joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002e3e0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
cmp byte [rcx + 0x11], 0
je 0x14002e572
movdqa xmm2, xmmword [0x140cd2380]
lea r10, [rcx + 4]
movdqa xmm3, xmmword [0x140cd24f0]
mov r8, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x140cd2530]
mov r9d, 2
sub r8, rcx
sub r9, rcx
mov rdx, 0xfffffffffffffffc
sub rdx, rcx
nop dword [rax]
nop word [rax + rax]
lea rax, [rdx + r10]
movq xmm0, rax
movzx eax, word [r10 - 4]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
pshufd xmm1, xmm0, 0xd8
movq xmm0, xmm3
paddd xmm1, xmm0
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm4
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd eax, xmm1
mov word [r10 - 4], ax
lea rax, [r8 + r10]
movq xmm0, rax
movzx eax, word [r10 - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
pshufd xmm1, xmm0, 0xd8
movq xmm0, xmm3
paddd xmm1, xmm0
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm4
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd eax, xmm1
mov word [r10 - 2], ax
mov rax, r10
sub rax, rcx
movq xmm0, rax
movzx eax, word [r10]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
pshufd xmm1, xmm0, 0xd8
movq xmm0, xmm3
paddd xmm1, xmm0
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm4
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd eax, xmm1
mov word [r10], ax
lea rax, [r9 + r10]
movq xmm0, rax
movzx eax, word [r10 + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
pshufd xmm1, xmm0, 0xd8
movq xmm0, xmm3
paddd xmm1, xmm0
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm4
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd eax, xmm1
mov word [r10 + 2], ax
add r10, 8
lea rax, [rdx + r10]
cmp rax, 0x10
jb 0x14002e430
mov byte [rcx + 0x11], 0
ret
Function at 0x14002e5c0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x12], 0
mov rdx, rcx
je 0x14002e753
movdqa xmm2, xmmword [0x140cd2380]
lea r10, [rcx + 4]
movdqa xmm3, xmmword [0x140cd24f0]
mov r8, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x140cd2530]
sub r8, rcx
xor eax, eax
mov r9d, 2
sub r9, rcx
nop
movzx ecx, word [r10 - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
pshufd xmm1, xmm0, 0xd8
movq xmm0, xmm3
paddd xmm1, xmm0
movd xmm0, ecx
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm4
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd ecx, xmm1
mov word [r10 - 4], cx
lea rcx, [r8 + r10]
movq xmm0, rcx
movzx ecx, word [r10 - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
pshufd xmm1, xmm0, 0xd8
movq xmm0, xmm3
paddd xmm1, xmm0
movd xmm0, ecx
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm4
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd ecx, xmm1
mov word [r10 - 2], cx
mov rcx, r10
sub rcx, rdx
movq xmm0, rcx
movzx ecx, word [r10]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
pshufd xmm1, xmm0, 0xd8
movq xmm0, xmm3
paddd xmm1, xmm0
movd xmm0, ecx
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm4
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd ecx, xmm1
mov word [r10], cx
lea rcx, [r9 + r10]
movq xmm0, rcx
movzx ecx, word [r10 + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
pshufd xmm1, xmm0, 0xd8
movq xmm0, xmm3
paddd xmm1, xmm0
movd xmm0, ecx
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm4
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd ecx, xmm1
mov word [r10 + 2], cx
add r10, 8
cmp rax, 0x10
jb 0x14002e600
cmp rax, 0x11
jae 0x14002e74f
lea ecx, [rax + 0x61]
xor byte [rdx + rax], cl
inc rax
cmp rax, 0x11
jb 0x14002e740
mov byte [rdx + 0x12], 0
ret
Function at 0x14002e790
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xf], 0
mov rdx, rcx
je 0x14002e8a3
movzx eax, word [rcx]
movdqa xmm3, xmmword [0x140cd24f0]
movdqa xmm2, xmmword [0x140cd2530]
movq xmm1, qword [0x140cd2330]
paddd xmm1, xmm3
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd eax, xmm1
movq xmm1, qword [0x140cd2340]
paddd xmm1, xmm3
mov word [rcx], ax
movzx eax, word [rcx + 2]
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd eax, xmm1
movq xmm1, qword [0x140cd2350]
paddd xmm1, xmm3
mov word [rcx + 2], ax
movzx eax, word [rcx + 4]
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd eax, xmm1
movq xmm1, qword [0x140cd2360]
paddd xmm1, xmm3
mov word [rcx + 4], ax
movzx eax, word [rcx + 6]
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd eax, xmm1
mov word [rcx + 6], ax
mov eax, 8
nop dword [rax]
lea ecx, [rax + 0x61]
xor byte [rdx + rax], cl
inc rax
cmp rax, 0xe
jb 0x14002e890
mov byte [rdx + 0xf], 0
ret

Function at 0x14002e8b0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xd], 0
mov rdx, rcx
je 0x14002e9c3
movzx eax, word [rcx]
movdqa xmm3, xmmword [0x140cd24f0]
movdqa xmm2, xmmword [0x140cd2530]
movq xmm1, qword [0x140cd2330]
paddd xmm1, xmm3
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd eax, xmm1
movq xmm1, qword [0x140cd2340]
paddd xmm1, xmm3
mov word [rcx], ax
movzx eax, word [rcx + 2]
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd eax, xmm1
movq xmm1, qword [0x140cd2350]
paddd xmm1, xmm3
mov word [rcx + 2], ax
movzx eax, word [rcx + 4]
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd eax, xmm1
movq xmm1, qword [0x140cd2360]
paddd xmm1, xmm3
mov word [rcx + 4], ax
movzx eax, word [rcx + 6]
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd eax, xmm1
mov word [rcx + 6], ax
mov eax, 8
nop dword [rax]
lea ecx, [rax + 0x61]
xor byte [rdx + rax], cl
inc rax
cmp rax, 0xc
jb 0x14002e9b0
mov byte [rdx + 0xd], 0
ret
Function at 0x14002ea00
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x13], 0
mov rdx, rcx
je 0x14002eb93
movdqa xmm2, xmmword [0x140cd2380]
lea r10, [rcx + 4]
movdqa xmm3, xmmword [0x140cd24f0]
mov r8, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x140cd2530]
sub r8, rcx
xor eax, eax
mov r9d, 2
sub r9, rcx
nop
movzx ecx, word [r10 - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
pshufd xmm1, xmm0, 0xd8
movq xmm0, xmm3
paddd xmm1, xmm0
movd xmm0, ecx
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm4
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd ecx, xmm1
mov word [r10 - 4], cx
lea rcx, [r8 + r10]
movq xmm0, rcx
movzx ecx, word [r10 - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
pshufd xmm1, xmm0, 0xd8
movq xmm0, xmm3
paddd xmm1, xmm0
movd xmm0, ecx
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm4
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd ecx, xmm1
mov word [r10 - 2], cx
mov rcx, r10
sub rcx, rdx
movq xmm0, rcx
movzx ecx, word [r10]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
pshufd xmm1, xmm0, 0xd8
movq xmm0, xmm3
paddd xmm1, xmm0
movd xmm0, ecx
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm4
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd ecx, xmm1
mov word [r10], cx
lea rcx, [r9 + r10]
movq xmm0, rcx
movzx ecx, word [r10 + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
pshufd xmm1, xmm0, 0xd8
movq xmm0, xmm3
paddd xmm1, xmm0
movd xmm0, ecx
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm4
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd ecx, xmm1
mov word [r10 + 2], cx
add r10, 8
cmp rax, 0x10
jb 0x14002ea40
cmp rax, 0x12
jae 0x14002eb8f
lea ecx, [rax + 0x61]
xor byte [rdx + rax], cl
inc rax
cmp rax, 0x12
jb 0x14002eb80
mov byte [rdx + 0x13], 0
ret
Function at 0x14002eba0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xe], 0
mov rdx, rcx
je 0x14002ecb3
movzx eax, word [rcx]
movdqa xmm3, xmmword [0x140cd24f0]
movdqa xmm2, xmmword [0x140cd2530]
movq xmm1, qword [0x140cd2330]
paddd xmm1, xmm3
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd eax, xmm1
movq xmm1, qword [0x140cd2340]
paddd xmm1, xmm3
mov word [rcx], ax
movzx eax, word [rcx + 2]
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd eax, xmm1
movq xmm1, qword [0x140cd2350]
paddd xmm1, xmm3
mov word [rcx + 2], ax
movzx eax, word [rcx + 4]
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd eax, xmm1
movq xmm1, qword [0x140cd2360]
paddd xmm1, xmm3
mov word [rcx + 4], ax
movzx eax, word [rcx + 6]
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd eax, xmm1
mov word [rcx + 6], ax
mov eax, 8
nop dword [rax]
lea ecx, [rax + 0x61]
xor byte [rdx + rax], cl
inc rax
cmp rax, 0xd
jb 0x14002eca0
mov byte [rdx + 0xe], 0
ret

Function at 0x14002ecc0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x10], 0
mov rdx, rcx
je 0x14002edd3
movzx eax, word [rcx]
movdqa xmm3, xmmword [0x140cd24f0]
movdqa xmm2, xmmword [0x140cd2530]
movq xmm1, qword [0x140cd2330]
paddd xmm1, xmm3
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd eax, xmm1
movq xmm1, qword [0x140cd2340]
paddd xmm1, xmm3
mov word [rcx], ax
movzx eax, word [rcx + 2]
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd eax, xmm1
movq xmm1, qword [0x140cd2350]
paddd xmm1, xmm3
mov word [rcx + 2], ax
movzx eax, word [rcx + 4]
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd eax, xmm1
movq xmm1, qword [0x140cd2360]
paddd xmm1, xmm3
mov word [rcx + 4], ax
movzx eax, word [rcx + 6]
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd eax, xmm1
mov word [rcx + 6], ax
mov eax, 8
nop dword [rax]
lea ecx, [rax + 0x61]
xor byte [rdx + rax], cl
inc rax
cmp rax, 0xf
jb 0x14002edc0
mov byte [rdx + 0x10], 0
ret
Function at 0x14002ede0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xb], 0
mov rdx, rcx
je 0x14002eef3
movzx eax, word [rcx]
movdqa xmm3, xmmword [0x140cd24f0]
movdqa xmm2, xmmword [0x140cd2530]
movq xmm1, qword [0x140cd2330]
paddd xmm1, xmm3
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd eax, xmm1
movq xmm1, qword [0x140cd2340]
paddd xmm1, xmm3
mov word [rcx], ax
movzx eax, word [rcx + 2]
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd eax, xmm1
movq xmm1, qword [0x140cd2350]
paddd xmm1, xmm3
mov word [rcx + 2], ax
movzx eax, word [rcx + 4]
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd eax, xmm1
movq xmm1, qword [0x140cd2360]
paddd xmm1, xmm3
mov word [rcx + 4], ax
movzx eax, word [rcx + 6]
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd eax, xmm1
mov word [rcx + 6], ax
mov eax, 8
nop dword [rax]
lea ecx, [rax + 0x61]
xor byte [rdx + rax], cl
inc rax
cmp rax, 0xa
jb 0x14002eee0
mov byte [rdx + 0xb], 0
ret

Function at 0x14002fc50
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rcx + r8], 0
jne 0x14002fc60
mov rdx, rcx
lea rbx, [0x1411dfd20]
mov rcx, rbx
call fcn.140030300
mov rdx, qword [0x1411dfd30]
xor ecx, ecx
mov qword [0x1411de190], rdx
test rdx, rdx
je 0x14002fcb0
cmp qword [0x1411dfd38], 0xf
mov rax, rbx
cmova rax, qword [0x1411dfd20]
xor byte [rax + rcx], 0x35
inc rcx
cmp rcx, rdx
jb 0x14002fc91
add rsp, 0x20
pop rbx
ret
Function at 0x14002fcc0
Capabilities:
Encode data using xor
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x70
mov rax, qword [0x140cf0080]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor ebx, ebx
lea r14, [0x1411dfd20]
mov rbp, rdx
mov rsi, rcx
mov rdx, qword [0x1411de190]
mov ecx, ebx
test rdx, rdx
je 0x14002fd1f
nop word [rax + rax]
cmp qword [0x1411dfd38], 0xf
mov rax, r14
cmova rax, qword [0x1411dfd20]
xor byte [rax + rcx], 0x35
inc rcx
cmp rcx, rdx
jb 0x14002fd00
cmp qword [0x1411dfd38], 0xf
lea rcx, [rsp + 0x30]
xorps xmm0, xmm0
mov rdi, r14
cmova rdi, qword [0x1411dfd20]
mov edx, r8d
movups xmmword [rsp + 0x50], xmm0
call fcn.14000fb80
cmp qword [rax + 0x18], 0xf
jbe 0x14002fd51
mov rax, qword [rax]
mov qword [rsp + 0x28], rdi
lea r9, [rsp + 0x50]
mov r8, rax
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea rcx, [rsp + 0x30]
call fcn.14002f260
mov rcx, qword [0x1411de190]
test rcx, rcx
je 0x14002fdaf
nop dword [rax + rax]
cmp qword [0x1411dfd38], 0xf
mov rax, r14
cmova rax, qword [0x1411dfd20]
xor byte [rax + rbx], 0x35
inc rbx
cmp rbx, rcx
jb 0x14002fd90
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14013f230
add rsp, 0x70
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x14002fde0
Capabilities:
Encode data using xor
Read .ini file

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x140cf0080]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rdi, r9
mov r11, r8
mov r10, rdx
mov rbx, rcx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x38], r9
xor ecx, ecx
lea rsi, [0x1411dfd20]
mov rdx, qword [0x1411de190]
test rdx, rdx
je 0x14002fe41
mov rax, rsi
cmp qword [0x1411dfd38], 0xf
cmova rax, qword [0x1411dfd20]
xor byte [rax + rcx], 0x35
inc rcx
cmp rcx, rdx
jb 0x14002fe22
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov rax, rsi
cmp qword [0x1411dfd38], 0xf
cmova rax, qword [0x1411dfd20]
mov r8, rdi
cmp qword [r9 + 0x18], 0xf
jbe 0x14002fe69
mov r8, qword [r9]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
lea r9, [rsp + 0x40]
mov rdx, r11
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
xor ecx, ecx
mov rdx, qword [0x1411de190]
test rdx, rdx
je 0x14002feb4
mov rax, rsi
cmp qword [0x1411dfd38], 0xf
cmova rax, qword [0x1411dfd20]
xor byte [rax + rcx], 0x35
inc rcx
cmp rcx, rdx
jb 0x14002fe95
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x14002fed6
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.14002f420
nop
mov rcx, rdi
call fcn.14002f260
mov rax, rbx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14013f230
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret
Function at 0x14002ff10
Capabilities:
Encode data using xor
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x70
mov rax, qword [0x140cf0080]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor edi, edi
lea r14, [0x1411dfd20]
mov rbp, rdx
mov rsi, rcx
mov rdx, qword [0x1411de190]
mov ecx, edi
test rdx, rdx
je 0x14002ff6f
nop word [rax + rax]
cmp qword [0x1411dfd38], 0xf
mov rax, r14
cmova rax, qword [0x1411dfd20]
xor byte [rax + rcx], 0x35
inc rcx
cmp rcx, rdx
jb 0x14002ff50
cmp qword [0x1411dfd38], 0xf
lea rcx, [rsp + 0x38]
xorps xmm1, xmm1
xorps xmm0, xmm0
cvtss2sd xmm1, xmm2
mov rbx, r14
cmova rbx, qword [0x1411dfd20]
movups xmmword [rsp + 0x58], xmm0
call fcn.14002fb00
cmp qword [rsp + 0x50], 0xf
lea r8, [rsp + 0x38]
mov qword [rsp + 0x28], rbx
lea r9, [rsp + 0x58]
cmova r8, qword [rsp + 0x38]
mov rdx, rbp
mov rcx, rsi
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea rcx, [rsp + 0x38]
call fcn.14002f260
mov rcx, qword [0x1411de190]
test rcx, rcx
je 0x14002ffff
cmp qword [0x1411dfd38], 0xf
mov rax, r14
cmova rax, qword [0x1411dfd20]
xor byte [rax + rdi], 0x35
inc rdi
cmp rdi, rcx
jb 0x14002ffe0
lea rcx, [rsp + 0x58]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
cvtsd2ss xmm0, xmm0
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14013f230
add rsp, 0x70
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140030030
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140cf0080]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rsi, rdx
mov rdi, rcx
mov edx, r8d
lea rcx, [rsp + 0x20]
call fcn.14000fb80
mov rdx, qword [0x1411de190]
lea rbp, [0x1411dfd20]
xor ebx, ebx
mov ecx, ebx
test rdx, rdx
je 0x140030094
cmp qword [0x1411dfd38], 0xf
mov rax, rbp
cmova rax, qword [0x1411dfd20]
xor byte [rax + rcx], 0x35
inc rcx
cmp rcx, rdx
jb 0x140030075
cmp qword [0x1411dfd38], 0xf
lea r8, [rsp + 0x20]
mov r9, rbp
mov rdx, rsi
cmova r9, qword [0x1411dfd20]
mov rcx, rdi
cmp qword [rsp + 0x38], 0xf
cmova r8, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov rcx, qword [0x1411de190]
test rcx, rcx
je 0x1400300ef
cmp qword [0x1411dfd38], 0xf
mov rax, rbp
cmova rax, qword [0x1411dfd20]
xor byte [rax + rbx], 0x35
inc rbx
cmp rbx, rcx
jb 0x1400300d0
lea rcx, [rsp + 0x20]
call fcn.14002f260
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14013f230
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x140030120
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140cf0080]
xor rax, rsp
mov qword [rsp + 0x48], rax
xorps xmm1, xmm1
mov rdi, rcx
cvtss2sd xmm1, xmm2
lea rcx, [rsp + 0x28]
mov rsi, rdx
xor ebx, ebx
call fcn.14002fb00
mov rdx, qword [0x1411de190]
lea rbp, [0x1411dfd20]
mov ecx, ebx
test rdx, rdx
je 0x14003018f
nop dword [rax]
cmp qword [0x1411dfd38], 0xf
mov rax, rbp
cmova rax, qword [0x1411dfd20]
xor byte [rax + rcx], 0x35
inc rcx
cmp rcx, rdx
jb 0x140030170
cmp qword [0x1411dfd38], 0xf
lea r8, [rsp + 0x28]
mov r9, rbp
mov rdx, rsi
cmova r9, qword [0x1411dfd20]
mov rcx, rdi
cmp qword [rsp + 0x40], 0xf
cmova r8, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov rcx, qword [0x1411de190]
test rcx, rcx
je 0x1400301ef
nop dword [rax + rax]
cmp qword [0x1411dfd38], 0xf
mov rax, rbp
cmova rax, qword [0x1411dfd20]
xor byte [rax + rbx], 0x35
inc rbx
cmp rbx, rcx
jb 0x1400301d0
lea rcx, [rsp + 0x28]
call fcn.14002f260
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14013f230
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret

Function at 0x140030220
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
lea rsi, [0x1411dfd20]
mov r11, rdx
mov r10, rcx
mov rdx, qword [0x1411de190]
mov rdi, r8
mov ecx, ebx
test rdx, rdx
je 0x14003026f
nop dword [rax + rax]
cmp qword [0x1411dfd38], 0xf
mov rax, rsi
cmova rax, qword [0x1411dfd20]
xor byte [rax + rcx], 0x35
inc rcx
cmp rcx, rdx
jb 0x140030250
cmp qword [0x1411dfd38], 0xf
mov r9, rsi
cmova r9, qword [0x1411dfd20]
cmp qword [r8 + 0x18], 0xf
jbe 0x14003028c
mov r8, qword [r8]
mov rdx, r11
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov rdx, qword [0x1411de190]
test rdx, rdx
je 0x1400302c3
cmp qword [0x1411dfd38], 0xf
mov rax, rsi
cmova rax, qword [0x1411dfd20]
xor byte [rax + rbx], 0x35
inc rbx
cmp rbx, rdx
jb 0x1400302a4
mov rcx, rdi
add rsp, 0x20
pop rdi
pop rsi
pop rbx
jmp fcn.14002f260

Function at 0x140034b90
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x140034c03
movdqa xmm2, xmmword [0x140cd2380]
xor edx, edx
movdqa xmm3, xmmword [0x140cd2500]
movdqa xmm4, xmmword [0x140cd2530]
movzx eax, word [rcx + rdx]
movq xmm0, rdx
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
pshufd xmm1, xmm0, 0xd8
movq xmm0, xmm3
paddd xmm1, xmm0
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm4
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd eax, xmm1
mov word [rcx + rdx], ax
add rdx, 2
cmp rdx, 4
jb 0x140034bb0
mov byte [rcx + 5], 0
mov rax, rcx
ret
Function at 0x140034c10
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xe], 0
je 0x140034c7b
movdqa xmm3, xmmword [0x140cd2380]
xor eax, eax
movdqa xmm4, xmmword [0x140cd2570]
nop dword [rax + rax]
movd xmm1, dword [rcx + rax*2]
movq xmm0, rax
punpcklqdq xmm0, xmm0
paddq xmm0, xmm3
pshufd xmm2, xmm0, 0xd8
movq xmm0, xmm4
paddd xmm2, xmm0
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
pshufhw xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movd dword [rcx + rax*2], xmm2
add rax, 2
cmp rax, 6
jb 0x140034c30
mov byte [rcx + 0xe], 0
mov rax, rcx
ret

Function at 0x140034e60
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x140034ed3
movdqa xmm2, xmmword [0x140cd2380]
xor edx, edx
movdqa xmm3, xmmword [0x140cd2500]
movdqa xmm4, xmmword [0x140cd2530]
movzx eax, word [rcx + rdx]
movq xmm0, rdx
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
pshufd xmm1, xmm0, 0xd8
movq xmm0, xmm3
paddd xmm1, xmm0
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm4
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd eax, xmm1
mov word [rcx + rdx], ax
add rdx, 2
cmp rdx, 4
jb 0x140034e80
mov byte [rcx + 5], 0
ret