joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14016e5d0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x10
mov r11, rcx
movaps xmmword [rsp], xmm6
movdqu xmm6, xmmword [rdx]
lea rdi, str.cw
pshufd xmm0, xmm6, 0x55
mov rbx, rdx
movd eax, xmm0
movdqu xmm5, xmmword [r11]
pshufd xmm0, xmm6, 0xff
mov r9d, eax
shr rax, 0x10
movzx r8d, al
mov eax, r9d
shr rax, 0x18
pslldq xmm5, 4
movdqa xmm4, xmm5
pslldq xmm5, 4
movzx r10d, byte [r8 + rdi]
movzx eax, byte [rax + rdi]
xorps xmm4, xmmword [r11]
shl eax, 8
or r10d, eax
mov eax, r9d
shr rax, 8
movzx ecx, al
shl r10d, 8
movzx eax, byte [rcx + rdi]
or r10d, eax
movzx eax, r9b
shl r10d, 8
movzx ecx, byte [rax + rdi]
or r10d, ecx
movd eax, xmm0
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movd xmm3, r10d
movzx r8d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
or r8d, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl r8d, 8
movzx eax, byte [rcx + rdi]
or r8d, eax
movzx eax, dl
shl r8d, 8
movzx ecx, byte [rax + rdi]
mov eax, r10d
or r8d, ecx
ror eax, 8
xor eax, 8
mov ecx, r8d
ror ecx, 8
xor ecx, 8
movd xmm2, r8d
movd xmm0, eax
punpckldq xmm3, xmm0
movdqa xmm0, xmm5
movd xmm1, ecx
xorps xmm0, xmm4
punpckldq xmm2, xmm1
punpcklqdq xmm3, xmm2
pslldq xmm5, 4
xorps xmm0, xmm5
pshufd xmm1, xmm3, 0xff
xorps xmm1, xmm0
pshufd xmm0, xmm1, 0x55
movd eax, xmm0
movdqu xmmword [r11], xmm1
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movzx r9d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
movdqa xmm5, xmm6
or r9d, eax
pshufd xmm0, xmm1, 0xff
shl r9d, 8
mov eax, edx
shr rax, 8
movzx ecx, al
pslldq xmm5, 4
movdqa xmm4, xmm5
pslldq xmm5, 4
xorps xmm4, xmm6
movaps xmm6, xmmword [rsp]
movzx eax, byte [rcx + rdi]
or r9d, eax
movzx eax, dl
shl r9d, 8
movzx ecx, byte [rax + rdi]
movd eax, xmm0
or r9d, ecx
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movd xmm3, r9d
movzx r8d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
or r8d, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl r8d, 8
movzx eax, byte [rcx + rdi]
or r8d, eax
movzx eax, dl
shl r8d, 8
movzx ecx, byte [rax + rdi]
or r8d, ecx
mov ecx, r9d
mov eax, r8d
ror eax, 8
ror ecx, 8
movd xmm2, r8d
movd xmm1, eax
punpckldq xmm2, xmm1
movd xmm0, ecx
punpckldq xmm3, xmm0
movdqa xmm0, xmm5
xorps xmm0, xmm4
punpcklqdq xmm3, xmm2
pslldq xmm5, 4
xorps xmm0, xmm5
pshufd xmm1, xmm3, 0xaa
xorps xmm1, xmm0
movdqu xmmword [rbx], xmm1
mov rbx, qword [rsp + 0x20]
add rsp, 0x10
pop rdi
ret
Function at 0x140173690
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movdqu xmm4, xmmword [rcx + 0x10]
vbroadcastf128 ymm1, xmmword [rcx]
vbroadcastf128 ymm0, xmmword [rcx + 0x10]
mov rax, qword [rsp + 0x28]
vmovdqu ymmword [rdx], ymm1
vmovdqu xmm1, xmmword [rcx]
vpslldq xmm1, xmm1, 4
vmovdqu ymmword [r8], ymm0
vmovdqa xmm0, xmm1
vpslldq xmm1, xmm1, 4
vxorps xmm0, xmm0, xmmword [rcx]
vmovdqa xmm3, xmm1
vxorps xmm3, xmm3, xmm0
vpslldq xmm1, xmm1, 4
vxorps xmm3, xmm3, xmm1
vaeskeygenassist xmm0, xmm4, 1
vpshufd xmm1, xmm0, 0xff
vxorps xmm3, xmm3, xmm1
vmovdqa xmm1, xmm4
vpslldq xmm1, xmm1, 4
vmovdqa xmm0, xmm1
vpslldq xmm1, xmm1, 4
vxorps xmm0, xmm0, xmm4
vmovdqa xmm4, xmm1
vpslldq xmm1, xmm1, 4
vxorps xmm4, xmm4, xmm0
vxorps xmm4, xmm4, xmm1
vaeskeygenassist xmm0, xmm3, 0
vpshufd xmm1, xmm0, 0xaa
vxorps xmm4, xmm4, xmm1
vinsertf128 ymm1, ymm3, xmm3, 1
vmovdqu ymmword [r9], ymm1
vmovdqa xmm1, xmm3
vpslldq xmm1, xmm1, 4
vinsertf128 ymm0, ymm4, xmm4, 1
vmovdqu ymmword [rax], ymm0
mov rax, qword [rsp + 0x30]
vmovdqa xmm0, xmm1
vpslldq xmm1, xmm1, 4
vxorps xmm0, xmm0, xmm3
vmovdqa xmm3, xmm1
vpslldq xmm1, xmm1, 4
vxorps xmm3, xmm3, xmm0
vxorps xmm3, xmm3, xmm1
vaeskeygenassist xmm0, xmm4, 2
vpshufd xmm1, xmm0, 0xff
vxorps xmm3, xmm3, xmm1
vmovdqa xmm1, xmm4
vpslldq xmm1, xmm1, 4
vmovdqa xmm0, xmm1
vpslldq xmm1, xmm1, 4
vxorps xmm0, xmm0, xmm4
vmovdqa xmm4, xmm1
vpslldq xmm1, xmm1, 4
vxorps xmm4, xmm4, xmm0
vxorps xmm4, xmm4, xmm1
vaeskeygenassist xmm0, xmm3, 0
vpshufd xmm1, xmm0, 0xaa
vxorps xmm4, xmm4, xmm1
vinsertf128 ymm1, ymm3, xmm3, 1
vmovdqu ymmword [rax], ymm1
mov rax, qword [rsp + 0x38]
vmovdqa xmm1, xmm3
vpslldq xmm1, xmm1, 4
vmovdqa xmm0, xmm1
vpslldq xmm1, xmm1, 4
vxorps xmm0, xmm0, xmm3
vmovdqa xmm3, xmm1
vxorps xmm3, xmm3, xmm0
vpslldq xmm1, xmm1, 4
vxorps xmm3, xmm3, xmm1
vaeskeygenassist xmm0, xmm4, 4
vpshufd xmm1, xmm0, 0xff
vxorps xmm3, xmm3, xmm1
vmovdqa xmm1, xmm4
vpslldq xmm1, xmm1, 4
vmovdqa xmm0, xmm1
vpslldq xmm1, xmm1, 4
vinsertf128 ymm2, ymm4, xmm4, 1
vxorps xmm0, xmm0, xmm4
vmovdqu ymmword [rax], ymm2
mov rax, qword [rsp + 0x40]
vmovdqa xmm4, xmm1
vpslldq xmm1, xmm1, 4
vxorps xmm4, xmm4, xmm0
vxorps xmm4, xmm4, xmm1
vaeskeygenassist xmm0, xmm3, 0
vpshufd xmm1, xmm0, 0xaa
vxorps xmm4, xmm4, xmm1
vinsertf128 ymm1, ymm3, xmm3, 1
vmovdqu ymmword [rax], ymm1
mov rax, qword [rsp + 0x48]
vmovdqa xmm1, xmm3
vpslldq xmm1, xmm1, 4
vmovdqa xmm0, xmm1
vpslldq xmm1, xmm1, 4
vxorps xmm0, xmm0, xmm3
vmovdqa xmm3, xmm1
vpslldq xmm1, xmm1, 4
vxorps xmm3, xmm3, xmm0
vxorps xmm3, xmm3, xmm1
vinsertf128 ymm2, ymm4, xmm4, 1
vmovdqu ymmword [rax], ymm2
mov rax, qword [rsp + 0x50]
vaeskeygenassist xmm0, xmm4, 8
vpshufd xmm1, xmm0, 0xff
vxorps xmm3, xmm3, xmm1
vmovdqa xmm1, xmm4
vpslldq xmm1, xmm1, 4
vmovdqa xmm0, xmm1
vpslldq xmm1, xmm1, 4
vmovdqa xmm2, xmm1
vxorps xmm0, xmm0, xmm4
vxorps xmm2, xmm2, xmm0
vpslldq xmm1, xmm1, 4
vxorps xmm2, xmm2, xmm1
vaeskeygenassist xmm0, xmm3, 0
vpshufd xmm1, xmm0, 0xaa
vxorps xmm2, xmm2, xmm1
vinsertf128 ymm1, ymm3, xmm3, 1
vmovdqu ymmword [rax], ymm1
mov rax, qword [rsp + 0x58]
vinsertf128 ymm2, ymm2, xmm2, 1
vmovdqu ymmword [rax], ymm2
vzeroupper
ret
Function at 0x14017bcd0
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, rsp
sub rsp, 0x98
movdqu xmm2, xmmword [rcx]
lea r9, [rdx + r8]
movdqu xmm3, xmmword [rcx + 0x10]
movdqu xmm4, xmmword [rcx + 0x20]
movdqu xmm5, xmmword [rcx + 0x30]
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
movdqa xmm7, xmmword [0x1407bd140]
movaps xmmword [rax - 0x38], xmm8
movdqa xmm8, xmmword [0x1407bd150]
movaps xmmword [rax - 0x48], xmm9
movdqa xmm9, xmmword [0x1407bd160]
aesdec xmm2, xmm7
aesenc xmm3, xmm7
movaps xmmword [rax - 0x58], xmm10
movdqa xmm10, xmmword [0x1407bd170]
aesdec xmm2, xmm8
aesenc xmm3, xmm8
movaps xmmword [rax - 0x68], xmm11
movdqa xmm11, xmmword [0x1407bd180]
movaps xmmword [rax - 0x78], xmm12
movaps xmmword [rsp + 0x10], xmm13
movaps xmmword [rsp], xmm14
lea rax, [r8 + 0x80]
movdqa xmm12, xmmword [0x1407bd190]
movdqa xmm13, xmmword [0x1407bd1a0]
movdqa xmm14, xmmword [0x1407bd1b0]
aesdec xmm4, xmm11
aesenc xmm5, xmm11
aesdec xmm4, xmm12
aesenc xmm5, xmm12
aesdec xmm2, xmm9
aesenc xmm3, xmm9
aesdec xmm4, xmm13
aesdec xmm2, xmm10
movdqu xmmword [r8], xmm2
aesenc xmm3, xmm10
movdqu xmmword [r8 + 0x10], xmm3
aesenc xmm5, xmm13
aesdec xmm4, xmm14
movdqu xmmword [r8 + 0x20], xmm4
aesenc xmm5, xmm14
movdqu xmmword [r8 + 0x30], xmm5
aesdec xmm2, xmm7
aesenc xmm3, xmm7
aesdec xmm4, xmm11
aesenc xmm5, xmm11
aesdec xmm2, xmm8
aesenc xmm3, xmm8
aesdec xmm4, xmm12
aesenc xmm5, xmm12
aesdec xmm2, xmm9
aesenc xmm3, xmm9
aesdec xmm4, xmm13
aesdec xmm2, xmm10
movdqu xmmword [r8 + 0x40], xmm2
aesenc xmm3, xmm10
movdqu xmmword [r8 + 0x50], xmm3
aesenc xmm5, xmm13
aesdec xmm4, xmm14
movdqu xmmword [r8 + 0x60], xmm4
aesenc xmm5, xmm14
movdqu xmmword [r8 + 0x70], xmm5
movdqa xmm6, xmmword [0x140486850]
cmp rax, r9
jae 0x14017bf0a
nop word [rax + rax]
aesdec xmm2, xmm7
aesenc xmm3, xmm7
aesdec xmm4, xmm11
aesenc xmm5, xmm11
aesdec xmm2, xmm8
aesenc xmm3, xmm8
aesdec xmm4, xmm12
aesenc xmm5, xmm12
aesdec xmm2, xmm9
aesenc xmm3, xmm9
aesdec xmm2, xmm10
movdqa xmm0, xmm6
movdqa xmm1, xmm6
andps xmm0, xmm2
movdqu xmmword [rax], xmm0
movdqa xmm0, xmm6
aesenc xmm3, xmm10
andps xmm1, xmm3
movdqu xmmword [rax + 0x10], xmm1
movdqa xmm1, xmm6
aesdec xmm4, xmm13
aesenc xmm5, xmm13
aesdec xmm4, xmm14
aesenc xmm5, xmm14
andps xmm0, xmm4
andps xmm1, xmm5
movdqu xmmword [rax + 0x20], xmm0
movdqu xmmword [rax + 0x30], xmm1
add rax, 0x40
cmp rax, r9
jb 0x14017be70
movaps xmm7, xmmword [rsp + 0x70]
lea r11, [rsp + 0x98]
movaps xmm6, xmmword [r11 - 0x18]
movaps xmm8, xmmword [r11 - 0x38]
movaps xmm9, xmmword [r11 - 0x48]
movaps xmm10, xmmword [r11 - 0x58]
movaps xmm11, xmmword [r11 - 0x68]
movaps xmm12, xmmword [r11 - 0x78]
movaps xmm13, xmmword [rsp + 0x10]
movaps xmm14, xmmword [rsp]
mov rsp, r11
ret
Function at 0x14017bf50
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x68
movdqa xmm2, xmmword [0x1404e3050]
mov r10, rcx
movdqa xmm3, xmmword [0x1404e3000]
mov rax, rcx
movdqa xmm4, xmmword [0x1404e3070]
mov r11, r8
movdqa xmm5, xmmword [0x1404e2f50]
lea r8, [rcx + 0x1c00]
movdqu xmm0, xmmword [r9]
lea rcx, [rdx - 0x1c00]
movdqu xmm1, xmmword [r9 + 0x10]
add rcx, rax
movaps xmmword [rsp + 0x50], xmm6
mov edx, 2
movdqu xmm6, xmmword [r9 + 0x20]
movaps xmmword [rsp + 0x40], xmm7
movdqu xmm7, xmmword [r9 + 0x30]
movaps xmmword [rsp + 0x30], xmm8
movdqa xmm8, xmmword [0x1404e3020]
movaps xmmword [rsp + 0x20], xmm9
movdqa xmm9, xmmword [0x1404e2d70]
movaps xmmword [rsp + 0x10], xmm10
movaps xmmword [rsp], xmm11
movdqa xmm11, xmmword [0x1404e2f00]
movdqa xmm10, xmmword [0x1404e2dc0]
nop
cmp rax, rcx
jae 0x14017c0a3
nop dword [rax]
aesenc xmm2, xmmword [rax]
aesdec xmm3, xmmword [rax + 0x10]
aesenc xmm4, xmmword [rax + 0x20]
aesdec xmm5, xmmword [rax + 0x30]
aesenc xmm2, xmmword [rax + 0x40]
aesdec xmm3, xmmword [rax + 0x50]
aesenc xmm4, xmmword [rax + 0x60]
aesdec xmm5, xmmword [rax + 0x70]
aesdec xmm0, xmm8
movdqu xmmword [rax], xmm0
aesenc xmm1, xmm9
movdqu xmmword [rax + 0x10], xmm1
aesdec xmm6, xmm10
movdqu xmmword [rax + 0x20], xmm6
aesenc xmm7, xmm11
movdqu xmmword [rax + 0x30], xmm7
aesdec xmm0, xmm8
movdqu xmmword [rax + 0x40], xmm0
aesenc xmm1, xmm9
movdqu xmmword [rax + 0x50], xmm1
aesdec xmm6, xmm10
aesenc xmm7, xmm11
movdqu xmmword [rax + 0x60], xmm6
movdqu xmmword [rax + 0x70], xmm7
prefetcht0 byte [r8]
prefetcht0 byte [r8 + 0x40]
sub rax, 0xffffffffffffff80
lea r8, [r8 + 0x80]
cmp rax, rcx
jb 0x14017c000
add rcx, 0x1c00
mov r8, r10
sub rdx, 1
jne 0x14017bff0
movaps xmm8, xmmword [rsp + 0x30]
movaps xmm9, xmmword [rsp + 0x20]
movaps xmm10, xmmword [rsp + 0x10]
movaps xmm11, xmmword [rsp]
movdqu xmmword [r9], xmm0
movdqa xmm0, xmmword [0x1404e2d40]
movdqu xmmword [r9 + 0x10], xmm1
movdqa xmm1, xmmword [0x1404e3080]
movdqu xmmword [r9 + 0x20], xmm6
movaps xmm6, xmmword [rsp + 0x50]
movdqu xmmword [r9 + 0x30], xmm7
movaps xmm7, xmmword [rsp + 0x40]
aesenc xmm2, xmm0
aesdec xmm3, xmm0
aesenc xmm4, xmm0
aesdec xmm5, xmm0
aesenc xmm2, xmm1
aesdec xmm3, xmm1
aesenc xmm4, xmm1
aesdec xmm5, xmm1
movdqu xmmword [r11], xmm2
movdqu xmmword [r11 + 0x10], xmm3
movdqu xmmword [r11 + 0x20], xmm4
movdqu xmmword [r11 + 0x30], xmm5
add rsp, 0x68
ret
Function at 0x140184df0
Capabilities:
Hash data using sha512

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x14051f680]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x140184eee
lea rax, [rdx - 1]
cmp rax, 0x3f
ja 0x140184ed5
xor eax, eax
mov byte [rsp + 0x20], dil
xor edx, edx
mov qword [rsp + 0x32], rax
mov r8d, 0xf0
mov dword [rsp + 0x3a], eax
mov word [rsp + 0x3e], ax
mov word [rsp + 0x21], 0x100
mov byte [rsp + 0x23], 1
mov dword [rsp + 0x24], 0
mov word [rsp + 0x30], 0
call fcn.14039f8d0
movaps xmm0, xmmword [0x140486860]
mov rax, qword [rsp + 0x20]
movups xmmword [rbx], xmm0
movaps xmm1, xmmword [0x140486870]
movups xmmword [rbx + 0x10], xmm1
movaps xmm0, xmmword [0x140486880]
movups xmmword [rbx + 0x20], xmm0
movaps xmm1, xmmword [0x140486890]
xorps xmm0, xmm0
movups xmmword [rbx + 0x30], xmm1
xor qword [rbx], rax
mov rax, qword [rsp + 0x30]
xor qword [rbx + 0x10], rax
mov rax, qword [rsp + 0x38]
xor qword [rbx + 0x18], rax
movq rax, xmm0
xor qword [rbx + 0x20], rax
xor qword [rbx + 8], 0
psrldq xmm0, 8
movq rax, xmm0
xor qword [rbx + 0x28], rax
movzx eax, dil
mov dword [rbx + 0xe4], eax
xor eax, eax
jmp 0x140184ef3
cmp byte [rcx + 0xe8], 0
je 0x140184ee6
mov qword [rcx + 0x58], 0xffffffffffffffff
mov qword [rcx + 0x50], 0xffffffffffffffff
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14036d350
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
ret

Function at 0x140189e00
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx + 0xab0]
mov ecx, dword [0x1407bd0ac]
movdqa xmm4, xmmword [0x1404e3020]
add rcx, rax
movdqa xmm5, xmmword [0x1404e2d70]
movdqu xmm0, xmmword [rdx]
movdqu xmm1, xmmword [rdx + 0x10]
movdqu xmm2, xmmword [rdx + 0x20]
movdqu xmm3, xmmword [rdx + 0x30]
movaps xmmword [rsp + 0x10], xmm6
movdqa xmm6, xmmword [0x1404e2dc0]
movaps xmmword [rsp], xmm7
movdqa xmm7, xmmword [0x1404e2f00]
cmp rax, rcx
jae 0x140189e90
nop word [rax + rax]
aesdec xmm0, xmm4
aesenc xmm1, xmm5
aesdec xmm2, xmm6
aesenc xmm3, xmm7
movdqu xmmword [rax], xmm0
movdqu xmmword [rax + 0x10], xmm1
movdqu xmmword [rax + 0x20], xmm2
movdqu xmmword [rax + 0x30], xmm3
add rax, 0x40
cmp rax, rcx
jb 0x140189e60
movaps xmm6, xmmword [rsp + 0x10]
movaps xmm7, xmmword [rsp]
movdqu xmmword [rdx], xmm0
movdqu xmmword [rdx + 0x10], xmm1
movdqu xmmword [rdx + 0x20], xmm2
movdqu xmmword [rdx + 0x30], xmm3
add rsp, 0x28
ret
Function at 0x14018fe30
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
lea rbp, [rsp - 0xc0]
sub rsp, 0x1c0
mov rax, qword [0x14051f680]
xor rax, rsp
mov qword [rbp + 0xb0], rax
movups xmm0, xmmword [0x140486c70]
mov rbx, r8
mov r8, rdx
movups xmm1, xmmword [0x140486c80]
mov rdx, rcx
lea rcx, [rsp + 0x20]
lea r9, [rbp - 0x70]
movaps xmmword [rsp + 0x20], xmm0
movaps xmmword [rsp + 0x30], xmm1
mov qword [rsp + 0x40], 0
call fcn.14018fc20
mov rax, qword [rsp + 0x40]
lea rcx, [rsp + 0x48]
shr rax, 3
lea rdx, [0x140486c30]
and eax, 0x3f
add rcx, rax
cmp rax, 0x38
jae 0x14018febf
mov r8d, gethostname
sub r8, rax
call fcn.14039f230
jmp 0x14018ff00
mov r8d, 0x40
sub r8, rax
call fcn.14039f230
lea r9, [rbp + 0x90]
lea r8, [rbp - 0x70]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x20]
call fcn.14018edc0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x78], rax
movups xmmword [rsp + 0x58], xmm0
movups xmmword [rsp + 0x68], xmm0
mov rdx, qword [rsp + 0x40]
lea r9, [rbp + 0x90]
movzx eax, byte [rsp + 0x40]
lea r8, [rbp - 0x70]
mov byte [rbp - 0x79], al
lea rcx, [rsp + 0x20]
mov rax, rdx
shr rax, 8
mov byte [rbp - 0x7a], al
mov rax, rdx
shr rax, 0x10
mov byte [rbp - 0x7b], al
mov rax, rdx
shr rax, 0x18
mov byte [rbp - 0x7c], al
mov rax, rdx
shr rax, 0x20
mov byte [rbp - 0x7d], al
mov rax, rdx
shr rax, 0x28
mov byte [rbp - 0x7e], al
mov rax, rdx
shr rdx, 0x38
mov byte [rbp - 0x80], dl
lea rdx, [rsp + 0x48]
shr rax, 0x30
mov byte [rbp - 0x7f], al
call fcn.14018edc0
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14018ea70
mov rcx, qword [rbp + 0xb0]
xor rcx, rsp
call fcn.14036d350
mov rbx, qword [rsp + 0x1e8]
add rsp, 0x1c0
pop rbp
ret
Function at 0x140191430
Capabilities:
Encode data using xor

Disassembly:
test r9d, r9d
je 0x1401915a1
push rbx
sub rsp, 0x10
xor eax, eax
mov r10d, r8d
mov qword [rsp + 0x30], rdi
mov rbx, rdx
mov r11, rcx
cmp r9d, 8
jb 0x140191576
lea r8d, [r9 - 1]
lea edi, [r8 + r10]
mov edx, r8d
add rdi, rcx
add rdx, rbx
add rcx, r10
cmp rcx, rdx
ja 0x14019147a
cmp rdi, rbx
jae 0x140191576
cmp r9d, 0x40
jb 0x14019154a
mov qword [rsp + 0x20], rbp
mov edi, r9d
mov qword [rsp + 0x28], rsi
and edi, 0x3f
mov ebp, r9d
mov qword [rsp + 8], r14
sub ebp, edi
mov qword [rsp], r15
mov r14d, 0xfffffff0
lea esi, [r10 + 0x20]
sub r14d, r10d
mov r15d, reloc.WS2_32.dll_recv
sub r15d, r10d
nop dword [rax + rax]
movdqu xmm1, xmmword [rbx + rax]
lea ecx, [rsi - 0x20]
add eax, 0x40
movdqu xmm0, xmmword [rcx + r11]
lea r8d, [rsi - 0x10]
xorps xmm1, xmm0
movdqu xmmword [rcx + r11], xmm1
lea ecx, [r14 + rsi]
movdqu xmm0, xmmword [r8 + r11]
movdqu xmm1, xmmword [rcx + rbx]
mov ecx, esi
sub ecx, r10d
xorps xmm1, xmm0
movdqu xmmword [r8 + r11], xmm1
lea r8d, [rsi + 0x10]
movdqu xmm0, xmmword [rsi + r11]
movdqu xmm1, xmmword [rcx + rbx]
lea ecx, [r15 + rsi]
xorps xmm1, xmm0
movdqu xmmword [rsi + r11], xmm1
add esi, 0x40
movdqu xmm0, xmmword [r8 + r11]
movdqu xmm1, xmmword [rcx + rbx]
xorps xmm1, xmm0
movdqu xmmword [r8 + r11], xmm1
cmp eax, ebp
jb 0x1401914c0
mov r15, qword [rsp]
mov r14, qword [rsp + 8]
mov rsi, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x20]
cmp edi, 8
jb 0x140191571
mov r8d, r9d
and r8d, 0xfffffff8
movq xmm1, qword [rbx + rax]
lea ecx, [rax + r10]
movq xmm0, qword [rcx + r11]
add eax, 8
xorps xmm1, xmm0
movq qword [rcx + r11], xmm1
cmp eax, r8d
jb 0x140191551
cmp eax, r9d
jae 0x140191597
mov r8d, eax
add r8, rbx
nop dword [rax]
movzx ecx, byte [r8]
lea edx, [rax + r10]
xor byte [rdx + r11], cl
lea r8, [r8 + 1]
inc eax
cmp eax, r9d
jb 0x140191580
mov rdi, qword [rsp + 0x30]
add rsp, 0x10
pop rbx
ret
Function at 0x1401915b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
lea r13, [0x140486cf0]
mov qword [rsp + 0x28], send
mov qword [rsp + 0x20], r13
mov rbx, rcx
mov rcx, rbx
call fcn.140191700
mov rcx, rbx
call fcn.1401918b0
mov rcx, rbx
call fcn.140191a20
xor r13d, r13d
nop
mov eax, 0xcccccccd
lea r10d, [r13*4]
mul r13d
mov ecx, r13d
add r10d, r13d
shr edx, 2
inc r13d
lea eax, [rdx + rdx*4]
sub ecx, eax
lea r8d, [rcx + rcx*4]
mov r12, qword [rbx + r8*8]
lea eax, [r8 + 2]
mov r15, qword [rbx + rax*8]
lea ecx, [r8 + 1]
mov rsi, qword [rbx + rcx*8]
lea eax, [r8 + 3]
mov rdi, qword [rbx + rax*8]
lea r14, [rbx + r8*8]
imul eax, edx, 0x19
not rsi
and rsi, r15
not r15
and r15, rdi
xor rsi, r12
not rdi
sub r10d, eax
lea eax, [r10 + 1]
xor r15, qword [rbx + rax*8]
lea r11, [rbx + rax*8]
lea eax, [r8 + 4]
mov r9, qword [rbx + rax*8]
lea eax, [r10 + 2]
and rdi, r9
lea r8, [rbx + rax*8]
xor rdi, qword [r8]
lea eax, [r10 + 3]
lea rdx, [rbx + rax*8]
not r9
and r9, r12
lea eax, [r10 + 4]
xor r9, qword [rdx]
not r12
and r12, qword [rbx + rcx*8]
xor r12, qword [rbx + rax*8]
mov qword [r14], rsi
mov qword [r11], r15
mov qword [r8], rdi
mov qword [rdx], r9
mov qword [rbx + rax*8], r12
cmp r13d, 5
jb 0x140191600
mov r13, qword [rsp + 0x20]
mov rax, qword [r13]
add r13, 8
xor qword [rbx], rax
sub qword [rsp + 0x28], 1
mov qword [rsp + 0x20], r13
jne 0x1401915e4
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140191700
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x14051f680]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor edi, edi
lea rsi, [rsp]
mov r11d, edi
mov rbx, rcx
nop word [rax + rax]
mov ecx, 4
lea rsi, [rsi + 8]
mov r10d, r11d
mov eax, 0xcccccccd
mul r11d
mov r9d, edx
shr r9d, 2
sub ecx, r9d
lea eax, [r9 + r9*4]
lea r8d, [r11 + rcx*4]
sub r10d, eax
add r8d, ecx
mov ecx, 3
sub ecx, r9d
mov rdx, qword [rbx + r8*8]
lea eax, [r11 + rcx*4]
add ecx, eax
xor rdx, qword [rbx + rcx*8]
mov ecx, 2
sub ecx, r9d
lea eax, [r11 + rcx*4]
inc r11d
add ecx, eax
lea eax, [r10 + 5]
xor rdx, qword [rbx + rcx*8]
xor rdx, qword [rbx + rax*8]
xor rdx, qword [rbx + r10*8]
mov qword [rsi - 8], rdx
cmp r11d, 5
jb 0x140191730
mov r9, qword [rsp + 0x20]
mov r11, qword [rsp + 8]
mov r10, qword [rsp + 0x10]
mov rcx, r11
mov rdx, qword [rsp]
mov r8, qword [rsp + 0x18]
shr rcx, 0x3f
lea rax, [r11 + r11]
xor rcx, rax
lea rax, [r10 + r10]
xor rcx, r9
mov qword [rsp + 0x28], rcx
mov rcx, r10
shr rcx, 0x3f
xor rcx, rax
lea rax, [r8 + r8]
xor rcx, rdx
mov qword [rsp + 0x30], rcx
mov rcx, r8
shr rcx, 0x3f
xor rcx, rax
lea rax, [r9 + r9]
xor rcx, r11
mov qword [rsp + 0x38], rcx
mov rcx, r9
shr rcx, 0x3f
lea r9, [rsp + 0x28]
xor rcx, rax
lea rax, [rdx + rdx]
xor rcx, r10
mov qword [rsp + 0x40], rcx
mov rcx, rdx
shr rcx, 0x3f
xor rcx, rax
xor rcx, r8
mov qword [rsp + 0x48], rcx
nop dword [rax + rax]
mov r8, qword [r9]
lea r9, [r9 + 8]
mov ecx, edi
mov eax, 0xcccccccd
mul edi
shr edx, 2
lea eax, [rdx + rdx*4]
sub ecx, eax
mov eax, ecx
add eax, 5
xor qword [rbx + rcx*8], r8
mov ecx, 2
sub ecx, edx
xor qword [rbx + rax*8], r8
lea eax, [rdi + rcx*4]
add ecx, eax
xor qword [rbx + rcx*8], r8
mov ecx, 3
sub ecx, edx
lea eax, [rdi + rcx*4]
add ecx, eax
xor qword [rbx + rcx*8], r8
mov ecx, 4
sub ecx, edx
lea eax, [rdi + rcx*4]
inc edi
add ecx, eax
xor qword [rbx + rcx*8], r8
cmp edi, 5
jb 0x140191830
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14036d350
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x140191c00
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push r12
sub rsp, 0x28
mov ebp, dword [rcx + 0xc8]
mov r12, r8
shr ebp, 3
mov rsi, rdx
cmp dword [rcx + 0xd0], 0
mov rdi, rcx
je 0x140191c34
mov eax, 1
add rsp, 0x28
pop r12
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + 0x58], r13
xor r13d, r13d
mov qword [rsp + 0x60], r14
mov r14d, r13d
test r12, r12
je 0x140191e0d
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x20], r15
nop word [rax + rax]
mov r8d, dword [rdi + 0xcc]
test r8d, r8d
jne 0x140191db3
lea rax, [r14 + rbp]
mov r15d, ebp
cmp r12, rax
jb 0x140191db3
mov rbx, r12
sub rbx, r14
cmp rbx, r15
jb 0x140191dab
nop
mov eax, r13d
test ebp, ebp
je 0x140191d94
cmp ebp, 8
jb 0x140191d6f
lea ecx, [rbp - 1]
lea r8, [rcx + rdi]
add rcx, rsi
cmp rdi, rcx
ja 0x140191cbc
cmp r8, rsi
jae 0x140191d6f
cmp ebp, 0x40
jb 0x140191d47
mov r8d, ebp
mov r9d, ebp
and r8d, 0x3f
sub r9d, r8d
mov r10d, 0x20
nop dword [rax + rax]
mov ecx, eax
add eax, 0x40
movdqu xmm0, xmmword [rdi + rcx]
movdqu xmm1, xmmword [rcx + rsi]
xorps xmm1, xmm0
movdqu xmmword [rdi + rcx], xmm1
lea ecx, [r10 - 0x10]
movdqu xmm0, xmmword [rdi + rcx]
movdqu xmm1, xmmword [rcx + rsi]
xorps xmm1, xmm0
movdqu xmmword [rdi + rcx], xmm1
mov ecx, r10d
movdqu xmm0, xmmword [rcx + rdi]
movdqu xmm1, xmmword [rcx + rsi]
xorps xmm1, xmm0
movdqu xmmword [rcx + rdi], xmm1
lea ecx, [r10 + 0x10]
add r10d, 0x40
movdqu xmm0, xmmword [rdi + rcx]
movdqu xmm1, xmmword [rcx + rsi]
xorps xmm1, xmm0
movdqu xmmword [rdi + rcx], xmm1
cmp eax, r9d
jb 0x140191ce0
cmp r8d, 8
jb 0x140191d6b
mov edx, ebp
and edx, 0xfffffff8
nop dword [rax]
mov ecx, eax
add eax, 8
movq xmm0, qword [rdi + rcx]
movq xmm1, qword [rcx + rsi]
xorps xmm1, xmm0
movq qword [rdi + rcx], xmm1
cmp eax, edx
jb 0x140191d50
cmp eax, ebp
jae 0x140191d94
mov ecx, eax
mov r9d, ebp
sub r9d, eax
lea r8, [rcx + rsi]
lea rdx, [rcx + rdi]
nop
movzx eax, byte [r8]
lea r8, [r8 + 1]
xor byte [rdx], al
lea rdx, [rdx + 1]
sub r9, 1
jne 0x140191d80
mov rcx, rdi
call fcn.1401915b0
add rsi, r15
sub rbx, r15
cmp rbx, r15
jae 0x140191c90
mov r14, r12
sub r14, rbx
jmp 0x140191dfa
mov edx, r12d
mov ecx, ebp
sub edx, r14d
sub ecx, r8d
lea eax, [rdx + r8]
cmp eax, ebp
cmovbe ecx, edx
mov rdx, rsi
mov ebx, ecx
mov r9d, ecx
mov rcx, rdi
add r14, rbx
call fcn.140191430
add dword [rdi + 0xcc], ebx
add rsi, rbx
cmp dword [rdi + 0xcc], ebp
jne 0x140191dfa
mov rcx, rdi
call fcn.1401915b0
mov dword [rdi + 0xcc], r13d
cmp r14, r12
jb 0x140191c60
mov r15, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x60]
xor eax, eax
mov r13, qword [rsp + 0x58]
add rsp, 0x28
pop r12
pop rdi
pop rsi
pop rbp
ret