joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140013010
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f5880], 1
je 0x140013073
mov r8, rdx
movabs r10, 0x97b425ed097b425f
xor r9d, r9d
mov eax, reloc.WLDAP32.dll_Ordinal_27
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 4
imul rax, rdx, 0xffffffffffffffe5
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x1b], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x1e
mov rdx, rsi
jne 0x140013030
mov dword [0x1400f5880], 1
mov eax, 0x1814bc36
pop rsi
ret

Function at 0x140013080
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f5888], 1
je 0x1400130f4
mov r8, rdx
movabs r10, 0xf0f0f0f0f0f0f0f1
xor r9d, r9d
mov r11, rdx
mov eax, reloc.WS2_32.dll_recvfrom
nop word cs:[rax + rax]
nop dword [rax]
mov rsi, rax
mov rax, r9
mul r10
mov rax, rdx
shr rdx, 4
and rax, 0xfffffffffffffff0
add rax, rdx
neg rax
movzx edx, byte [r8 + rsi]
xor dl, byte [r11 + rax]
mov byte [rcx + rsi - 0x11], dl
inc rsi
mov rax, rsi
mov edx, esi
inc r11
inc r9
cmp esi, 0x14
jne 0x1400130b0
mov dword [0x1400f5888], 1
mov eax, 0x5668124b
pop rsi
ret

Function at 0x140013a00
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f5890], 1
je 0x140013a79
mov r8, rdx
movabs r10, 0x8618618618618619
xor r9d, r9d
mov r11, rdx
mov esi, reloc.WS2_32.dll_setsockopt
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub r9, rdx
shr r9, 1
add r9, rdx
shr r9, 4
imul rdx, r9, 0xffffffffffffffeb
movzx r9d, byte [r8 + rsi]
xor r9b, byte [r11 + rdx]
mov byte [rcx + rsi - 0x15], r9b
mov rdx, rsi
inc rdx
mov rsi, rdx
inc r11
inc rax
cmp edx, 0x19
mov r9, rax
jne 0x140013a30
mov dword [0x1400f5890], 1
mov eax, 0x301ad10c
pop rsi
ret

Function at 0x140013a80
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f5898], 1
je 0x140013aea
mov r8, rdx
movabs r10, 0xcccccccccccccccd
xor r9d, r9d
mov eax, reloc.WS2_32.dll_sendto
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 2
and rdx, 0xfffffffffffffffc
lea rax, [rdx + rdx*4]
neg rax
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x14], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x17
mov rdx, rsi
jne 0x140013aa0
mov dword [0x1400f5898], 1
mov eax, 0x369ff411
pop rsi
ret

Function at 0x140013b40
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f58a8], 1
je 0x140013ba3
mov r8, rdx
movabs r10, 0xd79435e50d79435f
xor r9d, r9d
mov eax, reloc.WS2_32.dll_send
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 4
imul rax, rdx, 0xffffffffffffffed
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x13], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x16
mov rdx, rsi
jne 0x140013b60
mov dword [0x1400f58a8], 1
mov eax, 0xcfcab0e9
pop rsi
ret
Function at 0x140013bb0
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f58b0], 1
je 0x140013c2f
mov r8, rdx
movabs r10, 0x842108421084211
xor r9d, r9d
mov r11, rdx
mov esi, Ordinal_32
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub r9, rdx
shr r9, 1
add r9, rdx
shr r9, 4
mov rdx, r9
shl r9, 5
sub rdx, r9
movzx r9d, byte [r8 + rsi]
xor r9b, byte [r11 + rdx]
mov byte [rcx + rsi - 0x1f], r9b
mov rdx, rsi
inc rdx
mov rsi, rdx
inc r11
inc rax
cmp edx, 0x22
mov r9, rax
jne 0x140013be0
mov dword [0x1400f58b0], 1
mov eax, 0xbf2fae8
pop rsi
ret

Function at 0x140013c40
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f58c0], 1
je 0x140013cb9
mov r8, rdx
movabs r10, 0x8618618618618619
xor r9d, r9d
mov r11, rdx
mov esi, reloc.WS2_32.dll_setsockopt
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub r9, rdx
shr r9, 1
add r9, rdx
shr r9, 4
imul rdx, r9, 0xffffffffffffffeb
movzx r9d, byte [r8 + rsi]
xor r9b, byte [r11 + rdx]
mov byte [rcx + rsi - 0x15], r9b
mov rdx, rsi
inc rdx
mov rsi, rdx
inc r11
inc rax
cmp edx, 0x20
mov r9, rax
jne 0x140013c70
mov dword [0x1400f58c0], 1
mov eax, 0x37d19efd
pop rsi
ret

Function at 0x140013cc0
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f58c8], 1
je 0x140013d23
mov r8, rdx
movabs r10, 0x4ec4ec4ec4ec4ec5
xor r9d, r9d
mov eax, reloc.WLDAP32.dll_Ordinal_26
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 3
imul rax, rdx, 0xffffffffffffffe6
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x1a], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x1d
mov rdx, rsi
jne 0x140013ce0
mov dword [0x1400f58c8], 1
mov eax, 0xedbe9bd8
pop rsi
ret

Function at 0x140013d30
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f58d0], 1
je 0x140013d93
mov r8, rdx
movabs r10, 0x97b425ed097b425f
xor r9d, r9d
mov eax, reloc.WLDAP32.dll_Ordinal_27
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 4
imul rax, rdx, 0xffffffffffffffe5
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x1b], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x1f
mov rdx, rsi
jne 0x140013d50
mov dword [0x1400f58d0], 1
mov eax, 0x3a138d5f
pop rsi
ret

Function at 0x140013da0
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f58e0], 1
je 0x140013e10
mov r8, rdx
movabs r9, 0x4924924924924925
xor eax, eax
mov r10, rdx
mov r11d, Ordinal_32
nop word cs:[rax + rax]
nop dword [rax]
mov rsi, rax
shr rax, 2
mul r9
shr rdx, 1
imul rax, rdx, 0xffffffffffffffe4
movzx edx, byte [r8 + r11]
xor dl, byte [r10 + rax]
mov byte [rcx + r11 - 0x1c], dl
mov rax, r11
inc rax
mov r11, rax
inc r10
inc rsi
cmp eax, 0x28
mov rax, rsi
jne 0x140013dd0
mov dword [0x1400f58e0], 1
mov eax, 0x7cb9b098
pop rsi
ret
Function at 0x140013e20
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400f55f4], 1
je 0x140013e57
xor eax, eax
nop dword [rax + rax]
movzx r8d, byte [rdx + rax + 0x10]
xor r8b, byte [rdx + rax]
mov byte [rcx + rax], r8b
mov r8, rax
inc r8
mov rax, r8
cmp r8d, 5
jne 0x140013e30
mov dword [0x1400f55f4], 1
mov eax, 0xb100bdbd
ret

Function at 0x140013e60
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f58f0], 1
je 0x140013ed4
mov r8, rdx
movabs r10, 0xf0f0f0f0f0f0f0f1
xor r9d, r9d
mov r11, rdx
mov eax, reloc.WS2_32.dll_recvfrom
nop word cs:[rax + rax]
nop dword [rax]
mov rsi, rax
mov rax, r9
mul r10
mov rax, rdx
shr rdx, 4
and rax, 0xfffffffffffffff0
add rax, rdx
neg rax
movzx edx, byte [r8 + rsi]
xor dl, byte [r11 + rax]
mov byte [rcx + rsi - 0x11], dl
inc rsi
mov rax, rsi
mov edx, esi
inc r11
inc r9
cmp esi, 0x1c
jne 0x140013e90
mov dword [0x1400f58f0], 1
mov eax, 0x2f0cbffd
pop rsi
ret

Function at 0x140013ee0
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f5904], 1
je 0x140013f43
mov r8, rdx
movabs r10, 0x4ec4ec4ec4ec4ec5
xor r9d, r9d
mov eax, reloc.WLDAP32.dll_Ordinal_26
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 3
imul rax, rdx, 0xffffffffffffffe6
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x1a], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x27
mov rdx, rsi
jne 0x140013f00
mov dword [0x1400f5904], 1
mov eax, 0xd4ecc62e
pop rsi
ret

Function at 0x140013f90
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f591c], 1
je 0x140014004
mov r8, rdx
movabs r10, 0xf0f0f0f0f0f0f0f1
xor r9d, r9d
mov r11, rdx
mov eax, reloc.WS2_32.dll_recvfrom
nop word cs:[rax + rax]
nop dword [rax]
mov rsi, rax
mov rax, r9
mul r10
mov rax, rdx
shr rdx, 4
and rax, 0xfffffffffffffff0
add rax, rdx
neg rax
movzx edx, byte [r8 + rsi]
xor dl, byte [r11 + rax]
mov byte [rcx + rsi - 0x11], dl
inc rsi
mov rax, rsi
mov edx, esi
inc r11
inc r9
cmp esi, 0x16
jne 0x140013fc0
mov dword [0x1400f591c], 1
mov eax, 0xb8249e2
pop rsi
ret

Function at 0x140014010
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f5928], 1
je 0x140014080
mov r8, rdx
movabs r9, 0x4924924924924925
xor eax, eax
mov r10, rdx
mov r11d, Ordinal_32
nop word cs:[rax + rax]
nop dword [rax]
mov rsi, rax
shr rax, 2
mul r9
shr rdx, 1
imul rax, rdx, 0xffffffffffffffe4
movzx edx, byte [r8 + r11]
xor dl, byte [r10 + rax]
mov byte [rcx + r11 - 0x1c], dl
mov rax, r11
inc rax
mov r11, rax
inc r10
inc rsi
cmp eax, 0x22
mov rax, rsi
jne 0x140014040
mov dword [0x1400f5928], 1
mov eax, 0x1af4dd3c
pop rsi
ret
Function at 0x1400144c0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f5938], 1
je 0x140014539
mov r8, rdx
movabs r10, 0x642c8590b21642c9
xor r9d, r9d
mov r11, rdx
mov esi, reloc.WS2_32.dll_socket
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub r9, rdx
shr r9, 1
add r9, rdx
shr r9, 4
imul rdx, r9, 0xffffffffffffffe9
movzx r9d, byte [r8 + rsi]
xor r9b, byte [r11 + rdx]
mov byte [rcx + rsi - 0x17], r9b
mov rdx, rsi
inc rdx
mov rsi, rdx
inc r11
inc rax
cmp edx, 0x23
mov r9, rax
jne 0x1400144f0
mov dword [0x1400f5938], 1
mov eax, 0x77a99087
pop rsi
ret

Function at 0x140014b80
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f5944], 1
je 0x140014bf9
mov r8, rdx
movabs r10, 0x1a7b9611a7b9611b
xor r9d, r9d
mov r11, rdx
mov esi, Ordinal_32
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub r9, rdx
shr r9, 1
add r9, rdx
shr r9, 4
imul rdx, r9, 0xffffffffffffffe3
movzx r9d, byte [r8 + rsi]
xor r9b, byte [r11 + rdx]
mov byte [rcx + rsi - 0x1d], r9b
mov rdx, rsi
inc rdx
mov rsi, rdx
inc r11
inc rax
cmp edx, 0x24
mov r9, rax
jne 0x140014bb0
mov dword [0x1400f5944], 1
mov eax, 0xdf856fda
pop rsi
ret

Function at 0x140014c90
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400f5958], 1
je 0x140014cc7
xor eax, eax
nop dword [rax + rax]
movzx r8d, byte [rdx + rax + 0x10]
xor r8b, byte [rdx + rax]
mov byte [rcx + rax], r8b
mov r8, rax
inc r8
mov rax, r8
cmp r8d, 0xd
jne 0x140014ca0
mov dword [0x1400f5958], 1
mov eax, 0x69cbca46
ret

Function at 0x140014cd0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f59e0], 1
je 0x140014d49
mov r8, rdx
movabs r10, 0x642c8590b21642c9
xor r9d, r9d
mov r11, rdx
mov esi, reloc.WS2_32.dll_socket
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub r9, rdx
shr r9, 1
add r9, rdx
shr r9, 4
imul rdx, r9, 0xffffffffffffffe9
movzx r9d, byte [r8 + rsi]
xor r9b, byte [r11 + rdx]
mov byte [rcx + rsi - 0x17], r9b
mov rdx, rsi
inc rdx
mov rsi, rdx
inc r11
inc rax
cmp edx, 0x28
mov r9, rax
jne 0x140014d00
mov dword [0x1400f59e0], 1
mov eax, 0xc2e0d499
pop rsi
ret

Function at 0x140014e80
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f5988], 1
je 0x140014ef9
mov r8, rdx
movabs r10, 0x1a7b9611a7b9611b
xor r9d, r9d
mov r11, rdx
mov esi, Ordinal_32
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub r9, rdx
shr r9, 1
add r9, rdx
shr r9, 4
imul rdx, r9, 0xffffffffffffffe3
movzx r9d, byte [r8 + rsi]
xor r9b, byte [r11 + rdx]
mov byte [rcx + rsi - 0x1d], r9b
mov rdx, rsi
inc rdx
mov rsi, rdx
inc r11
inc rax
cmp edx, 0x3a
mov r9, rax
jne 0x140014eb0
mov dword [0x1400f5988], 1
mov eax, 0x5e537777
pop rsi
ret
Function at 0x140014f00
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f5964], 1
je 0x140014f7f
mov r8, rdx
movabs r10, 0x842108421084211
xor r9d, r9d
mov r11, rdx
mov esi, Ordinal_32
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub r9, rdx
shr r9, 1
add r9, rdx
shr r9, 4
mov rdx, r9
shl r9, 5
sub rdx, r9
movzx r9d, byte [r8 + rsi]
xor r9b, byte [r11 + rdx]
mov byte [rcx + rsi - 0x1f], r9b
mov rdx, rsi
inc rdx
mov rsi, rdx
inc r11
inc rax
cmp edx, 0x24
mov r9, rax
jne 0x140014f30
mov dword [0x1400f5964], 1
mov eax, 0xd1e39c71
pop rsi
ret

Function at 0x140015400
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
cmp dword [0x1400f59b4], 1
je 0x140015455
xor eax, eax
nop dword [rax + rax]
mov r8d, eax
mov r9d, eax
imul r9, r9, 0x38e38e39
shr r9, 0x22
add r9d, r9d
lea r9d, [r9 + r9*8]
movzx r10d, byte [rdx + rax + 0x12]
sub r8d, r9d
movsxd r8, r8d
xor r10b, byte [rdx + r8]
mov byte [rcx + rax], r10b
mov r8, rax
inc r8
mov rax, r8
cmp r8d, 0x27
jne 0x140015410
mov dword [0x1400f59b4], 1
mov eax, 0x57d72b60
ret

Function at 0x1400155d0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f59c0], 1
je 0x140015649
mov r8, rdx
movabs r10, 0x1a7b9611a7b9611b
xor r9d, r9d
mov r11, rdx
mov esi, Ordinal_32
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub r9, rdx
shr r9, 1
add r9, rdx
shr r9, 4
imul rdx, r9, 0xffffffffffffffe3
movzx r9d, byte [r8 + rsi]
xor r9b, byte [r11 + rdx]
mov byte [rcx + rsi - 0x1d], r9b
mov rdx, rsi
inc rdx
mov rsi, rdx
inc r11
inc rax
cmp edx, 0x24
mov r9, rax
jne 0x140015600
mov dword [0x1400f59c0], 1
mov eax, 0x49c03896
pop rsi
ret

Function at 0x140015650
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f59c8], 1
je 0x1400156b9
mov r8, rdx
movabs r10, 0xaaaaaaaaaaaaaaab
xor r9d, r9d
mov eax, Ordinal_27
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 1
and rdx, 0xfffffffffffffff8
lea rax, [rdx + rdx*2]
neg rax
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x18], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x1c
mov rdx, rsi
jne 0x140015670
mov dword [0x1400f59c8], 1
mov eax, 0xb23b292c
pop rsi
ret

Function at 0x140015a80
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f55e8], 1
je 0x140015af4
mov r8, rdx
movabs r10, 0xf0f0f0f0f0f0f0f1
xor r9d, r9d
mov r11, rdx
mov eax, reloc.WS2_32.dll_recvfrom
nop word cs:[rax + rax]
nop dword [rax]
mov rsi, rax
mov rax, r9
mul r10
mov rax, rdx
shr rdx, 4
and rax, 0xfffffffffffffff0
add rax, rdx
neg rax
movzx edx, byte [r8 + rsi]
xor dl, byte [r11 + rax]
mov byte [rcx + rsi - 0x11], dl
inc rsi
mov rax, rsi
mov edx, esi
inc r11
inc r9
cmp esi, 0x1c
jne 0x140015ab0
mov dword [0x1400f55e8], 1
mov eax, 0xec4ffe97
pop rsi
ret
Function at 0x140015f10
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f5544], 1
je 0x140015f7a
mov r8, rdx
movabs r10, 0xcccccccccccccccd
xor r9d, r9d
mov eax, reloc.WS2_32.dll_sendto
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 2
and rdx, 0xfffffffffffffffc
lea rax, [rdx + rdx*4]
neg rax
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x14], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x25
mov rdx, rsi
jne 0x140015f30
mov dword [0x1400f5544], 1
mov eax, 0xe32c8e53
pop rsi
ret

Function at 0x140015f90
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f552c], 1
je 0x140016000
mov r8, rdx
movabs r9, 0x4924924924924925
xor eax, eax
mov r10, rdx
mov r11d, Ordinal_32
nop word cs:[rax + rax]
nop dword [rax]
mov rsi, rax
shr rax, 2
mul r9
shr rdx, 1
imul rax, rdx, 0xffffffffffffffe4
movzx edx, byte [r8 + r11]
xor dl, byte [r10 + rax]
mov byte [rcx + r11 - 0x1c], dl
mov rax, r11
inc rax
mov r11, rax
inc r10
inc rsi
cmp eax, 0x1f
mov rax, rsi
jne 0x140015fc0
mov dword [0x1400f552c], 1
mov eax, 0xba8aa6e6
pop rsi
ret

Function at 0x140016f30
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f4794], 1
je 0x140016f9a
mov r8, rdx
movabs r10, 0xe38e38e38e38e38f
xor r9d, r9d
mov eax, reloc.WS2_32.dll_select
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 3
and rdx, 0xfffffffffffffffe
lea rax, [rdx + rdx*8]
neg rax
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x12], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x22
mov rdx, rsi
jne 0x140016f50
mov dword [0x1400f4794], 1
mov eax, 0x8b93befe
pop rsi
ret

Function at 0x1400172e0
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400f5854], 1
je 0x140017347
mov r8, rdx
movabs r10, 0x1a7b9611a7b9611b
xor r9d, r9d
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
imul eax, eax, 0xffffffe3
movzx edx, byte [r8 + r9 + 0x1d]
mov r11d, r9d
add eax, r9d
cdqe
xor dl, byte [r8 + rax]
mov byte [rcx + r9], dl
mov rax, r9
inc rax
mov r9, rax
cmp eax, 0x33
jne 0x140017300
mov dword [0x1400f5854], 1
mov eax, 0xc2a8f677
ret

Function at 0x1400177e0
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f54f4], 1
je 0x140017843
mov r8, rdx
movabs r10, 0x8888888888888889
xor r9d, r9d
mov eax, reloc.WLDAP32.dll_Ordinal_30
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 4
imul rax, rdx, 0xffffffffffffffe2
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x1e], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x25
mov rdx, rsi
jne 0x140017800
mov dword [0x1400f54f4], 1
mov eax, 0x8cf7b29a
pop rsi
ret
Function at 0x140017850
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f54e8], 1
je 0x1400178ba
mov r8, rdx
movabs r10, 0xe38e38e38e38e38f
xor r9d, r9d
mov eax, reloc.WS2_32.dll_select
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 3
and rdx, 0xfffffffffffffffe
lea rax, [rdx + rdx*8]
neg rax
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x12], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x18
mov rdx, rsi
jne 0x140017870
mov dword [0x1400f54e8], 1
mov eax, 0xee9d31d8
pop rsi
ret

Function at 0x1400178d0
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f5600], 1
je 0x14001793a
mov r8, rdx
movabs r10, 0xcccccccccccccccd
xor r9d, r9d
mov eax, reloc.WS2_32.dll_sendto
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 2
and rdx, 0xfffffffffffffffc
lea rax, [rdx + rdx*4]
neg rax
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x14], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x1b
mov rdx, rsi
jne 0x1400178f0
mov dword [0x1400f5600], 1
mov eax, 0xfcfc162a
pop rsi
ret

Function at 0x140017950
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f560c], 1
je 0x1400179ba
mov r8, rdx
movabs r10, 0xcccccccccccccccd
xor r9d, r9d
mov eax, reloc.WS2_32.dll_sendto
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 2
and rdx, 0xfffffffffffffffc
lea rax, [rdx + rdx*4]
neg rax
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x14], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x1c
mov rdx, rsi
jne 0x140017970
mov dword [0x1400f560c], 1
mov eax, 0x6141d043
pop rsi
ret

Function at 0x1400179d0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f5618], 1
je 0x140017a49
mov r8, rdx
movabs r10, 0x642c8590b21642c9
xor r9d, r9d
mov r11, rdx
mov esi, reloc.WS2_32.dll_socket
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub r9, rdx
shr r9, 1
add r9, rdx
shr r9, 4
imul rdx, r9, 0xffffffffffffffe9
movzx r9d, byte [r8 + rsi]
xor r9b, byte [r11 + rdx]
mov byte [rcx + rsi - 0x17], r9b
mov rdx, rsi
inc rdx
mov rsi, rdx
inc r11
inc rax
cmp edx, 0x1e
mov r9, rax
jne 0x140017a00
mov dword [0x1400f5618], 1
mov eax, 0xa68674ae
pop rsi
ret

Function at 0x140017a50
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f5628], 1
je 0x140017aba
mov r8, rdx
movabs r10, 0xcccccccccccccccd
xor r9d, r9d
mov eax, reloc.WS2_32.dll_sendto
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 2
and rdx, 0xfffffffffffffffc
lea rax, [rdx + rdx*4]
neg rax
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x14], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x1e
mov rdx, rsi
jne 0x140017a70
mov dword [0x1400f5628], 1
mov eax, 0x71dcf4c8
pop rsi
ret
Function at 0x140017ad0
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f5634], 1
je 0x140017b3a
mov r8, rdx
movabs r10, 0xe38e38e38e38e38f
xor r9d, r9d
mov eax, reloc.WS2_32.dll_select
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 3
and rdx, 0xfffffffffffffffe
lea rax, [rdx + rdx*8]
neg rax
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x12], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x19
mov rdx, rsi
jne 0x140017af0
mov dword [0x1400f5634], 1
mov eax, 0xe950aa00
pop rsi
ret

Function at 0x140017eb0
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f564c], 1
je 0x140017f13
mov r8, rdx
movabs r10, 0xd79435e50d79435f
xor r9d, r9d
mov eax, reloc.WS2_32.dll_send
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 4
imul rax, rdx, 0xffffffffffffffed
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x13], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x24
mov rdx, rsi
jne 0x140017ed0
mov dword [0x1400f564c], 1
mov eax, 0x916f33b2
pop rsi
ret

Function at 0x140018060
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400f3f0c], 1
je 0x14001809e
xor eax, eax
nop dword [rax + rax]
movzx r8d, byte [rdx + rax + 0x10]
mov r9d, eax
and r9d, 0xf
xor r8b, byte [rdx + r9]
mov byte [rcx + rax], r8b
mov r8, rax
inc r8
mov rax, r8
cmp r8d, 0x16
jne 0x140018070
mov dword [0x1400f3f0c], 1
mov eax, 0xca7d6548
ret

Function at 0x1400180b0
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400f3e34], 1
je 0x14001810d
mov r8, rdx
movabs r10, 0x4ec4ec4ec4ec4ec5
xor r9d, r9d
nop dword [rax]
mov rax, r9
mul r10
shr rdx, 3
mov eax, edx
imul eax, edx, 0xffffffe6
movzx edx, byte [r8 + r9 + 0x1a]
mov r11d, r9d
add eax, r9d
cdqe
xor dl, byte [r8 + rax]
mov byte [rcx + r9], dl
mov rax, r9
inc rax
mov r9, rax
cmp eax, 0x2a
jne 0x1400180d0
mov dword [0x1400f3e34], 1
mov eax, 0x75231108
ret

Function at 0x140018690
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
cmp dword [0x1400f5878], 1
je 0x1400186f0
mov r8, rdx
movabs r10, 0xf0f0f0f0f0f0f0f1
xor r9d, r9d
nop dword [rax]
mov rax, r9
mul r10
shr rdx, 4
mov eax, edx
shl edx, 4
add edx, eax
movzx eax, byte [r8 + r9 + 0x11]
mov r11d, r9d
sub r11d, edx
movsxd rdx, r11d
xor al, byte [r8 + rdx]
mov byte [rcx + r9], al
mov rax, r9
inc rax
mov r9, rax
cmp eax, 0x1d
jne 0x1400186b0
mov dword [0x1400f5878], 1
mov eax, 0xea5a0bf3
ret

Function at 0x14001be70
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f5478], 1
je 0x14001bed3
mov r8, rdx
movabs r10, 0x4ec4ec4ec4ec4ec5
xor r9d, r9d
mov eax, reloc.WLDAP32.dll_Ordinal_26
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 3
imul rax, rdx, 0xffffffffffffffe6
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x1a], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x20
mov rdx, rsi
jne 0x14001be90
mov dword [0x1400f5478], 1
mov eax, 0x7870ac0f
pop rsi
ret