joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b9e90
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rsi
push rdi
push r12
push r14
push r15
mov eax, 0xd0
call fcn.1400c8a20
sub rsp, rax
mov rax, qword [0x1401a1e90]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov r15, qword [rsp + 0x120]
xor eax, eax
mov r12, r9
movsxd rdi, r8d
mov r14, rdx
mov rsi, rcx
test r9, r9
je 0x1400b9edd
mov eax, 1
mov qword [rcx], r9
jmp 0x1400b9ee0
mov r12, qword [rcx]
mov qword [rsp + 0xc8], rbx
mov qword [rsp + 0xc0], rbp
mov qword [rsp + 0xb8], r13
test rdx, rdx
je 0x1400b9fd9
mov rcx, r12
call fcn.140086470
mov ebx, 0x80
cmp eax, ebx
mov ebp, eax
jle 0x1400b9f2a
lea r8, str.j____int_sizeof_ctx__key_
lea edx, [rbx - 0x18]
lea rcx, [0x14019e9f8]
call fcn.14006c040
cmp ebp, edi
jge 0x1400b9f80
lea rcx, [rsi + 8]
mov r8, r15
mov rdx, r12
call fcn.14008f950
test eax, eax
je 0x1400ba0c1
lea rcx, [rsi + 8]
mov r8, rdi
mov rdx, r14
call fcn.14008fba0
test eax, eax
je 0x1400ba0c1
lea rbp, [rsi + 0x98]
lea rdx, [rsi + 0x9c]
lea rcx, [rsi + 8]
mov r8, rbp
call fcn.14008fbc0
test eax, eax
je 0x1400ba0c1
jmp 0x1400b9fbc
test edi, edi
js 0x1400b9f88
cmp edi, ebx
jle 0x1400b9fa0
lea r8, str.len_0__len__int_sizeof_ctx__key_
lea rcx, str..cryptohmachmac.c
mov edx, 0x75
call fcn.14006c040
lea rcx, [rsi + 0x9c]
mov r8, rdi
mov rdx, r14
call fcn.1400c39a0
lea rbp, [rsi + 0x98]
mov dword [rbp], edi
mov eax, dword [rbp]
cmp eax, ebx
je 0x1400b9fe1
sub ebx, eax
lea rcx, [rax + rsi + 0x9c]
xor edx, edx
mov r8d, ebx
call fcn.1400c8db0
jmp 0x1400b9fe1
test eax, eax
je 0x1400ba0b0
lea rbx, [rsi + 0x9d]
mov edi, 0x40
lea rcx, [rsp + 0x21]
mov rdx, rbx
mov r8, rdi
nop dword [rax + rax]
movzx eax, byte [rdx - 1]
add rcx, 2
add rdx, 2
xor al, 0x36
mov byte [rcx - 3], al
movzx eax, byte [rdx - 2]
xor al, 0x36
sub r8, 1
mov byte [rcx - 2], al
jne 0x1400ba000
lea rcx, [rsi + 0x38]
mov r8, r15
mov rdx, r12
call fcn.14008f950
test eax, eax
je 0x1400ba0c1
mov rcx, r12
call fcn.140086470
lea rdx, [rsp + 0x20]
lea rcx, [rsi + 0x38]
movsxd r8, eax
call fcn.14008fba0
test eax, eax
je 0x1400ba0c1
lea rdx, [rsp + 0x21]
nop dword [rax]
movzx eax, byte [rbx - 1]
add rdx, 2
add rbx, 2
xor al, 0x5c
mov byte [rdx - 3], al
movzx eax, byte [rbx - 2]
xor al, 0x5c
sub rdi, 1
mov byte [rdx - 2], al
jne 0x1400ba060
lea rcx, [rsi + 0x68]
mov r8, r15
mov rdx, r12
call fcn.14008f950
test eax, eax
je 0x1400ba0c1
mov rcx, r12
call fcn.140086470
lea rdx, [rsp + 0x20]
lea rcx, [rsi + 0x68]
movsxd r8, eax
call fcn.14008fba0
test eax, eax
je 0x1400ba0c1
lea rdx, [rsi + 0x38]
lea rcx, [rsi + 8]
call fcn.14008fd20
test eax, eax
jne 0x1400ba0c5
xor eax, eax
jmp 0x1400ba0ca
mov eax, 1
mov r13, qword [rsp + 0xb8]
mov rbp, qword [rsp + 0xc0]
mov rbx, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400c3970
add rsp, 0xd0
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1400bbe10
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x40
call fcn.1400c8a20
sub rsp, rax
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
test r8, r8
jne 0x1400bbe48
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
test rcx, rcx
je 0x1400bbedf
test rdx, rdx
je 0x1400bbea3
mov rcx, qword [rcx + 0x10]
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x28], r8
call fcn.14006d180
test rax, rax
jne 0x1400bbecb
lea rdx, [0x14019fb18]
sub rdx, rbx
nop dword [rax]
movzx ecx, byte [rbx]
movzx eax, byte [rbx + rdx]
sub ecx, eax
jne 0x1400bbe92
inc rbx
test eax, eax
jne 0x1400bbe80
test ecx, ecx
jne 0x1400bbea3
mov rcx, rdi
call fcn.1400c911c
test rax, rax
jne 0x1400bbee7
mov rcx, qword [rsi + 0x10]
lea rax, str.default
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rdi
call fcn.14006d180
test rax, rax
je 0x1400bbe36
mov rax, qword [rax + 0x10]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov rcx, r8
call fcn.1400c911c
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x1400c9aa8
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.1400c9910
Function at 0x1400ebd00
Capabilities:
Encode data using xor

Disassembly:
xor eax, dword [r15]
xor ebx, dword [r15 + 4]
xor ecx, dword [r15 + 8]
xor edx, dword [r15 + 0xc]
mov r13d, dword [r15 + 0xf0]
sub r13d, 1
jmp 0x1400ebd20
movzx esi, al
movzx edi, bl
movzx ebp, cl
mov r10d, dword [r14 + rsi*8]
mov r11d, dword [r14 + rdi*8]
mov r12d, dword [r14 + rbp*8]
movzx esi, bh
movzx edi, ch
movzx ebp, dl
xor r10d, dword [r14 + rsi*8 + 3]
xor r11d, dword [r14 + rdi*8 + 3]
mov r8d, dword [r14 + rbp*8]
movzx esi, dh
shr ecx, 0x10
movzx ebp, ah
xor r12d, dword [r14 + rsi*8 + 3]
shr edx, 0x10
xor r8d, dword [r14 + rbp*8 + 3]
shr ebx, 0x10
lea r15, [r15 + 0x10]
shr eax, 0x10
movzx esi, cl
movzx edi, dl
movzx ebp, al
xor r10d, dword [r14 + rsi*8 + 2]
xor r11d, dword [r14 + rdi*8 + 2]
xor r12d, dword [r14 + rbp*8 + 2]
movzx esi, dh
movzx edi, ah
movzx ebp, bl
xor r10d, dword [r14 + rsi*8 + 1]
xor r11d, dword [r14 + rdi*8 + 1]
xor r8d, dword [r14 + rbp*8 + 2]
mov edx, dword [r15 + 0xc]
movzx edi, bh
movzx ebp, ch
mov eax, dword [r15]
xor r12d, dword [r14 + rdi*8 + 1]
xor r8d, dword [r14 + rbp*8 + 1]
mov ebx, dword [r15 + 4]
mov ecx, dword [r15 + 8]
xor eax, r10d
xor ebx, r11d
xor ecx, r12d
xor edx, r8d
sub r13d, 1
jne 0x1400ebd20
movzx esi, al
movzx edi, bl
movzx ebp, cl
movzx r10d, byte [r14 + rsi*8 + 2]
movzx r11d, byte [r14 + rdi*8 + 2]
movzx r12d, byte [r14 + rbp*8 + 2]
movzx esi, dl
movzx edi, bh
movzx ebp, ch
movzx r8d, byte [r14 + rsi*8 + 2]
mov edi, dword [r14 + rdi*8]
mov ebp, dword [r14 + rbp*8]
and edi, 0xff00
and ebp, 0xff00
xor r10d, edi
xor r11d, ebp
shr ecx, 0x10
movzx esi, dh
movzx edi, ah
shr edx, 0x10
mov esi, dword [r14 + rsi*8]
mov edi, dword [r14 + rdi*8]
and esi, 0xff00
and edi, 0xff00
shr ebx, 0x10
xor r12d, esi
xor r8d, edi
shr eax, 0x10
movzx esi, cl
movzx edi, dl
movzx ebp, al
mov esi, dword [r14 + rsi*8]
mov edi, dword [r14 + rdi*8]
mov ebp, dword [r14 + rbp*8]
and esi, 0xff0000
and edi, 0xff0000
and ebp, 0xff0000
xor r10d, esi
xor r11d, edi
xor r12d, ebp
movzx esi, bl
movzx edi, dh
movzx ebp, ah
mov esi, dword [r14 + rsi*8]
mov edi, dword [r14 + rdi*8 + 2]
mov ebp, dword [r14 + rbp*8 + 2]
and esi, 0xff0000
and edi, 0xff000000
and ebp, 0xff000000
xor r8d, esi
xor r10d, edi
xor r11d, ebp
movzx esi, bh
movzx edi, ch
mov edx, dword [r15 + 0x1c]
mov esi, dword [r14 + rsi*8 + 2]
mov edi, dword [r14 + rdi*8 + 2]
mov eax, dword [r15 + 0x10]
and esi, 0xff000000
and edi, 0xff000000
xor r12d, esi
xor r8d, edi
mov ebx, dword [r15 + 0x14]
mov ecx, dword [r15 + 0x18]
xor eax, r10d
xor ebx, r11d
xor ecx, r12d
xor edx, r8d
repz ret
Function at 0x1400ec160
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
push rbx
push rbp
push r12
push r13
push r14
push r15
mov r10, rsp
lea rcx, [rdx - 0x3f]
and rsp, 0xffffffffffffffc0
sub rcx, rsp
neg rcx
and rcx, 0x3c0
sub rsp, rcx
sub rsp, 0x20
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], r10
mov r15, rdx
mov r13d, dword [r15 + 0xf0]
mov eax, dword [rdi]
mov ebx, dword [rdi + 4]
mov ecx, dword [rdi + 8]
mov edx, dword [rdi + 0xc]
shl r13d, 4
lea rbp, [r15 + r13]
mov qword [rsp], r15
mov qword [rsp + 8], rbp
lea r14, [0x1400edb00]
lea rbp, [rsp + 0x300]
sub rbp, r14
and rbp, 0x300
lea r14, [r14 + rbp]
call fcn.1400ebef0
mov r9, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov dword [r9], eax
mov dword [r9 + 4], ebx
mov dword [r9 + 8], ecx
mov dword [r9 + 0xc], edx
mov r15, qword [rsi]
mov r14, qword [rsi + 8]
mov r13, qword [rsi + 0x10]
mov r12, qword [rsi + 0x18]
mov rbp, qword [rsi + 0x20]
mov rbx, qword [rsi + 0x28]
lea rsp, [rsi + 0x30]
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
repz ret

Function at 0x1400ec16d
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
push rbx
push rbp
push r12
push r13
push r14
push r15
mov r10, rsp
lea rcx, [rdx - 0x3f]
and rsp, 0xffffffffffffffc0
sub rcx, rsp
neg rcx
and rcx, 0x3c0
sub rsp, rcx
sub rsp, 0x20
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], r10
mov r15, rdx
mov r13d, dword [r15 + 0xf0]
mov eax, dword [rdi]
mov ebx, dword [rdi + 4]
mov ecx, dword [rdi + 8]
mov edx, dword [rdi + 0xc]
shl r13d, 4
lea rbp, [r15 + r13]
mov qword [rsp], r15
mov qword [rsp + 8], rbp
lea r14, [0x1400edb00]
lea rbp, [rsp + 0x300]
sub rbp, r14
and rbp, 0x300
lea r14, [r14 + rbp]
call fcn.1400ebef0
mov r9, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov dword [r9], eax
mov dword [r9 + 4], ebx
mov dword [r9 + 8], ecx
mov dword [r9 + 0xc], edx
mov r15, qword [rsi]
mov r14, qword [rsi + 8]
mov r13, qword [rsi + 0x10]
mov r12, qword [rsi + 0x18]
mov rbp, qword [rsi + 0x20]
mov rbx, qword [rsi + 0x28]
lea rsp, [rsi + 0x30]
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
repz ret
Function at 0x1400ec240
Capabilities:
Encode data using xor

Disassembly:
xor eax, dword [r15]
xor ebx, dword [r15 + 4]
xor ecx, dword [r15 + 8]
xor edx, dword [r15 + 0xc]
mov r13d, dword [r15 + 0xf0]
sub r13d, 1
jmp 0x1400ec260
movzx esi, al
movzx edi, bl
movzx ebp, cl
mov r10d, dword [r14 + rsi*8]
mov r11d, dword [r14 + rdi*8]
mov r12d, dword [r14 + rbp*8]
movzx esi, dh
movzx edi, ah
movzx ebp, dl
xor r10d, dword [r14 + rsi*8 + 3]
xor r11d, dword [r14 + rdi*8 + 3]
mov r8d, dword [r14 + rbp*8]
movzx esi, bh
shr eax, 0x10
movzx ebp, ch
xor r12d, dword [r14 + rsi*8 + 3]
shr edx, 0x10
xor r8d, dword [r14 + rbp*8 + 3]
shr ebx, 0x10
lea r15, [r15 + 0x10]
shr ecx, 0x10
movzx esi, cl
movzx edi, dl
movzx ebp, al
xor r10d, dword [r14 + rsi*8 + 2]
xor r11d, dword [r14 + rdi*8 + 2]
xor r12d, dword [r14 + rbp*8 + 2]
movzx esi, bh
movzx edi, ch
movzx ebp, bl
xor r10d, dword [r14 + rsi*8 + 1]
xor r11d, dword [r14 + rdi*8 + 1]
xor r8d, dword [r14 + rbp*8 + 2]
movzx esi, dh
mov edx, dword [r15 + 0xc]
movzx ebp, ah
xor r12d, dword [r14 + rsi*8 + 1]
mov eax, dword [r15]
xor r8d, dword [r14 + rbp*8 + 1]
xor eax, r10d
mov ebx, dword [r15 + 4]
mov ecx, dword [r15 + 8]
xor ecx, r12d
xor ebx, r11d
xor edx, r8d
sub r13d, 1
jne 0x1400ec260
lea r14, [r14 + 0x800]
movzx esi, al
movzx edi, bl
movzx ebp, cl
movzx r10d, byte [r14 + rsi]
movzx r11d, byte [r14 + rdi]
movzx r12d, byte [r14 + rbp]
movzx esi, dl
movzx edi, dh
movzx ebp, ah
movzx r8d, byte [r14 + rsi]
movzx edi, byte [r14 + rdi]
movzx ebp, byte [r14 + rbp]
shl edi, 8
shl ebp, 8
xor r10d, edi
xor r11d, ebp
shr edx, 0x10
movzx esi, bh
movzx edi, ch
shr eax, 0x10
movzx esi, byte [r14 + rsi]
movzx edi, byte [r14 + rdi]
shl esi, 8
shl edi, 8
shr ebx, 0x10
xor r12d, esi
xor r8d, edi
shr ecx, 0x10
movzx esi, cl
movzx edi, dl
movzx ebp, al
movzx esi, byte [r14 + rsi]
movzx edi, byte [r14 + rdi]
movzx ebp, byte [r14 + rbp]
shl esi, 0x10
shl edi, 0x10
shl ebp, 0x10
xor r10d, esi
xor r11d, edi
xor r12d, ebp
movzx esi, bl
movzx edi, bh
movzx ebp, ch
movzx esi, byte [r14 + rsi]
movzx edi, byte [r14 + rdi]
movzx ebp, byte [r14 + rbp]
shl esi, 0x10
shl edi, 0x18
shl ebp, 0x18
xor r8d, esi
xor r10d, edi
xor r11d, ebp
movzx esi, dh
movzx edi, ah
mov edx, dword [r15 + 0x1c]
movzx esi, byte [r14 + rsi]
movzx edi, byte [r14 + rdi]
mov eax, dword [r15 + 0x10]
shl esi, 0x18
shl edi, 0x18
xor r12d, esi
xor r8d, edi
mov ebx, dword [r15 + 0x14]
mov ecx, dword [r15 + 0x18]
lea r14, [r14 - 0x800]
xor eax, r10d
xor ebx, r11d
xor ecx, r12d
xor edx, r8d
repz ret
Function at 0x14007a680
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rax, qword [0x140128dc0]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dil, 1
cmp qword [rcx + 0x68], 0
je 0x14007a72a
mov rsi, rcx
cmp byte [rcx + 0x71], 0
je 0x14007a72a
mov rax, qword [rsi]
mov rcx, rsi
mov edx, 0xffffffff
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x14007a728
mov rcx, qword [rsi + 0x68]
lea r9, [rsp + 0x50]
lea rdx, [rsi + 0x74]
mov rax, qword [rcx]
lea r8, [rsp + 0x28]
mov qword [rsp + 0x20], r8
lea rdi, [rsp + 0x30]
mov r8, rdi
call qword [rax + 0x40]
cmp eax, 3
je 0x14007a741
cmp eax, 1
je 0x14007a6f7
test eax, eax
jne 0x14007a728
mov byte [rsi + 0x71], 0
mov rbx, qword [rsp + 0x28]
sub rbx, rdi
je 0x14007a71e
mov r9, qword [rsi + 0x80]
mov edx, 1
mov rcx, rdi
mov r8, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x14007a728
cmp byte [rsi + 0x71], 0
sete dil
jmp 0x14007a72a
xor edi, edi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400b7810
mov eax, edi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
mov byte [rsi + 0x71], 0
mov dil, 1
jmp 0x14007a72a
Function at 0x1400a2920
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0xa], al
je 0x1400a2943
lea edx, [rax - 0x4a]
xor byte [rax + rcx], dl
inc rax
cmp rax, 9
jb 0x1400a2930
mov byte [rcx + 0xa], 0
lea r8, [rcx + 9]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.1400a27f0
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x1400a2960
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 6], al
je 0x1400a2983
lea edx, [rax - 0x4a]
xor byte [rax + rcx], dl
inc rax
cmp rax, 5
jb 0x1400a2970
mov byte [rcx + 6], 0
lea r8, [rcx + 5]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.1400a27f0
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x1400a29a0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x1400a29d4
mov eax, esi
lea ecx, [rax - 0x4a]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x1400a29c0
mov byte [r8 + 7], sil
add r8, 6
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.1400a27f0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x1400a29f9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14007ca30
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400a2a73
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a2a6e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400a2a6e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b7584
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400a2a80
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x1400a2ab4
mov eax, esi
lea ecx, [rax - 0x4a]
xor byte [r8 + rax], cl
inc rax
cmp rax, 8
jb 0x1400a2aa0
mov byte [r8 + 9], sil
add r8, 8
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.1400a27f0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x1400a2ad9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14007ca30
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400a2b53
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a2b4e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400a2b4e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b7584
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400a2b60
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x1400a2b94
mov eax, esi
lea ecx, [rax - 0x4a]
xor byte [r8 + rax], cl
inc rax
cmp rax, 9
jb 0x1400a2b80
mov byte [r8 + 0xa], sil
add r8, 9
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.1400a27f0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x1400a2bb9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14007ca30
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400a2c33
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a2c2e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400a2c2e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b7584
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400a3160
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0x31], sil
je 0x1400a3194
mov eax, esi
lea ecx, [rax - 0x4a]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0x30
jb 0x1400a3180
mov byte [r8 + 0x31], sil
add r8, 0x30
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.1400a27f0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x1400a31b9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14007ca30
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400a3233
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a322e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400a322e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b7584
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400a3240
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 8], 0
je 0x1400a3263
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x4a]
xor byte [rax + rcx], dl
inc rax
cmp rax, 7
jb 0x1400a3250
mov byte [rcx + 8], 0
mov rax, rcx
ret

Function at 0x1400a3270
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 8], al
je 0x1400a3293
lea edx, [rax - 0x4a]
xor byte [rax + rcx], dl
inc rax
cmp rax, 7
jb 0x1400a3280
mov byte [rcx + 8], 0
lea r8, [rcx + 7]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.1400a27f0
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x1400a3f60
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x1400a3f83
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x4a]
xor byte [rax + rcx], dl
inc rax
cmp rax, 4
jb 0x1400a3f70
mov byte [rcx + 5], 0
ret
Function at 0x1400a4250
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r10, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x28], rcx
xor ebx, ebx
cmp byte [r8 + 0xb], bl
je 0x1400a4284
mov ecx, ebx
lea eax, [rcx - 0x4a]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x1400a4270
mov byte [r8 + 0xb], bl
add r8, 0xa
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x50]
call fcn.1400a27f0
nop
cmp byte [rdi + 0xb], 0
je 0x1400a42b4
lea eax, [rbx - 0x4a]
xor byte [rbx + rdi], al
inc rbx
cmp rbx, 0xa
jb 0x1400a42a1
mov byte [rdi + 0xb], 0
lea r8, [rdi + 0xa]
lea r9, [rsp + 0x20]
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.1400a27f0
nop
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
movzx edx, byte [rsp + 0x20]
mov rcx, rsi
call fcn.14007c630
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400a4324
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a431e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400a431e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b7584
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x1400a4364
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a435f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400a435f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b7584
mov rax, rsi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400a4370
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x1400a43a4
mov eax, esi
lea ecx, [rax - 0x4a]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0xb
jb 0x1400a4390
mov byte [r8 + 0xc], sil
add r8, 0xb
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.1400a27f0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x1400a43c9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14007ca30
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400a4443
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a443e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400a443e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b7584
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret