joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001f260
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f54a4], 1
je 0x14001f2d9
mov r8, rdx
movabs r10, 0x8618618618618619
xor r9d, r9d
mov r11, rdx
mov esi, reloc.WS2_32.dll_setsockopt
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub r9, rdx
shr r9, 1
add r9, rdx
shr r9, 4
imul rdx, r9, 0xffffffffffffffeb
movzx r9d, byte [r8 + rsi]
xor r9b, byte [r11 + rdx]
mov byte [rcx + rsi - 0x15], r9b
mov rdx, rsi
inc rdx
mov rsi, rdx
inc r11
inc rax
cmp edx, 0x20
mov r9, rax
jne 0x14001f290
mov dword [0x1400f54a4], 1
mov eax, 0x4e8fe2e5
pop rsi
ret

Function at 0x14001f690
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f54bc], 1
je 0x14001f6fa
mov r8, rdx
movabs r10, 0xcccccccccccccccd
xor r9d, r9d
mov eax, reloc.WS2_32.dll_sendto
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 2
and rdx, 0xfffffffffffffffc
lea rax, [rdx + rdx*4]
neg rax
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x14], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x25
mov rdx, rsi
jne 0x14001f6b0
mov dword [0x1400f54bc], 1
mov eax, 0x5a4d5d73
pop rsi
ret

Function at 0x140020b70
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
cmp dword [0x1400f5494], 1
je 0x140020bd0
mov r8, rdx
movabs r10, 0xf0f0f0f0f0f0f0f1
xor r9d, r9d
nop dword [rax]
mov rax, r9
mul r10
shr rdx, 4
mov eax, edx
shl edx, 4
add edx, eax
movzx eax, byte [r8 + r9 + 0x11]
mov r11d, r9d
sub r11d, edx
movsxd rdx, r11d
xor al, byte [r8 + rdx]
mov byte [rcx + r9], al
mov rax, r9
inc rax
mov r9, rax
cmp eax, 0x16
jne 0x140020b90
mov dword [0x1400f5494], 1
mov eax, 0xfed9f5c0
ret

Function at 0x140021e80
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f5524], 1
je 0x140021eea
mov r8, rdx
movabs r10, 0xcccccccccccccccd
xor r9d, r9d
mov eax, reloc.WS2_32.dll_sendto
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 2
and rdx, 0xfffffffffffffffc
lea rax, [rdx + rdx*4]
neg rax
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x14], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x21
mov rdx, rsi
jne 0x140021ea0
mov dword [0x1400f5524], 1
mov eax, 0xf7d9c33b
pop rsi
ret

Function at 0x1400228f0
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f581c], 1
je 0x14002295a
mov r8, rdx
movabs r10, 0xcccccccccccccccd
xor r9d, r9d
mov eax, reloc.WS2_32.dll_sendto
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 2
and rdx, 0xfffffffffffffffc
lea rax, [rdx + rdx*4]
neg rax
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x14], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x1d
mov rdx, rsi
jne 0x140022910
mov dword [0x1400f581c], 1
mov eax, 0x6f60d77b
pop rsi
ret
Function at 0x140022b00
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f5688], 1
je 0x140022b6a
mov r8, rdx
movabs r10, 0xe38e38e38e38e38f
xor r9d, r9d
mov eax, reloc.WS2_32.dll_select
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 3
and rdx, 0xfffffffffffffffe
lea rax, [rdx + rdx*8]
neg rax
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x12], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x1e
mov rdx, rsi
jne 0x140022b20
mov dword [0x1400f5688], 1
mov eax, 0x8849bd12
pop rsi
ret

Function at 0x140022b80
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f5678], 1
je 0x140022bf9
mov r8, rdx
movabs r10, 0x8618618618618619
xor r9d, r9d
mov r11, rdx
mov esi, reloc.WS2_32.dll_setsockopt
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub r9, rdx
shr r9, 1
add r9, rdx
shr r9, 4
imul rdx, r9, 0xffffffffffffffeb
movzx r9d, byte [r8 + rsi]
xor r9b, byte [r11 + rdx]
mov byte [rcx + rsi - 0x15], r9b
mov rdx, rsi
inc rdx
mov rsi, rdx
inc r11
inc rax
cmp edx, 0x21
mov r9, rax
jne 0x140022bb0
mov dword [0x1400f5678], 1
mov eax, 0xa6cb399a
pop rsi
ret

Function at 0x140022c00
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f475c], 1
je 0x140022c63
mov r8, rdx
movabs r10, 0x2e8ba2e8ba2e8ba3
xor r9d, r9d
mov eax, reloc.WLDAP32.dll_Ordinal_22
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 2
imul rax, rdx, 0xffffffffffffffea
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x16], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x19
mov rdx, rsi
jne 0x140022c20
mov dword [0x1400f475c], 1
mov eax, 0x95484054
pop rsi
ret

Function at 0x140022f20
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f56a8], 1
je 0x140022f8a
mov r8, rdx
movabs r10, 0xe38e38e38e38e38f
xor r9d, r9d
mov eax, reloc.WS2_32.dll_select
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 3
and rdx, 0xfffffffffffffffe
lea rax, [rdx + rdx*8]
neg rax
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x12], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x1c
mov rdx, rsi
jne 0x140022f40
mov dword [0x1400f56a8], 1
mov eax, 0x3bb2570f
pop rsi
ret

Function at 0x140022fa0
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f5698], 1
je 0x140023014
mov r8, rdx
movabs r10, 0xf0f0f0f0f0f0f0f1
xor r9d, r9d
mov r11, rdx
mov eax, reloc.WS2_32.dll_recvfrom
nop word cs:[rax + rax]
nop dword [rax]
mov rsi, rax
mov rax, r9
mul r10
mov rax, rdx
shr rdx, 4
and rax, 0xfffffffffffffff0
add rax, rdx
neg rax
movzx edx, byte [r8 + rsi]
xor dl, byte [r11 + rax]
mov byte [rcx + rsi - 0x11], dl
inc rsi
mov rax, rsi
mov edx, esi
inc r11
inc r9
cmp esi, 0x1b
jne 0x140022fd0
mov dword [0x1400f5698], 1
mov eax, 0xf93948ff
pop rsi
ret
Function at 0x1400232b0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f56bc], 1
je 0x140023329
mov r8, rdx
movabs r10, 0x642c8590b21642c9
xor r9d, r9d
mov r11, rdx
mov esi, reloc.WS2_32.dll_socket
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub r9, rdx
shr r9, 1
add r9, rdx
shr r9, 4
imul rdx, r9, 0xffffffffffffffe9
movzx r9d, byte [r8 + rsi]
xor r9b, byte [r11 + rdx]
mov byte [rcx + rsi - 0x17], r9b
mov rdx, rsi
inc rdx
mov rsi, rdx
inc r11
inc rax
cmp edx, 0x25
mov r9, rax
jne 0x1400232e0
mov dword [0x1400f56bc], 1
mov eax, 0xe4283dd0
pop rsi
ret

Function at 0x140023330
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f56d0], 1
je 0x140023399
mov r8, rdx
movabs r10, 0xaaaaaaaaaaaaaaab
xor r9d, r9d
mov eax, Ordinal_27
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 1
and rdx, 0xfffffffffffffff8
lea rax, [rdx + rdx*2]
neg rax
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x18], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x27
mov rdx, rsi
jne 0x140023350
mov dword [0x1400f56d0], 1
mov eax, 0x9e56fd18
pop rsi
ret

Function at 0x1400234d0
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400f56d8], 1
je 0x140023507
xor eax, eax
nop dword [rax + rax]
movzx r8d, byte [rdx + rax + 0x10]
xor r8b, byte [rdx + rax]
mov byte [rcx + rax], r8b
mov r8, rax
inc r8
mov rax, r8
cmp r8d, 3
jne 0x1400234e0
mov dword [0x1400f56d8], 1
mov eax, 0x8c9fbf6e
ret

Function at 0x140023510
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f5720], 1
je 0x140023579
mov r8, rdx
movabs r10, 0xaaaaaaaaaaaaaaab
xor r9d, r9d
mov eax, Ordinal_27
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 1
and rdx, 0xfffffffffffffff8
lea rax, [rdx + rdx*2]
neg rax
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x18], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x28
mov rdx, rsi
jne 0x140023530
mov dword [0x1400f5720], 1
mov eax, 0xc13f019a
pop rsi
ret

Function at 0x140023700
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f5734], 1
je 0x140023763
mov r8, rdx
movabs r10, 0x4ec4ec4ec4ec4ec5
xor r9d, r9d
mov eax, reloc.WLDAP32.dll_Ordinal_26
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 3
imul rax, rdx, 0xffffffffffffffe6
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x1a], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x27
mov rdx, rsi
jne 0x140023720
mov dword [0x1400f5734], 1
mov eax, 0x41a65487
pop rsi
ret
Function at 0x140023770
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f5748], 1
je 0x1400237e9
mov r8, rdx
movabs r10, 0x47ae147ae147ae15
xor r9d, r9d
mov r11, rdx
mov esi, Ordinal_27
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub r9, rdx
shr r9, 1
add r9, rdx
shr r9, 4
imul rdx, r9, 0xffffffffffffffe7
movzx r9d, byte [r8 + rsi]
xor r9b, byte [r11 + rdx]
mov byte [rcx + rsi - 0x19], r9b
mov rdx, rsi
inc rdx
mov rsi, rdx
inc r11
inc rax
cmp edx, 0x27
mov r9, rax
jne 0x1400237a0
mov dword [0x1400f5748], 1
mov eax, 0x2c8e1c21
pop rsi
ret

Function at 0x1400237f0
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f575c], 1
je 0x140023853
mov r8, rdx
movabs r10, 0x97b425ed097b425f
xor r9d, r9d
mov eax, reloc.WLDAP32.dll_Ordinal_27
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 4
imul rax, rdx, 0xffffffffffffffe5
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x1b], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x28
mov rdx, rsi
jne 0x140023810
mov dword [0x1400f575c], 1
mov eax, 0xc056c581
pop rsi
ret

Function at 0x140023860
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f5770], 1
je 0x1400238c3
mov r8, rdx
movabs r10, 0x97b425ed097b425f
xor r9d, r9d
mov eax, reloc.WLDAP32.dll_Ordinal_27
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 4
imul rax, rdx, 0xffffffffffffffe5
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x1b], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x2a
mov rdx, rsi
jne 0x140023880
mov dword [0x1400f5770], 1
mov eax, 0x5b0c5583
pop rsi
ret

Function at 0x1400238d0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f5784], 1
je 0x140023949
mov r8, rdx
movabs r10, 0x8618618618618619
xor r9d, r9d
mov r11, rdx
mov esi, reloc.WS2_32.dll_setsockopt
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub r9, rdx
shr r9, 1
add r9, rdx
shr r9, 4
imul rdx, r9, 0xffffffffffffffeb
movzx r9d, byte [r8 + rsi]
xor r9b, byte [r11 + rdx]
mov byte [rcx + rsi - 0x15], r9b
mov rdx, rsi
inc rdx
mov rsi, rdx
inc r11
inc rax
cmp edx, 0x24
mov r9, rax
jne 0x140023900
mov dword [0x1400f5784], 1
mov eax, 0xf932e4c4
pop rsi
ret

Function at 0x140023950
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f578c], 1
je 0x1400239b3
mov r8, rdx
movabs r10, 0x97b425ed097b425f
xor r9d, r9d
mov eax, reloc.WLDAP32.dll_Ordinal_27
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 4
imul rax, rdx, 0xffffffffffffffe5
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x1b], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x1f
mov rdx, rsi
jne 0x140023970
mov dword [0x1400f578c], 1
mov eax, 0x6d509413
pop rsi
ret
Function at 0x1400239c0
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f5794], 1
je 0x140023a2a
mov r8, rdx
movabs r10, 0xe38e38e38e38e38f
xor r9d, r9d
mov eax, reloc.WS2_32.dll_select
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 3
and rdx, 0xfffffffffffffffe
lea rax, [rdx + rdx*8]
neg rax
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x12], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x16
mov rdx, rsi
jne 0x1400239e0
mov dword [0x1400f5794], 1
mov eax, 0xe665badc
pop rsi
ret

Function at 0x140023a40
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f579c], 1
je 0x140023aaa
mov r8, rdx
movabs r10, 0xe38e38e38e38e38f
xor r9d, r9d
mov eax, reloc.WS2_32.dll_select
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 3
and rdx, 0xfffffffffffffffe
lea rax, [rdx + rdx*8]
neg rax
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x12], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x16
mov rdx, rsi
jne 0x140023a60
mov dword [0x1400f579c], 1
mov eax, 0x400d79f4
pop rsi
ret

Function at 0x140023ac0
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f57a4], 1
je 0x140023b23
mov r8, rdx
movabs r10, 0x8888888888888889
xor r9d, r9d
mov eax, reloc.WLDAP32.dll_Ordinal_30
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 4
imul rax, rdx, 0xffffffffffffffe2
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x1e], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x22
mov rdx, rsi
jne 0x140023ae0
mov dword [0x1400f57a4], 1
mov eax, 0x84031501
pop rsi
ret

Function at 0x140023b30
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f57ac], 1
je 0x140023b93
mov r8, rdx
movabs r10, 0x97b425ed097b425f
xor r9d, r9d
mov eax, reloc.WLDAP32.dll_Ordinal_27
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 4
imul rax, rdx, 0xffffffffffffffe5
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x1b], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x1f
mov rdx, rsi
jne 0x140023b50
mov dword [0x1400f57ac], 1
mov eax, 0x29a4ada
pop rsi
ret

Function at 0x140023ba0
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f57b4], 1
je 0x140023c03
mov r8, rdx
movabs r10, 0x2e8ba2e8ba2e8ba3
xor r9d, r9d
mov eax, reloc.WLDAP32.dll_Ordinal_22
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 2
imul rax, rdx, 0xffffffffffffffea
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x16], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x1a
mov rdx, rsi
jne 0x140023bc0
mov dword [0x1400f57b4], 1
mov eax, 0x946a763a
pop rsi
ret
Function at 0x140023c10
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f57dc], 1
je 0x140023c7a
mov r8, rdx
movabs r10, 0xe38e38e38e38e38f
xor r9d, r9d
mov eax, reloc.WS2_32.dll_select
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 3
and rdx, 0xfffffffffffffffe
lea rax, [rdx + rdx*8]
neg rax
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x12], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x1f
mov rdx, rsi
jne 0x140023c30
mov dword [0x1400f57dc], 1
mov eax, 0x1cf5596d
pop rsi
ret

Function at 0x140023c90
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f57f8], 1
je 0x140023cf9
mov r8, rdx
movabs r10, 0xaaaaaaaaaaaaaaab
xor r9d, r9d
mov eax, Ordinal_27
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 1
and rdx, 0xfffffffffffffff8
lea rax, [rdx + rdx*2]
neg rax
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x18], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x2f
mov rdx, rsi
jne 0x140023cb0
mov dword [0x1400f57f8], 1
mov eax, 0xdabe90c6
pop rsi
ret

Function at 0x140023d00
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400f580c], 1
je 0x140023d37
xor eax, eax
nop dword [rax + rax]
movzx r8d, byte [rdx + rax + 0x10]
xor r8b, byte [rdx + rax]
mov byte [rcx + rax], r8b
mov r8, rax
inc r8
mov rax, r8
cmp r8d, 0xe
jne 0x140023d10
mov dword [0x1400f580c], 1
mov eax, 0xfad01819
ret

Function at 0x140023d40
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f56fc], 1
je 0x140023db4
mov r8, rdx
movabs r10, 0xf0f0f0f0f0f0f0f1
xor r9d, r9d
mov r11, rdx
mov eax, reloc.WS2_32.dll_recvfrom
nop word cs:[rax + rax]
nop dword [rax]
mov rsi, rax
mov rax, r9
mul r10
mov rax, rdx
shr rdx, 4
and rax, 0xfffffffffffffff0
add rax, rdx
neg rax
movzx edx, byte [r8 + rsi]
xor dl, byte [r11 + rax]
mov byte [rcx + rsi - 0x11], dl
inc rsi
mov rax, rsi
mov edx, esi
inc r11
inc r9
cmp esi, 0x1d
jne 0x140023d70
mov dword [0x1400f56fc], 1
mov eax, 0xd1ab1fae
pop rsi
ret

Function at 0x140023f30
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f57c8], 1
je 0x140023f93
mov r8, rdx
movabs r10, 0x8888888888888889
xor r9d, r9d
mov eax, reloc.WLDAP32.dll_Ordinal_30
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 4
imul rax, rdx, 0xffffffffffffffe2
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x1e], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x2c
mov rdx, rsi
jne 0x140023f50
mov dword [0x1400f57c8], 1
mov eax, 0x2289ef15
pop rsi
ret

Function at 0x140023fa0
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f570c], 1
je 0x140024003
mov r8, rdx
movabs r10, 0xd79435e50d79435f
xor r9d, r9d
mov eax, reloc.WS2_32.dll_send
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 4
imul rax, rdx, 0xffffffffffffffed
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x13], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x1f
mov rdx, rsi
jne 0x140023fc0
mov dword [0x1400f570c], 1
mov eax, 0x3399b440
pop rsi
ret
Function at 0x140024210
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400f47c8], 1
je 0x14002424e
xor eax, eax
nop dword [rax + rax]
movzx r8d, byte [rdx + rax + 0x10]
mov r9d, eax
and r9d, 0xf
xor r8b, byte [rdx + r9]
mov byte [rcx + rax], r8b
mov r8, rax
inc r8
mov rax, r8
cmp r8d, 0x2d
jne 0x140024220
mov dword [0x1400f47c8], 1
mov eax, 0x4ba151dc
ret

Function at 0x140024360
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f47dc], 1
je 0x1400243c3
mov r8, rdx
movabs r10, 0xd79435e50d79435f
xor r9d, r9d
mov eax, reloc.WS2_32.dll_send
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 4
imul rax, rdx, 0xffffffffffffffed
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x13], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x23
mov rdx, rsi
jne 0x140024380
mov dword [0x1400f47dc], 1
mov eax, 0x47fbc0cd
pop rsi
ret

Function at 0x140025b90
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400f53c4], 1
je 0x140025bf7
mov r8, rdx
movabs r10, 0x8618618618618619
xor r9d, r9d
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
imul eax, eax, 0xffffffeb
movzx edx, byte [r8 + r9 + 0x15]
mov r11d, r9d
add eax, r9d
cdqe
xor dl, byte [r8 + rax]
mov byte [rcx + r9], dl
mov rax, r9
inc rax
mov r9, rax
cmp eax, 0x29
jne 0x140025bb0
mov dword [0x1400f53c4], 1
mov eax, 0x88a1c5e7
ret

Function at 0x140025c00
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400f53f4], 1
je 0x140025c67
mov r8, rdx
movabs r10, 0x642c8590b21642c9
xor r9d, r9d
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
imul eax, eax, 0xffffffe9
movzx edx, byte [r8 + r9 + 0x17]
mov r11d, r9d
add eax, r9d
cdqe
xor dl, byte [r8 + rax]
mov byte [rcx + r9], dl
mov rax, r9
inc rax
mov r9, rax
cmp eax, 0x29
jne 0x140025c20
mov dword [0x1400f53f4], 1
mov eax, 0xb63e02b9
ret

Function at 0x140025c70
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400f5434], 1
je 0x140025cc6
xor eax, eax
nop dword [rax + rax]
mov r8d, eax
mov r9d, eax
shr r9d, 2
imul r9, r9, 0x24924925
shr r9, 0x20
imul r9d, r9d, 0xffffffe4
movzx r10d, byte [rdx + rax + 0x1c]
add r9d, eax
movsxd r8, r9d
xor r10b, byte [rdx + r8]
mov byte [rcx + rax], r10b
mov r8, rax
inc r8
mov rax, r8
cmp r8d, 0x3b
jne 0x140025c80
mov dword [0x1400f5434], 1
mov eax, 0xe58210e9
ret

Function at 0x140025cd0
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400f546c], 1
je 0x140025d31
mov r8, rdx
movabs r9, 0x4924924924924925
xor eax, eax
nop dword [rax + rax]
mov r10, rax
shr rax, 2
mul r9
shr rdx, 1
mov eax, edx
imul eax, edx, 0xffffffe4
movzx edx, byte [r8 + r10 + 0x1c]
mov r11d, r10d
add eax, r10d
cdqe
xor dl, byte [r8 + rax]
mov byte [rcx + r10], dl
inc r10
mov rax, r10
mov edx, r10d
cmp r10d, 0x33
jne 0x140025cf0
mov dword [0x1400f546c], 1
mov eax, 0xbf6e48f0
ret
Function at 0x140025d70
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400f4868], 1
je 0x140025dcd
mov r8, rdx
movabs r10, 0xd79435e50d79435f
xor r9d, r9d
nop dword [rax]
mov rax, r9
mul r10
shr rdx, 4
mov eax, edx
imul eax, edx, 0xffffffed
movzx edx, byte [r8 + r9 + 0x13]
mov r11d, r9d
add eax, r9d
cdqe
xor dl, byte [r8 + rax]
mov byte [rcx + r9], dl
mov rax, r9
inc rax
mov r9, rax
cmp eax, 0x26
jne 0x140025d90
mov dword [0x1400f4868], 1
mov eax, 0xc35b0ca
ret

Function at 0x140026f90
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400f5394], 1
je 0x140026ff1
mov r8, rdx
movabs r10, 0xcccccccccccccccd
xor r9d, r9d
nop dword [rax]
mov rax, r9
mul r10
shr rdx, 4
mov eax, edx
shl eax, 2
lea eax, [rax + rax*4]
movzx edx, byte [r8 + r9 + 0x14]
mov r11d, r9d
sub r11d, eax
movsxd rax, r11d
xor dl, byte [r8 + rax]
mov byte [rcx + r9], dl
mov rax, r9
inc rax
mov r9, rax
cmp eax, 0x26
jne 0x140026fb0
mov dword [0x1400f5394], 1
mov eax, 0x11b49b7b
ret

Function at 0x140027000
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400f483c], 1
je 0x14002705d
mov r8, rdx
movabs r10, 0x4ec4ec4ec4ec4ec5
xor r9d, r9d
nop dword [rax]
mov rax, r9
mul r10
shr rdx, 3
mov eax, edx
imul eax, edx, 0xffffffe6
movzx edx, byte [r8 + r9 + 0x1a]
mov r11d, r9d
add eax, r9d
cdqe
xor dl, byte [r8 + rax]
mov byte [rcx + r9], dl
mov rax, r9
inc rax
mov r9, rax
cmp eax, 0x30
jne 0x140027020
mov dword [0x1400f483c], 1
mov eax, 0xd6f88660
ret

Function at 0x140027070
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400f4808], 1
je 0x1400270cd
mov r8, rdx
movabs r10, 0x2e8ba2e8ba2e8ba3
xor r9d, r9d
nop dword [rax]
mov rax, r9
mul r10
shr rdx, 2
mov eax, edx
imul eax, edx, 0xffffffea
movzx edx, byte [r8 + r9 + 0x16]
mov r11d, r9d
add eax, r9d
cdqe
xor dl, byte [r8 + rax]
mov byte [rcx + r9], dl
mov rax, r9
inc rax
mov r9, rax
cmp eax, 0x26
jne 0x140027090
mov dword [0x1400f4808], 1
mov eax, 0xc042ac36
ret

Function at 0x140029f50
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
cmp dword [0x1400f5668], 1
je 0x140029fb0
mov r8, rdx
movabs r10, 0xf0f0f0f0f0f0f0f1
xor r9d, r9d
nop dword [rax]
mov rax, r9
mul r10
shr rdx, 4
mov eax, edx
shl edx, 4
add edx, eax
movzx eax, byte [r8 + r9 + 0x11]
mov r11d, r9d
sub r11d, edx
movsxd rdx, r11d
xor al, byte [r8 + rdx]
mov byte [rcx + r9], al
mov rax, r9
inc rax
mov r9, rax
cmp eax, 0x17
jne 0x140029f70
mov dword [0x1400f5668], 1
mov eax, 0xf3cf9f5d
ret

Function at 0x14002a450
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400f5574], 1
je 0x14002a4b3
mov r8, rdx
movabs r10, 0x8888888888888889
xor r9d, r9d
mov eax, reloc.WLDAP32.dll_Ordinal_30
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 4
imul rax, rdx, 0xffffffffffffffe2
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x1e], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x2f
mov rdx, rsi
jne 0x14002a470
mov dword [0x1400f5574], 1
mov eax, 0xe7eea625
pop rsi
ret