joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140094e90
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1404e4980]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140094f63
cmp byte [rcx + 0x71], 0
je 0x140094f63
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x140094f5f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140094f24
sub eax, 1
je 0x140094f28
cmp eax, 2
jne 0x140094f5f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14017d1a0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140094f56
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140094f5f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140094f0c
xor al, al
jmp 0x140094f0c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14017d1a0
add rsp, 0x60
pop rbx
ret
Function at 0x140094f80
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, qword [rcx]
mov r10d, 0x270
mov ecx, dword [r9]
cmp ecx, r10d
jne 0x140094fe1
lea r8, [r9 + 8]
nop dword [rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x140094fa0
mov ecx, dword [r9]
jmp 0x1400950cb
cmp ecx, 0x4e0
jb 0x1400950cb
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x140095000
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x140095050
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x14009a540
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1404e4980]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov esi, edx
mov rdi, rcx
cmp edx, 0xffffffff
jne 0x14009a56d
xor eax, eax
jmp 0x14009a6d6
mov qword [rsp + 0xa0], rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
test rax, rax
je 0x14009a5ad
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::epptr_void_const___ptr64]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
cmp rax, rbx
jae 0x14009a5ad
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], sil
mov eax, esi
jmp 0x14009a6ce
cmp qword [rdi + 0x80], 0
je 0x14009a6c9
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::eback_void_const___ptr64]
lea rcx, [rdi + 0x70]
cmp rax, rcx
jne 0x14009a5e7
mov rdx, qword [rdi + 0x88]
mov rcx, rdi
mov r9, qword [rdi + 0x90]
mov r8, rdx
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::setg_char____ptr64__char____ptr64__char____ptr64____ptr64]
mov rcx, qword [rdi + 0x68]
test rcx, rcx
jne 0x14009a612
mov rdx, qword [rdi + 0x80]
movsx ecx, sil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x14009a6ce
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], sil
mov qword [rsp + 0x38], rax
lea rdx, [rdi + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14009a681
sub eax, 1
je 0x14009a681
cmp eax, 2
jne 0x14009a6c9
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rdi + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x14009a6ce
mov rbx, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rbx, rax
je 0x14009a6af
mov r9, qword [rdi + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbx
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x14009a6c9
lea rax, [rsp + 0x50]
mov byte [rdi + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, esi
mov eax, ecx
jmp 0x14009a6ce
mov eax, 0xffffffff
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14017d1a0
mov rsi, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x14009b530
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rsi, r8
mov r14, rdx
mov rbp, rcx
test r8, r8
jg 0x14009b552
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je case.default.0x14009b561
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x28], rbx
mov rbx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
test rax, rax
je 0x14009b5b2
cmp rax, rsi
mov rdi, rsi
mov rcx, rbp
cmovb rdi, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, rdi
mov rcx, r14
mov rdx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, edi
mov rcx, rbp
add r14, rdi
sub rbx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
cmp qword [rbp + 0x80], 0
mov rdi, rbx
je 0x14009b621
mov rcx, rbp
call fcn.140095130
cmp rbx, 0xfff
jbe 0x14009b601
mov r9, qword [rbp + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
add r14, rax
mov rdi, rbx
cmp rax, 0xfff
jne 0x14009b63a
cmp rbx, rax
ja 0x14009b5d0
test rdi, rdi
je 0x14009b621
mov r9, qword [rbp + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
sub rsi, rdi
mov rbx, qword [rsp + 0x28]
mov rax, rsi
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
sub rsi, rbx
jmp 0x14009b624
scasd eax, dword [rdi]
clc
mov bl, 0x9f
call [rcx]
jg 0x14033ca20
clc
sar dword [rdi], cl
add r15d, dword [rcx + rdi*8 - 0x1e]
jnp 0x14033ca27
and eax, 0x4cbaba7f
lahf
movabs dword [0x872ef7bbde62e9b5], eax
invalid
Function at 0x14009b640
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je case.default.0x14009b661
add rsp, 0x20
pop r14
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov rbp, rax
test rbx, rbx
jle 0x14009b6dc
test rax, rax
jle 0x14009b6bc
cmp rbx, rax
mov rcx, rdi
cmovl rbp, rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, rbp
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, ebp
mov rcx, rdi
add r14, rbp
sub rbx, rbp
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
test rbx, rbx
jle 0x14009b6dc
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14009b6dc
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x40]
sub rsi, rbx
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rbx
ret
mov ecx, 0x736eb75
pop rdi
invalid
Function at 0x1400bbac0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rbx, rdx
xor edi, edi
mov ecx, dword [0x1404e7590]
mov rax, qword gs:[0x58]
mov edx, 4
mov rsi, qword [rax + rcx*8]
add rsi, rdx
mov eax, dword [rsi]
cmp dword [0x1404e5e68], eax
jg 0x1400bbbf7
mov ebp, dword [reloc.WS2_32.dll_accept]
mov eax, dword [rsi]
cmp dword [0x1404e5e98], eax
jg 0x1400bbc2d
cmp byte [0x1404e5e67], 0
jne 0x1400bbb60
cmp ebp, 2
jge 0x1400bbb60
lea r8, [0x1404e5e64]
nop dword [rax + rax]
mov eax, 0x5397829d
imul edi
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 1
sub al, dl
movsx eax, al
imul ecx, eax, 0x31
add cl, dil
xor byte [r8], cl
inc edi
lea r8, [r8 + 1]
cmp edi, 4
jl 0x1400bbb30
nop
mov dword [0x1404e5e64], 0
lea rdi, [0x1404e5e64]
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
lea rdx, [0x1404e5e70]
mov rcx, rbx
call fcn.14003fa30
movzx eax, byte [0x1404e5e90]
mov byte [rbx + 0x20], al
mov rax, rbx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
lea rdx, [0x1404e5e64]
lea rcx, [rsp + 0x28]
call fcn.1400b7450
nop
lea rdx, [rsp + 0x28]
lea rcx, [0x1404e5e70]
call fcn.1400b8790
nop
lea rcx, [rsp + 0x28]
call fcn.14003fc80
lea rcx, [0x1401872e0]
call fcn.14017cf54
nop
lea rcx, [0x1404e5e98]
call fcn.14017cfa8
jmp 0x1400bbb16
lea rcx, [0x1404e5e68]
call fcn.14017d014
cmp dword [0x1404e5e68], 0xffffffff
jne 0x1400bbb02
mov eax, dword [str.UPT4]
mov dword [0x1404e5e64], eax
lea rcx, [0x1404e5e68]
call fcn.14017cfa8
jmp 0x1400bbb02
lea rcx, [0x1404e5e98]
call fcn.14017d014
cmp dword [0x1404e5e98], 0xffffffff
jne 0x1400bbb16
cmp byte [0x1404e5e67], 0
je 0x1400bbbab
cmp ebp, 2
jl 0x1400bbce3
movdqa xmm3, xmmword [0x14018f690]
movdqa xmm2, xmm3
punpckldq xmm2, xmm3
pmuldq xmm2, xmmword [0x1401937c0]
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmmword [0x1401937c0]
shufps xmm2, xmm0, 0xdd
psrad xmm2, 4
movdqa xmm0, xmm2
psrld xmm0, 0x1f
paddd xmm0, xmm2
pmulld xmm0, xmmword [str.1111]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140191460]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1401937b0]
movd xmm0, dword [0x1404e5e64]
xorps xmm2, xmm0
movd dword [0x1404e5e64], xmm2
jmp 0x1400bbbab
lea r9, [0x1404e5e64]
mov r8d, edi
nop dword [rax]
mov eax, 0x5397829d
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 1
sub al, dl
movsx eax, al
imul ecx, eax, 0x31
add cl, r8b
xor byte [r9], cl
inc r8d
lea r9, [r9 + 1]
cmp r8d, 4
jl 0x1400bbcf0
jmp 0x1400bbbab
Function at 0x1400beab0
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x2d8
mov rax, qword [0x1404e4980]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
mov dword [rsp + 0xa8], 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9, [rsp + 0xa8]
lea r8, [rsp + 0xb0]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [rsp + 0xb0]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xa0], rax
cmp qword [rsp + 0xa0], 0
je 0x1400beb57
cmp qword [rsp + 0xa0], 0xffffffffffffffff
jne 0x1400bebae
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x50], 0
mov rax, qword [rsp + 0x2e8]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
mov qword [rax], rcx
mov rax, qword [rsp + 0x2e8]
add rax, 8
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
mov qword [rax], rcx
mov rax, qword [rsp + 0x2e8]
jmp 0x1400becc6
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 2
xor edx, edx
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x1400bec4d
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x70], 0
mov rax, qword [rsp + 0x2e8]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
mov qword [rax], rcx
mov rax, qword [rsp + 0x2e8]
add rax, 8
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x80]
mov qword [rax], rcx
mov rax, qword [rsp + 0x2e8]
jmp 0x1400becc6
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 4
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x2e8]
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x88]
mov rcx, qword [rsp + 0xa0]
mov qword [rax], rcx
mov rax, qword [rsp + 0x2e8]
add rax, 8
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x98]
mov qword [rax], rcx
mov rax, qword [rsp + 0x2e8]
mov rcx, qword [rsp + 0x2c0]
xor rcx, rsp
call fcn.14017d1a0
add rsp, 0x2d8
ret
Function at 0x1400c12f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rbx, rdx
xor edi, edi
mov ecx, dword [0x1404e7590]
mov rax, qword gs:[0x58]
mov edx, 4
mov rsi, qword [rax + rcx*8]
add rsi, rdx
mov eax, dword [rsi]
cmp dword [0x1404e5fa0], eax
jg 0x1400c1428
mov ebp, dword [reloc.WS2_32.dll_accept]
mov eax, dword [rsi]
cmp dword [0x1404e5fd0], eax
jg 0x1400c1460
cmp byte [0x1404e5f9f], 0
jne 0x1400c1390
cmp ebp, 2
jge 0x1400c1390
lea r8, [0x1404e5f98]
nop dword [rax + rax]
mov eax, 0x5397829d
imul edi
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 1
sub al, dl
movsx eax, al
imul ecx, eax, 0x31
add cl, dil
xor byte [r8], cl
inc edi
lea r8, [r8 + 1]
cmp edi, 8
jl 0x1400c1360
nop
mov qword [0x1404e5f98], 0
lea rdi, [0x1404e5f98]
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
lea rdx, [0x1404e5fa8]
mov rcx, rbx
call fcn.14003fa30
movzx eax, byte [0x1404e5fc8]
mov byte [rbx + 0x20], al
mov rax, rbx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
lea rdx, [0x1404e5f98]
lea rcx, [rsp + 0x28]
call fcn.1400b7450
nop
lea rdx, [rsp + 0x28]
lea rcx, [0x1404e5fa8]
call fcn.1400b8790
nop
lea rcx, [rsp + 0x28]
call fcn.14003fc80
lea rcx, [0x140187590]
call fcn.14017cf54
nop
lea rcx, [0x1404e5fd0]
call fcn.14017cfa8
jmp 0x1400c1346
lea rcx, [0x1404e5fa0]
call fcn.14017d014
cmp dword [0x1404e5fa0], 0xffffffff
jne 0x1400c1332
mov rax, qword [0x140191940]
mov qword [0x1404e5f98], rax
lea rcx, [0x1404e5fa0]
call fcn.14017cfa8
jmp 0x1400c1332
lea rcx, [0x1404e5fd0]
call fcn.14017d014
cmp dword [0x1404e5fd0], 0xffffffff
jne 0x1400c1346
cmp byte [0x1404e5f9f], 0
je 0x1400c13dc
cmp ebp, 2
jl 0x1400c1590
movdqa xmm4, xmmword [0x1401937c0]
movdqa xmm2, xmmword [0x14018f690]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [str.1111]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140191460]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1401937b0]
movd xmm0, dword [0x1404e5f98]
xorps xmm2, xmm0
movd dword [0x1404e5f98], xmm2
movdqa xmm3, xmmword [0x140191440]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [str.1111]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140191460]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1401937b0]
movd xmm0, dword [0x1404e5f9c]
xorps xmm2, xmm0
movd dword [0x1404e5f9c], xmm2
jmp 0x1400c13dc
lea r9, [0x1404e5f98]
mov r8d, edi
nop word [rax + rax]
mov eax, 0x5397829d
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 1
sub al, dl
movsx eax, al
imul ecx, eax, 0x31
add cl, r8b
xor byte [r9], cl
inc r8d
lea r9, [r9 + 1]
cmp r8d, 8
jl 0x1400c15a0
jmp 0x1400c13dc
Function at 0x1400c3050
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rbx, rdx
xor edi, edi
mov ecx, dword [0x1404e7590]
mov rax, qword gs:[0x58]
mov edx, 4
mov rsi, qword [rax + rcx*8]
add rsi, rdx
mov eax, dword [rsi]
cmp dword [0x1404e5fe0], eax
jg 0x1400c3188
mov ebp, dword [reloc.WS2_32.dll_accept]
mov eax, dword [rsi]
cmp dword [0x1404e6010], eax
jg 0x1400c31c0
cmp byte [0x1404e5fdf], 0
jne 0x1400c30f0
cmp ebp, 2
jge 0x1400c30f0
lea r8, [0x1404e5fd8]
nop dword [rax + rax]
mov eax, 0x5397829d
imul edi
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 1
sub al, dl
movsx eax, al
imul ecx, eax, 0x31
add cl, dil
xor byte [r8], cl
inc edi
lea r8, [r8 + 1]
cmp edi, 8
jl 0x1400c30c0
nop
mov qword [0x1404e5fd8], 0
lea rdi, [0x1404e5fd8]
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
lea rdx, [0x1404e5fe8]
mov rcx, rbx
call fcn.14003fa30
movzx eax, byte [0x1404e6008]
mov byte [rbx + 0x20], al
mov rax, rbx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
lea rdx, [0x1404e5fd8]
lea rcx, [rsp + 0x28]
call fcn.1400b7450
nop
lea rdx, [rsp + 0x28]
lea rcx, [0x1404e5fe8]
call fcn.1400b8790
nop
lea rcx, [rsp + 0x28]
call fcn.14003fc80
lea rcx, [0x140187670]
call fcn.14017cf54
nop
lea rcx, [0x1404e6010]
call fcn.14017cfa8
jmp 0x1400c30a6
lea rcx, [0x1404e5fe0]
call fcn.14017d014
cmp dword [0x1404e5fe0], 0xffffffff
jne 0x1400c3092
mov rax, qword [0x140191948]
mov qword [0x1404e5fd8], rax
lea rcx, [0x1404e5fe0]
call fcn.14017cfa8
jmp 0x1400c3092
lea rcx, [0x1404e6010]
call fcn.14017d014
cmp dword [0x1404e6010], 0xffffffff
jne 0x1400c30a6
cmp byte [0x1404e5fdf], 0
je 0x1400c313c
cmp ebp, 2
jl 0x1400c32f0
movdqa xmm4, xmmword [0x1401937c0]
movdqa xmm2, xmmword [0x14018f690]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [str.1111]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140191460]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1401937b0]
movd xmm0, dword [0x1404e5fd8]
xorps xmm2, xmm0
movd dword [0x1404e5fd8], xmm2
movdqa xmm3, xmmword [0x140191440]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [str.1111]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140191460]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1401937b0]
movd xmm0, dword [0x1404e5fdc]
xorps xmm2, xmm0
movd dword [0x1404e5fdc], xmm2
jmp 0x1400c313c
lea r9, [0x1404e5fd8]
mov r8d, edi
nop word [rax + rax]
mov eax, 0x5397829d
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 1
sub al, dl
movsx eax, al
imul ecx, eax, 0x31
add cl, r8b
xor byte [r9], cl
inc r8d
lea r9, [r9 + 1]
cmp r8d, 8
jl 0x1400c3300
jmp 0x1400c313c