joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400e3ae0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov qword [rsp + 0x50], r12
lea rsi, [r8 - 1]
sar rsi, 1
mov r15, r9
mov qword [rsp + 0x58], r13
mov r12, r8
mov rbx, rdx
mov r14, rcx
mov rbp, rdx
mov r10, rdx
cmp rdx, rsi
jge 0x1400e3b70
nop dword [rax + rax]
lea rdi, [r10 + r10]
lea rax, [rdi + 2]
lea rax, [rax + rax*2]
lea rdx, [r14 + rax*2]
lea r8, [rdx - 6]
lea rcx, [rsp + 0x70]
call fcn.1400d36b0
movzx r10d, al
lea rax, [rbx + rbx*2]
lea rdx, [r14 + rax*2]
xor r10, 1
inc r10
add r10, rdi
mov rbx, r10
lea rcx, [r10 + r10*2]
mov eax, dword [r14 + rcx*2]
mov dword [rdx], eax
movzx eax, word [r14 + rcx*2 + 4]
mov word [rdx + 4], ax
cmp r10, rsi
jl 0x1400e3b20
cmp r10, rsi
jne 0x1400e3b9d
test r12b, 1
jne 0x1400e3b9d
lea rax, [rbx + rbx*2]
lea rdx, [r14 + rax*2]
lea rcx, [r12 + r12*2]
mov eax, dword [r14 + rcx*2 - 6]
lea rbx, [r12 - 1]
mov dword [rdx], eax
movzx eax, word [r14 + rcx*2 - 2]
mov word [rdx + 4], ax
mov rax, qword [rsp + 0x70]
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x50]
mov qword [rsp + 0x70], rax
cmp rbp, rbx
jge 0x1400e3bff
nop word [rax + rax]
lea rdi, [rbx - 1]
mov r8, r15
sar rdi, 1
lea rcx, [rsp + 0x70]
lea rax, [rdi + rdi*2]
lea rsi, [r14 + rax*2]
mov rdx, rsi
call fcn.1400d36b0
test al, al
je 0x1400e3bff
lea rax, [rbx + rbx*2]
mov rbx, rdi
lea rcx, [r14 + rax*2]
mov eax, dword [rsi]
mov dword [rcx], eax
movzx eax, word [rsi + 4]
mov word [rcx + 4], ax
cmp rbp, rdi
jl 0x1400e3bc0
lea rax, [rbx + rbx*2]
mov rbx, qword [rsp + 0x60]
lea rcx, [r14 + rax*2]
mov eax, dword [r15]
mov dword [rcx], eax
movzx eax, word [r15 + 4]
mov word [rcx + 4], ax
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400e3fd0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov qword [rsp + 0x50], r12
lea rsi, [r8 - 1]
sar rsi, 1
mov r15, r9
mov qword [rsp + 0x58], r13
mov r12, r8
mov rbx, rdx
mov r14, rcx
mov rbp, rdx
mov r10, rdx
cmp rdx, rsi
jge 0x1400e4060
nop dword [rax + rax]
lea rdi, [r10 + r10]
lea rax, [rdi + 2]
lea rax, [rax + rax*2]
lea rdx, [r14 + rax*2]
lea r8, [rdx - 6]
lea rcx, [rsp + 0x70]
call fcn.1400da290
movzx r10d, al
lea rax, [rbx + rbx*2]
lea rdx, [r14 + rax*2]
xor r10, 1
inc r10
add r10, rdi
mov rbx, r10
lea rcx, [r10 + r10*2]
mov eax, dword [r14 + rcx*2]
mov dword [rdx], eax
movzx eax, word [r14 + rcx*2 + 4]
mov word [rdx + 4], ax
cmp r10, rsi
jl 0x1400e4010
cmp r10, rsi
jne 0x1400e408d
test r12b, 1
jne 0x1400e408d
lea rax, [rbx + rbx*2]
lea rdx, [r14 + rax*2]
lea rcx, [r12 + r12*2]
mov eax, dword [r14 + rcx*2 - 6]
lea rbx, [r12 - 1]
mov dword [rdx], eax
movzx eax, word [r14 + rcx*2 - 2]
mov word [rdx + 4], ax
mov rax, qword [rsp + 0x70]
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x50]
mov qword [rsp + 0x70], rax
cmp rbp, rbx
jge 0x1400e40ef
nop word [rax + rax]
lea rdi, [rbx - 1]
mov r8, r15
sar rdi, 1
lea rcx, [rsp + 0x70]
lea rax, [rdi + rdi*2]
lea rsi, [r14 + rax*2]
mov rdx, rsi
call fcn.1400da290
test al, al
je 0x1400e40ef
lea rax, [rbx + rbx*2]
mov rbx, rdi
lea rcx, [r14 + rax*2]
mov eax, dword [rsi]
mov dword [rcx], eax
movzx eax, word [rsi + 4]
mov word [rcx + 4], ax
cmp rbp, rdi
jl 0x1400e40b0
lea rax, [rbx + rbx*2]
mov rbx, qword [rsp + 0x60]
lea rcx, [r14 + rax*2]
mov eax, dword [r15]
mov dword [rcx], eax
movzx eax, word [r15 + 4]
mov word [rcx + 4], ax
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400e4120
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov qword [rsp + 0x50], r12
lea rsi, [r8 - 1]
sar rsi, 1
mov r15, r9
mov qword [rsp + 0x58], r13
mov r12, r8
mov rbx, rdx
mov r14, rcx
mov rbp, rdx
mov r10, rdx
cmp rdx, rsi
jge 0x1400e41b0
nop dword [rax + rax]
lea rdi, [r10 + r10]
lea rax, [rdi + 2]
lea rax, [rax + rax*2]
lea rdx, [r14 + rax*2]
lea r8, [rdx - 6]
lea rcx, [rsp + 0x70]
call fcn.1400dce90
movzx r10d, al
lea rax, [rbx + rbx*2]
lea rdx, [r14 + rax*2]
xor r10, 1
inc r10
add r10, rdi
mov rbx, r10
lea rcx, [r10 + r10*2]
mov eax, dword [r14 + rcx*2]
mov dword [rdx], eax
movzx eax, word [r14 + rcx*2 + 4]
mov word [rdx + 4], ax
cmp r10, rsi
jl 0x1400e4160
cmp r10, rsi
jne 0x1400e41dd
test r12b, 1
jne 0x1400e41dd
lea rax, [rbx + rbx*2]
lea rdx, [r14 + rax*2]
lea rcx, [r12 + r12*2]
mov eax, dword [r14 + rcx*2 - 6]
lea rbx, [r12 - 1]
mov dword [rdx], eax
movzx eax, word [r14 + rcx*2 - 2]
mov word [rdx + 4], ax
mov rax, qword [rsp + 0x70]
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x50]
mov qword [rsp + 0x70], rax
cmp rbp, rbx
jge 0x1400e423f
nop word [rax + rax]
lea rdi, [rbx - 1]
mov r8, r15
sar rdi, 1
lea rcx, [rsp + 0x70]
lea rax, [rdi + rdi*2]
lea rsi, [r14 + rax*2]
mov rdx, rsi
call fcn.1400dce90
test al, al
je 0x1400e423f
lea rax, [rbx + rbx*2]
mov rbx, rdi
lea rcx, [r14 + rax*2]
mov eax, dword [rsi]
mov dword [rcx], eax
movzx eax, word [rsi + 4]
mov word [rcx + 4], ax
cmp rbp, rdi
jl 0x1400e4200
lea rax, [rbx + rbx*2]
mov rbx, qword [rsp + 0x60]
lea rcx, [r14 + rax*2]
mov eax, dword [r15]
mov dword [rcx], eax
movzx eax, word [r15 + 4]
mov word [rcx + 4], ax
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140112e10
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x140112e71
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x140112e30
mov ecx, dword [r9]
jmp 0x140112f5b
cmp ecx, 0x4e0
jb 0x140112f5b
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
add r10, 4
mov edx, r11d
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x140112e90
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x140112ee0
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x140129dd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, rdx
mov rdi, rcx
mov edx, 3
mov rcx, r8
mov rbx, r8
call fcn.1401233d0
mov esi, dword [rdi + 0x38]
mov rdx, rax
imul rdx, qword [rdi + 8]
mov rbp, qword [rdi + 0x28]
mov r11, qword [rdi + 0x18]
mov rax, rdx
shr rax, 0x21
xor rdx, rax
mov eax, dword [rdi + 0x3c]
mov r9, rdx
shr rdx, 5
and r9d, 0x1f
shrx r8, r9, rax
add r8d, esi
and rdx, rbp
movzx eax, byte [r11 + rdx]
lea r9, [rdx + rdx*2]
nop
mov rcx, qword [rdi + 0x10]
cmp r8d, eax
jne 0x140129e5e
movzx eax, word [rbx]
cmp ax, word [r9 + rcx]
jne 0x140129e5e
movzx eax, byte [rbx + 2]
cmp al, byte [r9 + rcx + 2]
je 0x140129ecb
movzx eax, byte [r11 + rdx + 1]
inc rdx
add r8d, esi
mov r10, rcx
cmp r8d, eax
jne 0x140129e8a
movzx eax, word [rbx]
cmp ax, word [r9 + rcx + 3]
jne 0x140129e8d
movzx eax, byte [rbx + 2]
cmp al, byte [r9 + rcx + 5]
je 0x140129ec8
jmp 0x140129e8d
mov r10, rcx
movzx eax, byte [r11 + rdx + 1]
inc rdx
add r9, 6
add r8d, esi
cmp r8d, eax
jbe 0x140129e40
test rbp, rbp
jne 0x140129eab
xor edx, edx
jmp 0x140129ec8
mov rcx, r11
movabs rax, 0x5555555555555556
sub rcx, r10
imul rcx
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rcx, r10
mov rbx, qword [rsp + 0x30]
lea rax, [r11 + rdx]
mov rbp, qword [rsp + 0x38]
lea rcx, [rcx + rdx*2]
mov rsi, qword [rsp + 0x40]
add rcx, rdx
mov rdi, qword [rsp + 0x48]
mov qword [r14 + 8], rax
mov rax, r14
mov qword [r14], rcx
add rsp, 0x20
pop r14
ret
Function at 0x14012a660
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
xor esi, esi
mov rdi, r8
mov ebp, esi
mov r14, rdx
mov rbx, rcx
nop word [rax + rax]
mov edx, 3
mov rcx, rdi
call fcn.1401233d0
imul rax, qword [rbx + 8]
mov r8, qword [rbx + 0x18]
mov r10d, dword [rbx + 0x38]
mov rcx, rax
shr rcx, 0x21
xor rax, rcx
mov ecx, dword [rbx + 0x3c]
mov rdx, rax
shr rax, 5
and rax, qword [rbx + 0x28]
and edx, 0x1f
shrx r9, rdx, rcx
add r9d, r10d
movzx ecx, byte [r8 + rax]
cmp r9d, ecx
jae 0x14012a6f1
nop word [rax + rax]
movzx ecx, byte [r8 + rax + 1]
inc rax
add r9d, r10d
cmp r9d, ecx
jb 0x14012a6e0
movzx ecx, byte [r8 + rax]
cmp r9d, ecx
jne 0x14012a729
lea rdx, [rax + rax*2]
add rdx, qword [rbx + 0x10]
movzx ecx, word [rdi]
cmp cx, word [rdx]
jne 0x14012a714
movzx ecx, byte [rdi + 2]
cmp cl, byte [rdx + 2]
je 0x14012a755
movzx ecx, byte [r8 + rax + 1]
inc rax
add rdx, 3
add r9d, r10d
cmp r9d, ecx
je 0x14012a703
mov rcx, qword [rbx + 0x30]
cmp qword [rbx + 0x20], rcx
jb 0x14012a765
mov rcx, rbx
call fcn.14013b800
test al, al
je 0x14012a74d
inc ebp
cmp ebp, 0x100
jl 0x14012a690
mov qword [r14], rsi
jmp 0x14012a836
mov qword [r14], rax
mov dword [r14 + 8], 1
jmp 0x14012a83a
lea ecx, [r10 + r9]
mov r11, rax
cmp ecx, 0xff
jbe 0x14012a778
mov qword [rbx + 0x30], rsi
cmp byte [r8 + rax], sil
je 0x14012a81d
mov r10, rax
inc rax
cmp byte [r8 + rax], sil
jne 0x14012a782
cmp rax, r11
je 0x14012a81d
lea r8, [rax + rax*2]
add r8, qword [rbx + 0x10]
movzx ecx, word [r8 - 3]
mov word [r8], cx
movzx ecx, byte [r8 - 1]
mov byte [r8 + 2], cl
cmp r10, r11
je 0x14012a7df
lea r8, [r10 + r10*2]
sub r10, r11
nop dword [rax]
mov rdx, qword [rbx + 0x10]
add rdx, r8
add r8, 0xfffffffffffffffd
movzx ecx, word [rdx - 3]
mov word [rdx], cx
movzx ecx, byte [rdx - 1]
mov byte [rdx + 2], cl
sub r10, 1
jne 0x14012a7c0
mov r8, qword [rbx + 0x18]
mov rdx, rax
nop word [rax + rax]
movzx ecx, byte [r8 + rdx - 1]
add cl, byte [rbx + 0x38]
mov byte [r8 + rdx], cl
mov r8, qword [rbx + 0x18]
movzx ecx, byte [r8 + rdx]
add ecx, dword [rbx + 0x38]
cmp ecx, 0xff
jbe 0x14012a815
mov qword [rbx + 0x30], rsi
dec rdx
cmp rdx, r11
jne 0x14012a7f0
mov rcx, qword [rbx + 0x18]
mov qword [r14], r11
mov byte [r11 + rcx], r9b
inc qword [rbx + 0x20]
cmp rax, r11
setne sil
add esi, 2
mov dword [r14 + 8], esi
mov rbx, qword [rsp + 0x30]
mov rax, r14
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14013c6a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x20
cmp qword [rcx + 0x30], 0
mov rsi, rdx
mov rbx, rcx
jne 0x14013c6c4
call fcn.140026410
test al, al
je 0x14013c81c
mov qword [rsp + 0x30], rbp
mov edx, 3
mov rcx, rsi
mov qword [rsp + 0x38], rdi
call fcn.1401233d0
imul rax, qword [rbx + 8]
mov r9d, dword [rbx + 0x38]
mov rcx, rax
shr rcx, 0x21
xor rax, rcx
mov ecx, dword [rbx + 0x3c]
mov rdx, rax
shr rax, 5
and rax, qword [rbx + 0x28]
and edx, 0x1f
shrx r8, rdx, rcx
mov rdx, qword [rbx + 0x18]
add r8d, r9d
movzx ecx, byte [rdx + rax]
cmp r8d, ecx
ja 0x14013c730
nop dword [rax]
nop dword [rax + rax]
movzx ecx, byte [rdx + rax + 1]
inc rax
add r8d, r9d
cmp r8d, ecx
jbe 0x14013c720
movzx ecx, r8b
xor ebp, ebp
add ecx, r9d
mov r11, rax
cmp ecx, 0xff
jbe 0x14013c748
mov qword [rbx + 0x30], rbp
cmp byte [rdx + rax], bpl
je 0x14013c759
nop
inc rax
cmp byte [rdx + rax], bpl
jne 0x14013c750
mov rdx, qword [rbx + 0x10]
lea rdi, [rdx + r11*2]
cmp rax, r11
je 0x14013c7ea
lea rdx, [rdx + rax*2]
add rdx, rax
lea r9, [rax - 1]
movzx ecx, word [rdx - 3]
mov word [rdx], cx
movzx ecx, byte [rdx - 1]
mov byte [rdx + 2], cl
cmp r9, r11
je 0x14013c7af
lea r10, [r9 + r9*2]
sub r9, r11
nop
mov rdx, qword [rbx + 0x10]
add rdx, r10
add r10, 0xfffffffffffffffd
movzx ecx, word [rdx - 3]
mov word [rdx], cx
movzx ecx, byte [rdx - 1]
mov byte [rdx + 2], cl
sub r9, 1
jne 0x14013c790
mov rdx, qword [rbx + 0x18]
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [rdx + rax - 1]
add cl, byte [rbx + 0x38]
mov byte [rdx + rax], cl
mov rdx, qword [rbx + 0x18]
movzx ecx, byte [rdx + rax]
add ecx, dword [rbx + 0x38]
cmp ecx, 0xff
jbe 0x14013c7e2
mov qword [rbx + 0x30], rbp
dec rax
cmp rax, r11
jne 0x14013c7c0
movzx eax, word [rsi]
mov rbp, qword [rsp + 0x30]
mov word [rdi + r11], ax
movzx eax, byte [rsi + 2]
mov byte [rdi + r11 + 2], al
mov rax, qword [rbx + 0x18]
mov rdi, qword [rsp + 0x38]
mov byte [r11 + rax], r8b
inc qword [rbx + 0x20]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
call fcn.14001c8f0
int3
Function at 0x14013c830
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov qword [rsp + 0x50], r12
lea rsi, [r8 - 1]
sar rsi, 1
mov rbp, r9
mov qword [rsp + 0x58], r13
mov r12, r8
mov rbx, rdx
mov r14, rcx
mov r15, rdx
cmp rdx, rsi
jge 0x14013c8c5
nop word [rax + rax]
lea rdi, [rdx + rdx]
lea rax, [rdi + 2]
lea rax, [rax + rax*2]
lea rdx, [r14 + rax*8]
lea r8, [rdx - 0x18]
lea rcx, [rsp + 0x70]
call fcn.14012bea0
movzx edx, al
lea rax, [rbx + rbx*2]
xor rdx, 1
inc rdx
add rdx, rdi
mov rbx, rdx
lea rcx, [rdx + rdx*2]
vmovups xmm0, xmmword [r14 + rcx*8]
vmovups xmmword [r14 + rax*8], xmm0
vmovsd xmm1, qword [r14 + rcx*8 + 0x10]
vmovsd qword [r14 + rax*8 + 0x10], xmm1
cmp rdx, rsi
jl 0x14013c870
jne 0x14013c8f5
test r12b, 1
jne 0x14013c8f5
lea rax, [rbx + rbx*2]
lea rcx, [r12 + r12*2]
vmovups xmm0, xmmword [r14 + rcx*8 - 0x18]
vmovups xmmword [r14 + rax*8], xmm0
vmovsd xmm1, qword [r14 + rcx*8 - 8]
vmovsd qword [r14 + rax*8 + 0x10], xmm1
lea rbx, [r12 - 1]
mov rax, qword [rsp + 0x70]
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x50]
mov qword [rsp + 0x70], rax
cmp r15, rbx
jge 0x14013c955
nop
lea rdi, [rbx - 1]
mov r8, rbp
sar rdi, 1
lea rcx, [rsp + 0x70]
lea rax, [rdi + rdi*2]
lea rsi, [r14 + rax*8]
mov rdx, rsi
call fcn.14012bea0
test al, al
je 0x14013c955
lea rax, [rbx + rbx*2]
mov rbx, rdi
vmovups xmm0, xmmword [rsi]
vmovups xmmword [r14 + rax*8], xmm0
vmovsd xmm1, qword [rsi + 0x10]
vmovsd qword [r14 + rax*8 + 0x10], xmm1
cmp r15, rdi
jl 0x14013c910
vmovups xmm0, xmmword [rbp]
lea rax, [rbx + rbx*2]
mov rbx, qword [rsp + 0x60]
vmovups xmmword [r14 + rax*8], xmm0
vmovsd xmm1, qword [rbp + 0x10]
vmovsd qword [r14 + rax*8 + 0x10], xmm1
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14013c990
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov qword [rsp + 0x50], r12
lea rsi, [r8 - 1]
sar rsi, 1
mov rbp, r9
mov qword [rsp + 0x58], r13
mov r12, r8
mov rbx, rdx
mov r14, rcx
mov r15, rdx
cmp rdx, rsi
jge 0x14013ca25
nop word [rax + rax]
lea rdi, [rdx + rdx]
lea rax, [rdi + 2]
lea rax, [rax + rax*2]
lea rdx, [r14 + rax*8]
lea r8, [rdx - 0x18]
lea rcx, [rsp + 0x70]
call fcn.14012d650
movzx edx, al
lea rax, [rbx + rbx*2]
xor rdx, 1
inc rdx
add rdx, rdi
mov rbx, rdx
lea rcx, [rdx + rdx*2]
vmovups xmm0, xmmword [r14 + rcx*8]
vmovups xmmword [r14 + rax*8], xmm0
vmovsd xmm1, qword [r14 + rcx*8 + 0x10]
vmovsd qword [r14 + rax*8 + 0x10], xmm1
cmp rdx, rsi
jl 0x14013c9d0
jne 0x14013ca55
test r12b, 1
jne 0x14013ca55
lea rax, [rbx + rbx*2]
lea rcx, [r12 + r12*2]
vmovups xmm0, xmmword [r14 + rcx*8 - 0x18]
vmovups xmmword [r14 + rax*8], xmm0
vmovsd xmm1, qword [r14 + rcx*8 - 8]
vmovsd qword [r14 + rax*8 + 0x10], xmm1
lea rbx, [r12 - 1]
mov rax, qword [rsp + 0x70]
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x50]
mov qword [rsp + 0x70], rax
cmp r15, rbx
jge 0x14013cab5
nop
lea rdi, [rbx - 1]
mov r8, rbp
sar rdi, 1
lea rcx, [rsp + 0x70]
lea rax, [rdi + rdi*2]
lea rsi, [r14 + rax*8]
mov rdx, rsi
call fcn.14012d650
test al, al
je 0x14013cab5
lea rax, [rbx + rbx*2]
mov rbx, rdi
vmovups xmm0, xmmword [rsi]
vmovups xmmword [r14 + rax*8], xmm0
vmovsd xmm1, qword [rsi + 0x10]
vmovsd qword [r14 + rax*8 + 0x10], xmm1
cmp r15, rdi
jl 0x14013ca70
vmovups xmm0, xmmword [rbp]
lea rax, [rbx + rbx*2]
mov rbx, qword [rsp + 0x60]
vmovups xmmword [r14 + rax*8], xmm0
vmovsd xmm1, qword [rbp + 0x10]
vmovsd qword [r14 + rax*8 + 0x10], xmm1
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14013caf0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov qword [rsp + 0x50], r12
lea rsi, [r8 - 1]
sar rsi, 1
mov rbp, r9
mov qword [rsp + 0x58], r13
mov r12, r8
mov rbx, rdx
mov r14, rcx
mov r15, rdx
cmp rdx, rsi
jge 0x14013cb85
nop word [rax + rax]
lea rdi, [rdx + rdx]
lea rax, [rdi + 2]
lea rax, [rax + rax*2]
lea rdx, [r14 + rax*8]
lea r8, [rdx - 0x18]
lea rcx, [rsp + 0x70]
call fcn.14012fb40
movzx edx, al
lea rax, [rbx + rbx*2]
xor rdx, 1
inc rdx
add rdx, rdi
mov rbx, rdx
lea rcx, [rdx + rdx*2]
vmovups xmm0, xmmword [r14 + rcx*8]
vmovups xmmword [r14 + rax*8], xmm0
vmovsd xmm1, qword [r14 + rcx*8 + 0x10]
vmovsd qword [r14 + rax*8 + 0x10], xmm1
cmp rdx, rsi
jl 0x14013cb30
jne 0x14013cbb5
test r12b, 1
jne 0x14013cbb5
lea rax, [rbx + rbx*2]
lea rcx, [r12 + r12*2]
vmovups xmm0, xmmword [r14 + rcx*8 - 0x18]
vmovups xmmword [r14 + rax*8], xmm0
vmovsd xmm1, qword [r14 + rcx*8 - 8]
vmovsd qword [r14 + rax*8 + 0x10], xmm1
lea rbx, [r12 - 1]
mov rax, qword [rsp + 0x70]
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x50]
mov qword [rsp + 0x70], rax
cmp r15, rbx
jge 0x14013cc15
nop
lea rdi, [rbx - 1]
mov r8, rbp
sar rdi, 1
lea rcx, [rsp + 0x70]
lea rax, [rdi + rdi*2]
lea rsi, [r14 + rax*8]
mov rdx, rsi
call fcn.14012fb40
test al, al
je 0x14013cc15
lea rax, [rbx + rbx*2]
mov rbx, rdi
vmovups xmm0, xmmword [rsi]
vmovups xmmword [r14 + rax*8], xmm0
vmovsd xmm1, qword [rsi + 0x10]
vmovsd qword [r14 + rax*8 + 0x10], xmm1
cmp r15, rdi
jl 0x14013cbd0
vmovups xmm0, xmmword [rbp]
lea rax, [rbx + rbx*2]
mov rbx, qword [rsp + 0x60]
vmovups xmmword [r14 + rax*8], xmm0
vmovsd xmm1, qword [rbp + 0x10]
vmovsd qword [r14 + rax*8 + 0x10], xmm1
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14013cc50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov qword [rsp + 0x50], r12
lea rsi, [r8 - 1]
sar rsi, 1
mov rbp, r9
mov qword [rsp + 0x58], r13
mov r12, r8
mov rbx, rdx
mov r14, rcx
mov r15, rdx
cmp rdx, rsi
jge 0x14013cce5
nop word [rax + rax]
lea rdi, [rdx + rdx]
lea rax, [rdi + 2]
lea rax, [rax + rax*2]
lea rdx, [r14 + rax*8]
lea r8, [rdx - 0x18]
lea rcx, [rsp + 0x70]
call fcn.140131fd0
movzx edx, al
lea rax, [rbx + rbx*2]
xor rdx, 1
inc rdx
add rdx, rdi
mov rbx, rdx
lea rcx, [rdx + rdx*2]
vmovups xmm0, xmmword [r14 + rcx*8]
vmovups xmmword [r14 + rax*8], xmm0
vmovsd xmm1, qword [r14 + rcx*8 + 0x10]
vmovsd qword [r14 + rax*8 + 0x10], xmm1
cmp rdx, rsi
jl 0x14013cc90
jne 0x14013cd15
test r12b, 1
jne 0x14013cd15
lea rax, [rbx + rbx*2]
lea rcx, [r12 + r12*2]
vmovups xmm0, xmmword [r14 + rcx*8 - 0x18]
vmovups xmmword [r14 + rax*8], xmm0
vmovsd xmm1, qword [r14 + rcx*8 - 8]
vmovsd qword [r14 + rax*8 + 0x10], xmm1
lea rbx, [r12 - 1]
mov rax, qword [rsp + 0x70]
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x50]
mov qword [rsp + 0x70], rax
cmp r15, rbx
jge 0x14013cd75
nop
lea rdi, [rbx - 1]
mov r8, rbp
sar rdi, 1
lea rcx, [rsp + 0x70]
lea rax, [rdi + rdi*2]
lea rsi, [r14 + rax*8]
mov rdx, rsi
call fcn.140131fd0
test al, al
je 0x14013cd75
lea rax, [rbx + rbx*2]
mov rbx, rdi
vmovups xmm0, xmmword [rsi]
vmovups xmmword [r14 + rax*8], xmm0
vmovsd xmm1, qword [rsi + 0x10]
vmovsd qword [r14 + rax*8 + 0x10], xmm1
cmp r15, rdi
jl 0x14013cd30
vmovups xmm0, xmmword [rbp]
lea rax, [rbx + rbx*2]
mov rbx, qword [rsp + 0x60]
vmovups xmmword [r14 + rax*8], xmm0
vmovsd xmm1, qword [rbp + 0x10]
vmovsd qword [r14 + rax*8 + 0x10], xmm1
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140149e30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movabs rax, 0x9e3779b185ebca87
lea rdi, [0x140db1440]
mov r9, rdx
mov r11d, edx
imul r9, rax
shr r11d, 4
mov rbx, rdx
xor r8d, r8d
mov r10, rcx
nop word [rax + rax]
mov eax, r8d
inc r8d
shl eax, 4
mov ecx, eax
mov rdx, qword [rax + r10]
mov rax, qword [rax + rdi + 8]
xor rax, qword [rcx + r10 + 8]
mov rcx, qword [rcx + rdi]
xor rcx, rdx
mul rcx
xor rax, rdx
add r9, rax
cmp r8d, 8
jb 0x140149e70
mov rax, qword [0x140db14bf]
movabs rsi, 0x165667919e3779f9
xor rax, qword [r10 + rbx - 8]
mov r8d, 8
mov rcx, qword [0x140db14b7]
xor rcx, qword [r10 + rbx - 0x10]
mul rcx
mov rcx, r9
shr rcx, 0x25
mov rbx, rax
xor rcx, r9
xor rbx, rdx
imul rcx, rsi
mov r9, rcx
shr r9, 0x20
xor r9, rcx
cmp r11d, r8d
jbe 0x140149f26
nop dword [rax]
mov eax, r8d
mov ecx, r8d
shl ecx, 4
inc r8d
shl eax, 4
add ecx, 0xffffff80
mov rdx, qword [rcx + rdi + 0xb]
xor rdx, qword [rax + r10 + 8]
mov rcx, qword [rcx + rdi + 3]
xor rcx, qword [rax + r10]
mov rax, rdx
mul rcx
xor rdx, rax
add rbx, rdx
cmp r8d, r11d
jb 0x140149ef0
mov rdi, qword [rsp + 0x18]
lea rax, [rbx + r9]
mov rbx, qword [rsp + 8]
mov rcx, rax
shr rcx, 0x25
xor rcx, rax
imul rcx, rsi
mov rsi, qword [rsp + 0x10]
mov rax, rcx
shr rax, 0x20
xor rax, rcx
ret
Function at 0x1401709f0
Capabilities:
Initialize winsock library
Terminate process

Disassembly:
sub rsp, 0x1d8
mov rax, qword [0x14143b040]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov rax, qword gs:[0x58]
mov edx, 8
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x14145c140], eax
jle 0x140170a80
lea rcx, [0x14145c140]
call fcn.1403f4e98
cmp dword [0x14145c140], 0xffffffff
jne 0x140170a80
mov ecx, 0x202
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x140170a74
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, [0x1413cd118]
call fcn.140001250
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, [0x14145c140]
call fcn.1403f4e2c
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1403f4b10
add rsp, 0x1d8
ret