joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140071ca0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rsi, rcx
mov rbp, r8
mov rcx, qword [rcx + 8]
mov r15, rdx
mov rax, qword [rcx]
call qword [rax + Ordinal_50]
mov rdx, qword [rsi + 0x48]
lea rcx, [rsi + 0x10]
call fcn.14003aab0
mov rdx, qword [rsi + 0x48]
lea rcx, [rsi + 0x28]
call fcn.14003aab0
mov rcx, qword [rsi + 0x10]
mov r8, qword [rsi + 0x18]
sub r8, rcx
je 0x140071cf9
xor edx, edx
call fcn.140154200
mov rcx, qword [rsi + 0x28]
mov r8, qword [rsi + 0x30]
sub r8, rcx
je 0x140071d0d
xor edx, edx
call fcn.140154200
mov rax, qword [rsi + 0x48]
xor ebx, ebx
cmp rbp, rax
jbe 0x140071d38
mov rcx, qword [rsi + 8]
mov r8, rbp
mov rdx, r15
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rsi + 8]
mov rdx, qword [rsi + 0x10]
mov rax, qword [rcx]
call qword [rax + Ordinal_26]
jmp 0x140071da9
test rbp, rbp
je 0x140071da9
mov r9, rbx
mov r8, rbx
test rax, rax
je 0x140071da9
mov r10, rbp
shr r10, 0x3f
nop
mov rcx, r8
mov rax, r8
sub rcx, rbp
xor rax, rbp
xor rcx, r8
mov rdx, r9
or rcx, rax
sub rdx, rbp
xor rcx, r8
shr rdx, 0x3f
shr rcx, 0x3f
dec rcx
not rcx
and r8, rcx
mov rcx, r9
shr rcx, 0x3f
xor dl, cl
movzx eax, cl
xor al, r10b
or dl, al
mov rax, qword [rsi + 0x10]
xor dl, cl
neg dl
and dl, byte [r8 + r15]
inc r8
mov byte [r9 + rax], dl
inc r9
cmp r9, qword [rsi + 0x48]
jne 0x140071d50
cmp qword [rsi + 0x48], rbx
je 0x140071dd3
nop
mov rax, qword [rsi + 0x10]
xor byte [rax + rbx], 0x36
mov rax, qword [rsi + 0x10]
movzx ecx, byte [rax + rbx]
mov rax, qword [rsi + 0x28]
xor cl, 0x6a
mov byte [rbx + rax], cl
inc rbx
cmp rbx, qword [rsi + 0x48]
jne 0x140071db0
mov rcx, qword [rsi + 8]
mov rdx, qword [rsi + 0x10]
mov r8, qword [rsi + 0x18]
sub r8, rdx
mov rax, qword [rcx]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
jmp qword [rax + reloc.WS2_32.dll_recv]

Function at 0x140072c90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov rbx, qword [rdx]
mov rax, rcx
xor rax, qword [rbx + 0x18]
mov r9, qword [rbx]
mov r10, qword [rbx + 8]
mov r11, qword [rbx + 0x10]
test r8, r8
je 0x140072ce6
nop
add r9, r10
add r11, rax
rol r10, 0xd
xor r10, r9
rol rax, 0x10
xor rax, r11
rol r9, 0x20
add r11, r10
add r9, rax
rol r10, 0x11
rol rax, 0x15
xor r10, r11
xor rax, r9
rol r11, 0x20
sub r8, 1
jne 0x140072cb0
xor r9, rcx
mov qword [rbx], r9
mov rcx, qword [rdx]
mov rbx, qword [rsp + 8]
mov qword [rcx + 8], r10
mov rcx, qword [rdx]
mov qword [rcx + 0x10], r11
mov rcx, qword [rdx]
mov qword [rcx + 0x18], rax
ret
Function at 0x140072d10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0x28]
mov rsi, r8
mov rdi, rdx
mov qword [rsp + 0x40], r14
mov rbx, rcx
cmp qword [rcx + 0x20], rax
jne 0x140072d3d
add rcx, 8
call fcn.140041540
add byte [rbx + 0x48], sil
xor ebp, ebp
mov rax, qword [rbx + 0x40]
test rax, rax
je 0x140072da6
test rsi, rsi
je 0x140072d87
mov rdx, rax
mov rax, rdx
cmp rdx, 8
je 0x140072d87
movzx ecx, byte [rdi]
inc rdi
mov rax, qword [rbx + 0x38]
shr rax, 8
shl rcx, 0x38
or rcx, rax
lea rax, [rdx + 1]
mov qword [rbx + 0x40], rax
mov rdx, rax
mov qword [rbx + 0x38], rcx
sub rsi, 1
jne 0x140072d54
cmp rax, 8
jne 0x140072da6
mov r8, qword [rbx + 0x10]
lea rdx, [rbx + 0x20]
mov rcx, qword [rbx + 0x38]
call fcn.140072c90
mov qword [rbx + 0x40], rbp
mov qword [rbx + 0x38], rbp
cmp rsi, 8
jb 0x140072e55
mov r11, rsi
mov qword [rsp + 0x48], r15
shr r11, 3
imul rax, r11, 0xfffffffffffffff8
add rsi, rax
nop dword [rax]
nop word [rax + rax]
mov r9, qword [rbx + 0x20]
mov r15, qword [rdi]
mov r10, qword [rbx + 0x10]
mov rax, r15
xor rax, qword [r9 + 0x18]
mov rcx, qword [r9]
mov rdx, qword [r9 + 8]
mov r8, qword [r9 + 0x10]
test r10, r10
je 0x140072e28
add rcx, rdx
add r8, rax
rol rdx, 0xd
xor rdx, rcx
rol rax, 0x10
xor rax, r8
rol rcx, 0x20
add r8, rdx
add rcx, rax
rol rdx, 0x11
rol rax, 0x15
xor rdx, r8
xor rax, rcx
rol r8, 0x20
sub r10, 1
jne 0x140072df2
xor rcx, r15
add rdi, 8
mov qword [r9], rcx
mov rcx, qword [rbx + 0x20]
mov qword [rcx + 8], rdx
mov rcx, qword [rbx + 0x20]
mov qword [rcx + 0x10], r8
mov rcx, qword [rbx + 0x20]
mov qword [rcx + 0x18], rax
sub r11, 1
jne 0x140072dd0
mov r15, qword [rsp + 0x48]
mov r14, qword [rsp + 0x40]
test rsi, rsi
je 0x140072e98
mov r8, qword [rbx + 0x40]
mov rdx, qword [rbx + 0x38]
nop word [rax + rax]
movzx ecx, byte [rdi + rbp]
mov rax, rdx
shl rcx, 0x38
inc r8
shr rax, 8
mov rdx, rcx
or rdx, rax
mov qword [rbx + 0x40], r8
inc rbp
mov qword [rbx + 0x38], rdx
cmp rbp, rsi
jne 0x140072e70
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
Function at 0x140072fd0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
mov rax, qword [rcx + 0x28]
cmp qword [rcx + 0x20], rax
jne 0x140072ff8
add rcx, 8
call fcn.140041540
mov rcx, qword [rbx + 0x40]
test rcx, rcx
jne 0x14007300f
movzx eax, byte [rbx + 0x48]
shl rax, 0x38
mov qword [rbx + 0x38], rax
jmp 0x140073038
cmp rcx, 8
jae 0x140073038
mov eax, 8
sub al, cl
movzx ecx, al
shl cl, 3
mov rdx, qword [rbx + 0x38]
shr rdx, cl
movzx eax, byte [rbx + 0x48]
shl rax, 0x38
or rdx, rax
mov qword [rbx + 0x38], rdx
mov r8, qword [rbx + 0x10]
lea rdx, [rbx + 0x20]
mov rcx, qword [rbx + 0x38]
call fcn.140072c90
mov rax, qword [rbx + 0x20]
xor qword [rax + 0x10], 0xff
mov r9, qword [rbx + 0x18]
mov r10, qword [rbx + 0x20]
mov rax, qword [r10]
mov rcx, qword [r10 + 8]
mov r8, qword [r10 + 0x10]
mov rdx, qword [r10 + 0x18]
test r9, r9
je 0x1400730a7
add rax, rcx
add r8, rdx
rol rcx, 0xd
xor rcx, rax
rol rdx, 0x10
xor rdx, r8
add r8, rcx
rol rax, 0x20
add rax, rdx
rol rcx, 0x11
xor rcx, r8
rol rdx, 0x15
xor rdx, rax
rol r8, 0x20
sub r9, 1
jne 0x140073071
mov qword [r10], rax
mov rax, qword [rbx + 0x20]
mov qword [rax + 8], rcx
mov rax, qword [rbx + 0x20]
mov qword [rax + 0x10], r8
mov rax, qword [rbx + 0x20]
mov qword [rax + 0x18], rdx
mov rcx, qword [rbx + 0x20]
mov rax, qword [rcx + 0x18]
xor rax, qword [rcx + 0x10]
xor rax, qword [rcx + 8]
xor rax, qword [rcx]
mov qword [rsi], rax
mov rcx, qword [rbx + 0x20]
mov rax, qword [rbx + 0x28]
sub rax, rcx
sar rax, 3
lea r8, [rax*8]
test r8, r8
je 0x1400730fb
xor edx, edx
call fcn.140154200
mov rax, qword [rbx + 0x20]
mov rdx, qword [rbx + 0x28]
cmp rax, rdx
je 0x14007310f
mov qword [rbx + 0x28], rax
mov rdx, rax
mov rax, qword [rbx + 0x30]
xor esi, esi
cmp rdx, rax
je 0x140073159
mov rcx, qword [rbx + 0x20]
cmp rcx, rdx
jne 0x140073149
test rcx, rcx
je 0x140073147
sub rax, rcx
sar rax, 3
lea r8d, [rsi + 8]
mov rdx, rax
call fcn.140041650
mov qword [rbx + 0x20], rsi
mov qword [rbx + 0x28], rsi
mov qword [rbx + 0x30], rsi
jmp 0x140073159
sub rdx, rcx
sar rdx, 3
lea rcx, [rbx + 0x20]
call fcn.1400676e0
mov qword [rbx + 0x38], rsi
mov qword [rbx + 0x40], rsi
mov byte [rbx + 0x48], 0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400836b0
Capabilities:
Encrypt data using blowfish

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbp, rdx
mov rdi, rcx
mov edx, reloc.WS2_32.dll_select
add rcx, 0x20
mov rsi, r8
call fcn.140050720
mov rcx, qword [rdi + 0x20]
test rcx, rcx
je 0x14008374e
mov r8d, 0x48
lea rdx, [0x140169e90]
call fcn.140153a80
mov edx, 0x400
lea rcx, [rdi + 8]
call fcn.140050720
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14008374e
mov r8d, 0x1000
lea rdx, [0x140169ee0]
call fcn.140153a80
xor r9d, r9d
mov qword [rsp + 0x20], 0
mov r8, rsi
mov rdx, rbp
mov rcx, rdi
call fcn.140082fe0
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
lea r9, str.buildinclude_botan_mem_ops.h
mov dword [rsp + 0x20], Ordinal_143
lea r8, str.copy_mem
lea rdx, str.If_n___0_then_args_are_not_null
lea rcx, str.n___0_implies_in___nullptr__out___nullptr
call fcn.14006e610
int3

Function at 0x140083780
Capabilities:
Encrypt data using camellia

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov r11, rcx
lea rbx, [0x14016ef80]
xor r11, rdx
mov rax, r11
shr rax, 0x38
movzx r14d, byte [rax + rbx]
mov rax, r11
shr rax, 0x30
movzx edx, al
movzx eax, byte [rdx + rbx]
rol al, 1
movzx esi, al
mov rax, r11
shr rax, 0x28
movzx ecx, al
movzx eax, byte [rcx + rbx]
ror al, 1
movzx ebp, al
mov rax, r11
shr rax, 0x20
rol al, 1
movzx eax, al
movzx edi, byte [rax + rbx]
mov rax, r11
shr rax, 0x18
movzx ecx, al
mov rax, r11
shr rax, 0x10
movzx r9d, byte [rcx + rbx]
movzx ecx, al
mov rax, r11
shr rax, 8
rol al, 1
rol r9b, 1
movzx r10d, byte [rcx + rbx]
movzx eax, al
ror r10b, 1
movzx r8d, byte [rax + rbx]
movzx eax, r11b
movzx edx, byte [rax + rbx]
movzx ecx, dl
xor cl, r8b
movzx eax, cl
xor cl, r9b
xor al, r10b
movzx ebx, cl
xor r10b, r9b
movzx r11d, al
movzx eax, r10b
mov r9d, r11d
xor r9, r14
xor al, dl
xor r9, rbp
movzx edx, al
xor r9, rdi
xor r10b, r8b
shl r9, 8
xor r10b, dil
xor r11, r14
movzx r8d, r10b
xor r11, rsi
mov ecx, r14d
xor rcx, rbx
mov eax, r14d
xor rax, rbp
xor rcx, rdi
xor rax, rdx
xor rcx, rsi
or r9, rcx
xor rax, rsi
shl r9, 8
or r9, rax
mov eax, r8d
shl r9, 8
xor rax, rbp
xor rax, rsi
or r9, rax
mov eax, ebp
shl r9, 8
or r9, r11
shl r9, 8
xor rax, rbx
xor rbp, rdx
mov rbx, qword [rsp + 0x10]
xor rax, rsi
mov rsi, qword [rsp + 0x20]
or rax, r9
xor rbp, rdi
shl rax, 8
mov rdi, qword [rsp + 0x28]
or rax, rbp
mov rbp, qword [rsp + 0x18]
xor r8, r14
shl rax, 8
or rax, r8
pop r14
ret
Function at 0x14008e910
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rax, qword [rcx + 0x10]
mov r15, r9
mov r14, r8
mov rdi, rdx
mov rsi, rcx
cmp qword [rcx + 8], rax
jne 0x14008e939
call fcn.140041540
test r15, r15
je 0x14008ea2b
mov qword [rsp + 0x40], rbx
lea rbx, [r14 + 2]
mov qword [rsp + 0x48], rbp
sub r14, rdi
mov qword [rsp + 0x50], r12
lea rbp, [rdi + 2]
nop dword [rax]
mov rcx, qword [rsi + 0x20]
lea rdi, [r14 + rbp]
movzx eax, byte [rbp - 2]
lea r8, [rdi - 2]
mov r9d, 1
lea rdx, [rdi - 2]
xor al, byte [rcx]
mov byte [rdi - 2], al
movzx eax, byte [rbp - 1]
xor al, byte [rcx + 1]
mov byte [rbx - 1], al
movzx eax, byte [rcx + 2]
xor al, byte [rbp]
mov byte [rbx], al
movzx eax, byte [rbp + 1]
xor al, byte [rcx + 3]
mov byte [rbx + 1], al
movzx eax, byte [rbp + 2]
xor al, byte [rcx + 4]
mov byte [rbx + 2], al
movzx eax, byte [rbp + 3]
xor al, byte [rcx + 5]
mov byte [rbx + 3], al
movzx eax, byte [rbp + 4]
xor al, byte [rcx + 6]
mov byte [rbx + 4], al
movzx eax, byte [rbp + 5]
xor al, byte [rcx + 7]
lea rcx, [rsi + 0x38]
mov byte [rbx + 5], al
mov rax, qword [rsi + 0x38]
call qword [rax + 0x48]
mov rcx, qword [rsi + 8]
lea rbp, [rbp + 8]
lea rbx, [rbx + 8]
movzx eax, byte [rcx]
xor byte [rdi - 2], al
movzx eax, byte [rcx + 1]
xor byte [rbx - 9], al
movzx eax, byte [rcx + 2]
xor byte [rbx - 8], al
movzx eax, byte [rcx + 3]
xor byte [rbx - 7], al
movzx eax, byte [rcx + 4]
xor byte [rbx - 6], al
movzx eax, byte [rcx + 5]
xor byte [rbx - 5], al
movzx eax, byte [rcx + 6]
xor byte [rbx - 4], al
movzx eax, byte [rcx + 7]
xor byte [rbx - 3], al
sub r15, 1
jne 0x14008e960
mov r12, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x14008ea40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rax, qword [rcx + 0x10]
mov r15, r9
mov r14, r8
mov rdi, rdx
mov rsi, rcx
cmp qword [rcx + 8], rax
jne 0x14008ea69
call fcn.140041540
test r15, r15
je 0x14008eb5b
mov qword [rsp + 0x40], rbx
lea rbx, [r14 + 2]
mov qword [rsp + 0x48], rbp
sub r14, rdi
mov qword [rsp + 0x50], r12
lea rbp, [rdi + 2]
nop dword [rax]
mov rcx, qword [rsi + 8]
lea rdi, [r14 + rbp]
movzx eax, byte [rbp - 2]
lea r8, [rdi - 2]
mov r9d, 1
lea rdx, [rdi - 2]
xor al, byte [rcx]
mov byte [rdi - 2], al
movzx eax, byte [rbp - 1]
xor al, byte [rcx + 1]
mov byte [rbx - 1], al
movzx eax, byte [rcx + 2]
xor al, byte [rbp]
mov byte [rbx], al
movzx eax, byte [rbp + 1]
xor al, byte [rcx + 3]
mov byte [rbx + 1], al
movzx eax, byte [rbp + 2]
xor al, byte [rcx + 4]
mov byte [rbx + 2], al
movzx eax, byte [rbp + 3]
xor al, byte [rcx + 5]
mov byte [rbx + 3], al
movzx eax, byte [rbp + 4]
xor al, byte [rcx + 6]
mov byte [rbx + 4], al
movzx eax, byte [rbp + 5]
xor al, byte [rcx + 7]
lea rcx, [rsi + 0x38]
mov byte [rbx + 5], al
mov rax, qword [rsi + 0x38]
call qword [rax + 0x40]
mov rcx, qword [rsi + 0x20]
lea rbp, [rbp + 8]
lea rbx, [rbx + 8]
movzx eax, byte [rcx]
xor byte [rdi - 2], al
movzx eax, byte [rcx + 1]
xor byte [rbx - 9], al
movzx eax, byte [rcx + 2]
xor byte [rbx - 8], al
movzx eax, byte [rcx + 3]
xor byte [rbx - 7], al
movzx eax, byte [rcx + 4]
xor byte [rbx - 6], al
movzx eax, byte [rcx + 5]
xor byte [rbx - 5], al
movzx eax, byte [rcx + 6]
xor byte [rbx - 4], al
movzx eax, byte [rcx + 7]
xor byte [rbx - 3], al
sub r15, 1
jne 0x14008ea90
mov r12, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x14008f6d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
movzx r11d, cx
mov ebx, reloc.WS2_32.dll_ntohs
movzx eax, r11w
mov edi, r11d
nop word [rax + rax]
movzx r8d, ax
xor r9d, r9d
imul r8d, r8d
movzx ecx, r8w
mov edx, r8d
shr edx, 0x10
cmp ecx, edx
lea r10d, [r8 - 1]
not r8d
setb r9b
add ax, ax
shr r8d, 0x1f
sub r9w, dx
add r9w, cx
shr r10d, 0x1f
and r10w, r8w
mov ecx, 1
sub cx, ax
xor r8d, r8d
xor cx, r9w
neg r10w
and r10w, cx
xor r10w, r9w
movzx eax, r10w
imul eax, edi
movzx ecx, ax
mov edx, eax
shr edx, 0x10
cmp ecx, edx
setb r8b
sub r8w, dx
add r8w, cx
lea ecx, [rax - 1]
shr ecx, 0x1f
not eax
shr eax, 0x1f
and ax, cx
mov ecx, 1
sub cx, r10w
neg ax
sub cx, r11w
xor cx, r8w
and ax, cx
xor ax, r8w
sub rbx, 1
jne 0x14008f6f0
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
Function at 0x1400a0830
Capabilities:
Encode data using xor

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x1401ce680]
xor rax, rsp
mov qword [rbp + 0x47], rax
movups xmm0, xmmword [rdx]
mov r10d, dword [reloc.WS2_32.dll_accept]
mov r8, rcx
movups xmm1, xmmword [rdx + 0x10]
mov r9d, 4
movups xmmword [rbp - 0x39], xmm0
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rbp - 0x29], xmm1
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rbp - 0x19], xmm0
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rbp - 9], xmm1
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rbp + 7], xmm0
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rbp + 0x17], xmm1
movups xmm1, xmmword [rdx + 0x70]
lea rdx, [rbp - 0x39]
movups xmmword [rbp + 0x27], xmm0
movups xmmword [rbp + 0x37], xmm1
nop
xor eax, eax
cmp r10d, 2
jl 0x1400a08d0
nop dword [rax + rax]
movdqu xmm0, xmmword [rdx + rax*8]
pshufb xmm0, xmmword [0x14015c2a0]
movdqu xmmword [rdx + rax*8], xmm0
add rax, 2
cmp rax, 4
jl 0x1400a08b0
jmp 0x1400a08e4
mov rcx, qword [rdx + rax*8]
bswap rcx
mov qword [rdx + rax*8], rcx
inc rax
cmp rax, 4
jl 0x1400a08d0
add rdx, 0x20
sub r9, 1
jne 0x1400a08a0
movdqu xmm0, xmmword [rbp - 0x31]
mov rax, qword [rbp - 0x39]
mov edx, 8
movdqu xmm1, xmmword [rbp - 0x39]
movdqu xmm2, xmmword [rbp - 0x29]
shr rax, 0x3f
imul r9, rax, 0x80043
mov eax, 0x3f
movd xmm4, eax
mov eax, 1
psrlq xmm0, xmm4
movd xmm3, eax
psllq xmm1, xmm3
psllq xmm2, xmm3
pxor xmm1, xmm0
movdqu xmm0, xmmword [rbp - 0x21]
movdqu xmmword [rbp - 0x39], xmm1
movdqu xmm1, xmmword [rbp - 0x19]
psrlq xmm0, xmm4
psllq xmm1, xmm3
pxor xmm2, xmm0
movdqu xmm0, xmmword [rbp - 0x11]
movdqu xmmword [rbp - 0x29], xmm2
movdqu xmm2, xmmword [rbp - 9]
psrlq xmm0, xmm4
psllq xmm2, xmm3
pxor xmm1, xmm0
movdqu xmm0, xmmword [rbp - 1]
movdqu xmmword [rbp - 0x19], xmm1
psrlq xmm0, xmm4
pxor xmm2, xmm0
movdqu xmmword [rbp - 9], xmm2
mov rax, qword [rbp + rdx*8 - 0x39]
mov rcx, qword [rbp + rdx*8 - 0x31]
add rax, rax
shr rcx, 0x3f
xor rcx, rax
mov qword [rbp + rdx*8 - 0x39], rcx
inc rdx
cmp rdx, 0xf
jne 0x1400a0980
mov rax, qword [rbp + 0x3f]
lea rcx, [rbp - 0x39]
add rax, rax
mov edx, reloc.WS2_32.dll_recv
xor rax, r9
mov qword [rbp + 0x3f], rax
nop dword [rax]
mov rax, qword [rcx]
lea r8, [r8 + 8]
lea rcx, [rcx + 8]
bswap rax
mov qword [r8 - 8], rax
sub rdx, 1
jne 0x1400a09c0
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.14010f1d0
add rsp, 0x90
pop rbp
ret
Function at 0x1400a1060
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1401ce680]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rax, [r8 - 1]
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
cmp rax, 0xf
ja 0x1400a11eb
mov rax, qword [rcx + 0x98]
lea r8, [rsp + 0x20]
shl rax, 3
mov r9d, reloc.WS2_32.dll_recv
bswap rax
mov qword [rsp + 0x20], rax
mov rax, qword [rcx + 0xa0]
shl rax, 3
bswap rax
mov qword [rsp + 0x70], rbx
lea rbx, [rcx + 0x38]
mov rdx, rbx
mov qword [rsp + 0x28], rax
call fcn.1400a13a0
xor eax, eax
cmp rbp, 0x40
jb 0x1400a1198
mov r10, qword [rbx]
lea rdx, [rbp - 1]
lea rcx, [rbp - 1]
add rdx, rdi
add rcx, r10
lea r8, [rsi + 0x50]
cmp rdi, rcx
ja 0x1400a10ff
cmp rdx, r10
jae 0x1400a11a0
mov r9, qword [r8]
lea rcx, [rbp - 1]
add rcx, r9
cmp rdi, rcx
ja 0x1400a1117
cmp rdx, r9
jae 0x1400a11a0
cmp rdi, rbx
ja 0x1400a1121
cmp rdx, rbx
jae 0x1400a11a0
cmp rdi, r8
ja 0x1400a112b
cmp rdx, r8
jae 0x1400a11a0
mov rcx, rbp
and rcx, 0xffffffffffffffc0
movdqu xmm0, xmmword [r9 + rax]
movdqu xmm1, xmmword [r10 + rax]
movdqu xmm2, xmmword [r9 + rax + 0x10]
pxor xmm1, xmm0
movdqu xmm0, xmmword [r10 + rax + 0x10]
movdqu xmmword [rdi + rax], xmm1
movdqu xmm1, xmmword [r9 + rax + 0x20]
pxor xmm2, xmm0
movdqu xmm0, xmmword [r10 + rax + 0x20]
movdqu xmmword [rdi + rax + 0x10], xmm2
movdqu xmm2, xmmword [r9 + rax + 0x30]
pxor xmm1, xmm0
movdqu xmm0, xmmword [r10 + rax + 0x30]
movdqu xmmword [rdi + rax + 0x20], xmm1
pxor xmm2, xmm0
movdqu xmmword [rdi + rax + 0x30], xmm2
add rax, 0x40
cmp rax, rcx
jne 0x1400a1132
cmp rax, rbp
je 0x1400a11b9
nop dword [rax]
mov rdx, qword [rsi + 0x50]
mov rcx, qword [rbx]
movzx edx, byte [rdx + rax]
xor dl, byte [rcx + rax]
mov byte [rdi + rax], dl
inc rax
cmp rax, rbp
jne 0x1400a11a0
mov rax, qword [rbx]
cmp rax, qword [rbx + 8]
je 0x1400a11c6
mov qword [rbx + 8], rax
mov rbx, qword [rsp + 0x70]
mov qword [rsi + 0xa0], 0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14010f1d0
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
lea r8, str.src_lib_utils_ghash_ghash.cpp
lea rdx, str.final
lea rcx, str.GHASH_output_length
call fcn.14006fa10
int3
Function at 0x1400a89b0
Capabilities:
Decrypt data using aes via x86 extensions
Encode data using xor

Disassembly:
mov rax, rsp
sub rsp, 0x98
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
movaps xmmword [rax - 0x38], xmm8
movaps xmmword [rax - 0x48], xmm9
movaps xmmword [rax - 0x58], xmm10
movaps xmmword [rax - 0x68], xmm11
movaps xmmword [rax - 0x78], xmm12
mov rax, qword [rcx + 0x20]
movaps xmmword [rsp + 0x10], xmm13
movaps xmmword [rsp], xmm14
movdqu xmm4, xmmword [rax]
movdqu xmm5, xmmword [rax + 0x10]
movdqu xmm6, xmmword [rax + 0x20]
movdqu xmm7, xmmword [rax + 0x30]
movdqu xmm8, xmmword [rax + 0x40]
movdqu xmm9, xmmword [rax + 0x50]
movdqu xmm10, xmmword [rax + 0x60]
movdqu xmm11, xmmword [rax + 0x70]
movdqu xmm12, xmmword [rax + 0x80]
movdqu xmm13, xmmword [rax + 0x90]
movdqu xmm14, xmmword [rax + 0xa0]
cmp r9, 4
jb 0x1400a8b83
mov rcx, r9
mov r10, r8
shr rcx, 2
sub r10, rdx
imul rax, rcx, 0xfffffffffffffffc
add r9, rax
nop
movdqu xmm3, xmmword [rdx + 0x10]
movdqu xmm2, xmmword [rdx + 0x20]
movdqu xmm1, xmmword [rdx + 0x30]
movdqu xmm0, xmmword [rdx]
pxor xmm3, xmm4
pxor xmm2, xmm4
pxor xmm1, xmm4
pxor xmm0, xmm4
aesdec xmm3, xmm5
aesdec xmm2, xmm5
aesdec xmm1, xmm5
aesdec xmm0, xmm5
aesdec xmm3, xmm6
aesdec xmm2, xmm6
aesdec xmm1, xmm6
aesdec xmm0, xmm6
aesdec xmm3, xmm7
aesdec xmm2, xmm7
aesdec xmm1, xmm7
aesdec xmm0, xmm7
aesdec xmm3, xmm8
aesdec xmm2, xmm8
aesdec xmm1, xmm8
aesdec xmm0, xmm8
aesdec xmm3, xmm9
aesdec xmm2, xmm9
aesdec xmm1, xmm9
aesdec xmm0, xmm9
aesdec xmm3, xmm10
aesdec xmm2, xmm10
aesdec xmm1, xmm10
aesdec xmm0, xmm10
aesdec xmm3, xmm11
aesdec xmm2, xmm11
aesdec xmm1, xmm11
aesdec xmm0, xmm11
aesdec xmm3, xmm12
aesdec xmm2, xmm12
aesdec xmm1, xmm12
aesdec xmm0, xmm12
aesdec xmm3, xmm13
aesdec xmm2, xmm13
aesdec xmm1, xmm13
aesdec xmm0, xmm13
aesdeclast xmm3, xmm14
aesdeclast xmm2, xmm14
aesdeclast xmm1, xmm14
aesdeclast xmm0, xmm14
movdqu xmmword [r8], xmm0
add r8, 0x40
movdqu xmmword [r10 + rdx + 0x10], xmm3
movdqu xmmword [r10 + rdx + 0x20], xmm2
movdqu xmmword [r10 + rdx + 0x30], xmm1
add rdx, 0x40
sub rcx, 1
jne 0x1400a8a50
test r9, r9
je 0x1400a8be3
sub rdx, r8
nop dword [rax + rax]
movdqu xmm0, xmmword [rdx + r8]
lea r8, [r8 + 0x10]
pxor xmm0, xmm4
aesdec xmm0, xmm5
aesdec xmm0, xmm6
aesdec xmm0, xmm7
aesdec xmm0, xmm8
aesdec xmm0, xmm9
aesdec xmm0, xmm10
aesdec xmm0, xmm11
aesdec xmm0, xmm12
aesdec xmm0, xmm13
aesdeclast xmm0, xmm14
movdqu xmmword [r8 - 0x10], xmm0
sub r9, 1
jne 0x1400a8b90
movaps xmm7, xmmword [rsp + 0x70]
lea r11, [rsp + 0x98]
movaps xmm6, xmmword [r11 - 0x18]
movaps xmm8, xmmword [r11 - 0x38]
movaps xmm9, xmmword [r11 - 0x48]
movaps xmm10, xmmword [r11 - 0x58]
movaps xmm11, xmmword [r11 - 0x68]
movaps xmm12, xmmword [r11 - 0x78]
movaps xmm13, xmmword [rsp + 0x10]
movaps xmm14, xmmword [rsp]
mov rsp, r11
ret