joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140026c30
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
test rcx, rcx
je 0x140026c8d
mov rsi, rdx
mov r8d, dword [rcx]
test r8, r8
je 0x140026c94
mov edi, 0x100
and edi, dword [rcx + 4]
mov rax, qword [rcx + 8]
movzx r11d, byte [rax]
xor r9d, r9d
test r11b, r11b
mov edx, edi
cmove edx, r9d
sets r10b
cmp r8d, 1
cmovne edx, edi
test edx, edx
sete bl
je 0x140026caa
cmp r11b, 0x80
jbe 0x140026d4c
mov r10d, 1
mov r9b, 0xff
jmp 0x140026cb1
xor edi, edi
jmp 0x140026d3f
test rsi, rsi
je 0x140026d8e
mov rax, qword [rsi]
mov edi, 1
jmp 0x140026d36
and bl, r10b
movzx r10d, bl
lea edi, [r10 + r8]
test rsi, rsi
je 0x140026d3f
mov rax, qword [rsi]
test r10d, r10d
je 0x140026ccf
mov byte [rax], r9b
inc rax
mov r8d, dword [rcx]
test r8d, r8d
je 0x140026d36
test edx, edx
je 0x140026d95
mov r9, qword [rcx + 8]
movsxd r10, r8d
lea rcx, [r10 + rax]
dec rcx
lea rdx, [r9 + r10]
dec rdx
movzx r9d, byte [r9 + r10 - 1]
test r9b, r9b
jne 0x140026da6
cmp r8d, 2
jl 0x140026da6
nop word [rax + rax]
mov byte [rcx], 0
dec rcx
lea eax, [r8 - 1]
movzx r9d, byte [rdx - 1]
dec rdx
test r9b, r9b
jne 0x140026da9
cmp r8d, 2
mov r8d, eax
ja 0x140026d10
jmp 0x140026da9
mov byte [rax], 0
movsxd rax, edi
add qword [rsi], rax
mov eax, edi
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
xor r10d, r10d
cmp r11b, 0x80
jne 0x140026de1
mov r9d, 0
cmp r8d, 2
jl 0x140026cb1
mov r9d, 1
nop
cmp byte [rax + r9], 0
jne 0x140026c82
inc r9
cmp r8, r9
jne 0x140026d70
xor r10d, r10d
xor r9d, r9d
jmp 0x140026cb1
mov edi, 1
jmp 0x140026d3f
mov r8d, r8d
mov rdx, qword [rcx + 8]
mov rcx, rax
call fcn.1402689f0
jmp 0x140026d39
mov eax, r8d
neg r9b
mov byte [rcx], r9b
cmp eax, 2
jl 0x140026d39
lea r8d, [rax - 2]
cmp r8d, 3
jb 0x140026e79
mov r9, rdx
sub r9, rcx
cmp r9, 0x10
jb 0x140026e79
lea r9, [r8 + 1]
cmp r8d, 0xf
jae 0x140026de9
xor r8d, r8d
jmp 0x140026e2a
xor r9d, r9d
jmp 0x140026cb1
mov r8, r9
and r8, 0xfffffffffffffff0
mov r10, r8
neg r10
xor r11d, r11d
pcmpeqd xmm0, xmm0
nop dword [rax]
movdqu xmm1, xmmword [rdx + r11 - 0x10]
pxor xmm1, xmm0
movdqu xmmword [rcx + r11 - 0x10], xmm1
add r11, 0xfffffffffffffff0
cmp r10, r11
jne 0x140026e00
cmp r9, r8
je 0x140026d39
test r9b, 0xc
je 0x140026e70
mov rbx, r9
and rbx, 0xfffffffffffffffc
mov r14, rbx
neg r14
mov r10, rdx
sub r10, rbx
mov r11, rcx
sub r11, rbx
sub eax, ebx
neg r8
nop dword [rax + rax]
mov ebp, dword [rdx + r8 - 4]
not ebp
mov dword [rcx + r8 - 4], ebp
add r8, 0xfffffffffffffffc
cmp r14, r8
jne 0x140026e50
cmp r9, rbx
je 0x140026d39
jmp 0x140026e7f
sub eax, r8d
sub rcx, r8
sub rdx, r8
mov r10, rdx
mov r11, rcx
inc eax
xor ecx, ecx
nop word cs:[rax + rax]
movzx edx, byte [r10 + rcx - 1]
not dl
mov byte [r11 + rcx - 1], dl
dec rcx
lea edx, [rax + rcx]
cmp edx, 2
ja 0x140026e90
jmp 0x140026d39
Function at 0x140037b60
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov r11, qword [rsp + 0x68]
inc r11
xor eax, eax
cmp r11, r9
ja 0x140037c6e
movzx eax, byte [r8 + r9 - 1]
add r11, rax
mov r10, r9
sub r10, r11
xor r11, r9
xor r10, r9
or r10, r11
xor r10, r9
not r10
sar r10, 0x3f
cmp r9, 0x100
mov esi, 0x100
cmovb rsi, r9
test rsi, rsi
je 0x140037c47
lea r11, [r9 - 1]
cmp rsi, 1
jne 0x140037bc7
xor edi, edi
jmp 0x140037c1e
mov ebx, esi
and ebx, 0x1fe
lea r14, [r8 + r11]
xor edi, edi
mov r15, 0xffffffffffffffff
mov r12, r10
nop
movzx r10d, byte [r14]
xor r10b, al
movzx r13d, r10b
not r13
movzx r10d, byte [r14 - 1]
xor r10b, al
cmp rdi, rax
cmova r13, r15
movzx r10d, r10b
not r10
cmovae r10, r15
and r10, r12
and r10, r13
add rdi, 2
add r14, 0xfffffffffffffffe
mov r12, r10
cmp rbx, rdi
jne 0x140037be0
test sil, 1
je 0x140037c47
sub r11, rdi
movzx r8d, byte [r8 + r11]
xor r8b, al
cmp rdi, rax
movzx r8d, r8b
not r8
mov r11, 0xffffffffffffffff
cmovbe r11, r8
and r10, r11
xor r8d, r8d
cmp r10b, 0xff
sete r8b
mov r10, r8
neg r10
inc eax
neg r8d
and r8d, eax
sub r9, r8
mov qword [rdx], r9
mov qword [rcx], r10
mov eax, 1
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140037c80
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
mov rbx, r9
mov r14, r8
mov rsi, rdx
mov qword [rsp + 0x28], rcx
mov r13, qword [rsp + 0x120]
mov rax, qword [0x14039fd98]
xor rax, rsp
mov qword [rsp + 0xb0], rax
lea r15, [rdx + 0x100]
xor r12d, r12d
mov rax, r13
sub rax, r15
cmovae r12, rax
test rdx, rdx
je 0x140037ce3
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8, rsi
call fcn.140268830
cmp r12, r13
jae 0x140037e84
mov rcx, rbx
sub rcx, rsi
cmp r13, r15
cmovb r15, r13
mov rdx, rbx
neg rdx
xor eax, eax
xor r8d, r8d
xor r9d, r9d
nop word [rax + rax]
cmp r8, rsi
mov r10d, 0
cmovae r10, rsi
mov r11, r8
mov r13, r12
xor r13, rcx
mov rbp, r13
not rbp
dec r13
and r13, rbp
sar r13, 0x3f
movzx r9d, r9b
or r9, r13
mov rbp, r12
xor rbp, rbx
lea rdi, [rdx + r12]
xor rdi, r12
or rdi, rbp
xor rdi, r12
sar rdi, 0x3f
and edi, r9d
and dil, byte [r14 + r12]
sub r11, r10
or byte [rsp + r11 + 0x70], dil
and r13, r11
or rax, r13
inc r12
neg r10
add r8, r10
inc r8
dec r15
jne 0x140037d10
cmp rsi, 2
jb 0x140037e90
mov rcx, rsi
and rcx, 0xfffffffffffffffe
mov r8d, 1
lea r9, [rsp + 0x30]
lea r11, [rsp + 0x70]
xor r10d, r10d
jmp 0x140037db2
add r8, r8
shr rax, 1
mov r11, rdx
cmp r8, rsi
jae 0x140037e95
mov rdx, r9
mov r9, r11
mov ebx, eax
and bl, 1
lea r11d, [rbx - 1]
mov r15, r8
xor r14d, r14d
jmp 0x140037dff
sub r15, r12
test bl, bl
mov byte [rdx + r14], bpl
movzx edi, byte [r9 + r15]
cmove edi, r10d
movzx ebp, byte [r9 + r14 + 1]
and bpl, r11b
or dil, bpl
mov byte [rdx + r14 + 1], dil
add r14, 2
inc r15
cmp rcx, r14
je 0x140037e50
mov r12d, 0
cmp r15, rsi
jb 0x140037e0d
mov r12, rsi
mov rdi, r15
sub rdi, r12
movzx r13d, byte [r9 + r14]
and r13b, r11b
test bl, bl
movzx ebp, byte [r9 + rdi]
cmove ebp, r10d
or bpl, r13b
neg r12
add r15, r12
inc r15
mov r12d, 0
cmp r15, rsi
jb 0x140037dd0
mov r12, rsi
jmp 0x140037dd0
test sil, 1
je 0x140037da0
cmp r15, rsi
mov edi, 0
cmovae rdi, rsi
sub r15, rdi
and r11b, byte [r9 + r14]
test bl, bl
movzx edi, byte [r9 + r15]
cmove edi, r10d
or dil, r11b
mov byte [rdx + r14], dil
jmp 0x140037da0
xor eax, eax
cmp rsi, 2
jae 0x140037d84
lea rdx, [rsp + 0x70]
test rsi, rsi
je 0x140037ea7
mov rcx, qword [rsp + 0x28]
mov r8, rsi
call fcn.1402689f0
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140265fe0
nop
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14003e4e0
Capabilities:
Encrypt data using curve25519

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x1a8
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14039fd98]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
lea r14, [rsp + 0xc0]
mov edx, 0x20
mov rcx, r8
mov r8, r14
call fcn.140069f60
and byte [rsp + 0xc0], 0xf8
movzx eax, byte [rsp + 0xdf]
and al, 0x3f
or al, 0x40
mov byte [rsp + 0xdf], al
lea r8, [0x1402de700]
lea r15, [rsp + 0x20]
mov rcx, r15
mov rdx, r14
call fcn.14003c840
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x170], rax
movups xmm0, xmmword [rsp + 0x70]
movups xmm1, xmmword [rsp + 0x80]
movaps xmmword [rsp + 0x160], xmm1
movaps xmmword [rsp + 0x150], xmm0
lea r14, [rsp + 0x128]
lea rdx, [rsp + 0x150]
mov rcx, r14
call fcn.1400437e0
lea r12, [rsp + 0x150]
mov rcx, r12
mov rdx, r15
mov r8, r14
call fcn.140046220
lea rdx, [rsp + 0x48]
lea r15, [rsp + 0x100]
mov rcx, r15
mov r8, r14
call fcn.140046220
mov rcx, rdi
mov rdx, r15
call fcn.140038d60
lea rcx, [rsp + 0x180]
mov rdx, r12
call fcn.140038d60
movzx eax, byte [rsp + 0x180]
shl al, 7
xor byte [rdi + 0x1f], al
movups xmm0, xmmword [rbx]
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
movups xmm0, xmmword [rdi]
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsi + 0x20], xmm0
movups xmmword [rsi + 0x30], xmm1
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.140265fe0
nop
add rsp, 0x1a8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140042130
Capabilities:
Encrypt data using curve25519

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x168
mov qword [rsp + 0x20], rcx
mov rax, qword [0x14039fd98]
xor rax, rsp
mov qword [rsp + 0x160], rax
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
movaps xmmword [rsp + 0x140], xmm0
movaps xmmword [rsp + 0x150], xmm1
and byte [rsp + 0x140], 0xf8
movzx eax, byte [rsp + 0x15f]
and al, 0x3f
or al, 0x40
mov byte [rsp + 0x15f], al
lea r8, [0x1402de700]
lea rcx, [rsp + 0xa0]
lea rdx, [rsp + 0x140]
call fcn.14003c840
mov rax, qword [rsp + 0xf0]
mov r11, qword [rsp + 0xc8]
mov rsi, qword [rsp + 0xd0]
lea rdi, [r11 + rax]
mov rcx, qword [rsp + 0xf8]
lea rbx, [rsi + rcx]
mov rdx, qword [rsp + 0x100]
mov r14, qword [rsp + 0xd8]
lea r15, [r14 + rdx]
mov r8, qword [rsp + 0x108]
mov r12, qword [rsp + 0xe0]
lea r13, [r12 + r8]
mov r9, qword [rsp + 0x110]
mov rbp, qword [rsp + 0xe8]
lea r10, [rbp + r9]
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], r15
mov qword [rsp + 0x90], r13
mov qword [rsp + 0x98], r10
movabs r10, 0xffffffffffffe
add rax, r10
sub rax, r11
add rax, 0xffffffffffffffdc
add rcx, r10
sub rcx, rsi
add rdx, r10
sub rdx, r14
add r8, r10
sub r8, r12
add r9, r10
sub r9, rbp
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], r8
mov qword [rsp + 0x70], r9
lea rdi, [rsp + 0x28]
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.1400437e0
lea rdx, [rsp + 0x78]
mov rcx, rdi
mov r8, rdi
call fcn.140046220
mov rcx, qword [rsp + 0x20]
mov rdx, rdi
call fcn.140038d60
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140265fe0
nop
add rsp, 0x168
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14004a3f0
Capabilities:
Encrypt data using openssl rsa

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, rdx
mov rax, qword [0x14039fd98]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x28]
mov r8d, 6
call fcn.1400344a0
xor edi, edi
test eax, eax
je 0x14004a5a7
lea rcx, [rsp + 0x28]
call fcn.14002a370
movzx r15d, byte [reloc.WS2_32.dll_htons]
cmp rax, r15
jne 0x14004a475
mov rbx, rax
lea rcx, [rsp + 0x28]
call fcn.140033e80
lea r14, [0x1402dfe80]
test r15b, r15b
je 0x14004a59d
lea rdx, [0x1402dfe84]
mov rcx, rax
mov r8, rbx
call fcn.140268730
test eax, eax
je 0x14004a59d
lea rcx, [rsp + 0x28]
call fcn.14002a370
movzx r15d, byte [reloc.WS2_32.dll_getsockopt]
cmp rax, r15
jne 0x14004a4c3
mov rbx, rax
lea rcx, [rsp + 0x28]
call fcn.140033e80
lea r14, [0x1402dfb18]
test r15b, r15b
je 0x14004a59d
lea rdx, [0x1402dfb1c]
mov rcx, rax
mov r8, rbx
call fcn.140268730
test eax, eax
je 0x14004a59d
lea rcx, [rsp + 0x28]
call fcn.14002a370
movzx r15d, byte [reloc.WS2_32.dll_getsockopt]
cmp rax, r15
jne 0x14004a511
mov rbx, rax
lea rcx, [rsp + 0x28]
call fcn.140033e80
lea r14, [0x1402df9a0]
test r15b, r15b
je 0x14004a59d
lea rdx, [0x1402df9a4]
mov rcx, rax
mov r8, rbx
call fcn.140268730
test eax, eax
je 0x14004a59d
lea rcx, [rsp + 0x28]
call fcn.14002a370
movzx r15d, byte [reloc.WS2_32.dll_closesocket]
cmp rax, r15
jne 0x14004a557
mov rbx, rax
lea rcx, [rsp + 0x28]
call fcn.140033e80
lea r14, [0x1402dfc90]
test r15b, r15b
je 0x14004a59d
lea rdx, [0x1402dfc94]
mov rcx, rax
mov r8, rbx
call fcn.140268730
test eax, eax
je 0x14004a59d
lea rcx, [rsp + 0x28]
call fcn.14002a370
movzx r15d, byte [reloc.WS2_32.dll_closesocket]
cmp rax, r15
jne 0x14004a5a7
mov rbx, rax
lea rcx, [rsp + 0x28]
call fcn.140033e80
lea r14, [0x1402dfff8]
test r15b, r15b
je 0x14004a59d
lea rdx, [0x1402dfffc]
mov rcx, rax
mov r8, rbx
call fcn.140268730
test eax, eax
jne 0x14004a5a7
mov eax, dword [r14]
mov dword [rsi], eax
mov edi, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140265fe0
mov eax, edi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14004e440
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xf8
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x30], r8
mov r14, rdx
mov r15, rcx
mov r12, qword [rsp + 0x168]
mov rax, qword [0x14039fd98]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov rcx, r12
call fcn.140049fa0
mov rbx, rax
lea r13, [rsp + 0x40]
mov rcx, r13
call fcn.140075d50
mov qword [rsp + 0x20], 0
mov rcx, r13
mov rdx, r15
mov r8, r14
mov r9, r12
call fcn.140075d80
test eax, eax
je 0x14004e6e9
mov rsi, qword [rsp + 0x170]
test rsi, rsi
je 0x14004e6ed
mov r14, qword [rsp + 0x178]
mov eax, 1
lea r15, [rsp + 0x40]
jmp 0x14004e4f2
add r14, rbp
mov eax, dword [rsp + 0x2c]
inc eax
sub rsi, rbp
je 0x14004e6ed
cmp rbx, rsi
mov rbp, rsi
cmovb rbp, rbx
mov dword [rsp + 0x2c], eax
bswap eax
mov dword [rsp + 0xac], eax
mov qword [rsp + 0x20], 0
mov rcx, r15
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call fcn.140075d80
test eax, eax
je 0x14004e6e9
mov rcx, r15
mov rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x38]
call fcn.140076080
test eax, eax
je 0x14004e6e9
mov r8d, 4
mov rcx, r15
lea rdx, [rsp + 0xac]
call fcn.140076080
test eax, eax
je 0x14004e6e9
mov rcx, r15
lea rdx, [rsp + 0xb0]
xor r8d, r8d
call fcn.1400760a0
test eax, eax
je 0x14004e6e9
test rbp, rbp
je 0x14004e595
mov rcx, r14
lea rdx, [rsp + 0xb0]
mov r8, rbp
call fcn.1402689f0
cmp dword [rsp + 0x160], 2
jb 0x14004e4e0
mov r12, rbp
and r12, 0xffffffffffffffe0
mov r13, rbp
and r13, 0xfffffffffffffff8
mov edi, 1
jmp 0x14004e5cf
inc edi
cmp edi, dword [rsp + 0x160]
je 0x14004e4e0
mov qword [rsp + 0x20], 0
mov rcx, r15
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call fcn.140075d80
test eax, eax
je 0x14004e6e9
mov rcx, r15
lea rdx, [rsp + 0xb0]
mov r8, rbx
call fcn.140076080
test eax, eax
je 0x14004e6e9
mov rcx, r15
lea rdx, [rsp + 0xb0]
xor r8d, r8d
call fcn.1400760a0
test eax, eax
je 0x14004e6e9
test rbp, rbp
je 0x14004e5c0
cmp rbp, 8
jae 0x14004e640
xor eax, eax
jmp 0x14004e6d0
cmp rbp, 0x20
jae 0x14004e64a
xor ecx, ecx
jmp 0x14004e6a0
xor eax, eax
nop dword [rax]
movups xmm0, xmmword [r14 + rax]
movups xmm1, xmmword [r14 + rax + 0x10]
xorps xmm0, xmmword [rsp + rax + 0xb0]
xorps xmm1, xmmword [rsp + rax + 0xc0]
movups xmmword [r14 + rax], xmm0
movups xmmword [r14 + rax + 0x10], xmm1
add rax, 0x20
cmp r12, rax
jne 0x14004e650
cmp rbp, r12
je 0x14004e5c0
mov rcx, r12
mov rax, r12
test bpl, 0x18
je 0x14004e6d0
nop word cs:[rax + rax]
mov rax, qword [rsp + rcx + 0xb0]
xor qword [r14 + rcx], rax
add rcx, 8
cmp r13, rcx
jne 0x14004e6a0
mov rax, r13
cmp rbp, r13
je 0x14004e5c0
nop word cs:[rax + rax]
movzx ecx, byte [rsp + rax + 0xb0]
xor byte [r14 + rax], cl
inc rax
cmp rbp, rax
jne 0x14004e6d0
jmp 0x14004e5c0
xor esi, esi
jmp 0x14004e6fb
xor esi, esi
cmp dword [rsp + 0x160], 0
setne sil
lea rcx, [rsp + 0x40]
call fcn.140076160
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.140265fe0
mov eax, esi
add rsp, 0xf8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140052050
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rax, qword [0x14039fd98]
xor rax, rsp
mov qword [rsp + 0x30], rax
test r8, r8
je 0x140052260
mov r14, r9
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov r13, qword [rsp + 0xa8]
mov r12, qword [rsp + 0xa0]
cmp rcx, 0x20
setae al
add rcx, 0xffffffffffffffe0
cmp rcx, rdx
setae cl
cmp rsi, rdx
jb 0x14005210a
and al, cl
jne 0x14005210a
cmp rdi, 0x10
jb 0x140052164
lea r15, [rsp + 0x20]
nop dword [rax]
mov rcx, rsi
mov rdx, r15
mov r8, r14
call r13
mov rax, qword [rsi]
mov rcx, qword [r12]
xor rcx, qword [rsp + 0x20]
mov qword [rbx], rcx
mov qword [r12], rax
mov rax, qword [rsi + 8]
mov rcx, qword [r12 + 8]
xor rcx, qword [rsp + 0x28]
mov qword [rbx + 8], rcx
mov qword [r12 + 8], rax
add rdi, 0xfffffffffffffff0
add rsi, 0x10
add rbx, 0x10
cmp rdi, 0xf
ja 0x1400520c0
jmp 0x140052164
cmp rdi, 0x10
jb 0x140052159
mov rbp, r12
nop word cs:[rax + rax]
mov r15, rsi
mov rcx, rsi
mov rdx, rbx
mov r8, r14
call r13
mov rax, qword [rbp]
xor qword [rbx], rax
mov rax, qword [rbp + 8]
xor qword [rbx + 8], rax
add rdi, 0xfffffffffffffff0
add rsi, 0x10
add rbx, 0x10
mov rbp, r15
cmp rdi, 0xf
ja 0x140052120
lea rax, [rsi - 0x10]
jmp 0x14005215c
mov rax, r12
movups xmm0, xmmword [rax]
movups xmmword [r12], xmm0
test rdi, rdi
je 0x140052260
lea rdx, [rsp + 0x20]
mov rcx, rsi
mov r8, r14
call r13
cmp rdi, 0x10
mov eax, reloc.WS2_32.dll_recv
cmovb rax, rdi
cmp rax, 1
jne 0x140052192
xor ecx, ecx
jmp 0x1400521db
mov edx, eax
and edx, 0x1e
xor ecx, ecx
nop dword [rax]
movzx r8d, byte [rsi + rcx]
movzx r9d, byte [r12 + rcx]
xor r9b, byte [rsp + rcx + 0x20]
mov byte [rbx + rcx], r9b
mov byte [r12 + rcx], r8b
movzx r8d, byte [rsi + rcx + 1]
movzx r9d, byte [r12 + rcx + 1]
xor r9b, byte [rsp + rcx + 0x21]
mov byte [rbx + rcx + 1], r9b
mov byte [r12 + rcx + 1], r8b
add rcx, 2
cmp rdx, rcx
jne 0x1400521a0
test al, 1
je 0x1400521f5
movzx edx, byte [rsi + rcx]
movzx r8d, byte [r12 + rcx]
xor r8b, byte [rsp + rcx + 0x20]
mov byte [rbx + rcx], r8b
mov byte [r12 + rcx], dl
cmp rdi, 0xf
ja 0x140052260
mov edx, eax
neg edx
mov rcx, rax
and edx, 3
je 0x140052221
mov rcx, rax
nop word [rax + rax]
movzx r8d, byte [rsi + rcx]
mov byte [r12 + rcx], r8b
inc rcx
dec rdx
jne 0x140052210
add rax, 0xfffffffffffffff3
cmp rax, 3
jb 0x140052260
nop dword [rax + rax]
movzx eax, byte [rsi + rcx]
mov byte [r12 + rcx], al
movzx eax, byte [rsi + rcx + 1]
mov byte [r12 + rcx + 1], al
movzx eax, byte [rsi + rcx + 2]
mov byte [r12 + rcx + 2], al
movzx eax, byte [rsi + rcx + 3]
mov byte [r12 + rcx + 3], al
add rcx, 4
cmp rcx, 0x10
jne 0x140052230
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140265fe0
nop
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140052570
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
movsxd r8, dword [rdx + 8]
mov r9, qword [rdx]
movsxd rdx, dword [rcx + 8]
mov rcx, qword [rcx]
mov r10, rdx
sub r10, r8
mov r11, r8
cmovb r11, rdx
xor eax, eax
test r11, r11
je 0x1400525d9
xor esi, esi
nop dword [rax + rax]
mov rdi, qword [r9 + rsi*8]
mov rbx, qword [rcx + rsi*8]
mov r14, rbx
xor r14, rdi
mov r15, rbx
sub r15, rdi
xor r15, rbx
or r15, r14
xor edi, edi
xor r15, rbx
setns dil
sar r15, 0x3f
or r15d, edi
test r14, r14
cmovne eax, r15d
inc rsi
cmp r11, rsi
jne 0x1400525a0
cmp edx, r8d
jae 0x1400525f1
mov r10, r8
sub r10, rdx
cmp r10, 4
jae 0x14005260e
xor esi, esi
mov rcx, rdx
jmp 0x140052670
cmp r8d, edx
jae 0x14005270d
cmp r10, 4
jae 0x14005268a
xor esi, esi
mov r9, r8
jmp 0x1400526f0
mov r11, r10
and r11, 0xfffffffffffffffc
lea rcx, [r11 + rdx]
lea rdx, [r9 + rdx*8]
add rdx, 0x10
pxor xmm0, xmm0
xor esi, esi
pxor xmm1, xmm1
nop dword [rax + rax]
movdqu xmm2, xmmword [rdx + rsi*8 - 0x10]
por xmm0, xmm2
movdqu xmm2, xmmword [rdx + rsi*8]
por xmm1, xmm2
add rsi, 4
cmp r11, rsi
jne 0x140052630
por xmm1, xmm0
pshufd xmm0, xmm1, 0xee
por xmm0, xmm1
movq rsi, xmm0
cmp r10, r11
je 0x14005267c
nop word cs:[rax + rax]
or rsi, qword [r9 + rcx*8]
inc rcx
cmp r8, rcx
jne 0x140052670
xor ecx, ecx
neg rsi
sbb ecx, ecx
or eax, ecx
jmp 0x14005270d
mov r11, r10
and r11, 0xfffffffffffffffc
lea r9, [r11 + r8]
lea r8, [rcx + r8*8]
add r8, 0x10
pxor xmm0, xmm0
xor esi, esi
pxor xmm1, xmm1
nop word [rax + rax]
movdqu xmm2, xmmword [r8 + rsi*8 - 0x10]
por xmm0, xmm2
movdqu xmm2, xmmword [r8 + rsi*8]
por xmm1, xmm2
add rsi, 4
cmp r11, rsi
jne 0x1400526b0
por xmm1, xmm0
pshufd xmm0, xmm1, 0xee
por xmm0, xmm1
movq rsi, xmm0
cmp r10, r11
je 0x1400526fc
nop word cs:[rax + rax]
or rsi, qword [rcx + r9*8]
inc r9
cmp rdx, r9
jne 0x1400526f0
xor ecx, ecx
xor edx, edx
test rsi, rsi
cmove ecx, eax
setne dl
or edx, ecx
mov eax, edx
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400544c0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
test rcx, rcx
je 0x140054562
test rdx, rdx
je 0x140054562
mov r8d, dword [rcx + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x14005457b
movsxd rax, dword [rdx + 8]
mov r10, qword [rdx]
movsxd rdx, dword [rcx + 8]
mov r9, qword [rcx]
mov r11, rdx
sub r11, rax
mov rsi, rax
cmovb rsi, rdx
xor ecx, ecx
test rsi, rsi
je 0x140054548
xor edi, edi
nop dword [rax]
mov rbx, qword [r10 + rdi*8]
mov r14, qword [r9 + rdi*8]
mov r15, r14
xor r15, rbx
mov r12, r14
sub r12, rbx
xor r12, r14
or r12, r15
xor ebx, ebx
xor r12, r14
setns bl
sar r12, 0x3f
or r12d, ebx
test r15, r15
cmovne ecx, r12d
inc rdi
cmp rsi, rdi
jne 0x140054510
cmp edx, eax
jae 0x14005458a
mov r11, rax
sub r11, rdx
cmp r11, 4
jae 0x1400545a6
xor edi, edi
mov r9, rdx
jmp 0x140054610
xor r8d, r8d
test rdx, rdx
setne r8b
xor eax, eax
neg rcx
sbb eax, eax
or eax, r8d
jmp 0x1400546b7
xor eax, eax
neg r8d
sbb eax, eax
or eax, 1
jmp 0x1400546b7
cmp eax, edx
jae 0x1400546ad
cmp r11, 4
jae 0x14005462a
xor edi, edi
mov r10, rax
jmp 0x140054690
mov rsi, r11
and rsi, 0xfffffffffffffffc
lea r9, [rsi + rdx]
lea rdx, [r10 + rdx*8]
add rdx, 0x10
pxor xmm0, xmm0
xor edi, edi
pxor xmm1, xmm1
nop word cs:[rax + rax]
movdqu xmm2, xmmword [rdx + rdi*8 - 0x10]
por xmm0, xmm2
movdqu xmm2, xmmword [rdx + rdi*8]
por xmm1, xmm2
add rdi, 4
cmp rsi, rdi
jne 0x1400545d0
por xmm1, xmm0
pshufd xmm0, xmm1, 0xee
por xmm0, xmm1
movq rdi, xmm0
cmp r11, rsi
je 0x14005461c
nop word cs:[rax + rax]
or rdi, qword [r10 + r9*8]
inc r9
cmp rax, r9
jne 0x140054610
xor eax, eax
neg rdi
sbb eax, eax
or ecx, eax
jmp 0x1400546ad
mov rsi, r11
and rsi, 0xfffffffffffffffc
lea r10, [rsi + rax]
lea rax, [r9 + rax*8]
add rax, 0x10
pxor xmm0, xmm0
xor edi, edi
pxor xmm1, xmm1
nop word [rax + rax]
movdqu xmm2, xmmword [rax + rdi*8 - 0x10]
por xmm0, xmm2
movdqu xmm2, xmmword [rax + rdi*8]
por xmm1, xmm2
add rdi, 4
cmp rsi, rdi
jne 0x140054650
por xmm1, xmm0
pshufd xmm0, xmm1, 0xee
por xmm0, xmm1
movq rdi, xmm0
cmp r11, rsi
je 0x14005469c
nop word cs:[rax + rax]
or rdi, qword [r9 + r10*8]
inc r10
cmp rdx, r10
jne 0x140054690
xor eax, eax
xor edx, edx
test rdi, rdi
cmove eax, ecx
setne dl
or edx, eax
mov ecx, edx
mov eax, ecx
neg eax
test r8d, r8d
cmove eax, ecx
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret