joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401cd140
Capabilities:
Connect socket
Set socket configuration

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
mov eax, gethostbyaddr
call fcn.1401fb0a0
sub rsp, rax
movsxd rbx, ecx
mov edi, r8d
mov dword [rsp + 0x40], 1
mov rbp, rdx
cmp ebx, 0xffffffff
jne 0x1401cd1ab
call fcn.140069570
lea r8, str.BIO_connect
lea edx, [rbx + 0x55]
lea rcx, str.crypto_bio_bio_sock2.c
call fcn.140069690
xor r8d, r8d
lea ecx, [rbx + 0x21]
mov edx, 0x87
call fcn.140069790
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov edx, edi
mov qword [rsp + 0x48], rsi
shr edx, 3
mov ecx, ebx
and edx, 1
call fcn.14008acf0
test eax, eax
je 0x1401cd25e
mov rsi, rbx
test dil, 4
je 0x1401cd275
lea r9, [rsp + 0x40]
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, 8
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x1401cd275
call fcn.140069570
lea r8, str.BIO_connect
mov edx, 0x5e
lea rcx, str.crypto_bio_bio_sock2.c
call fcn.140069690
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r8, str.calling_setsockopt__
mov ecx, 2
mov edx, eax
call fcn.140069790
call fcn.140069570
lea r8, str.BIO_connect
mov edx, 0x60
lea rcx, str.crypto_bio_bio_sock2.c
call fcn.140069690
xor r8d, r8d
mov edx, 0x89
mov ecx, 0x20
call fcn.140069790
xor eax, eax
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
test dil, 0x10
je 0x1401cd302
mov edx, 6
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x40]
mov rcx, rsi
lea r8d, [rdx - 5]
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x1401cd302
call fcn.140069570
lea r8, str.BIO_connect
mov edx, 0x68
lea rcx, str.crypto_bio_bio_sock2.c
call fcn.140069690
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r8, str.calling_setsockopt__
mov ecx, 2
mov edx, eax
call fcn.140069790
call fcn.140069570
lea r8, str.BIO_connect
mov edx, 0x6a
lea rcx, str.crypto_bio_bio_sock2.c
call fcn.140069690
xor r8d, r8d
mov edx, 0x8a
jmp 0x1401cd254
mov rcx, rbp
call fcn.14008af90
mov rcx, rbp
mov ebx, eax
call fcn.14008af80
mov rdx, rax
mov r8d, ebx
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x1401cd396
mov ecx, eax
call fcn.1401cd0a0
test eax, eax
jne 0x1401cd25e
call fcn.140069570
lea r8, str.BIO_connect
mov edx, WSACleanup
lea rcx, str.crypto_bio_bio_sock2.c
call fcn.140069690
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r8, str.calling_connect__
mov ecx, 2
mov edx, eax
call fcn.140069790
call fcn.140069570
lea r8, str.BIO_connect
mov edx, reloc.WS2_32.dll_WSACleanup
lea rcx, str.crypto_bio_bio_sock2.c
call fcn.140069690
xor r8d, r8d
lea edx, [r8 + 0x67]
jmp 0x1401cd254
mov eax, 1
jmp 0x1401cd260
Function at 0x1401ce0b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push r12
push r13
push r14
mov eax, 0x50
call fcn.1401fb0a0
sub rsp, rax
mov r14, qword [rsp + 0xa8]
lea r10, [rax - 0x51]
mov rbp, qword [rsp + 0xb0]
xor r11d, r11d
cmp r14, 1
mov eax, r11d
mov r13, r9
mov r12, r8
mov r9, qword [rcx]
setne al
add rax, rbp
mov rsi, rcx
cmp rax, r9
jbe 0x1401ce10e
xor eax, eax
add rsp, 0x50
pop r14
pop r13
pop r12
pop rsi
pop rbp
ret
mov qword [rsp + 0x80], rbx
cmp r14, 1
je 0x1401ce213
lea r10, [r8 - 1]
add r10, r9
movzx ebx, byte [r10]
cmp dword [rsp + 0xb8], r11d
je 0x1401ce14b
sub r9, rbx
mov eax, 1
sub r9, rbp
dec r9
mov qword [rcx], r9
jmp 0x1401ce24a
lea rcx, [rbx + rax]
mov qword [rsp + 0x98], r15
mov r15d, 0x100
mov r8, r9
sub r8, rcx
mov rax, r9
xor r8, rcx
xor rax, rcx
or r8, rax
xor r8, r9
shr r8, 0x3f
dec r8
cmp r9, r15
cmovb r15, r9
test r15, r15
je 0x1401ce1ed
mov qword [rsp + 0x90], rdi
mov rdi, rbx
shr rdi, 0x3f
nop dword [rax]
nop dword [rax + rax]
mov rax, r11
lea r10, [r10 - 1]
shr rax, 0x3f
mov rcx, rbx
sub rcx, r11
inc r11
shr rcx, 0x3f
xor cl, al
xor al, dil
or cl, al
xor cl, dil
dec cl
movzx edx, cl
movzx ecx, byte [r10 + 1]
xor rcx, rbx
and rdx, rcx
not rdx
and r8, rdx
cmp r11, r15
jb 0x1401ce1a0
mov rdi, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x88]
mov r15, qword [rsp + 0x98]
lea rax, [rbx + 1]
not r8
movzx r10d, r8b
dec r10
shr r10, 0x3f
neg r10
and rax, r10
sub r9, rax
mov qword [rsi], r9
mov rax, qword [rsp + 0xc0]
mov r9, r13
mov qword [rsp + 0x40], rax
mov r8, r12
mov rax, qword [rsp + 0xa0]
mov rcx, rsi
mov qword [rsp + 0x38], r10
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
call fcn.1401cdce0
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop r13
pop r12
pop rsi
pop rbp
ret
Function at 0x1401ce7c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
mov eax, 0x68
call fcn.1401fb0a0
sub rsp, rax
mov rax, qword [0x140423a00]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [rcx + 0x3c]
mov rdi, r9
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test eax, eax
je 0x1401ce8f3
movups xmm0, xmmword [rcx + 0x10]
mov r15, qword [rcx + 0x20]
lea rbx, [rcx + 0x10]
dec eax
mov dword [rsp + 0x28], 1
mov dword [rcx + 0x3c], eax
xor r9d, r9d
mov eax, dword [rbx + 8]
xor r8d, r8d
and al, 0x7f
mov dword [rsp + 0x30], edi
movups xmmword [rsp + 0x48], xmm0
and byte [rsp + 0x54], 0x7f
xor edx, edx
mov byte [rsp + 0x50], al
mov rcx, r15
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call fcn.1400bd680
test eax, eax
je 0x1401ce8f3
mov eax, dword [rsp + 0x30]
lea r8, [rsp + 0x30]
mov r9, r14
mov dword [rsp + 0x20], eax
mov rdx, rbp
mov rcx, r15
call fcn.1400be2e0
test eax, eax
je 0x1401ce8f3
mov r9, rdi
lea rdx, [rsp + 0x38]
mov r8, rbp
mov rcx, rsi
call fcn.1401ceef0
test eax, eax
je 0x1401ce8f3
lea rax, [rbx + 0xf]
xor r8d, r8d
lea rcx, [rsp + 0x38]
cmp rcx, rax
ja 0x1401ce8c9
lea rax, [rsp + 0x47]
cmp rax, rbx
jb 0x1401ce8c9
lea rcx, [rsp + 0x38]
mov eax, r8d
sub rbx, rcx
nop
lea rdx, [rsp + 0x38]
add rdx, rax
inc rax
movzx ecx, byte [rbx + rdx]
xor byte [rdx], cl
cmp rax, 0x10
jl 0x1401ce8b0
jmp 0x1401ce8dc
movdqu xmm1, xmmword [rsp + 0x38]
movdqu xmm0, xmmword [rbx]
xorps xmm1, xmm0
movdqu xmmword [rsp + 0x38], xmm1
mov rax, qword [rsp + 0x38]
or rax, qword [rsp + 0x40]
je 0x1401ce90f
mov rdx, rdi
mov rcx, rbp
call fcn.140070ac0
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1401fad50
add rsp, 0x68
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov dword [rsi + 0x38], r8d
mov eax, edi
jmp 0x1401ce8f5

Function at 0x1401cf940
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rcx
xor eax, eax
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], eax
mov rcx, qword [rsp + 0x10]
movzx r8d, byte [rcx + rax]
mov rcx, qword [rsp + 0x18]
movzx r9d, byte [rcx + rax]
inc rax
mov ecx, dword [rsp + 8]
xor r9d, r8d
or ecx, r9d
mov dword [rsp + 8], ecx
cmp rax, 0x10
jl 0x1401cf950
mov eax, dword [rsp + 8]
dec eax
shr eax, 8
and eax, 1
dec eax
ret

Function at 0x1401cf990
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rcx
xor eax, eax
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], eax
mov rcx, qword [rsp + 0x10]
movzx r8d, byte [rcx + rax]
mov rcx, qword [rsp + 0x18]
movzx r9d, byte [rcx + rax]
inc rax
mov ecx, dword [rsp + 8]
xor r9d, r8d
or ecx, r9d
mov dword [rsp + 8], ecx
cmp rax, 0x20
jl 0x1401cf9a0
mov eax, dword [rsp + 8]
dec eax
shr eax, 8
and eax, 1
dec eax
ret
Function at 0x1401d0ac0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov dword [rcx], 0x61707865
mov dword [rcx + 4], 0x3320646e
mov dword [rcx + 8], 0x79622d32
mov dword [rcx + 0xc], 0x6b206574
mov eax, dword [rdx]
mov dword [rcx + 0x10], eax
mov eax, dword [rdx + 4]
mov dword [rcx + 0x14], eax
mov eax, dword [rdx + 8]
mov dword [rcx + 0x18], eax
mov eax, dword [rdx + 0xc]
mov dword [rcx + 0x1c], eax
mov eax, dword [rdx + 0x10]
mov dword [rcx + 0x20], eax
mov eax, dword [rdx + 0x14]
mov dword [rcx + 0x24], eax
mov eax, dword [rdx + 0x18]
mov dword [rcx + 0x28], eax
mov eax, dword [rdx + 0x1c]
mov dword [rcx + 0x2c], eax
ret
Function at 0x1401d3750
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
call fcn.1401d37d0
mov eax, 0xffffffff
cmp rbx, rax
jbe 0x1401d3774
call fcn.1401cf7e0
mov edx, ebx
mov rcx, rdi
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x1401d3787
call fcn.1401cf7e0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1401d7130
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r14
sub rsp, 0x10
mov rax, qword [0x140423a00]
xor rax, rsp
mov qword [rsp + 8], rax
xor r8d, r8d
lea r14, [0x1402db550]
mov dword [rsp], r8d
mov r9, rcx
mov word [r11 - 0x14], r8w
xor eax, eax
movzx r10d, byte [r11 - 0x13]
movzx r11d, r8b
movzx ebx, byte [rsp + 3]
movzx edi, byte [rsp + 2]
movzx esi, byte [rsp + 1]
movzx ebp, byte [rsp]
nop dword [rax]
movzx edx, byte [r9 + rax]
movzx ecx, dl
xor cl, byte [rax + r14]
or cl, bpl
movzx ebp, cl
movzx ecx, dl
xor cl, byte [rax + r14 + 0x20]
or cl, sil
movzx esi, cl
movzx ecx, dl
xor cl, byte [rax + r14 + 0x40]
or cl, dil
movzx edi, cl
movzx ecx, dl
xor cl, byte [rax + r14 + 0x60]
or cl, bl
movzx ebx, cl
movzx ecx, dl
xor cl, byte [rax + r14 + 0x80]
or cl, r11b
movzx r11d, cl
movzx ecx, dl
xor cl, byte [rax + r14 + 0xa0]
xor dl, byte [rax + r14 + 0xc0]
or cl, r10b
or dl, r8b
movzx r10d, cl
inc rax
movzx r8d, dl
cmp rax, 0x1f
jb 0x1401d7190
movzx ecx, byte [rax + r9]
movzx r9d, byte [rax + r14 + 0xc0]
and cl, 0x7f
movzx r8d, cl
movzx ecx, dl
xor r9d, r8d
movzx edx, byte [rax + r14 + 0xa0]
or r9d, ecx
xor edx, r8d
dec r9d
or edx, r10d
dec edx
or r9d, edx
movzx edx, byte [rax + r14 + 0x80]
xor edx, r8d
or edx, r11d
dec edx
or r9d, edx
movzx edx, byte [rax + r14 + 0x60]
xor edx, r8d
or edx, ebx
dec edx
or r9d, edx
movzx edx, byte [rax + r14 + 0x40]
xor edx, r8d
or edx, edi
dec edx
or r9d, edx
movzx edx, byte [rax + r14 + 0x20]
movzx eax, byte [rax + r14]
xor edx, r8d
xor eax, r8d
or edx, esi
or eax, ebp
dec edx
dec eax
or r9d, edx
or eax, r9d
shr eax, 8
and eax, 1
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.1401fad50
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
add rsp, 0x10
pop r14
ret
Function at 0x1401d8c00
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov eax, dword [rdx]
mov dword [rcx + 0x14], eax
mov eax, dword [rdx + 4]
mov dword [rcx + 0x28], eax
mov eax, dword [rdx + 8]
mov dword [rcx + 0x3c], eax
mov eax, dword [rdx + 0xc]
mov dword [rcx + 0x30], eax
mov eax, dword [rdx + 0x10]
mov dword [rcx + 0x1c], eax
mov eax, dword [rdx + 0x14]
mov dword [rcx + 0x10], eax
mov eax, dword [rdx + 0x18]
mov dword [rcx + 0x24], eax
mov eax, dword [rdx + 0x1c]
mov dword [rcx + 0x38], eax
mov dword [rcx], 0x61707865
mov dword [rcx + 4], 0x3320646e
mov dword [rcx + 8], 0x79622d32
mov dword [rcx + 0xc], 0x6b206574
ret
Function at 0x1401dca80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x38
movdqu xmm0, xmmword [rdx]
movdqu xmm2, xmmword [r8 + 0x60]
movaps xmmword [rsp + 0x20], xmm6
movaps xmmword [rsp + 0x10], xmm7
movdqu xmm7, xmmword [rdx + 0x10]
movaps xmmword [rsp], xmm8
movdqa xmm8, xmm2
xorps xmm7, xmmword [r8 + 0x50]
xorps xmm8, xmm0
xorps xmm7, xmmword [r8 + 0x20]
xorps xmm8, xmmword [r8 + 0x10]
movdqu xmm0, xmmword [r8 + 0x20]
andps xmm0, xmmword [r8 + 0x30]
andps xmm2, xmmword [r8 + 0x70]
xorps xmm8, xmm0
movdqu xmmword [rcx], xmm8
xorps xmm7, xmm2
movdqu xmmword [rcx + 0x10], xmm7
movdqu xmm6, xmmword [r8 + 0x70]
movdqu xmm5, xmmword [r8 + 0x30]
movdqu xmm0, xmmword [r8 + 0x60]
movdqu xmm1, xmmword [r8 + 0x50]
aesenc xmm1, xmmword [r8 + 0x60]
aesenc xmm0, xmm6
aesenc xmm6, xmmword [r8]
movdqu xmmword [r8 + 0x70], xmm0
xorps xmm6, xmm8
movdqu xmm0, xmmword [r8 + 0x40]
aesenc xmm0, xmmword [r8 + 0x50]
movaps xmm8, xmmword [rsp]
movdqu xmmword [r8 + 0x50], xmm0
movdqu xmm0, xmmword [r8 + 0x20]
aesenc xmm0, xmm5
aesenc xmm5, xmmword [r8 + 0x40]
movdqu xmmword [r8 + 0x30], xmm0
xorps xmm5, xmm7
movdqu xmm0, xmmword [r8]
aesenc xmm0, xmmword [r8 + 0x10]
movaps xmm7, xmmword [rsp + 0x10]
movdqu xmmword [r8 + 0x60], xmm1
movdqu xmm1, xmmword [r8 + 0x10]
aesenc xmm1, xmmword [r8 + 0x20]
movdqu xmmword [r8], xmm6
movaps xmm6, xmmword [rsp + 0x20]
movdqu xmmword [r8 + 0x10], xmm0
movdqu xmmword [r8 + 0x20], xmm1
movdqu xmmword [r8 + 0x40], xmm5
add rsp, 0x38
ret
Function at 0x1401dcb90
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x60
movaps xmmword [rsp + 0x50], xmm6
mov rax, qword [0x140423a00]
xor rax, rsp
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
mov rbx, rcx
lea rcx, [rsp + 0x20]
mov rsi, r9
movups xmmword [rsp + 0x20], xmm0
mov rdi, r8
movups xmmword [rsp + 0x30], xmm0
call fcn.140239dc0
movdqu xmm0, xmmword [rsp + 0x20]
lea rcx, [rsp + 0x20]
mov r8d, 0x20
movdqu xmm3, xmmword [rsi + 0x60]
sub r8, rdi
movdqa xmm1, xmm3
add rcx, rdi
andps xmm3, xmmword [rsi + 0x70]
xorps xmm1, xmm0
movdqu xmm0, xmmword [rsi + 0x20]
xor edx, edx
andps xmm0, xmmword [rsi + 0x30]
xorps xmm1, xmmword [rsi + 0x10]
xorps xmm1, xmm0
movdqu xmm0, xmmword [rsp + 0x30]
movdqu xmmword [rsp + 0x20], xmm1
xorps xmm0, xmmword [rsi + 0x50]
xorps xmm0, xmmword [rsi + 0x20]
xorps xmm0, xmm3
movdqu xmmword [rsp + 0x30], xmm0
call fcn.14023a460
mov r8, rdi
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140239dc0
movdqu xmm6, xmmword [rsi + 0x70]
movdqu xmm5, xmmword [rsi + 0x30]
movdqu xmm0, xmmword [rsi + 0x60]
movdqu xmm1, xmmword [rsi + 0x50]
aesenc xmm1, xmmword [rsi + 0x60]
aesenc xmm0, xmm6
aesenc xmm6, xmmword [rsi]
movdqu xmmword [rsi + 0x70], xmm0
movdqu xmm0, xmmword [rsi + 0x40]
aesenc xmm0, xmmword [rsi + 0x50]
movdqu xmmword [rsi + 0x50], xmm0
movdqu xmm0, xmmword [rsi + 0x20]
aesenc xmm0, xmm5
aesenc xmm5, xmmword [rsi + 0x40]
movdqu xmmword [rsi + 0x30], xmm0
movdqu xmm0, xmmword [rsi]
aesenc xmm0, xmmword [rsi + 0x10]
movdqu xmmword [rsi + 0x60], xmm1
movdqu xmm1, xmmword [rsi + 0x10]
aesenc xmm1, xmmword [rsi + 0x20]
movdqu xmmword [rsi + 0x10], xmm0
movdqu xmm0, xmmword [rsp + 0x20]
movdqu xmmword [rsi + 0x20], xmm1
xorps xmm6, xmm0
movdqu xmm0, xmmword [rsp + 0x30]
movdqu xmmword [rsi], xmm6
xorps xmm5, xmm0
movdqu xmmword [rsi + 0x40], xmm5
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1401fad50
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret
Function at 0x1401dcce0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x38
movdqu xmm2, xmmword [r8 + 0x60]
movdqu xmm3, xmmword [r8 + 0x20]
movdqa xmm0, xmm2
andps xmm0, xmmword [r8 + 0x70]
movaps xmmword [rsp + 0x20], xmm6
movaps xmmword [rsp + 0x10], xmm7
movdqu xmm7, xmmword [rdx]
movaps xmmword [rsp], xmm8
movdqu xmm8, xmmword [rdx + 0x10]
xorps xmm2, xmm7
xorps xmm2, xmmword [r8 + 0x10]
movdqa xmm1, xmm8
xorps xmm1, xmmword [r8 + 0x50]
xorps xmm1, xmm3
andps xmm3, xmmword [r8 + 0x30]
xorps xmm1, xmm0
xorps xmm2, xmm3
movdqu xmmword [rcx], xmm2
movdqu xmmword [rcx + 0x10], xmm1
movdqu xmm6, xmmword [r8 + 0x70]
movdqu xmm5, xmmword [r8 + 0x30]
movdqu xmm0, xmmword [r8 + 0x60]
movdqu xmm1, xmmword [r8 + 0x50]
aesenc xmm1, xmmword [r8 + 0x60]
aesenc xmm0, xmm6
aesenc xmm6, xmmword [r8]
movdqu xmmword [r8 + 0x70], xmm0
xorps xmm6, xmm7
movdqu xmm0, xmmword [r8 + 0x40]
aesenc xmm0, xmmword [r8 + 0x50]
movaps xmm7, xmmword [rsp + 0x10]
movdqu xmmword [r8 + 0x50], xmm0
movdqu xmm0, xmmword [r8 + 0x20]
aesenc xmm0, xmm5
aesenc xmm5, xmmword [r8 + 0x40]
movdqu xmmword [r8 + 0x30], xmm0
xorps xmm5, xmm8
movdqu xmm0, xmmword [r8]
aesenc xmm0, xmmword [r8 + 0x10]
movaps xmm8, xmmword [rsp]
movdqu xmmword [r8 + 0x60], xmm1
movdqu xmm1, xmmword [r8 + 0x10]
aesenc xmm1, xmmword [r8 + 0x20]
movdqu xmmword [r8], xmm6
movaps xmm6, xmmword [rsp + 0x20]
movdqu xmmword [r8 + 0x10], xmm0
movdqu xmmword [r8 + 0x20], xmm1
movdqu xmmword [r8 + 0x40], xmm5
add rsp, 0x38
ret
Function at 0x1401dcdf0
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, rsp
sub rsp, 0xb8
movdqu xmm0, xmmword [rdx]
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
movaps xmmword [rax - 0x38], xmm8
movaps xmmword [rax - 0x48], xmm9
movdqa xmm9, xmm0
movaps xmmword [rax - 0x58], xmm10
movdqa xmm10, xmmword [0x1402db6e0]
movaps xmmword [rax - 0x68], xmm11
movdqa xmm4, xmm10
movaps xmmword [rax - 0x78], xmm12
mov eax, 5
movdqu xmm12, xmmword [rcx]
movaps xmmword [rsp + 0x30], xmm13
movdqa xmm13, xmmword [0x1402db6d0]
movdqa xmm8, xmm12
movaps xmmword [rsp + 0x20], xmm14
xorps xmm8, xmm13
xorps xmm9, xmm12
movaps xmmword [rsp + 0x10], xmm15
movdqa xmm11, xmm12
movdqa xmmword [rsp], xmm4
movdqa xmm15, xmm8
xorps xmm11, xmm10
movdqa xmm14, xmm9
nop dword [rax]
movdqa xmm5, xmm14
movdqa xmm3, xmm9
movdqa xmm6, xmm13
movdqa xmm7, xmm11
movdqa xmm1, xmm15
aesenc xmm5, xmmword [rsp]
aesenc xmm6, xmm10
aesenc xmm10, xmm9
xorps xmm10, xmm12
movdqa xmm9, xmm6
movdqa xmm2, xmm10
aesenc xmm4, xmm13
movdqa xmm10, xmm4
movdqa xmm13, xmm5
aesenc xmm7, xmm8
aesenc xmm8, xmm14
xorps xmm0, xmm8
movdqa xmm14, xmm7
aesenc xmm1, xmm11
movdqa xmm8, xmm1
aesenc xmm3, xmm15
movdqa xmm11, xmm3
movdqa xmm15, xmm2
aesenc xmm13, xmm4
movdqa xmm4, xmm0
aesenc xmm14, xmm0
movdqu xmm0, xmmword [rdx]
aesenc xmm4, xmm5
movdqa xmmword [rsp], xmm4
xorps xmm14, xmm0
aesenc xmm9, xmm2
xorps xmm9, xmm12
aesenc xmm8, xmm7
aesenc xmm11, xmm1
aesenc xmm15, xmm3
aesenc xmm10, xmm6
sub rax, 1
jne 0x1401dce80
lea r11, [rsp + 0xb8]
movdqu xmmword [r8], xmm14
movaps xmm6, xmmword [r11 - 0x18]
movaps xmm7, xmmword [r11 - 0x28]
movaps xmm12, xmmword [r11 - 0x78]
movaps xmm14, xmmword [rsp + 0x20]
movdqu xmmword [r8 + 0x20], xmm13
movaps xmm13, xmmword [rsp + 0x30]
movdqu xmmword [r8 + 0x30], xmm10
movaps xmm10, xmmword [r11 - 0x58]
movdqu xmmword [r8 + 0x40], xmm9
movaps xmm9, xmmword [r11 - 0x48]
movdqu xmmword [r8 + 0x50], xmm15
movaps xmm15, xmmword [rsp + 0x10]
movdqu xmmword [r8 + 0x60], xmm11
movaps xmm11, xmmword [r11 - 0x68]
movdqu xmmword [r8 + 0x70], xmm8
movaps xmm8, xmmword [r11 - 0x38]
movdqu xmmword [r8 + 0x10], xmm4
mov rsp, r11
ret
Function at 0x1401dcfc0
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x88
mov rax, qword [rsp + 0xb0]
lea r8, [r8*8]
movaps xmmword [rsp + 0x70], xmm6
lea r9, [r9*8]
movaps xmmword [rsp + 0x60], xmm7
movq xmm0, r9
movaps xmmword [rsp + 0x50], xmm8
movq xmm7, r8
movdqu xmm6, xmmword [rax + 0x20]
mov r8d, 7
movdqu xmm3, xmmword [rax + 0x40]
movdqu xmm5, xmmword [rax + 0x30]
movdqu xmm8, xmmword [rax + 0x10]
movdqu xmm4, xmmword [rax]
movaps xmmword [rsp + 0x40], xmm9
movdqu xmm9, xmmword [rax + 0x60]
movaps xmmword [rsp + 0x30], xmm10
movdqu xmm10, xmmword [rax + 0x50]
punpcklqdq xmm7, xmm0
movaps xmmword [rsp + 0x20], xmm11
xorps xmm7, xmm6
movdqu xmm11, xmmword [rax + 0x70]
nop dword [rax]
nop word [rax + rax]
movdqa xmm2, xmm4
movdqa xmm0, xmm9
movdqa xmm4, xmm11
movdqa xmm1, xmm10
aesenc xmm0, xmm11
movdqa xmm11, xmm0
movdqa xmm0, xmm3
aesenc xmm0, xmm10
movdqa xmm10, xmm0
movdqa xmm0, xmm5
aesenc xmm0, xmm3
movdqa xmm3, xmm0
movdqa xmm0, xmm8
xorps xmm3, xmm7
aesenc xmm1, xmm9
movdqa xmm9, xmm1
movdqa xmm1, xmm6
aesenc xmm0, xmm6
movdqa xmm6, xmm0
movdqa xmm0, xmm2
aesenc xmm0, xmm8
movdqa xmm8, xmm0
aesenc xmm1, xmm5
movdqa xmm5, xmm1
aesenc xmm4, xmm2
xorps xmm4, xmm7
sub r8, 1
jne 0x1401dd050
movdqu xmmword [rax], xmm4
movdqu xmmword [rax + 0x20], xmm6
movdqu xmmword [rax + 0x70], xmm11
movdqu xmmword [rax + 0x60], xmm9
movdqu xmmword [rax + 0x50], xmm10
movdqu xmmword [rax + 0x40], xmm3
movdqu xmmword [rax + 0x30], xmm1
movdqu xmmword [rax + 0x10], xmm0
cmp rdx, 0x10
jne 0x1401dd11a
xorps xmm3, xmm10
xorps xmm5, xmm6
xorps xmm3, xmm9
xorps xmm4, xmm0
xorps xmm3, xmm5
xorps xmm3, xmm4
movdqu xmmword [rcx], xmm3
jmp 0x1401dd153
cmp rdx, 0x20
jne 0x1401dd149
xorps xmm4, xmm0
xorps xmm5, xmm6
xorps xmm4, xmm5
movdqu xmmword [rcx], xmm4
movdqu xmm1, xmmword [rax + 0x60]
movdqu xmm0, xmmword [rax + 0x50]
xorps xmm1, xmmword [rax + 0x70]
xorps xmm0, xmmword [rax + 0x40]
xorps xmm1, xmm0
movdqu xmmword [rcx + 0x10], xmm1
jmp 0x1401dd153
mov r8, rdx
xor edx, edx
call fcn.14023a460
movaps xmm6, xmmword [rsp + 0x70]
movaps xmm7, xmmword [rsp + 0x60]
movaps xmm8, xmmword [rsp + 0x50]
movaps xmm9, xmmword [rsp + 0x40]
movaps xmm10, xmmword [rsp + 0x30]
movaps xmm11, xmmword [rsp + 0x20]
add rsp, 0x88
ret
Function at 0x1401dee90
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x140423a00]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, rcx
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
mov rsi, r9
movups xmmword [rsp + 0x20], xmm0
mov rdi, r8
call fcn.140239dc0
movdqu xmm1, xmmword [rsp + 0x20]
lea rcx, [rsp + 0x20]
mov r8d, reloc.WS2_32.dll_recv
movdqu xmm0, xmmword [rsi + 0x20]
sub r8, rdi
xorps xmm1, xmmword [rsi + 0x50]
add rcx, rdi
xorps xmm1, xmmword [rsi + 0x40]
xor edx, edx
xorps xmm1, xmmword [rsi + 0x10]
andps xmm0, xmmword [rsi + 0x30]
xorps xmm1, xmm0
movdqu xmmword [rsp + 0x20], xmm1
call fcn.14023a460
mov r8, rdi
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140239dc0
movdqu xmm4, xmmword [rsi + 0x50]
movdqu xmm0, xmmword [rsi + 0x40]
movdqu xmm1, xmmword [rsi + 0x30]
aesenc xmm1, xmmword [rsi + 0x40]
aesenc xmm0, xmm4
aesenc xmm4, xmmword [rsi]
movdqu xmmword [rsi + 0x50], xmm0
movdqu xmm0, xmmword [rsi + 0x20]
aesenc xmm0, xmmword [rsi + 0x30]
movdqu xmmword [rsi + 0x30], xmm0
movdqu xmm0, xmmword [rsi]
aesenc xmm0, xmmword [rsi + 0x10]
movdqu xmmword [rsi + 0x40], xmm1
movdqu xmm1, xmmword [rsi + 0x10]
aesenc xmm1, xmmword [rsi + 0x20]
movdqu xmmword [rsi + 0x10], xmm0
movdqu xmm0, xmmword [rsp + 0x20]
movdqu xmmword [rsi + 0x20], xmm1
xorps xmm4, xmm0
movdqu xmmword [rsi], xmm4
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1401fad50
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x1401df030
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, rsp
sub rsp, 0x88
movdqa xmm3, xmmword [0x1402db710]
movdqa xmm4, xmmword [0x1402db720]
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
movaps xmmword [rax - 0x38], xmm8
movdqu xmm8, xmmword [rdx]
movaps xmmword [rax - 0x48], xmm9
movdqu xmm9, xmmword [rdx + 0x10]
movaps xmmword [rax - 0x58], xmm10
movaps xmmword [rax - 0x68], xmm11
movdqu xmm11, xmmword [rcx]
movaps xmmword [rax - 0x78], xmm12
mov eax, 4
movdqu xmm12, xmmword [rcx + 0x10]
xorps xmm8, xmm11
movaps xmmword [rsp], xmm13
xorps xmm9, xmm12
movdqa xmm7, xmm12
movdqa xmm2, xmm11
xorps xmm7, xmm4
movdqa xmm13, xmm9
xorps xmm2, xmm3
movdqa xmm10, xmm8
nop dword [rax]
movdqa xmm0, xmm3
movdqa xmm5, xmm2
movdqa xmm1, xmm4
aesenc xmm0, xmm2
movdqa xmm6, xmm0
movdqa xmm2, xmm13
aesenc xmm1, xmm3
movdqa xmm3, xmm10
aesenc xmm2, xmm4
movdqa xmm4, xmm1
aesenc xmm4, xmm0
movdqa xmm0, xmm2
aesenc xmm3, xmm13
aesenc xmm0, xmm1
movdqa xmm1, xmm3
aesenc xmm1, xmm2
aesenc xmm5, xmm7
aesenc xmm7, xmm10
movdqa xmm10, xmm4
xorps xmm7, xmm11
movdqa xmm2, xmm7
aesenc xmm2, xmm3
movdqa xmm3, xmm0
aesenc xmm3, xmm4
movdqa xmm4, xmm1
aesenc xmm4, xmm0
movdqa xmm0, xmm2
aesenc xmm6, xmm5
aesenc xmm10, xmm6
aesenc xmm0, xmm1
aesenc xmm5, xmm7
movdqa xmm7, xmm3
xorps xmm5, xmm12
movdqa xmm1, xmm5
aesenc xmm1, xmm2
movdqa xmm2, xmm4
aesenc xmm2, xmm3
movdqa xmm3, xmm0
aesenc xmm3, xmm4
movdqa xmm4, xmm1
aesenc xmm7, xmm10
aesenc xmm6, xmm5
xorps xmm6, xmm8
movdqa xmm13, xmm6
aesenc xmm10, xmm6
xorps xmm10, xmm9
aesenc xmm4, xmm0
aesenc xmm13, xmm1
sub rax, 1
jne 0x1401df0b0
movaps xmm6, xmmword [rsp + 0x70]
movaps xmm8, xmmword [rsp + 0x50]
movaps xmm9, xmmword [rsp + 0x40]
movaps xmm11, xmmword [rsp + 0x20]
movaps xmm12, xmmword [rsp + 0x10]
movdqu xmmword [r8], xmm10
movaps xmm10, xmmword [rsp + 0x30]
movdqu xmmword [r8 + 0x10], xmm13
movaps xmm13, xmmword [rsp]
movdqu xmmword [r8 + 0x50], xmm7
movaps xmm7, xmmword [rsp + 0x60]
movdqu xmmword [r8 + 0x20], xmm4
movdqu xmmword [r8 + 0x30], xmm3
movdqu xmmword [r8 + 0x40], xmm2
add rsp, 0x88
ret