joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b3df0
Capabilities:
Hash data using ripemd256
Hash data with md5

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x140353c70]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xd0]
mov r13, r9
mov rbp, qword [rsp + 0xd8]
mov r15, r8
mov qword [rsp + 0x38], rdx
mov rdi, rdx
mov qword [rsp + 0x40], rax
mov rbx, rcx
mov qword [rsp + 0x30], rbp
test rax, rax
je 0x1400b401e
xor esi, esi
mov dword [rcx + 0x54], 0x67452301
mov dword [rcx + 0x50], esi
mov qword [rcx + 8], rsi
mov dword [rcx + 0x58], 0xefcdab89
mov dword [rcx + 0x5c], 0x98badcfe
mov dword [rcx + 0x60], 0x10325476
mov dword [rcx + 0x64], 0x76543210
mov dword [rcx + 0x68], 0xfedcba98
mov dword [rcx + 0x6c], 0x89abcdef
mov dword [rcx + 0x70], 0x1234567
mov ecx, 0x4e28
call fcn.14003be80
mov r14, rax
test rax, rax
je 0x1400b401e
mov qword [rsp + 0x68], r12
mov rcx, rdi
mov r12b, 1
mov dword [rsp + 0x48], esi
call fcn.14010ff30
test al, al
jne 0x1400b3ffe
nop word [rax + rax]
mov qword [rsp + 0x28], r13
lea r9, [rsp + 0x48]
mov r8d, 0x4e20
mov qword [rsp + 0x20], r15
mov rdx, r14
mov rcx, rdi
call fcn.140110180
movzx r12d, al
test al, al
je 0x1400b3ffe
mov esi, dword [rsp + 0x48]
test esi, esi
je 0x1400b3fd8
test rbp, rbp
je 0x1400b3f0f
mov r8d, esi
mov rdx, r14
mov rcx, rbp
call fcn.14003e880
mov esi, dword [rsp + 0x48]
mov rbp, r14
cmp esi, 1
jb 0x1400b3fbd
nop dword [rax + rax]
mov edx, dword [rbx + 0x50]
test edx, edx
jne 0x1400b3f65
cmp esi, 0x40
jb 0x1400b3f65
movups xmm0, xmmword [rbp]
mov rcx, rbx
movups xmmword [rbx + 0x10], xmm0
movups xmm1, xmmword [rbp + 0x10]
movups xmmword [rbx + 0x20], xmm1
movups xmm0, xmmword [rbp + 0x20]
movups xmmword [rbx + 0x30], xmm0
movups xmm1, xmmword [rbp + 0x30]
movups xmmword [rbx + 0x40], xmm1
call fcn.1400b2c80
add qword [rbx + 8], 0x200
add rbp, 0x40
add esi, 0xffffffc0
jmp 0x1400b3fac
mov ecx, 0x40
mov eax, esi
sub ecx, edx
cmp esi, ecx
cmovae eax, ecx
lea rcx, [rdx + 0x10]
add rcx, rbx
mov r8d, eax
mov rdx, rbp
mov edi, eax
call sub.VCRUNTIME140.dll_memcpy
add dword [rbx + 0x50], edi
add rbp, rdi
sub esi, edi
cmp dword [rbx + 0x50], 0x40
jne 0x1400b3fac
mov rcx, rbx
call fcn.1400b2c80
add qword [rbx + 8], 0x200
mov dword [rbx + 0x50], 0
test esi, esi
jne 0x1400b3f20
mov esi, dword [rsp + 0x48]
mov rdi, qword [rsp + 0x38]
test r15, r15
je 0x1400b3fd3
mov edx, esi
mov r8, r13
mov rcx, r15
call fcn.14009e710
test al, al
jne 0x1400b3fea
mov rbp, qword [rsp + 0x30]
mov rcx, rdi
call fcn.14010ff30
test al, al
je 0x1400b3ec0
jmp 0x1400b3ffe
mov rax, qword [r13]
lea rdx, str.RIPEMD256_aborted_by_application
mov rcx, r13
call qword [rax + 0x28]
xor r12b, r12b
mov rcx, r14
call fcn.140247544
mov rdx, qword [rsp + 0x40]
mov rcx, rbx
call fcn.1400b4040
movzx eax, r12b
mov r12, qword [rsp + 0x68]
jmp 0x1400b4020
xor al, al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1402474e0
add rsp, 0x70
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400b4300
Capabilities:
Hash data using ripemd256
Hash data with md5

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor eax, eax
mov dword [rcx + 0x54], 0x67452301
mov dword [rcx + 0x50], eax
mov rdi, r9
mov qword [rcx + 8], rax
mov rbx, rcx
mov dword [rcx + 0x58], 0xefcdab89
mov dword [rcx + 0x5c], 0x98badcfe
mov dword [rcx + 0x60], 0x10325476
mov dword [rcx + 0x64], 0x76543210
mov dword [rcx + 0x68], 0xfedcba98
mov dword [rcx + 0x6c], 0x89abcdef
mov dword [rcx + 0x70], 0x1234567
call fcn.1400b4210
mov rdx, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400b4040
Function at 0x1400b5ce0
Capabilities:
Hash data using ripemd320
Hash data using sha1

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x140353c70]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xd0]
mov r13, r9
mov rbp, qword [rsp + 0xd8]
mov r15, r8
mov qword [rsp + 0x38], rdx
mov rdi, rdx
mov qword [rsp + 0x40], rax
mov rbx, rcx
mov qword [rsp + 0x30], rbp
test rax, rax
je 0x1400b5f1e
xor esi, esi
mov dword [rcx + 0x54], 0x67452301
mov dword [rcx + 0x50], esi
mov qword [rcx + 8], rsi
mov dword [rcx + 0x58], 0xefcdab89
mov dword [rcx + 0x5c], 0x98badcfe
mov dword [rcx + 0x60], 0x10325476
mov dword [rcx + 0x64], 0xc3d2e1f0
mov dword [rcx + 0x68], 0x76543210
mov dword [rcx + 0x6c], 0xfedcba98
mov dword [rcx + 0x70], 0x89abcdef
mov dword [rcx + 0x74], 0x1234567
mov dword [rcx + 0x78], 0x3c2d1e0f
mov ecx, 0x4e28
call fcn.14003be80
mov r14, rax
test rax, rax
je 0x1400b5f1e
mov qword [rsp + 0x68], r12
mov rcx, rdi
mov r12b, 1
mov dword [rsp + 0x48], esi
call fcn.14010ff30
test al, al
jne 0x1400b5efe
nop dword [rax]
nop word [rax + rax]
mov qword [rsp + 0x28], r13
lea r9, [rsp + 0x48]
mov r8d, 0x4e20
mov qword [rsp + 0x20], r15
mov rdx, r14
mov rcx, rdi
call fcn.140110180
movzx r12d, al
test al, al
je 0x1400b5efe
mov esi, dword [rsp + 0x48]
test esi, esi
je 0x1400b5ed8
test rbp, rbp
je 0x1400b5e0f
mov r8d, esi
mov rdx, r14
mov rcx, rbp
call fcn.14003e880
mov esi, dword [rsp + 0x48]
mov rbp, r14
cmp esi, 1
jb 0x1400b5ebd
nop dword [rax + rax]
mov edx, dword [rbx + 0x50]
test edx, edx
jne 0x1400b5e65
cmp esi, 0x40
jb 0x1400b5e65
movups xmm0, xmmword [rbp]
mov rcx, rbx
movups xmmword [rbx + 0x10], xmm0
movups xmm1, xmmword [rbp + 0x10]
movups xmmword [rbx + 0x20], xmm1
movups xmm0, xmmword [rbp + 0x20]
movups xmmword [rbx + 0x30], xmm0
movups xmm1, xmmword [rbp + 0x30]
movups xmmword [rbx + 0x40], xmm1
call fcn.1400b43d0
add qword [rbx + 8], 0x200
add rbp, 0x40
add esi, 0xffffffc0
jmp 0x1400b5eac
mov ecx, 0x40
mov eax, esi
sub ecx, edx
cmp esi, ecx
cmovae eax, ecx
lea rcx, [rdx + 0x10]
add rcx, rbx
mov r8d, eax
mov rdx, rbp
mov edi, eax
call sub.VCRUNTIME140.dll_memcpy
add dword [rbx + 0x50], edi
add rbp, rdi
sub esi, edi
cmp dword [rbx + 0x50], 0x40
jne 0x1400b5eac
mov rcx, rbx
call fcn.1400b43d0
add qword [rbx + 8], 0x200
mov dword [rbx + 0x50], 0
test esi, esi
jne 0x1400b5e20
mov esi, dword [rsp + 0x48]
mov rdi, qword [rsp + 0x38]
test r15, r15
je 0x1400b5ed3
mov edx, esi
mov r8, r13
mov rcx, r15
call fcn.14009e710
test al, al
jne 0x1400b5eea
mov rbp, qword [rsp + 0x30]
mov rcx, rdi
call fcn.14010ff30
test al, al
je 0x1400b5dc0
jmp 0x1400b5efe
mov rax, qword [r13]
lea rdx, str.RIPEMD320_aborted_by_application
mov rcx, r13
call qword [rax + 0x28]
xor r12b, r12b
mov rcx, r14
call fcn.140247544
mov rdx, qword [rsp + 0x40]
mov rcx, rbx
call fcn.1400b5f40
movzx eax, r12b
mov r12, qword [rsp + 0x68]
jmp 0x1400b5f20
xor al, al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1402474e0
add rsp, 0x70
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400b6230
Capabilities:
Hash data using ripemd320
Hash data using sha1

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor eax, eax
mov dword [rcx + 0x54], 0x67452301
mov dword [rcx + 0x50], eax
mov rdi, r9
mov qword [rcx + 8], rax
mov rbx, rcx
mov dword [rcx + 0x58], 0xefcdab89
mov dword [rcx + 0x5c], 0x98badcfe
mov dword [rcx + 0x60], 0x10325476
mov dword [rcx + 0x64], 0xc3d2e1f0
mov dword [rcx + 0x68], 0x76543210
mov dword [rcx + 0x6c], 0xfedcba98
mov dword [rcx + 0x70], 0x89abcdef
mov dword [rcx + 0x74], 0x1234567
mov dword [rcx + 0x78], 0x3c2d1e0f
call fcn.1400b6140
mov rdx, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400b5f40

Function at 0x1400b62b0
Capabilities:
Hash data with md5

Disassembly:
lea rax, vtable.s738174zz.0
mov dword [rcx + 8], 0x67452301
mov qword [rcx], rax
xor eax, eax
mov qword [rcx + 0x18], rax
mov rax, rcx
mov dword [rcx + 0xc], 0xefcdab89
mov dword [rcx + 0x10], 0x98badcfe
mov dword [rcx + 0x14], 0x10325476
ret

Function at 0x1400b6320
Capabilities:
Hash data with md5

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x48
mov rax, qword [0x140353c70]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r13, qword [rsp + 0xb0]
mov r14, r9
mov rbp, qword [rsp + 0xb8]
mov rsi, r8
mov r15, rdx
mov rdi, rcx
test r13, r13
je 0x1400b6460
mov dword [rcx + 8], 0x67452301
xor r12d, r12d
mov qword [rcx + 0x18], r12
mov dword [rcx + 0xc], 0xefcdab89
mov dword [rcx + 0x10], 0x98badcfe
mov dword [rcx + 0x14], 0x10325476
mov ecx, 0x4e28
call fcn.14003be80
mov rbx, rax
test rax, rax
je 0x1400b6460
mov dword [rsp + 0x30], r12d
mov rcx, r15
mov r12b, 1
call fcn.14010ff30
test al, al
jne 0x1400b6447
nop word [rax + rax]
mov qword [rsp + 0x28], r14
lea r9, [rsp + 0x30]
mov r8d, 0x4e20
mov qword [rsp + 0x20], rsi
mov rdx, rbx
mov rcx, r15
call fcn.140110180
test al, al
je 0x1400b6447
mov r8d, dword [rsp + 0x30]
test r8d, r8d
je 0x1400b6426
test rbp, rbp
je 0x1400b6403
mov rdx, rbx
mov rcx, rbp
call fcn.14003e880
mov r8d, dword [rsp + 0x30]
mov rdx, rbx
mov rcx, rdi
call fcn.1400b6e20
test rsi, rsi
je 0x1400b6426
mov edx, dword [rsp + 0x30]
mov r8, r14
mov rcx, rsi
call fcn.14009e710
test al, al
jne 0x1400b6434
mov rcx, r15
call fcn.14010ff30
test al, al
je 0x1400b63c0
jmp 0x1400b6447
mov rax, qword [r14]
lea rdx, str.MD4_aborted_by_application
mov rcx, r14
call qword [rax + 0x28]
xor r12b, r12b
mov rcx, rbx
call fcn.140247544
mov rdx, r13
mov rcx, rdi
call fcn.1400b6480
movzx eax, r12b
jmp 0x1400b6462
xor al, al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1402474e0
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400b65a0
Capabilities:
Hash data with md5

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x140353c70]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x20]
call fcn.14003e200
nop
lea r8, [rsp + 0x20]
xor edx, edx
mov rcx, rbx
call fcn.14004a5e0
xor eax, eax
mov qword [rdi + 0x18], rax
mov dword [rdi + 8], 0x67452301
mov dword [rdi + 0xc], 0xefcdab89
mov dword [rdi + 0x10], 0x98badcfe
mov dword [rdi + 0x14], 0x10325476
lea rcx, [rsp + 0x20]
call fcn.140042d30
mov ebx, eax
lea rcx, [rsp + 0x20]
call fcn.1400428d0
mov rdx, rax
mov r8d, ebx
mov rcx, rdi
call fcn.1400b6e20
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.1400b6480
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.14003e880
nop
lea rcx, [rsp + 0x20]
call fcn.14003e3b0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1402474e0
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400b7150
Capabilities:
Hash data using sha1
Hash data using sha224
Hash data using sha256
Resolve function by parsing pe exports

Disassembly:
cmp dword [rcx + 0x10], 0x100
jle fcn.1400ba660
jmp fcn.1400bca10

Function at 0x1400b7170
Capabilities:
Hash data using sha1
Hash data using sha224
Hash data using sha256

Disassembly:
mov edx, dword [rcx + 0x10]
xor r8d, r8d
sub edx, 0xa0
je 0x1400b7300
sub edx, 0x40
je 0x1400b7212
sub edx, 0x20
je 0x1400b72c0
sub edx, 0x80
je 0x1400b7250
cmp edx, 0x80
jne 0x1400b7327
mov rax, qword [0x140358420]
mov qword [rcx + 0x40], rax
mov rax, qword [0x140358428]
mov qword [rcx + 0x48], rax
mov rax, qword [0x140358430]
mov qword [rcx + 0x50], rax
mov rax, qword [0x140358438]
mov qword [rcx + 0x58], rax
mov rax, qword [0x140358440]
mov qword [rcx + 0x60], rax
mov rax, qword [0x140358448]
mov qword [rcx + 0x68], rax
mov rax, qword [0x140358450]
mov qword [rcx + 0x70], rax
mov rax, qword [0x140358458]
mov qword [rcx + 0x78], rax
mov qword [rcx + 0x80], r8
mov qword [rcx + 0x88], r8
mov dword [rcx + 0x14], 0xc1059ed8
mov dword [rcx + 0x18], 0x367cd507
mov dword [rcx + 0x1c], 0x3070dd17
mov dword [rcx + 0x20], 0xf70e5939
mov dword [rcx + 0x24], 0xffc00b31
mov dword [rcx + 0x28], 0x68581511
mov dword [rcx + 0x2c], 0x64f98fa7
mov dword [rcx + 0x30], 0xbefa4fa4
mov qword [rcx + 0x34], r8
ret
mov rax, qword [0x140358160]
mov qword [rcx + 0x40], rax
mov rax, qword [0x140358168]
mov qword [rcx + 0x48], rax
mov rax, qword [0x140358170]
mov qword [rcx + 0x50], rax
mov rax, qword [0x140358178]
mov qword [rcx + 0x58], rax
mov rax, qword [0x140358180]
mov qword [rcx + 0x60], rax
mov rax, qword [0x140358188]
mov qword [rcx + 0x68], rax
mov rax, qword [0x140358190]
mov qword [rcx + 0x70], rax
mov rax, qword [0x140358198]
mov qword [rcx + 0x78], rax
mov qword [rcx + 0x80], r8
mov qword [rcx + 0x88], r8
ret
mov dword [rcx + 0x14], 0x6a09e667
mov dword [rcx + 0x18], 0xbb67ae85
mov dword [rcx + 0x1c], 0x3c6ef372
mov dword [rcx + 0x20], 0xa54ff53a
mov dword [rcx + 0x24], 0x510e527f
mov dword [rcx + 0x28], 0x9b05688c
mov dword [rcx + 0x2c], 0x1f83d9ab
mov dword [rcx + 0x30], 0x5be0cd19
mov qword [rcx + 0x34], r8
ret
mov dword [rcx + 0x14], 0x67452301
mov dword [rcx + 0x18], 0xefcdab89
mov dword [rcx + 0x1c], 0x98badcfe
mov dword [rcx + 0x20], 0x10325476
mov dword [rcx + 0x24], 0xc3d2e1f0
mov qword [rcx + 0x34], r8
ret
Function at 0x1400b9110
Capabilities:
Hash data using sha1
Hash data using sha224
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov edi, ecx
xor esi, esi
mov qword [rsp + 0x38], rsi
mov ecx, 0x110
call fcn.140247500
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400b931c
mov rcx, rax
call fcn.14005f960
nop
lea rax, vtable.s836175zz.0
mov qword [rbx], rax
call fcn.14003be30
mov byte [0x1403500a0], al
call fcn.1400b8c20
test edi, edi
jle 0x1400b9317
mov ecx, edi
sub ecx, 0xa0
je 0x1400b92f0
sub ecx, 0x40
je 0x1400b92b0
sub ecx, 0x20
je 0x1400b9270
sub ecx, 0x80
je 0x1400b9200
cmp ecx, 0x80
jne 0x1400b9317
mov rax, qword [0x140358420]
mov qword [rbx + 0x40], rax
mov rax, qword [0x140358428]
mov qword [rbx + 0x48], rax
mov rax, qword [0x140358430]
mov qword [rbx + 0x50], rax
mov rax, qword [0x140358438]
mov qword [rbx + 0x58], rax
mov rax, qword [0x140358440]
mov qword [rbx + 0x60], rax
mov rax, qword [0x140358448]
mov qword [rbx + 0x68], rax
mov rax, qword [0x140358450]
mov qword [rbx + 0x70], rax
mov rax, qword [0x140358458]
jmp 0x1400b9254
mov rax, qword [0x140358160]
mov qword [rbx + 0x40], rax
mov rax, qword [0x140358168]
mov qword [rbx + 0x48], rax
mov rax, qword [0x140358170]
mov qword [rbx + 0x50], rax
mov rax, qword [0x140358178]
mov qword [rbx + 0x58], rax
mov rax, qword [0x140358180]
mov qword [rbx + 0x60], rax
mov rax, qword [0x140358188]
mov qword [rbx + 0x68], rax
mov rax, qword [0x140358190]
mov qword [rbx + 0x70], rax
mov rax, qword [0x140358198]
mov qword [rbx + 0x78], rax
mov qword [rbx + 0x80], rsi
mov qword [rbx + 0x88], rsi
jmp 0x1400b9317
mov dword [rbx + 0x14], 0x6a09e667
mov dword [rbx + 0x18], 0xbb67ae85
mov dword [rbx + 0x1c], 0x3c6ef372
mov dword [rbx + 0x20], 0xa54ff53a
mov dword [rbx + 0x24], 0x510e527f
mov dword [rbx + 0x28], 0x9b05688c
mov dword [rbx + 0x2c], 0x1f83d9ab
mov dword [rbx + 0x30], 0x5be0cd19
jmp 0x1400b9313
mov dword [rbx + 0x14], 0xc1059ed8
mov dword [rbx + 0x18], 0x367cd507
mov dword [rbx + 0x1c], 0x3070dd17
mov dword [rbx + 0x20], 0xf70e5939
mov dword [rbx + 0x24], 0xffc00b31
mov dword [rbx + 0x28], 0x68581511
mov dword [rbx + 0x2c], 0x64f98fa7
mov dword [rbx + 0x30], 0xbefa4fa4
jmp 0x1400b9313
mov dword [rbx + 0x14], 0x67452301
mov dword [rbx + 0x18], 0xefcdab89
mov dword [rbx + 0x1c], 0x98badcfe
mov dword [rbx + 0x20], 0x10325476
mov dword [rbx + 0x24], 0xc3d2e1f0
mov qword [rbx + 0x34], rsi
mov dword [rbx + 0x10], edi
jmp 0x1400b931f
mov rbx, rsi
mov qword [rsp + 0x38], rbx
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x1400b95d0
Capabilities:
Hash data using sha1
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, 0x200
jmp fcn.1400b9110

Function at 0x1400b95e0
Capabilities:
Hash data using sha1
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, 0x100
jmp fcn.1400b9110

Function at 0x1400b95f0
Capabilities:
Hash data using sha1
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, 0x180
jmp fcn.1400b9110
Function at 0x1400c03b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x1e0
mov rax, qword [0x140353c70]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov rsi, r8
mov edi, edx
mov rbx, rcx
test r8, r8
jne 0x1400c03e8
xor al, al
jmp 0x1400c04c0
lea rcx, [rsp + 0x20]
call fcn.1400bf6f0
test edi, edi
je 0x1400c040e
test rbx, rbx
je 0x1400c040e
mov r9b, reloc.WS2_32.dll_select
lea rcx, [rsp + 0x20]
mov r8d, edi
mov rdx, rbx
call fcn.1400c0ca0
movzx eax, byte [rsp + 0x1c0]
mov byte [rsp + 0x187], 0
mov byte [rsp + rax + 0xf8], 6
movzx edx, byte [rsp + 0x1c0]
or byte [rsp + 0x187], 0x80
inc dl
cmp dl, 0x8f
jae 0x1400c045d
movzx eax, dl
lea rcx, [rsp + 0xf8]
add rcx, rax
mov eax, 0x8f
sub al, dl
xor edx, edx
movzx r8d, al
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x30]
mov edx, reloc.WS2_32.dll_select
nop word [rax + rax]
mov rcx, qword [rax + 0xc8]
xor qword [rax], rcx
lea rax, [rax + 8]
sub rdx, 1
jne 0x1400c0470
lea rcx, [rsp + 0x30]
call fcn.1400bf7f0
mov eax, dword [rsp + 0x48]
lea rcx, [rsp + 0x20]
movaps xmm0, xmmword [rsp + 0x30]
movsd xmm1, qword [rsp + 0x40]
movups xmmword [rsi], xmm0
movsd qword [rsi + 0x10], xmm1
mov dword [rsi + 0x18], eax
lea rax, vtable.s868203zz.0
mov qword [rsp + 0x20], rax
call fcn.14005fa70
mov al, 1
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1402474e0
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x1400c0530
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x1e0
mov rax, qword [0x140353c70]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov rsi, r8
mov edi, edx
mov rbx, rcx
test r8, r8
jne 0x1400c0568
xor al, al
jmp 0x1400c0637
lea rcx, [rsp + 0x20]
call fcn.1400bf6f0
test edi, edi
je 0x1400c058e
test rbx, rbx
je 0x1400c058e
mov r9b, send
lea rcx, [rsp + 0x20]
mov r8d, edi
mov rdx, rbx
call fcn.1400c0ca0
movzx eax, byte [rsp + 0x1c0]
mov byte [rsp + 0x17f], 0
mov byte [rsp + rax + 0xf8], 6
movzx edx, byte [rsp + 0x1c0]
or byte [rsp + 0x17f], 0x80
inc dl
cmp dl, 0x87
jae 0x1400c05dd
movzx eax, dl
lea rcx, [rsp + 0xf8]
add rcx, rax
mov eax, 0x87
sub al, dl
xor edx, edx
movzx r8d, al
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x30]
mov edx, send
nop word [rax + rax]
mov rcx, qword [rax + 0xc8]
xor qword [rax], rcx
lea rax, [rax + 8]
sub rdx, 1
jne 0x1400c05f0
lea rcx, [rsp + 0x30]
call fcn.1400bf7f0
movaps xmm0, xmmword [rsp + 0x30]
lea rax, vtable.s868203zz.0
movaps xmm1, xmmword [rsp + 0x40]
lea rcx, [rsp + 0x20]
movups xmmword [rsi], xmm0
mov qword [rsp + 0x20], rax
movups xmmword [rsi + 0x10], xmm1
call fcn.14005fa70
mov al, 1
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1402474e0
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400c06a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x1e0
mov rax, qword [0x140353c70]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov rsi, r8
mov edi, edx
mov rbx, rcx
test r8, r8
jne 0x1400c06d8
xor al, al
jmp 0x1400c07b0
lea rcx, [rsp + 0x20]
call fcn.1400bf6f0
test edi, edi
je 0x1400c06fe
test rbx, rbx
je 0x1400c06fe
mov r9b, ntohs
lea rcx, [rsp + 0x20]
mov r8d, edi
mov rdx, rbx
call fcn.1400c0ca0
movzx eax, byte [rsp + 0x1c0]
mov byte [rsp + 0x15f], 0
mov byte [rsp + rax + 0xf8], 6
movzx edx, byte [rsp + 0x1c0]
or byte [rsp + 0x15f], 0x80
inc dl
cmp dl, 0x67
jae 0x1400c074d
movzx eax, dl
lea rcx, [rsp + 0xf8]
add rcx, rax
mov eax, Ordinal_105
sub al, dl
xor edx, edx
movzx r8d, al
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x30]
mov edx, recv
nop word [rax + rax]
mov rcx, qword [rax + 0xc8]
xor qword [rax], rcx
lea rax, [rax + 8]
sub rdx, 1
jne 0x1400c0760
lea rcx, [rsp + 0x30]
call fcn.1400bf7f0
movaps xmm0, xmmword [rsp + 0x30]
lea rax, vtable.s868203zz.0
movaps xmm1, xmmword [rsp + 0x40]
lea rcx, [rsp + 0x20]
movups xmmword [rsi], xmm0
mov qword [rsp + 0x20], rax
movaps xmm0, xmmword [rsp + 0x50]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi + 0x20], xmm0
call fcn.14005fa70
mov al, 1
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1402474e0
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x1400c0820
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x1e0
mov rax, qword [0x140353c70]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov rsi, r8
mov edi, edx
mov rbx, rcx
test r8, r8
jne 0x1400c0858
xor al, al
jmp 0x1400c0939
lea rcx, [rsp + 0x20]
call fcn.1400bf6f0
test edi, edi
je 0x1400c087e
test rbx, rbx
je 0x1400c087e
mov r9b, 9
lea rcx, [rsp + 0x20]
mov r8d, edi
mov rdx, rbx
call fcn.1400c0ca0
movzx eax, byte [rsp + 0x1c0]
mov byte [rsp + 0x13f], 0
mov byte [rsp + rax + 0xf8], 6
movzx edx, byte [rsp + 0x1c0]
or byte [rsp + 0x13f], 0x80
inc dl
cmp dl, 0x47
jae 0x1400c08cd
movzx eax, dl
lea rcx, [rsp + 0xf8]
add rcx, rax
mov eax, 0x47
sub al, dl
xor edx, edx
movzx r8d, al
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x30]
mov edx, 9
nop word [rax + rax]
mov rcx, qword [rax + 0xc8]
xor qword [rax], rcx
lea rax, [rax + 8]
sub rdx, 1
jne 0x1400c08e0
lea rcx, [rsp + 0x30]
call fcn.1400bf7f0
movaps xmm0, xmmword [rsp + 0x30]
lea rax, vtable.s868203zz.0
movaps xmm1, xmmword [rsp + 0x40]
lea rcx, [rsp + 0x20]
movups xmmword [rsi], xmm0
mov qword [rsp + 0x20], rax
movaps xmm0, xmmword [rsp + 0x50]
movups xmmword [rsi + 0x10], xmm1
movaps xmm1, xmmword [rsp + 0x60]
movups xmmword [rsi + 0x20], xmm0
movups xmmword [rsi + 0x30], xmm1
call fcn.14005fa70
mov al, 1
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1402474e0
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret