov rdi, r8
mov dword [rsp + 0x2c], 0xefcdab89
mov r8, rdx
mov dword [rsp + 0x30], 0x98badcfe
mov rdx, rcx
mov dword [rsp + 0x34], 0x10325476
xor eax, eax
mov dword [rsp + 0x38], 0xc3d2e1f0
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
movups xmmword [rsp + 0x3c], xmm0
movups xmmword [rsp + 0x4c], xmm0
movups xmmword [rsp + 0x5c], xmm0
movups xmmword [rsp + 0x6c], xmm0
call fcn.140041380
mov ebx, eax
test eax, eax
jne 0x14004167d
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.140041460
mov ebx, eax
mov rax, qword [fcn.140080540]
lea rcx, [rsp + 0x20]
xor edx, edx
lea r8d, [rdx + 0x5c]
call rax
mov eax, ebx
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400946f0
mov rbx, qword [rsp + 0xb8]
add rsp, 0x90
pop rdi
ret
Function at 0x14004c940
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x1400c9948]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, qword [rsp + 0xa0]
lea rax, [rsp + 0x30]
xor esi, esi
mov qword [rsp + 0x20], rax
mov rbp, rdx
mov qword [rsp + 0x30], rsi
mov r14, r9
lea rdx, [rcx + 0x10]
mov rbx, r8
lea r9, [rsp + 0x38]
mov r15, rcx
lea r8d, [rsi + 0x10]
xorps xmm0, xmm0
add rcx, 0x20
movups xmmword [rsp + 0x38], xmm0
call fcn.14001cfd0
mov r12d, eax
test eax, eax
je 0x14004c9d4
or dword [r15 + 0xa4], 0x10
lea r8d, [rsi + 0x10]
mov r9, qword [fcn.140080540]
lea rcx, [rsp + 0x38]
xor edx, edx
call r9
mov eax, r12d
jmp 0x14004cb09
test rbx, rbx
je 0x14004caf3
cmp rbx, 0x40
jb 0x14004cac5
lea rdx, [rdi - 1]
lea rax, [r14 - 1]
add rdx, rbx
add rax, rbx
cmp rdi, rax
ja 0x14004ca03
cmp rdx, r14
jae 0x14004cac5
lea rax, [rbp - 1]
add rax, rbx
lea r8, [rsp + 0x38]
lea rcx, [rsp + 0x38]
add r8, rbp
add rcx, rax
cmp rdi, rcx
ja 0x14004ca28
cmp rdx, r8
jae 0x14004cac5
mov r9, rbx
and r9, 0xffffffffffffffc0
lea rdx, [rsp + 0x48]
mov rcx, r14
sub rcx, rbp
lea rax, [rsp + 0x48]
sub rcx, rdx
lea r8, [rsp + 0x48]
mov rdx, rdi
add rax, rbp
sub rdx, rbp
sub rdx, r8
nop dword [rax]
nop word [rax + rax]
movdqu xmm0, xmmword [rax - 0x10]
add rsi, 0x40
movdqu xmm1, xmmword [rcx + rax]
movdqu xmm2, xmmword [rcx + rax + 0x10]
lea rax, [rax + 0x40]
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmmword [rdx + rax - 0x40], xmm1
pxor xmm2, xmm0
movdqu xmm0, xmmword [rax - 0x30]
movdqu xmm1, xmmword [rcx + rax - 0x20]
movdqu xmmword [rdx + rax - 0x30], xmm2
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm2, xmmword [rcx + rax - 0x10]
movdqu xmmword [rdx + rax - 0x20], xmm1
pxor xmm2, xmm0
movdqu xmmword [rdx + rax - 0x10], xmm2
cmp rsi, r9
jb 0x14004ca60
cmp rsi, rbx
jae 0x14004caf3
sub rbp, r14
lea rdx, [rsp + 0x38]
add rdx, rbp
lea rax, [rsi + r14]
sub rdi, r14
sub rbx, rsi
nop word [rax + rax]
movzx ecx, byte [rdx + rax]
xor cl, byte [rax]
mov byte [rdi + rax], cl
lea rax, [rax + 1]
sub rbx, 1
jne 0x14004cae0
mov rax, qword [fcn.140080540]
lea rcx, [rsp + 0x38]
xor edx, edx
lea r8d, [rdx + 0x10]
call rax
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400946f0
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14004cce0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbx, rcx
mov rsi, r8
mov ecx, dword [rcx + 0xa4]
mov rdi, rdx
test cl, 0x10
jne 0x14004cf04
test r8, r8
je 0x14004cedb
test cl, 8
jne 0x14004cf04
mov rdx, qword [rbx + 0x88]
test cl, 4
jne 0x14004cd45
cmp r8, rdx
ja 0x14004cf04
movzx eax, byte [rbx + 0x89]
xor byte [rbx], al
xor byte [rbx + 1], dl
or ecx, 4
mov dword [rbx + 0xa4], ecx
jmp 0x14004cd60
mov rcx, qword [rbx + 0x98]
add rcx, r8
cmp rcx, rdx
ja 0x14004cf04
nop dword [rax + rax]
mov r10, qword [rbx + 0x98]
mov eax, reloc.WS2_32.dll_recv
add r10, 2
mov r9, rsi
and r10d, 0xf
sub rax, r10
cmp rax, rsi
cmovbe r9, rax
xor r8b, r8b
cmp r9, 0x40
jb 0x14004ce42
lea eax, [r9 - 1]
movzx edx, r10b
movzx ecx, al
lea eax, [rdx + rcx]
add rcx, rdi
movzx r11d, al
add rdx, rbx
add r11, rbx
cmp rdx, rcx
ja 0x14004cdb7
cmp r11, rdi
jae 0x14004ce42
mov rdx, r9
and rdx, 0xffffffffffffffc0
xor ecx, ecx
mov r11b, 0x20
movdqu xmm1, xmmword [rcx + rdi]
lea rax, [rcx + r10]
add r8b, 0x40
movdqu xmm0, xmmword [rax + rbx]
pxor xmm1, xmm0
movdqu xmmword [rax + rbx], xmm1
lea eax, [r11 - 0x10]
movzx ecx, al
movdqu xmm1, xmmword [rcx + rdi]
lea rax, [rcx + r10]
movzx ecx, r11b
movdqu xmm0, xmmword [rax + rbx]
pxor xmm1, xmm0
movdqu xmmword [rax + rbx], xmm1
lea rax, [rcx + r10]
movdqu xmm0, xmmword [rax + rbx]
movdqu xmm1, xmmword [rcx + rdi]
pxor xmm1, xmm0
movdqu xmmword [rax + rbx], xmm1
lea eax, [r11 + 0x10]
add r11b, 0x40
movzx ecx, al
movdqu xmm1, xmmword [rcx + rdi]
lea rax, [rcx + r10]
movzx ecx, r8b
movdqu xmm0, xmmword [rax + rbx]
pxor xmm1, xmm0
movdqu xmmword [rax + rbx], xmm1
cmp rcx, rdx
jb 0x14004cdc3
movzx edx, r8b
cmp rdx, r9
jae 0x14004ce67
nop dword [rax + rax]
movzx eax, byte [rdx + rdi]
lea rcx, [rdx + r10]
xor byte [rcx + rbx], al
inc r8b
movzx edx, r8b
cmp rdx, r9
jb 0x14004ce50
mov rcx, qword [rbx + 0x98]
lea rax, [r9 + r10]
add rcx, r9
sub rsi, r9
add rdi, r9
mov qword [rbx + 0x98], rcx
cmp rax, 0x10
je 0x14004ce91
cmp rcx, qword [rbx + 0x88]
jne 0x14004ceb4
lea rax, [rsp + 0x40]
mov r9, rbx
lea rcx, [rbx + 0x20]
mov qword [rsp + 0x20], rax
mov r8d, reloc.WS2_32.dll_recv
mov rdx, rbx
call fcn.14001cfd0
test eax, eax
jne 0x14004ceed
test rsi, rsi
jne 0x14004cd60
mov rax, qword [rbx + 0x88]
cmp qword [rbx + 0x98], rax
jne 0x14004cedb
or dword [rbx + 0xa4], 8
mov qword [rbx + 0x98], rsi
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
or dword [rbx + 0xa4], 0x10
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x48]
mov eax, 0xfffffff3
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14004d580
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1400c9948]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rdx, qword [rsp + 0xc8]
mov rdi, r8
mov rax, qword [rsp + 0xd8]
lea r8, [r11 - 0x38]
mov rbx, qword [rsp + 0xf0]
mov rsi, qword [rsp + 0xe0]
mov qword [r11 - 0x48], rbx
mov qword [r11 - 0x50], r8
mov r8, rdi
mov qword [r11 - 0x58], rsi
mov qword [r11 - 0x60], rax
mov rax, qword [rsp + 0xd0]
mov qword [r11 - 0x68], rax
mov rax, qword [rsp + 0xc0]
mov qword [r11 - 0x70], rdx
xor edx, edx
mov qword [r11 - 0x78], rax
call fcn.14004d460
test eax, eax
jne 0x14004d6ff
mov r10, qword [rsp + 0xe8]
xor r9d, r9d
xor r8b, r8b
cmp rbx, 8
jb 0x14004d6a9
mov rdx, rbx
xorps xmm4, xmm4
and rdx, 0xfffffffffffffff8
xorps xmm3, xmm3
movd xmm2, dword [r9 + r10]
lea eax, [r8 + 4]
movd xmm1, dword [rsp + r9 + 0x60]
xorps xmm0, xmm0
punpcklbw xmm2, xmm0
add r8b, 8
punpcklwd xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
movzx ecx, al
por xmm4, xmm2
movzx r9d, r8b
movd xmm2, dword [rcx + r10]
movd xmm1, dword [rsp + rcx + 0x60]
punpcklbw xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
por xmm3, xmm2
cmp r9, rdx
jb 0x14004d626
por xmm3, xmm4
movdqa xmm0, xmm3
psrldq xmm0, 8
por xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
por xmm3, xmm0
movd r9d, xmm3
movzx eax, r8b
cmp rax, rbx
jae 0x14004d6db
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [rax + r10]
inc r8b
movzx ecx, byte [rsp + rax + 0x60]
xor edx, ecx
movzx eax, r8b
or r9d, edx
cmp rax, rbx
jb 0x14004d6c0
test r9d, r9d
je 0x14004d6fd
test rdi, rdi
je 0x14004d6f6
mov rax, qword [fcn.140080540]
mov r8, rdi
xor edx, edx
mov rcx, rsi
call rax
mov eax, 0xfffffff1
jmp 0x14004d6ff
xor eax, eax
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400946f0
add rsp, 0x80
pop rdi
pop rsi
pop rbx
ret
Function at 0x14004dbe0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword [0x1400c9948]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbp, qword [rsp + 0xa0]
mov rax, r8
mov rsi, qword [rsp + 0xa8]
mov rdi, rdx
mov rdx, rax
mov r8d, 1
mov r14, r9
mov rbx, rcx
call fcn.14004d810
test eax, eax
jne 0x14004dd4e
cmp dword [rbx + 0xe8], 1
je 0x14004dc3f
mov eax, 0xffffffac
jmp 0x14004dd4e
mov r8, qword [rsp + 0x90]
lea rcx, [rbx + 0x88]
add qword [rbx + 0xd8], r8
mov rdx, r14
call fcn.140055290
test eax, eax
jne 0x14004dd4e
mov r9, rsi
mov r8, rbp
mov rdx, rdi
mov rcx, rbx
call fcn.14004d8e0
test eax, eax
jne 0x14004dd4e
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14004d9b0
test eax, eax
jne 0x14004dd4e
mov rcx, qword [rsp + 0x98]
lea rax, [rsp + 0x20]
xor edx, edx
xorps xmm4, xmm4
sub rcx, rax
xorps xmm3, xmm3
nop dword [rax + rax]
xorps xmm0, xmm0
lea rax, [rsp + 0x20]
add rax, rdx
add rdx, 8
movd xmm2, dword [rcx + rax]
movd xmm1, dword [rax]
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
movd xmm1, dword [rax + 4]
punpcklbw xmm1, xmm0
por xmm4, xmm2
movd xmm2, dword [rcx + rax + 4]
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
por xmm3, xmm2
cmp rdx, 0x10
jb 0x14004dcb0
por xmm3, xmm4
movdqa xmm0, xmm3
psrldq xmm0, 8
por xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
por xmm3, xmm0
movd eax, xmm3
test eax, eax
je 0x14004dd4c
test rdi, rdi
je 0x14004dd45
mov rax, qword [fcn.140080540]
mov r8, rdi
xor edx, edx
mov rcx, rsi
call rax
mov eax, 0xffffffaa
jmp 0x14004dd4e
xor eax, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400946f0
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14004e610
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0xa0
mov rax, qword [0x1400c9948]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rsi, rcx
mov rdi, r9
xor ecx, ecx
mov r14, r8
mov qword [rsp + 0x58], rcx
test r9, r9
je 0x14004e876
movabs rax, 0x2000000000000000
cmp r9, rax
jae 0x14004e876
mov qword [rsp + 0x98], rbp
xorps xmm0, xmm0
lea rbp, [rsi + 0x180]
movups xmmword [rbp], xmm0
movups xmmword [rsi + 0x190], xmm0
mov dword [rsi + 0x1a0], edx
mov qword [rsi + 0x160], rcx
mov qword [rsi + 0x168], rcx
cmp r9, 0xc
jne 0x14004e6ab
movsd xmm0, qword [r8]
movsd qword [rbp], xmm0
mov eax, dword [r8 + 8]
mov dword [rbp + 8], eax
mov byte [rsi + 0x18f], 1
jmp 0x14004e84a
mov qword [rsp + 0xc8], rbx
mov qword [rsp + 0x90], r12
mov qword [rsp + 0x88], r13
mov qword [rsp + 0x80], r15
lea r15, [r9*8]
mov rax, r15
mov r12, r15
shr rax, 0x28
mov r13, r15
mov qword [rsp + 0x30], rax
mov rax, r15
shr rax, 0x20
mov qword [rsp + 0x38], rax
mov rax, r15
shr rax, 0x18
mov qword [rsp + 0x40], rax
mov rax, r15
shr rax, 0x10
mov qword [rsp + 0x48], rax
mov rax, r15
shr r12, 0x38
shr r13, 0x30
shr rax, 8
mov qword [rsp + 0x50], rax
movups xmmword [rsp + 0x60], xmm0
nop dword [rax]
nop word [rax + rax]
mov ebx, reloc.WS2_32.dll_recv
cmp rdi, rbx
cmovb rbx, rdi
test rbx, rbx
je 0x14004e765
mov r8, r14
mov rax, rbp
sub r8, rsi
mov rdx, rbx
nop dword [rax]
movzx ecx, byte [r8 + rax - 0x180]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x14004e750
mov r8, rbp
mov rdx, rbp
mov rcx, rsi
call fcn.14004e0d0
add r14, rbx
sub rdi, rbx
jne 0x14004e730
movzx eax, byte [rsp + 0x60]
mov r8, rbp
xor byte [rbp], al
mov rdx, rbp
movzx eax, byte [rsp + 0x61]
mov rcx, rsi
xor byte [rsi + 0x181], al
movzx eax, byte [rsp + 0x62]
xor byte [rsi + 0x182], al
movzx eax, byte [rsp + 0x63]
xor byte [rsi + 0x183], al
movzx eax, byte [rsp + 0x64]
xor byte [rsi + 0x184], al
movzx eax, byte [rsp + 0x65]
xor byte [rsi + 0x185], al
movzx eax, byte [rsp + 0x66]
xor byte [rsi + 0x186], al
movzx eax, byte [rsp + 0x67]
xor byte [rsi + 0x187], al
xor byte [rsi + 0x188], r12b
xor byte [rsi + 0x189], r13b
mov rax, qword [rsp + 0x30]
xor byte [rsi + 0x18a], al
mov rax, qword [rsp + 0x38]
xor byte [rsi + 0x18b], al
mov rax, qword [rsp + 0x40]
xor byte [rsi + 0x18c], al
mov rax, qword [rsp + 0x48]
xor byte [rsi + 0x18d], al
mov rax, qword [rsp + 0x50]
xor byte [rsi + 0x18e], al
xor byte [rsi + 0x18f], r15b
call fcn.14004e0d0
mov r15, qword [rsp + 0x80]
mov r13, qword [rsp + 0x88]
mov r12, qword [rsp + 0x90]
mov rbx, qword [rsp + 0xc8]
lea rax, [rsp + 0x58]
mov r8d, reloc.WS2_32.dll_recv
lea r9, [rsi + 0x170]
mov qword [rsp + 0x20], rax
mov rdx, rbp
mov rcx, rsi
call fcn.14001cfd0
mov rbp, qword [rsp + 0x98]
jmp 0x14004e87b
mov eax, 0xffffffec
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400946f0
add rsp, 0xa0
pop r14
pop rdi
pop rsi
ret
Function at 0x14004e8a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movabs rax, 0x2000000000000000
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
cmp r8, rax
jb 0x14004e8dc
mov eax, 0xffffffec
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rcx + 0x168]
mov r8, rax
mov qword [rsp + 0x38], r14
and r8d, 0xf
je 0x14004e961
mov r14d, reloc.WS2_32.dll_recv
sub r14, r8
cmp r14, rdi
cmova r14, rdi
test r14, r14
je 0x14004e935
add rcx, 0x190
mov r9, rsi
add rcx, r8
sub r9, r8
sub r9, rbx
mov rdx, r14
nop dword [rax]
movzx eax, byte [r9 + rcx - 0x190]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x14004e920
lea rax, [r14 + r8]
cmp rax, 0x10
jne 0x14004e951
lea rdx, [rbx + 0x190]
mov rcx, rbx
mov r8, rdx
call fcn.14004e0d0
mov rax, qword [rbx + 0x168]
sub rdi, r14
add rsi, r14
add rax, r14
add rax, rdi
mov qword [rbx + 0x168], rax
cmp rdi, 0x10
jb 0x14004ea58
mov qword [rsp + 0x30], rbp
mov rbp, rdi
shr rbp, 4
imul rax, rbp, 0xfffffffffffffff0
add rdi, rax
nop dword [rax + rax]
movzx eax, byte [rsi]
lea r8, [rbx + 0x190]
xor byte [rbx + 0x190], al
lea rdx, [rbx + 0x190]
movzx eax, byte [rsi + 1]
mov rcx, rbx
xor byte [rbx + 0x191], al
movzx eax, byte [rsi + 2]
xor byte [rbx + 0x192], al
movzx eax, byte [rsi + 3]
xor byte [rbx + 0x193], al
movzx eax, byte [rsi + 4]
xor byte [rbx + 0x194], al
movzx eax, byte [rsi + 5]
xor byte [rbx + 0x195], al
movzx eax, byte [rsi + 6]
xor byte [rbx + 0x196], al
movzx eax, byte [rsi + 7]
xor byte [rbx + 0x197], al
movzx eax, byte [rsi + 8]
xor byte [rbx + 0x198], al
movzx eax, byte [rsi + 9]
xor byte [rbx + 0x199], al
movzx eax, byte [rsi + 0xa]
xor byte [rbx + 0x19a], al
movzx eax, byte [rsi + 0xb]
xor byte [rbx + 0x19b], al
movzx eax, byte [rsi + 0xc]
xor byte [rbx + 0x19c], al
movzx eax, byte [rsi + 0xd]
xor byte [rbx + 0x19d], al
movzx eax, byte [rsi + 0xe]
xor byte [rbx + 0x19e], al
movzx eax, byte [rsi + 0xf]
xor byte [rbx + 0x19f], al
call fcn.14004e0d0
add rsi, 0x10
sub rbp, 1
jne 0x14004e990
mov rbp, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
test rdi, rdi
je 0x14004ea84
lea rcx, [rbx + 0x190]
sub rsi, rbx
nop dword [rax]
movzx eax, byte [rsi + rcx - 0x190]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub rdi, 1
jne 0x14004ea70
mov rbx, qword [rsp + 0x40]
xor eax, eax
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x14004f0b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rbx, qword [rsp + 0x60]
mov rdi, rcx
mov qword [r9], 0
mov rax, qword [rcx + 0x160]
mov rcx, qword [rcx + 0x168]
lea r14, [rax*8]
lea rbp, [rcx*8]
test rax, rax
jne 0x14004f10b
test cl, 0xf
je 0x14004f10b
lea rdx, [rdi + 0x190]
mov rcx, rdi
mov r8, rdx
call fcn.14004e0d0
mov rsi, qword [rsp + 0x68]
lea rax, [rsi - 4]
cmp rax, 0xc
ja 0x14004f258
test byte [rdi + 0x160], 0xf
je 0x14004f139
lea rdx, [rdi + 0x190]
mov rcx, rdi
mov r8, rdx
call fcn.14004e0d0
lea rdx, [rdi + 0x170]
mov r8, rsi
mov rcx, rbx
call fcn.140080780
test r14, r14
jne 0x14004f159
test rbp, rbp
je 0x14004f254
lea rdx, [rdi + 0x190]
mov rax, rbp
shr rax, 0x38
mov r8, rdx
xor byte [rdx], al
mov rcx, rdi
mov rax, rbp
shr rax, 0x30
xor byte [rdi + 0x191], al
mov rax, rbp
shr rax, 0x28
xor byte [rdi + 0x192], al
mov rax, rbp
shr rax, 0x20
xor byte [rdi + 0x193], al
mov rax, rbp
shr rax, 0x18
xor byte [rdi + 0x194], al
mov rax, rbp
shr rax, 0x10
xor byte [rdi + 0x195], al
mov rax, rbp
shr rax, 8
xor byte [rdi + 0x196], al
mov rax, r14
xor byte [rdi + 0x197], bpl
shr rax, 0x38
xor byte [rdi + 0x198], al
mov rax, r14
shr rax, 0x30
xor byte [rdi + 0x199], al
mov rax, r14
shr rax, 0x28
xor byte [rdi + 0x19a], al
mov rax, r14
shr rax, 0x20
xor byte [rdi + 0x19b], al
mov rax, r14
shr rax, 0x18
xor byte [rdi + 0x19c], al
mov rax, r14
shr rax, 0x10
xor byte [rdi + 0x19d], al
mov rax, r14
shr rax, 8
xor byte [rdi + 0x19e], al
xor byte [rdi + 0x19f], r14b
call fcn.14004e0d0
test rsi, rsi
je 0x14004f254
sub rdi, rbx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdi + rbx + 0x190]
xor byte [rbx], al
lea rbx, [rbx + 1]
sub rsi, 1
jne 0x14004f240
xor eax, eax
jmp 0x14004f25d
mov eax, 0xffffffec
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret