joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400219c0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x138
mov rsi, r9
mov rdi, rdx
mov rbx, rcx
mov r14, qword [rsp + 0x190]
lea rcx, [rsp + 0x40]
mov rdx, r8
mov r8, r9
call fcn.140021a70
movups xmm0, xmmword [r14]
movaps xmmword [rsp + 0x20], xmm0
and rdi, 0xfffffffffffffff0
je 0x140021a58
shr rsi, 2
add esi, 6
lea r15, [rsp + 0x20]
lea rax, [rsp + 0x30]
lea r14, [rsp + 0x40]
nop word cs:[rax + rax]
mov r12, rax
movups xmm0, xmmword [rbx]
movups xmmword [rax], xmm0
mov rcx, rbx
mov rdx, rbx
mov r8, r14
mov r9d, esi
call fcn.140021b20
mov rax, qword [r15]
xor qword [rbx], rax
mov rax, qword [r15 + 8]
xor qword [rbx + 8], rax
add rbx, 0x10
mov rax, r15
mov r15, r12
add rdi, 0xfffffffffffffff0
jne 0x140021a20
add rsp, 0x138
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x140021a70
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, r8
mov rsi, rcx
call fcn.140021080
mov eax, dword [0x14013b620]
mov ecx, dword [0x14013ce80]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 0x30]
jg 0x140021aee
test byte [0x14013b607], 2
jne 0x140021ab2
add rsp, 0x28
pop rdi
pop rsi
ret
cmp rdi, 0x20
je 0x140021ad2
cmp rdi, 0x18
je 0x140021ae0
cmp rdi, 0x10
jne 0x140021aab
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.14004d850
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.14004d960
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.14004d8c0
lea rcx, [0x14013b620]
call fcn.14009ab34
cmp dword [0x14013b620], 0xffffffff
jne 0x140021aa2
lea rcx, [0x14013b5e0]
call fcn.14004db90
lea rcx, [0x14013b620]
call fcn.14009aac8
jmp 0x140021aa2
Function at 0x140022520
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x198
mov qword [rsp + 0x80], r9
mov qword [rsp + 0x88], r8
mov r13, rdx
mov r14, rcx
mov rsi, qword [rsp + 0x210]
mov rbx, qword [rsp + 0x218]
mov rdx, qword [rsp + 0x200]
mov r8, qword [rsp + 0x208]
mov r15, r8
shr r15, 2
add r15d, 6
lea rdi, [rsp + 0xa0]
mov rcx, rdi
call fcn.140021080
xorps xmm0, xmm0
movaps xmmword [rsp + 0x90], xmm0
lea r12, [rsp + 0x90]
mov rcx, r12
mov rdx, r12
mov r8, rdi
mov r9d, r15d
call fcn.1400214a0
lea rcx, [rsp + 0x70]
mov rdx, r12
mov r8, rsi
mov r9, rbx
call fcn.140022780
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x68], eax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x7c]
bswap eax
inc eax
bswap eax
mov dword [rsp + 0x6c], eax
mov rdi, r13
xor r12d, r12d
and rdi, 0xfffffffffffffff0
je 0x140022637
lea rbp, [rsp + 0x60]
lea rsi, [rsp + 0x50]
lea rbx, [rsp + 0xa0]
nop dword [rax]
mov rcx, rbp
mov rdx, rsi
mov r8, rbx
mov r9d, r15d
call fcn.1400214a0
movups xmm0, xmmword [r14 + r12]
xorps xmm0, xmmword [rsp + 0x50]
movups xmmword [r14 + r12], xmm0
mov eax, dword [rsp + 0x6c]
bswap eax
inc eax
bswap eax
mov dword [rsp + 0x6c], eax
add r12, 0x10
cmp r12, rdi
jb 0x140022600
mov rbp, qword [rsp + 0x220]
mov rsi, r13
and rsi, 0xf
je 0x1400226f1
lea rcx, [rsp + 0x60]
lea rdx, [rsp + 0x50]
lea r8, [rsp + 0xa0]
mov r9d, r15d
call fcn.1400214a0
mov eax, r13d
and eax, 3
cmp esi, 4
jae 0x140022675
xor ecx, ecx
jmp 0x1400226c4
sub rsi, rax
lea rdx, [r12 + r14]
add rdx, 3
xor ecx, ecx
nop word cs:[rax + rax]
movzx r8d, byte [rsp + rcx + 0x50]
xor byte [rdx + rcx - 3], r8b
movzx r8d, byte [rsp + rcx + 0x51]
xor byte [rdx + rcx - 2], r8b
movzx r8d, byte [rsp + rcx + 0x52]
xor byte [rdx + rcx - 1], r8b
movzx r8d, byte [rsp + rcx + 0x53]
xor byte [rdx + rcx], r8b
add rcx, 4
cmp rsi, rcx
jne 0x140022690
test rax, rax
je 0x1400226f1
add r12, rcx
add r12, r14
add rcx, rsp
add rcx, 0x50
xor edx, edx
nop dword [rax + rax]
movzx r8d, byte [rcx + rdx]
xor byte [r12 + rdx], r8b
inc rdx
cmp rax, rdx
jne 0x1400226e0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r15d
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov rcx, rbp
mov rdx, r14
mov r8, r13
mov r9, qword [rsp + 0x88]
call fcn.140022a70
nop
add rsp, 0x198
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140022d50
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x1a8
mov r15, r9
mov r14, r8
mov rbp, rdx
mov rdi, rcx
mov rdx, qword [rsp + 0x210]
mov r8, qword [rsp + 0x218]
mov rbx, r8
shr rbx, 2
add ebx, 6
lea rsi, [rsp + 0xb0]
mov rcx, rsi
call fcn.140021080
xorps xmm0, xmm0
movaps xmmword [rsp + 0xa0], xmm0
lea r12, [rsp + 0xa0]
mov rcx, r12
mov rdx, r12
mov r8, rsi
mov r9d, ebx
call fcn.1400214a0
lea r13, [rsp + 0x80]
mov rcx, r13
mov rdx, r12
mov r8, qword [rsp + 0x220]
mov r9, qword [rsp + 0x228]
call fcn.140022780
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r15
lea rcx, [rsp + 0x90]
mov rdx, rdi
mov r8, rbp
mov r9, r14
call fcn.140022a70
mov rax, qword [rsp + 0x230]
movdqu xmm0, xmmword [rax]
pcmpeqb xmm0, xmmword [rsp + 0x90]
pmovmskb eax, xmm0
xor ecx, ecx
cmp eax, 0xffff
setne cl
jne 0x140022f73
mov eax, dword [rsp + 0x88]
mov dword [rsp + 0x78], eax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x70], rax
mov eax, dword [rsp + 0x8c]
bswap eax
inc eax
bswap eax
mov dword [rsp + 0x7c], eax
mov rsi, rbp
and rsi, 0xfffffffffffffff0
mov dword [rsp + 0x6c], ecx
je 0x140022ed8
xor r13d, r13d
lea r14, [rsp + 0x70]
lea r15, [rsp + 0x50]
lea r12, [rsp + 0xb0]
nop word cs:[rax + rax]
mov rcx, r14
mov rdx, r15
mov r8, r12
mov r9d, ebx
call fcn.1400214a0
movdqu xmm0, xmmword [rdi + r13]
pxor xmm0, xmmword [rsp + 0x50]
movdqu xmmword [rdi + r13], xmm0
mov eax, dword [rsp + 0x7c]
bswap eax
inc eax
bswap eax
mov dword [rsp + 0x7c], eax
add r13, 0x10
cmp r13, rsi
jb 0x140022e90
mov r14, rbp
and r14, 0xf
jne 0x140022ee8
jmp 0x140022f6f
xor r13d, r13d
mov r14, rbp
and r14, 0xf
je 0x140022f6f
lea rcx, [rsp + 0x70]
lea rdx, [rsp + 0x50]
lea r8, [rsp + 0xb0]
mov r9d, ebx
call fcn.1400214a0
and ebp, 3
cmp r14d, 4
jae 0x140022f0f
xor eax, eax
jmp 0x140022f4c
sub r14, rbp
lea rcx, [rdi + r13]
add rcx, 3
xor eax, eax
nop dword [rax]
movzx edx, byte [rsp + rax + 0x50]
xor byte [rcx + rax - 3], dl
movzx edx, byte [rsp + rax + 0x51]
xor byte [rcx + rax - 2], dl
movzx edx, byte [rsp + rax + 0x52]
xor byte [rcx + rax - 1], dl
movzx edx, byte [rsp + rax + 0x53]
xor byte [rcx + rax], dl
add rax, 4
cmp r14, rax
jne 0x140022f20
test rbp, rbp
je 0x140022f6f
add r13, rax
add rdi, r13
add rax, rsp
add rax, 0x50
xor ecx, ecx
movzx edx, byte [rax + rcx]
xor byte [rdi + rcx], dl
inc rcx
cmp rbp, rcx
jne 0x140022f60
mov ecx, dword [rsp + 0x6c]
test ecx, ecx
sete al
add rsp, 0x1a8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140023060
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov rdx, qword [rcx]
movzx r8d, byte [rdx]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
lea rax, str.cw
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx], r8b
mov rdx, qword [rcx]
movzx r8d, byte [rdx + 1]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 1], r8b
mov rdx, qword [rcx]
movzx r8d, byte [rdx + 2]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 2], r8b
mov rdx, qword [rcx]
movzx r8d, byte [rdx + 3]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 3], r8b
mov rdx, qword [rcx + 8]
movzx r8d, byte [rdx]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx], r8b
mov rdx, qword [rcx + 8]
movzx r8d, byte [rdx + 1]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 1], r8b
mov rdx, qword [rcx + 8]
movzx r8d, byte [rdx + 2]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 2], r8b
mov rdx, qword [rcx + 8]
movzx r8d, byte [rdx + 3]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 3], r8b
mov rdx, qword [rcx + 0x10]
movzx r8d, byte [rdx]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx], r8b
mov rdx, qword [rcx + 0x10]
movzx r8d, byte [rdx + 1]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 1], r8b
mov rdx, qword [rcx + 0x10]
movzx r8d, byte [rdx + 2]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 2], r8b
mov rdx, qword [rcx + 0x10]
movzx r8d, byte [rdx + 3]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 3], r8b
mov rdx, qword [rcx + 0x18]
movzx r8d, byte [rdx]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx], r8b
mov rdx, qword [rcx + 0x18]
movzx r8d, byte [rdx + 1]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 1], r8b
mov rdx, qword [rcx + 0x18]
movzx r8d, byte [rdx + 2]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 2], r8b
mov rcx, qword [rcx + 0x18]
movzx edx, byte [rcx + 3]
mov r8d, edx
and r8d, 0xfffffff0
and edx, 0xf
add r8, rax
movzx eax, byte [rdx + r8]
mov byte [rcx + 3], al
ret
Function at 0x140023600
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov rdx, qword [rcx]
movzx r8d, byte [rdx]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
lea rax, [0x1400ccfb0]
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx], r8b
mov rdx, qword [rcx]
movzx r8d, byte [rdx + 1]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 1], r8b
mov rdx, qword [rcx]
movzx r8d, byte [rdx + 2]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 2], r8b
mov rdx, qword [rcx]
movzx r8d, byte [rdx + 3]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 3], r8b
mov rdx, qword [rcx + 8]
movzx r8d, byte [rdx]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx], r8b
mov rdx, qword [rcx + 8]
movzx r8d, byte [rdx + 1]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 1], r8b
mov rdx, qword [rcx + 8]
movzx r8d, byte [rdx + 2]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 2], r8b
mov rdx, qword [rcx + 8]
movzx r8d, byte [rdx + 3]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 3], r8b
mov rdx, qword [rcx + 0x10]
movzx r8d, byte [rdx]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx], r8b
mov rdx, qword [rcx + 0x10]
movzx r8d, byte [rdx + 1]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 1], r8b
mov rdx, qword [rcx + 0x10]
movzx r8d, byte [rdx + 2]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 2], r8b
mov rdx, qword [rcx + 0x10]
movzx r8d, byte [rdx + 3]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 3], r8b
mov rdx, qword [rcx + 0x18]
movzx r8d, byte [rdx]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx], r8b
mov rdx, qword [rcx + 0x18]
movzx r8d, byte [rdx + 1]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 1], r8b
mov rdx, qword [rcx + 0x18]
movzx r8d, byte [rdx + 2]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 2], r8b
mov rcx, qword [rcx + 0x18]
movzx edx, byte [rcx + 3]
mov r8d, edx
and r8d, 0xfffffff0
and edx, 0xf
add r8, rax
movzx eax, byte [rdx + r8]
mov byte [rcx + 3], al
ret
Function at 0x140023fd0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x40
mov r12, qword [r8 + 8]
sub r12, qword [r8]
mov rbx, rcx
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
cmp r12, 0x10
jb 0x140024042
mov rsi, r8
mov rdi, rdx
shr r12, 4
xor r13d, r13d
lea r14, [rsp + 0x20]
lea r15, [rsp + 0x30]
nop dword [rax]
mov rax, qword [rsi]
movups xmm0, xmmword [rax + r13]
movups xmm1, xmmword [rdi]
movaps xmmword [rsp + 0x30], xmm1
movups xmm1, xmmword [rbx]
xorps xmm1, xmm0
movaps xmmword [rsp + 0x20], xmm1
mov rcx, rbx
mov rdx, r14
mov r8, r15
call fcn.140024440
add r13, 0x10
dec r12
jne 0x140024010
mov rax, rbx
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14002c110
Capabilities:
Get file size
Read file via mapping

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rdi, rdx
cmp qword [rcx + 0x18], 8
jb 0x14002c126
mov rcx, qword [rcx]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor ebx, ebx
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x14002c1d8
mov rsi, rax
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14002c1e5
mov rax, qword [rsp + 0x40]
mov qword [rdi], rax
mov r9, rax
shr r9, 0x20
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x28], 0
xor ebx, ebx
mov rcx, rsi
xor edx, edx
mov r8d, 2
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
test rax, rax
je 0x14002c1cf
mov r14, rax
mov rax, qword [rdi]
mov qword [rsp + 0x20], rax
mov rcx, r14
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rbx
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
xor ebx, ebx
jmp 0x14002c1cf
Function at 0x14002f2a0
Capabilities:
Hash data using fnv

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
movaps xmm0, xmmword [0x1400cd3a0]
movaps xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x20], 0xc3557318
lea rdi, [rbp - 0x30]
mov rcx, rdi
call fcn.14002a1d0
mov ecx, 0x20
call fcn.14009a7a0
movdqa xmm0, xmmword [rbp - 0x30]
movdqu xmmword [rax], xmm0
movzx ecx, byte [rax]
movabs rdx, 0xcbf29ce484222325
xor rdx, rcx
movabs rcx, 0x100000001b3
imul rdx, rcx
movzx r8d, byte [rax + 1]
xor r8, rdx
imul r8, rcx
movzx edx, byte [rax + 2]
xor rdx, r8
imul rdx, rcx
movzx r8d, byte [rax + 3]
xor r8, rdx
imul r8, rcx
movzx edx, byte [rax + 4]
xor rdx, r8
imul rdx, rcx
movzx r8d, byte [rax + 5]
xor r8, rdx
imul r8, rcx
movzx edx, byte [rax + 6]
xor rdx, r8
imul rdx, rcx
movzx r8d, byte [rax + 7]
xor r8, rdx
imul r8, rcx
movzx edx, byte [rax + 8]
xor rdx, r8
imul rdx, rcx
movzx r8d, byte [rax + 9]
xor r8, rdx
imul r8, rcx
movzx edx, byte [rax + 0xa]
xor rdx, r8
imul rdx, rcx
movzx r8d, byte [rax + 0xb]
xor r8, rdx
imul r8, rcx
movzx edx, byte [rax + 0xc]
xor rdx, r8
imul rdx, rcx
movzx r8d, byte [rax + 0xd]
xor r8, rdx
imul r8, rcx
movzx r9d, byte [rax + 0xe]
xor r9, r8
imul r9, rcx
movzx edx, byte [rax + 0xf]
xor rdx, r9
imul rdx, rcx
and rdx, qword [rsi + 0x30]
mov rbx, qword [rsi + 8]
mov r8, qword [rsi + 0x18]
mov rcx, rdx
shl rcx, 4
mov rcx, qword [r8 + rcx + 8]
cmp rcx, rbx
je 0x14002f421
add rdx, rdx
mov rdx, qword [r8 + rdx*8]
cmp qword [rcx + 0x20], 0x10
jne 0x14002f40f
nop
cmp qword [rcx + 0x28], 0x10
jb 0x14002f3f0
mov r8, qword [rcx + 0x10]
jmp 0x14002f3f4
lea r8, [rcx + 0x10]
movdqu xmm0, xmmword [rax]
movdqu xmm1, xmmword [r8]
pcmpeqb xmm1, xmm0
pmovmskb r8d, xmm1
cmp r8d, 0xffff
je 0x14002f423
cmp rcx, rdx
je 0x14002f421
mov rcx, qword [rcx + 8]
cmp qword [rcx + 0x20], 0x10
je 0x14002f3e0
jmp 0x14002f40f
xor ecx, ecx
test rcx, rcx
cmovne rbx, rcx
mov edx, 0x20
mov rcx, rax
call fcn.14009a7e4
cmp rbx, qword [rsi + 8]
je 0x14002f4ff
add rbx, 0x30
mov rcx, rbx
xor edx, edx
call fcn.140033ff0
cmp eax, 0x5767ece
je 0x14002f461
cmp eax, 0xdd60b16f
jne 0x14002f4ff
lea rbx, [rsi + 0x40]
mov rcx, rdi
mov rdx, rbx
call fcn.140051910
cmp rbx, rdi
je 0x14002f4c4
mov rax, qword [rsi + 0x58]
cmp rax, 0x10
jb 0x14002f4af
mov rcx, qword [rbx]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14002f4aa
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14002f509
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.14009a7e4
movdqu xmm0, xmmword [rbp - 0x30]
movdqu xmm1, xmmword [rbp - 0x20]
movdqu xmmword [rbx + 0x10], xmm1
movdqu xmmword [rbx], xmm0
jmp 0x14002f4ff
mov rax, qword [rbp - 0x18]
cmp rax, 0x10
jb 0x14002f4ff
mov rcx, qword [rbp - 0x30]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14002f4fa
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14002f50e
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.14009a7e4
nop
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop rbp
ret
call fcn.1400a4324
call fcn.1400a4324
int3
Function at 0x140033ff0
Capabilities:
Encode data using xor

Disassembly:
mov r8, qword [rcx + 0x10]
test r8, r8
je 0x1400340e8
cmp qword [rcx + 0x18], 0x10
jb 0x140034007
mov rcx, qword [rcx]
mov rax, r8
and rax, 3
je 0x140034057
xor r9d, r9d
nop word cs:[rax + rax]
movzx r10d, byte [rcx + r9]
add r10d, edx
mov r11d, r10d
shl r11d, 0xa
add r11d, r10d
mov edx, r11d
shr edx, 6
xor edx, r11d
inc r9
cmp rax, r9
jne 0x140034020
add rcx, r9
mov rax, r8
sub rax, r9
cmp r8, 4
jae 0x140034064
jmp 0x1400340e8
mov rax, r8
cmp r8, 4
jb 0x1400340e8
xor r8d, r8d
nop word [rax + rax]
movzx r9d, byte [rcx + r8]
add r9d, edx
mov edx, r9d
shl edx, 0xa
add edx, r9d
mov r9d, edx
shr r9d, 6
xor r9d, edx
movzx edx, byte [rcx + r8 + 1]
add edx, r9d
mov r9d, edx
shl r9d, 0xa
add r9d, edx
mov edx, r9d
shr edx, 6
xor edx, r9d
movzx r9d, byte [rcx + r8 + 2]
add r9d, edx
mov edx, r9d
shl edx, 0xa
add edx, r9d
mov r9d, edx
shr r9d, 6
xor r9d, edx
movzx edx, byte [rcx + r8 + 3]
add edx, r9d
mov r9d, edx
shl r9d, 0xa
add r9d, edx
mov edx, r9d
shr edx, 6
xor edx, r9d
add r8, 4
cmp rax, r8
jne 0x140034070
lea eax, [rdx + rdx*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
mov eax, ecx
shl eax, 0xf
add eax, ecx
ret

Function at 0x140035270
Capabilities:
Initialize winsock library

Disassembly:
push rbp
push rsi
sub rsp, 0x1e8
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x150], xmm6
mov qword [rbp + 0x148], 0xfffffffffffffffe
mov rsi, rcx
mov word [rcx + 8], 1
mov byte [rcx + 0xa], 0
xorps xmm6, xmm6
movups xmmword [rcx + 0x10], xmm6
mov qword [rcx + 0x20], 0
lea rax, [0x1400cd830]
mov qword [rcx], rax
mov qword [rcx + 0x30], 0xffffffffffffffff
movups xmmword [rcx + 0x38], xmm6
mov word [rcx + 0x48], 0
add rcx, 0x50
mov dword [rbp - 0x58], 0
lea rdx, [rbp - 0x58]
lea r8, [rbp + 0x147]
call fcn.140040790
mov word [rsi + 0x90], 0
mov byte [rsi + 0x92], 0
movups xmmword [rsi + 0x98], xmm6
mov qword [rsi + 0xa8], 0
mov qword [rsi + 0xb0], setsockopt
movups xmmword [rsi + 0xb8], xmm6
movups xmmword [rsi + 0xc8], xmm6
movups xmmword [rsi + 0xd8], xmm6
mov qword [rsi + 0xe8], 0
mov qword [rsi + setsockopt0], 0xf
movups xmmword [rsi + 0xf8], xmm6
movups xmmword [rsi + 0x108], xmm6
movups xmmword [rsi + 0x118], xmm6
movups xmmword [rsi + 0x128], xmm6
movups xmmword [rsi + 0x138], xmm6
mov qword [rsi + 0x148], setsockopt
movups xmmword [rsi + 0x150], xmm6
mov qword [rsi + 0x160], 0
mov rax, qword [0x14013c9c0]
lea rcx, [rax + 1]
mov qword [0x14013c9c0], rcx
test rax, rax
jne 0x1400353a3
lea rdx, [rbp - 0x58]
mov cx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov rax, rsi
movaps xmm6, xmmword [rbp + 0x150]
add rsp, 0x1e8
pop rsi
pop rbp
ret

Function at 0x140035400
Capabilities:
Initialize winsock library

Disassembly:
push rbp
sub rsp, 0x1c0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x138], 0xfffffffffffffffe
mov rax, qword [0x14013c9c0]
lea rcx, [rax + 1]
mov qword [0x14013c9c0], rcx
test rax, rax
jne 0x140035440
lea rdx, [rbp - 0x60]
mov cx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
nop
add rsp, 0x1c0
pop rbp
ret
Function at 0x140035be0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Set socket configuration

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, rdx
mov rsi, rcx
mov rax, qword [rdx + 0x10]
mov qword [rcx + 0x48], rax
movups xmm0, xmmword [rdx]
movups xmmword [rcx + 0x38], xmm0
cmp qword [rdx], 0
mov rcx, qword [rcx + 0x30]
jne 0x140035ca2
cmp word [rdi + 8], 0
jne 0x140035ca2
cmp word [rdi + 0xa], 0xffff
jne 0x140035ca2
cmp rcx, 0xffffffffffffffff
jne 0x140035c56
mov ecx, 2
mov edx, 1
mov r8d, 6
call qword [sym.imp.WS2_32.dll_socket]
mov rcx, rax
mov qword [rsi + 0x30], rax
cmp rax, 0xffffffffffffffff
je 0x140035ce5
mov dword [rbp - 0x24], 1
lea r8, [rbp - 0x24]
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
jne 0x140035ce5
mov qword [rbp - 0x1c], 0
mov word [rbp - 0x24], 2
movzx eax, word [rdi + 0x10]
mov word [rbp - 0x22], ax
mov eax, dword [rdi + 0xc]
mov dword [rbp - 0x20], eax
mov rcx, qword [rsi + 0x30]
lea rdx, [rbp - 0x24]
mov r8d, reloc.WS2_32.dll_recv
call qword [sym.imp.WS2_32.dll_connect]
jmp 0x140035d21
cmp rcx, 0xffffffffffffffff
jne 0x140035ccb
mov ecx, reloc.WS2_32.dll_socket
mov edx, 1
mov r8d, 6
call qword [sym.imp.WS2_32.dll_socket]
mov rcx, rax
mov qword [rsi + 0x30], rax
cmp rax, 0xffffffffffffffff
je 0x140035ce5
mov dword [rbp - 0x24], 1
lea r8, [rbp - 0x24]
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x140035ce9
xor eax, eax
jmp 0x140035d23
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], 0
mov word [rbp - 0x24], reloc.WS2_32.dll_socket
movzx eax, word [rdi + 0x10]
mov word [rbp - 0x22], ax
movups xmm0, xmmword [rdi]
movups xmmword [rbp - 0x1c], xmm0
mov rcx, qword [rsi + 0x30]
lea rdx, [rbp - 0x24]
mov r8d, 0x1c
call qword [sym.imp.WS2_32.dll_connect]
mov al, 1
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret