joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140130160
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rsi
push rdi
push r13
sub rsp, 0x28
mov rdi, rdx
movsxd rsi, r8d
lea r13, [0x140000000]
mov rbx, rcx
lea eax, [rsi*4]
movsxd r10, eax
movzx r11d, byte [r10 + r13 + 0x31abd8]
movsx rax, byte [r11 + rcx + 0x92ff]
movzx edx, byte [rax + r13 + 0x31ade9]
movsx rax, byte [r11 + rcx + 0x92f8]
movzx ecx, byte [rax + r13 + 0x31ade9]
mov eax, 2
cmp dl, cl
cmovge edx, ecx
mov rcx, rdi
movsx edx, dl
test edx, edx
cmovs edx, eax
movsxd rax, r9d
movsx r8d, byte [rax + r13 + 0x31ade9]
call fcn.14011c3f0
mov rdx, rdi
mov rcx, rbx
call fcn.14011c2b0
mov eax, dword [rbx + 0x6430]
bt eax, esi
jae 0x14013032a
cmp dword [rbx + 0x3138], 3
mov rcx, rsi
jne 0x140130307
mov qword [rsp + 0x50], rbp
lea rbp, [0x14031b067]
mov qword [rsp + 0x58], r12
lea r12, [rdi + 0x44]
mov qword [rsp + 0x60], r14
lea r14, [r13 + 0x31abd8]
lea r14, [r14 + rsi*4]
mov qword [rsp + 0x20], r15
add rsi, 0xa7
mov r15d, 3
shl rsi, 7
add rsi, rbx
nop
movzx eax, byte [r14]
movzx r10d, byte [rbp]
lea r8, [rax + rbx]
movzx eax, byte [rax + rbx + 0x9320]
movzx ecx, word [r13 + r10*2 + 0x31b338]
neg al
sbb rdx, rdx
xor eax, eax
and edx, 2
add rcx, r12
cmp byte [r8 + 0x9327], al
setne al
add rdx, rcx
add rdx, rax
cmp byte [r8 + 0x9328], 0
movzx eax, byte [rdx]
je 0x1401302ba
movzx ecx, byte [r13 + rax*2 + 0x2fee31]
mov r9, rdi
mov byte [rdx], cl
xor rax, 1
mov r8d, r10d
movzx ecx, word [r13 + rax*2 + 0x2fef70]
add dword [rdi + 0x40], ecx
mov rcx, rsi
mov edx, dword [rbx + 0x5fe4]
call qword [rbx + 0xc0a8]
jmp 0x1401302d1
movzx ecx, byte [r13 + rax*2 + 0x2fee30]
mov byte [rdx], cl
movzx ecx, word [r13 + rax*2 + 0x2fef70]
add dword [rdi + 0x40], ecx
add rsi, 0x200
add r14, 0x10
inc rbp
sub r15, 1
jne 0x140130240
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x60]
mov r12, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
add rsp, 0x28
pop r13
pop rdi
pop rsi
pop rbx
ret
mov edx, dword [rbx + 0x5fe4]
add rcx, 0xa7
shl rcx, 7
mov r9, rdi
add rcx, rbx
mov r8d, 5
call qword [rbx + 0xc0a8]
add rsp, 0x28
pop r13
pop rdi
pop rsi
pop rbx
ret
Function at 0x14013b420
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
push r15
xor esi, esi
lea r11, [0x140457100]
mov ebx, esi
lea r10, [0x140458000]
mov edi, esi
lea r14, [0x140000000]
mov ebp, 0x100
lea r15, [0x140458780]
nop
mov r9d, esi
mov eax, esi
movzx edx, r9b
cmp ebx, 1
jle 0x14013b4a1
lea r8d, [rbx - 1]
nop dword [rax]
nop word [rax + rax]
movzx ecx, dl
movzx edx, byte [r14 + rcx*2 + 0x2fee31]
xor rcx, 1
movzx ecx, word [r14 + rcx*2 + 0x2fef70]
add eax, ecx
sub r8, 1
jne 0x14013b480
lea rcx, [rdi - 1]
cmp rcx, 0xc
ja 0x14013b4c2
movzx ecx, dl
movzx edx, byte [r14 + rcx*2 + 0x2fee30]
movzx ecx, word [r14 + rcx*2 + 0x2fef70]
add eax, ecx
add ax, bp
mov byte [r10], dl
mov word [r11], ax
inc r9d
add r11, 2
inc r10
cmp r9d, 0x80
jl 0x14013b463
inc ebx
inc rdi
cmp r10, r15
jl 0x14013b460
lea rbx, [0x1403d06d0]
lea rdi, [0x1403d0750]
nop dword [rax + rax]
movzx r11d, sil
lea rdi, [rdi + 2]
inc esi
lea rbx, [rbx + 1]
movzx r10d, byte [r14 + r11*2 + 0x2fee31]
xor r11, 1
movzx r8d, byte [r14 + r10*2 + 0x2fee31]
xor r10, 1
movzx ecx, byte [r14 + r8*2 + 0x2fee31]
xor r8, 1
movzx eax, byte [r14 + rcx*2 + 0x2fee31]
xor rcx, 1
movzx r9d, byte [r14 + rax*2 + 0x2fee31]
xor rax, 1
mov byte [rbx - 1], r9b
movzx edx, word [r14 + rax*2 + 0x2fef70]
add dx, word [r14 + rcx*2 + 0x2fef70]
add dx, word [r14 + r8*2 + 0x2fef70]
add dx, word [r14 + r10*2 + 0x2fef70]
add dx, word [r14 + r11*2 + 0x2fef70]
add dx, bp
mov word [rdi - 2], dx
cmp esi, 0x80
jl 0x14013b500
mov rbx, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
pop r15
pop r14
ret
Function at 0x140143640
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
movsxd rax, dword [rdx + 0x68]
mov rsi, rdx
mov rbx, qword [rcx + 0x9d00]
mov rdi, rcx
imul r9, rax, 0xc8
mov rax, qword [rbx + 0x138]
cmp dword [r9 + rax + 8], 0
movzx ebp, byte [r9 + rax]
je 0x140143843
mov eax, dword [rbx + 0x1d0]
test eax, eax
jns 0x140143741
mov r9, qword [rbx + 0x128]
lea rcx, [rsp + 0x40]
mov edx, 1
inc eax
mov r8d, edx
mov dword [rbx + 0x1d0], eax
call fcn.14027efc0
test rax, rax
je 0x140143726
movsxd rcx, dword [rbx + 0x1d0]
mov edx, 2
movsxd r8, dword [rbx + 0x1d4]
mov r9, qword [rbx + 0x128]
mov rcx, qword [rbx + rcx*8 + 0x1c0]
call fcn.14027efc0
mov ecx, dword [rbx + 0x1d4]
cmp rax, rcx
jne 0x140143726
movzx ecx, byte [rsp + 0x40]
cmp cl, bpl
je 0x140143741
mov eax, dword [rbx + 0x1d0]
cmp eax, 1
jne 0x140143692
movzx eax, bpl
lea r8, str.MB_tree_frametype__d_doesnt_match_actual_frametype__d._n
movzx r9d, cl
xor edx, edx
mov rcx, rdi
mov dword [rsp + 0x20], eax
call fcn.14010dde0
mov eax, 0xffffffff
jmp 0x14014384a
lea r8, str.Incomplete_MB_tree_stats_file._n
xor edx, edx
mov rcx, rdi
call fcn.14010dde0
mov eax, 0xffffffff
jmp 0x14014384a
cmp dword [rbx + 0x1d8], 0
je 0x140143753
mov rcx, qword [rbx + 0x1e0]
jmp 0x14014375a
mov rcx, qword [rsi + 0x3090]
movsxd rdx, dword [rbx + 0x1d0]
mov r8d, dword [rbx + 0x1d4]
mov rdx, qword [rbx + rdx*8 + 0x1c0]
call qword [rdi + 0xbd20]
cmp dword [rbx + 0x1d8], 0
je 0x140143791
mov r8, qword [rsi + 0x3090]
mov rdx, rbx
mov rcx, rdi
call fcn.140140680
cmp dword [rdi + 0x5188], 0
je 0x14014383b
xor r8d, r8d
cmp dword [rdi + 0x5f88], r8d
jle 0x14014383b
movss xmm2, dword [0x14031b5e4]
lea r11, [0x1402fc020]
movss xmm3, dword [0x14031b5f0]
xor r10d, r10d
xor r9d, r9d
nop dword [rax + rax]
mov rax, qword [rsi + 0x3090]
movaps xmm0, xmm3
movss xmm1, dword [rax + r9]
mulss xmm1, xmm2
subss xmm0, xmm1
cvttss2si ecx, xmm0
test ecx, ecx
jns 0x1401437f4
xor edx, edx
jmp 0x14014381b
cmp ecx, 0x3ff
jle 0x140143803
mov edx, 0xffff
jmp 0x14014381b
mov eax, ecx
sar ecx, 6
and eax, 0x3f
movzx edx, byte [rax + r11]
add edx, 0x100
shl edx, cl
sar edx, 8
mov rax, qword [rsi + 0x30b8]
inc r8d
add r9, 4
mov word [r10 + rax], dx
add r10, 2
cmp r8d, dword [rdi + 0x5f88]
jl 0x1401437d0
dec dword [rbx + 0x1d0]
jmp 0x140143848
call fcn.140142e70
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x140148680
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x440
mov rdi, rdx
mov r8d, 0x104
lea rdx, [rsp + 0x230]
mov ebx, 0xffffffff
call fcn.140148730
mov rsi, rax
test rax, rax
je 0x14014870c
mov r8d, 0x104
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.140148730
mov rdi, rax
test rax, rax
je 0x1401486f7
mov rcx, rax
call fcn.1402824ac
mov rdx, rdi
mov rcx, rsi
call fcn.1402824b4
mov ebx, eax
lea rax, [rsp + 0x20]
cmp rdi, rax
je 0x1401486f7
mov rcx, rdi
call fcn.140273908
lea rax, [rsp + 0x230]
cmp rsi, rax
je 0x14014870c
mov rcx, rsi
call fcn.140273908
lea r11, [rsp + 0x440]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x140151e10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb0
movsxd rax, dword [rcx + 0x5fe4]
mov r8, rcx
shl rax, 5
mov rdi, rdx
lea rdx, [0x140000000]
xor r12d, r12d
mov r13, r9
mov esi, 0xffffffff
mov ebp, r12d
movzx ecx, word [rax + rdx + 0x2ff136]
movzx r15d, word [rax + rdx + 0x2ff176]
movzx eax, word [0x1402ff1b6]
mov dword [rsp + 0x108], ecx
mov rcx, r9
mov dword [rsp + 0xf0], eax
call qword [r8 + 0xbed8]
cdqe
lea r14, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov ebx, r12d
sub r14, 2
movzx eax, word [r13 + rbx*2]
lea rcx, [0x140000000]
movzx edx, byte [rbx + rcx + 0x2fc018]
add edx, dword [rsp + 0x108]
test ax, ax
je 0x140151ee6
add r14, 2
mov r8d, 1
mov rcx, rdi
inc esi
mov word [r14], ax
call fcn.140001060
cmp rbx, qword [rsp + 0x20]
je 0x140151fb8
lea rax, [0x140000000]
movzx edx, byte [rbx + rax + 0x2fc018]
add edx, r15d
xor r8d, r8d
mov rcx, rdi
call fcn.140001060
inc ebp
inc rbx
cmp rbx, 7
jne 0x140151e90
inc esi
movsxd rax, ebp
movsxd rdx, esi
movzx ecx, word [r13 + rax*2]
lea r13, [0x140000000]
mov word [rsp + rdx*2 + 0x30], cx
mov ebx, dword [rsp + 0xf0]
movsxd r15, esi
movsx r14d, word [rsp + r15*2 + 0x30]
mov rcx, rdi
mov eax, r14d
sar r14d, 0x1f
cdq
mov ebp, eax
xor ebp, edx
sub ebp, edx
movzx edx, byte [r12 + r13 + 0x31e698]
add edx, ebx
cmp ebp, 1
jle 0x140151ffc
mov r8d, 1
call fcn.140001060
movzx esi, byte [r12 + r13 + 0x31e6a8]
add esi, ebx
mov ebx, reloc.WS2_32.dll_ntohs
cmp ebp, ebx
cmovl ebx, ebp
sub ebx, 2
test ebx, ebx
jle 0x140151f96
nop dword [rax]
nop word [rax + rax]
mov r8d, 1
mov edx, esi
mov rcx, rdi
call fcn.140001060
dec ebx
test ebx, ebx
jg 0x140151f80
mov rcx, rdi
cmp ebp, 0xf
jge 0x140151fe1
xor r8d, r8d
mov edx, esi
call fcn.140001060
mov ebx, dword [rsp + 0xf0]
lea rax, [0x14031e6b8]
jmp 0x14015200b
movsxd rax, ebp
lea r13, [0x140000000]
mov r8d, 1
mov rcx, rdi
movzx edx, byte [rax + r13 + 0x2fc018]
add edx, r15d
call fcn.140001060
jmp 0x140151f16
lea r8d, [rbp - 0xf]
xor edx, edx
call fcn.1400e43a0
mov ebx, dword [rsp + 0xf0]
lea rax, [0x14031e6b8]
jmp 0x14015200b
xor r8d, r8d
call fcn.140001060
lea rax, [0x14031e6b0]
movzx r12d, byte [r12 + rax]
mov edx, r14d
mov rcx, rdi
call fcn.1400010e0
sub r15, 1
jns 0x140151f20
mov rbx, qword [rsp + 0xf8]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140164260
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
push r15
mov r13d, dword [reloc.WS2_32.dll_accept]
lea r15, [rdx + rdx]
xor ebp, ebp
lea r12, [r9 + r9]
mov rbx, r8
mov rsi, rcx
xorps xmm4, xmm4
xorps xmm3, xmm3
lea r14d, [rbp + 0x10]
nop dword [rax]
xor r9d, r9d
cmp r13d, 2
jl 0x140164316
mov rax, rsi
lea edx, [r9 + 2]
sub rax, rbx
lea r9d, [rdx + 0xe]
lea rcx, [rbx + 8]
nop dword [rax + rax]
movq xmm0, qword [rax + rcx - 8]
movq xmm1, qword [rcx - 8]
lea rcx, [rcx + 0x10]
pmovzxwd xmm2, xmm0
pmovzxwd xmm0, xmm1
psubd xmm2, xmm0
movq xmm0, qword [rax + rcx - 0x10]
pabsd xmm1, xmm2
paddd xmm1, xmm4
movdqa xmm4, xmm1
movq xmm1, qword [rcx - 0x10]
pmovzxwd xmm2, xmm0
pmovzxwd xmm0, xmm1
psubd xmm2, xmm0
pabsd xmm1, xmm2
paddd xmm1, xmm3
movdqa xmm3, xmm1
sub rdx, 1
jne 0x1401642c0
xor r10d, r10d
xor r11d, r11d
cmp r9, 0x10
jae 0x1401643b5
mov eax, reloc.WS2_32.dll_recv
sub rax, r9
cmp rax, 2
jl 0x140164394
lea rcx, [r9 + 1]
mov r8d, reloc.WLDAP32.dll_Ordinal_14
sub r8, r9
lea rcx, [rbx + rcx*2]
mov rdi, rsi
shr r8, 1
sub rdi, rbx
inc r8
lea r9, [r9 + r8*2]
nop word [rax + rax]
movzx eax, word [rcx - 2]
movzx edx, word [rdi + rcx - 2]
lea rcx, [rcx + 4]
sub edx, eax
mov eax, edx
cdq
xor eax, edx
sub eax, edx
movzx edx, word [rcx + rdi - 4]
add r10d, eax
movzx eax, word [rcx - 4]
sub edx, eax
mov eax, edx
cdq
xor eax, edx
sub eax, edx
add r11d, eax
sub r8, 1
jne 0x140164360
cmp r9, 0x10
jge 0x1401643af
movzx eax, word [rbx + r9*2]
movzx ecx, word [rsi + r9*2]
sub ecx, eax
mov eax, ecx
cdq
xor eax, edx
sub eax, edx
add ebp, eax
lea eax, [r11 + r10]
add ebp, eax
add rsi, r15
add rbx, r12
sub r14, 1
jne 0x1401642a0
mov rbx, qword [rsp + 0x28]
paddd xmm3, xmm4
mov rsi, qword [rsp + 0x38]
movdqa xmm0, xmm3
mov rdi, qword [rsp + 0x40]
psrldq xmm0, 8
paddd xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
paddd xmm3, xmm0
movd eax, xmm3
add eax, ebp
mov rbp, qword [rsp + 0x30]
pop r15
pop r14
pop r13
pop r12
ret
Function at 0x140164410
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
push r15
mov r13d, dword [reloc.WS2_32.dll_accept]
lea r15, [rdx + rdx]
xor ebp, ebp
lea r12, [r9 + r9]
mov rbx, r8
mov rsi, rcx
xorps xmm4, xmm4
xorps xmm3, xmm3
lea r14d, [rbp + 8]
nop dword [rax]
xor r9d, r9d
cmp r13d, 2
jl 0x1401644c6
mov rax, rsi
lea edx, [r9 + 2]
sub rax, rbx
lea r9d, [rdx + 0xe]
lea rcx, [rbx + 8]
nop dword [rax + rax]
movq xmm0, qword [rax + rcx - 8]
movq xmm1, qword [rcx - 8]
lea rcx, [rcx + 0x10]
pmovzxwd xmm2, xmm0
pmovzxwd xmm0, xmm1
psubd xmm2, xmm0
movq xmm0, qword [rax + rcx - 0x10]
pabsd xmm1, xmm2
paddd xmm1, xmm4
movdqa xmm4, xmm1
movq xmm1, qword [rcx - 0x10]
pmovzxwd xmm2, xmm0
pmovzxwd xmm0, xmm1
psubd xmm2, xmm0
pabsd xmm1, xmm2
paddd xmm1, xmm3
movdqa xmm3, xmm1
sub rdx, 1
jne 0x140164470
xor r10d, r10d
xor r11d, r11d
cmp r9, 0x10
jae 0x140164565
mov eax, reloc.WS2_32.dll_recv
sub rax, r9
cmp rax, 2
jl 0x140164544
lea rcx, [r9 + 1]
mov r8d, reloc.WLDAP32.dll_Ordinal_14
sub r8, r9
lea rcx, [rbx + rcx*2]
mov rdi, rsi
shr r8, 1
sub rdi, rbx
inc r8
lea r9, [r9 + r8*2]
nop word [rax + rax]
movzx eax, word [rcx - 2]
movzx edx, word [rdi + rcx - 2]
lea rcx, [rcx + 4]
sub edx, eax
mov eax, edx
cdq
xor eax, edx
sub eax, edx
movzx edx, word [rcx + rdi - 4]
add r10d, eax
movzx eax, word [rcx - 4]
sub edx, eax
mov eax, edx
cdq
xor eax, edx
sub eax, edx
add r11d, eax
sub r8, 1
jne 0x140164510
cmp r9, 0x10
jge 0x14016455f
movzx eax, word [rbx + r9*2]
movzx ecx, word [rsi + r9*2]
sub ecx, eax
mov eax, ecx
cdq
xor eax, edx
sub eax, edx
add ebp, eax
lea eax, [r11 + r10]
add ebp, eax
add rsi, r15
add rbx, r12
sub r14, 1
jne 0x140164450
mov rbx, qword [rsp + 0x28]
paddd xmm3, xmm4
mov rsi, qword [rsp + 0x38]
movdqa xmm0, xmm3
mov rdi, qword [rsp + 0x40]
psrldq xmm0, 8
paddd xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
paddd xmm3, xmm0
movd eax, xmm3
add eax, ebp
mov rbp, qword [rsp + 0x30]
pop r15
pop r14
pop r13
pop r12
ret
Function at 0x140164720
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
push r15
mov r13d, dword [reloc.WS2_32.dll_accept]
lea r15, [rdx + rdx]
xor ebp, ebp
lea r12, [r9 + r9]
mov r10, r8
mov rbx, rcx
xorps xmm3, xmm3
lea r14d, [rbp + 4]
nop word [rax + rax]
xor ecx, ecx
cmp r13d, 2
jl 0x140164791
movq xmm0, qword [rbx]
mov ecx, 4
movq xmm1, qword [r10]
pmovzxwd xmm2, xmm0
pmovzxwd xmm0, xmm1
psubd xmm2, xmm0
pabsd xmm1, xmm2
paddd xmm1, xmm3
movdqa xmm3, xmm1
xor edi, edi
xor esi, esi
cmp rcx, 4
jae 0x140164825
mov eax, 4
sub rax, rcx
cmp rax, 2
jl 0x140164806
lea r9, [rcx + 1]
mov r8d, 2
sub r8, rcx
lea r9, [r10 + r9*2]
mov r11, rbx
shr r8, 1
sub r11, r10
inc r8
lea rcx, [rcx + r8*2]
nop
movzx eax, word [r9 - 2]
movzx edx, word [r11 + r9 - 2]
lea r9, [r9 + 4]
sub edx, eax
mov eax, edx
cdq
xor eax, edx
sub eax, edx
movzx edx, word [r11 + r9 - 4]
add edi, eax
movzx eax, word [r9 - 4]
sub edx, eax
mov eax, edx
cdq
xor eax, edx
sub eax, edx
add esi, eax
sub r8, 1
jne 0x1401647d0
cmp rcx, 4
jge 0x140164820
movzx eax, word [r10 + rcx*2]
movzx edx, word [rbx + rcx*2]
sub edx, eax
mov eax, edx
cdq
xor eax, edx
sub eax, edx
add ebp, eax
lea eax, [rsi + rdi]
add ebp, eax
add rbx, r15
add r10, r12
sub r14, 1
jne 0x140164760
mov rbx, qword [rsp + 0x28]
movdqa xmm0, xmm3
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
psrldq xmm0, 8
paddd xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
paddd xmm3, xmm0
movd eax, xmm3
add eax, ebp
mov rbp, qword [rsp + 0x30]
pop r15
pop r14
pop r13
pop r12
ret
Function at 0x140164880
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
push r15
mov r13d, dword [reloc.WS2_32.dll_accept]
lea r15, [rdx + rdx]
xor ebp, ebp
lea r12, [r9 + r9]
mov r10, r8
mov rbx, rcx
xorps xmm3, xmm3
lea r14d, [rbp + 8]
nop word [rax + rax]
xor ecx, ecx
cmp r13d, 2
jl 0x1401648f1
movq xmm0, qword [rbx]
mov ecx, 4
movq xmm1, qword [r10]
pmovzxwd xmm2, xmm0
pmovzxwd xmm0, xmm1
psubd xmm2, xmm0
pabsd xmm1, xmm2
paddd xmm1, xmm3
movdqa xmm3, xmm1
xor edi, edi
xor esi, esi
cmp rcx, 4
jae 0x140164985
mov eax, 4
sub rax, rcx
cmp rax, 2
jl 0x140164966
lea r9, [rcx + 1]
mov r8d, 2
sub r8, rcx
lea r9, [r10 + r9*2]
mov r11, rbx
shr r8, 1
sub r11, r10
inc r8
lea rcx, [rcx + r8*2]
nop
movzx eax, word [r9 - 2]
movzx edx, word [r11 + r9 - 2]
lea r9, [r9 + 4]
sub edx, eax
mov eax, edx
cdq
xor eax, edx
sub eax, edx
movzx edx, word [r11 + r9 - 4]
add edi, eax
movzx eax, word [r9 - 4]
sub edx, eax
mov eax, edx
cdq
xor eax, edx
sub eax, edx
add esi, eax
sub r8, 1
jne 0x140164930
cmp rcx, 4
jge 0x140164980
movzx eax, word [r10 + rcx*2]
movzx edx, word [rbx + rcx*2]
sub edx, eax
mov eax, edx
cdq
xor eax, edx
sub eax, edx
add ebp, eax
lea eax, [rsi + rdi]
add ebp, eax
add rbx, r15
add r10, r12
sub r14, 1
jne 0x1401648c0
mov rbx, qword [rsp + 0x28]
movdqa xmm0, xmm3
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
psrldq xmm0, 8
paddd xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
paddd xmm3, xmm0
movd eax, xmm3
add eax, ebp
mov rbp, qword [rsp + 0x30]
pop r15
pop r14
pop r13
pop r12
ret
Function at 0x1401649e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
push r15
mov r13d, dword [reloc.WS2_32.dll_accept]
lea r15, [rdx + rdx]
xor ebp, ebp
lea r12, [r9 + r9]
mov rdi, r8
mov rsi, rcx
xorps xmm4, xmm4
xorps xmm3, xmm3
lea r14d, [rbp + 0x10]
nop dword [rax]
xor r9d, r9d
cmp r13d, 2
jl 0x140164a77
movq xmm0, qword [rsi]
mov r9d, 8
movq xmm1, qword [rdi]
pmovzxwd xmm2, xmm0
pmovzxwd xmm0, xmm1
psubd xmm2, xmm0
movq xmm0, qword [rsi + 8]
pabsd xmm1, xmm2
paddd xmm1, xmm4
movdqa xmm4, xmm1
movq xmm1, qword [rdi + 8]
pmovzxwd xmm2, xmm0
pmovzxwd xmm0, xmm1
psubd xmm2, xmm0
pabsd xmm1, xmm2
paddd xmm1, xmm3
movdqa xmm3, xmm1
xor r11d, r11d
xor ebx, ebx
cmp r9, 8
jae 0x140164b16
mov eax, 8
sub rax, r9
cmp rax, 2
jl 0x140164af5
lea rcx, [r9 + 1]
mov r8d, 6
sub r8, r9
lea rcx, [rdi + rcx*2]
mov r10, rsi
shr r8, 1
sub r10, rdi
inc r8
lea r9, [r9 + r8*2]
nop word [rax + rax]
movzx eax, word [rcx - 2]
movzx edx, word [r10 + rcx - 2]
lea rcx, [rcx + 4]
sub edx, eax
mov eax, edx
cdq
xor eax, edx
sub eax, edx
movzx edx, word [r10 + rcx - 4]
add r11d, eax
movzx eax, word [rcx - 4]
sub edx, eax
mov eax, edx
cdq
xor eax, edx
sub eax, edx
add ebx, eax
sub r8, 1
jne 0x140164ac0
cmp r9, 8
jge 0x140164b10
movzx eax, word [rdi + r9*2]
movzx ecx, word [rsi + r9*2]
sub ecx, eax
mov eax, ecx
cdq
xor eax, edx
sub eax, edx
add ebp, eax
lea eax, [rbx + r11]
add ebp, eax
add rsi, r15
add rdi, r12
sub r14, 1
jne 0x140164a20
mov rbx, qword [rsp + 0x28]
paddd xmm3, xmm4
mov rsi, qword [rsp + 0x38]
movdqa xmm0, xmm3
mov rdi, qword [rsp + 0x40]
psrldq xmm0, 8
paddd xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
paddd xmm3, xmm0
movd eax, xmm3
add eax, ebp
mov rbp, qword [rsp + 0x30]
pop r15
pop r14
pop r13
pop r12
ret
Function at 0x140164b70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
push r15
mov r13d, dword [reloc.WS2_32.dll_accept]
lea r15, [rdx + rdx]
xor ebp, ebp
lea r12, [r9 + r9]
mov rdi, r8
mov rsi, rcx
xorps xmm4, xmm4
xorps xmm3, xmm3
lea r14d, [rbp + 4]
nop dword [rax]
xor r9d, r9d
cmp r13d, 2
jl 0x140164c07
movq xmm0, qword [rsi]
mov r9d, 8
movq xmm1, qword [rdi]
pmovzxwd xmm2, xmm0
pmovzxwd xmm0, xmm1
psubd xmm2, xmm0
movq xmm0, qword [rsi + 8]
pabsd xmm1, xmm2
paddd xmm1, xmm4
movdqa xmm4, xmm1
movq xmm1, qword [rdi + 8]
pmovzxwd xmm2, xmm0
pmovzxwd xmm0, xmm1
psubd xmm2, xmm0
pabsd xmm1, xmm2
paddd xmm1, xmm3
movdqa xmm3, xmm1
xor r11d, r11d
xor ebx, ebx
cmp r9, 8
jae 0x140164ca6
mov eax, 8
sub rax, r9
cmp rax, 2
jl 0x140164c85
lea rcx, [r9 + 1]
mov r8d, 6
sub r8, r9
lea rcx, [rdi + rcx*2]
mov r10, rsi
shr r8, 1
sub r10, rdi
inc r8
lea r9, [r9 + r8*2]
nop word [rax + rax]
movzx eax, word [rcx - 2]
movzx edx, word [r10 + rcx - 2]
lea rcx, [rcx + 4]
sub edx, eax
mov eax, edx
cdq
xor eax, edx
sub eax, edx
movzx edx, word [r10 + rcx - 4]
add r11d, eax
movzx eax, word [rcx - 4]
sub edx, eax
mov eax, edx
cdq
xor eax, edx
sub eax, edx
add ebx, eax
sub r8, 1
jne 0x140164c50
cmp r9, 8
jge 0x140164ca0
movzx eax, word [rdi + r9*2]
movzx ecx, word [rsi + r9*2]
sub ecx, eax
mov eax, ecx
cdq
xor eax, edx
sub eax, edx
add ebp, eax
lea eax, [rbx + r11]
add ebp, eax
add rsi, r15
add rdi, r12
sub r14, 1
jne 0x140164bb0
mov rbx, qword [rsp + 0x28]
paddd xmm3, xmm4
mov rsi, qword [rsp + 0x38]
movdqa xmm0, xmm3
mov rdi, qword [rsp + 0x40]
psrldq xmm0, 8
paddd xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
paddd xmm3, xmm0
movd eax, xmm3
add eax, ebp
mov rbp, qword [rsp + 0x30]
pop r15
pop r14
pop r13
pop r12
ret
Function at 0x140164d00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
push r15
mov r13d, dword [reloc.WS2_32.dll_accept]
lea r15, [rdx + rdx]
xor ebp, ebp
lea r12, [r9 + r9]
mov rdi, r8
mov rsi, rcx
xorps xmm4, xmm4
xorps xmm3, xmm3
lea r14d, [rbp + 8]
nop dword [rax]
xor r9d, r9d
cmp r13d, 2
jl 0x140164d97
movq xmm0, qword [rsi]
mov r9d, 8
movq xmm1, qword [rdi]
pmovzxwd xmm2, xmm0
pmovzxwd xmm0, xmm1
psubd xmm2, xmm0
movq xmm0, qword [rsi + 8]
pabsd xmm1, xmm2
paddd xmm1, xmm4
movdqa xmm4, xmm1
movq xmm1, qword [rdi + 8]
pmovzxwd xmm2, xmm0
pmovzxwd xmm0, xmm1
psubd xmm2, xmm0
pabsd xmm1, xmm2
paddd xmm1, xmm3
movdqa xmm3, xmm1
xor r11d, r11d
xor ebx, ebx
cmp r9, 8
jae 0x140164e36
mov eax, 8
sub rax, r9
cmp rax, 2
jl 0x140164e15
lea rcx, [r9 + 1]
mov r8d, 6
sub r8, r9
lea rcx, [rdi + rcx*2]
mov r10, rsi
shr r8, 1
sub r10, rdi
inc r8
lea r9, [r9 + r8*2]
nop word [rax + rax]
movzx eax, word [rcx - 2]
movzx edx, word [r10 + rcx - 2]
lea rcx, [rcx + 4]
sub edx, eax
mov eax, edx
cdq
xor eax, edx
sub eax, edx
movzx edx, word [r10 + rcx - 4]
add r11d, eax
movzx eax, word [rcx - 4]
sub edx, eax
mov eax, edx
cdq
xor eax, edx
sub eax, edx
add ebx, eax
sub r8, 1
jne 0x140164de0
cmp r9, 8
jge 0x140164e30
movzx eax, word [rdi + r9*2]
movzx ecx, word [rsi + r9*2]
sub ecx, eax
mov eax, ecx
cdq
xor eax, edx
sub eax, edx
add ebp, eax
lea eax, [rbx + r11]
add ebp, eax
add rsi, r15
add rdi, r12
sub r14, 1
jne 0x140164d40
mov rbx, qword [rsp + 0x28]
paddd xmm3, xmm4
mov rsi, qword [rsp + 0x38]
movdqa xmm0, xmm3
mov rdi, qword [rsp + 0x40]
psrldq xmm0, 8
paddd xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
paddd xmm3, xmm0
movd eax, xmm3
add eax, ebp
mov rbp, qword [rsp + 0x30]
pop r15
pop r14
pop r13
pop r12
ret