joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001ea80
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rdi
push r13
lea rbp, [rsp - 0x268]
sub rsp, 0x368
mov rax, qword [0x140088040]
xor rax, rsp
mov qword [rbp + 0x240], rax
mov rbx, r8
mov rdi, rdx
mov r13, rcx
cmp r8, 0x180
jbe 0x14001eac2
mov eax, 0xffffffc8
jmp 0x14001ed1f
mov qword [rsp + 0x3a8], rsi
lea rcx, [rbp + 0xa0]
mov qword [rsp + 0x360], r12
xor edx, edx
mov r8d, 0x1a0
mov qword [rsp + 0x350], r15
call fcn.140065540
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x120
call fcn.140065540
mov rax, rbx
mov byte [rbp + 0xb3], bl
shr rax, 0x18
lea rcx, [rbp + 0xb8]
mov byte [rbp + 0xb0], al
mov r8, rbx
mov rax, rbx
mov byte [rbp + 0xb7], 0x30
shr rax, 0x10
mov rdx, rdi
mov byte [rbp + 0xb1], al
mov rax, rbx
shr rax, 8
mov byte [rbp + 0xb2], al
call fcn.140065900
xor r15d, r15d
mov byte [rbp + rbx + 0xb8], 0x80
mov eax, r15d
lea r12, [rbx + 0x19]
lea rcx, [rbp + 0x80]
nop
mov byte [rcx], al
lea rcx, [rcx + 1]
inc eax
cmp eax, 0x20
jl 0x14001eb60
mov r8d, 0x100
lea rdx, [rbp + 0x80]
lea rcx, [rsp + 0x20]
call fcn.1400367d0
mov esi, eax
mov r8d, reloc.WS2_32.dll_recv
test eax, eax
jne 0x14001ec85
mov qword [rsp + 0x358], r14
mov r14, r15
nop
xorps xmm0, xmm0
mov rdi, r12
movups xmmword [rbp + 0x40], xmm0
test r12, r12
je 0x14001ec17
lea rbx, [rbp + 0xa0]
lea rax, [rbp + 0x40]
sub rbx, rax
nop dword [rax]
lea rax, [rbp + 0x40]
mov rdx, r8
nop word [rax + rax]
movzx ecx, byte [rax + rbx]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x14001ebd0
mov rax, rdi
lea rdx, [rbp + 0x40]
add rbx, 0x10
lea rcx, [rsp + 0x20]
cmp rdi, 0x10
cmovae rax, r8
lea r8, [rbp + 0x40]
sub rdi, rax
call fcn.140037350
mov esi, eax
test eax, eax
jne 0x14001ec7d
lea r8d, [rax + 0x10]
test rdi, rdi
jne 0x14001ebc0
movups xmm0, xmmword [rbp + 0x40]
inc byte [rbp + 0xa3]
movups xmmword [rbp + r14 + 0x50], xmm0
add r14, 0x10
cmp r14, 0x30
jl 0x14001eba0
mov r8d, 0x100
lea rdx, [rbp + 0x50]
lea rcx, [rsp + 0x20]
call fcn.1400367d0
mov esi, eax
test eax, eax
jne 0x14001ec7d
mov rbx, r13
nop
lea r8, [rbp + 0x70]
lea rdx, [rbp + 0x70]
lea rcx, [rsp + 0x20]
call fcn.140037350
mov esi, eax
test eax, eax
jne 0x14001ec7d
movups xmm0, xmmword [rbp + 0x70]
add r15d, 0x10
movups xmmword [rbx], xmm0
add rbx, 0x10
cmp r15d, 0x30
jl 0x14001ec50
mov r14, qword [rsp + 0x358]
mov rax, qword [fcn.140065540]
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x120
call rax
mov rax, qword [fcn.140065540]
lea rcx, [rbp + 0xa0]
xor edx, edx
mov r8d, 0x1a0
call rax
mov rax, qword [fcn.140065540]
lea rcx, [rbp + 0x50]
xor edx, edx
lea r8d, [rdx + 0x30]
call rax
mov rax, qword [fcn.140065540]
lea rcx, [rbp + 0x80]
xor edx, edx
lea r8d, [rdx + 0x20]
call rax
mov rax, qword [fcn.140065540]
lea rcx, [rbp + 0x40]
xor edx, edx
lea r8d, [rdx + 0x10]
call rax
mov r15, qword [rsp + 0x350]
mov r12, qword [rsp + 0x360]
test esi, esi
je 0x14001ed15
mov rax, qword [fcn.140065540]
xor edx, edx
mov rcx, r13
lea r8d, [rdx + 0x30]
call rax
mov eax, esi
mov rsi, qword [rsp + 0x3a8]
mov rcx, qword [rbp + 0x240]
xor rcx, rsp
call fcn.140042de0
add rsp, 0x368
pop r13
pop rdi
pop rbx
pop rbp
ret
Function at 0x14001f600
Capabilities:
Encrypt data using openssl rsa

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x50
mov rdi, rcx
mov rax, rdx
mov rcx, qword [rcx]
xor ebx, ebx
sub rax, rcx
mov r14, r8
cmp rax, 1
jge 0x14001f633
mov eax, 0xffffffa0
add eax, 0xffffc300
add rsp, 0x50
pop r14
pop rdi
pop rbx
ret
cmp byte [rcx], 0x30
je 0x14001f64b
mov eax, 0xffffff9e
add eax, 0xffffc300
add rsp, 0x50
pop r14
pop rdi
pop rbx
ret
lea rax, [rcx + 1]
mov rcx, rdi
lea r8, [rsp + 0x70]
mov qword [rdi], rax
call fcn.140035d10
test eax, eax
je 0x14001f671
add eax, 0xffffc300
add rsp, 0x50
pop r14
pop rdi
pop rbx
ret
mov qword [rsp + 0x78], rbp
lea r9, [rsp + 0x20]
mov rbp, qword [rsp + 0x70]
lea r8, [rsp + 0x38]
add rbp, qword [rdi]
xorps xmm0, xmm0
xor eax, eax
mov qword [rsp + 0x80], rsi
mov rdx, rbp
mov qword [rsp + 0x88], r15
mov rcx, rdi
mov qword [rsp + 0x30], rax
movups xmmword [rsp + 0x20], xmm0
call fcn.140035f10
test eax, eax
je 0x14001f6dc
add eax, 0xffffc580
jne 0x14001f72a
mov rcx, qword [rdi]
mov rax, rbp
sub rax, rcx
cmp rax, 1
jge 0x14001f779
mov eax, 0xffffffa0
add eax, 0xffffc500
jmp 0x14001f72a
cmp qword [0x1400784e0], 0
lea rbx, [0x1400784e0]
mov rcx, rbx
je 0x14001f725
mov r15, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
nop word [rax + rax]
cmp qword [rcx + 8], rsi
jne 0x14001f718
mov rcx, qword [rcx]
mov r8, rsi
mov rdx, r15
call fcn.140065f80
test eax, eax
je 0x14001f748
add rbx, 0x28
mov rcx, rbx
cmp qword [rbx], 0
jne 0x14001f700
mov eax, 0xffffc380
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov r15, qword [rsp + 0x88]
add rsp, 0x50
pop r14
pop rdi
pop rbx
ret
test rbx, rbx
je 0x14001f725
mov ebx, dword [rbx + 0x20]
cmp ebx, 1
jne 0x14001f6bd
mov eax, dword [rsp + 0x20]
cmp eax, 5
je 0x14001f766
test eax, eax
jne 0x14001f772
cmp qword [rsp + 0x28], 0
je 0x14001f6bd
mov eax, 0xffffc580
jmp 0x14001f72a
cmp byte [rcx], 3
je 0x14001f78a
mov eax, 0xffffff9e
add eax, 0xffffc500
jmp 0x14001f72a
lea rax, [rcx + 1]
mov rdx, rbp
mov rcx, rdi
mov qword [rdi], rax
lea r8, [rsp + 0x70]
call fcn.140035d10
test eax, eax
jne 0x14001f869
mov rax, qword [rsp + 0x70]
lea rdx, [rax - 1]
cmp rax, 2
jb 0x14001f864
mov rax, qword [rdi]
movzx ecx, byte [rax]
inc rax
mov qword [rdi], rax
test cl, cl
jne 0x14001f864
add rax, rdx
cmp rax, rbp
je 0x14001f7e2
mov eax, 0xffffc49a
jmp 0x14001f72a
cmp ebx, 1
jne 0x14001f725
cmp qword [r14], 0
jne 0x14001f85a
call fcn.14003c350
mov qword [r14 + 8], rax
test rax, rax
jne 0x14001f809
mov eax, 0xffffc080
jmp 0x14001f72a
lea rax, reloc.WS2_32.dll_accept
mov rdx, rbp
mov qword [r14], rax
mov rcx, rdi
mov r8, qword [r14 + 8]
call fcn.14001f430
mov ebx, eax
test eax, eax
jne 0x14001f832
cmp qword [rdi], rbp
je 0x14001f853
mov ebx, 0xffffc49a
mov rax, qword [r14]
test rax, rax
je 0x14001f841
mov rcx, qword [r14 + 8]
call qword [rax + 0x50]
mov rax, qword [fcn.140065540]
xor edx, edx
mov rcx, r14
lea r8d, [rdx + 0x10]
call rax
mov eax, ebx
jmp 0x14001f72a
mov eax, 0xffffc180
jmp 0x14001f72a
mov eax, 0xffffff98
add eax, 0xffffc500
jmp 0x14001f72a
Function at 0x1400205a0
Capabilities:
Connect socket
Connect udp socket
Create udp socket
Get local ipv4 addresses
Get socket information
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x140088040]
xor rax, rsp
mov qword [rbp + 0x50], rax
mov rsi, qword [rbp + 0xb0]
lea rax, [rsp + 0x3c]
mov rdi, r8
mov qword [rsp + 0x20], rax
mov r14, rdx
mov dword [rsp + 0x34], 0x80
mov rbx, rcx
mov dword [rsp + 0x3c], 4
movsxd rcx, dword [rcx]
lea r9, [rsp + 0x38]
mov edx, 0xffff
mov r8d, 0x1008
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x14002077e
mov edx, dword [rsp + 0x38]
lea eax, [rdx - 1]
cmp eax, 1
ja 0x14002077e
movsxd rcx, dword [rbx]
cmp edx, 1
jne 0x140020656
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_accept]
mov dword [r14], eax
test eax, eax
jns 0x140020696
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x14002077e
mov eax, 0xffff9700
jmp 0x140020783
mov r9d, 2
mov byte [rsp + 0x30], 0
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x30]
lea rax, [rsp + 0x50]
lea r8d, [r9 - 1]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_recvfrom]
cmp eax, 0xffffffff
jne 0x140020637
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2738
jne 0x14002063b
cmp dword [rsp + 0x38], 1
je 0x14002074d
movsxd rcx, dword [rbx]
lea rdx, [rsp + 0x50]
mov r8d, dword [rsp + 0x34]
mov dword [rsp + 0x40], 1
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
jne 0x14002077e
mov eax, dword [rbx]
lea r8, [rsp + 0x34]
mov dword [r14], eax
lea rdx, [rbp - 0x30]
mov dword [rbx], 0xffffffff
movsxd rcx, dword [r14]
mov dword [rsp + 0x34], 0x80
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x140020746
movzx ecx, word [rbp - 0x30]
lea edx, [rax + 2]
lea r8d, [rax + 0x11]
call qword [sym.imp.WS2_32.dll_socket]
mov dword [rbx], eax
test eax, eax
js 0x140020746
movsxd rcx, eax
lea r9, [rsp + 0x40]
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 4
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x140020746
movsxd rcx, dword [rbx]
lea rdx, [rbp - 0x30]
mov r8d, dword [rsp + 0x34]
call qword [sym.imp.WS2_32.dll_bind]
test eax, eax
je 0x14002074d
mov eax, 0xffffffba
jmp 0x140020783
mov eax, 0xffffffbe
jmp 0x140020783
test rdi, rdi
je 0x14002077a
cmp word [rsp + 0x50], 2
jne 0x14002076b
mov eax, dword [rsp + 0x54]
mov qword [rsi], 4
mov dword [rdi], eax
xor eax, eax
jmp 0x140020783
movups xmm0, xmmword [rsp + 0x58]
mov qword [rsi], reloc.WS2_32.dll_recv
movups xmmword [rdi], xmm0
xor eax, eax
jmp 0x140020783
mov eax, 0xffffffb6
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.140042de0
add rsp, 0x160
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140022b80
Capabilities:
Hash data using sha384
Hash data using sha512

Disassembly:
xor eax, eax
movabs r8, 0xcbbb9d5dc1059ed8
mov qword [rcx], rax
test edx, edx
mov qword [rcx + 8], rax
movabs rax, 0x6a09e667f3bcc908
cmovne rax, r8
movabs r8, 0x629a292a367cd507
mov qword [rcx + 0x10], rax
movabs rax, 0xbb67ae8584caa73b
cmovne rax, r8
movabs r8, 0x9159015a3070dd17
mov qword [rcx + 0x18], rax
movabs rax, 0x3c6ef372fe94f82b
cmovne rax, r8
movabs r8, 0x152fecd8f70e5939
mov qword [rcx + 0x20], rax
movabs rax, 0xa54ff53a5f1d36f1
cmovne rax, r8
movabs r8, 0x67332667ffc00b31
mov qword [rcx + 0x28], rax
movabs rax, 0x510e527fade682d1
cmovne rax, r8
movabs r8, 0x8eb44a8768581511
mov qword [rcx + 0x30], rax
movabs rax, 0x9b05688c2b3e6c1f
cmovne rax, r8
movabs r8, 0xdb0c2e0d64f98fa7
mov qword [rcx + 0x38], rax
movabs rax, 0x1f83d9abfb41bd6b
cmovne rax, r8
movabs r8, 0x47b5481dbefa4fa4
mov qword [rcx + 0x40], rax
movabs rax, 0x5be0cd19137e2179
cmovne rax, r8
mov qword [rcx + 0x48], rax
xor eax, eax
mov dword [rcx + 0xd0], edx
ret
Function at 0x140023ca0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x80
mov rax, qword [0x140088040]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbx, r8
mov r14, rdx
mov rdi, rcx
test rcx, rcx
je 0x140023ef3
mov rdx, qword [rcx]
test rdx, rdx
je 0x140023ef3
cmp qword [rcx + 0x10], 0
je 0x140023ef3
movsxd rax, dword [rdx + 0x14]
mov qword [rsp + 0x78], rsi
cmp rbx, rax
jbe 0x140023d42
mov rcx, qword [rcx + 8]
call qword [rdx + 0x18]
mov esi, eax
test eax, eax
jne 0x140023ed6
mov rax, qword [rdi]
mov r8, rbx
mov rcx, qword [rdi + 8]
mov rdx, r14
call qword [rax + 0x20]
mov esi, eax
test eax, eax
jne 0x140023ed6
mov rax, qword [rdi]
lea rdx, [rsp + 0x20]
mov rcx, qword [rdi + 8]
call qword [rax + 0x28]
mov esi, eax
test eax, eax
jne 0x140023ed6
mov rdx, qword [rdi]
lea r14, [rsp + 0x20]
movsxd rbx, dword [rdx + 0x10]
mov qword [rsp + 0xb8], rbp
mov rbp, qword [rdi + 0x10]
mov qword [rsp + 0x70], r15
mov rcx, rbp
movsxd r15, dword [rdx + 0x14]
mov edx, 0x36
mov r8, r15
lea rsi, [r15 + rbp]
call fcn.140065540
mov rax, qword [rdi]
mov edx, 0x5c
mov rcx, rsi
movsxd r8, dword [rax + 0x14]
call fcn.140065540
xor eax, eax
test rbx, rbx
je 0x140023ea6
cmp rbx, 8
jb 0x140023e7a
lea rcx, [rsi - 1]
lea r8, [r14 - 1]
add rcx, rbx
add r8, rbx
cmp rsi, r8
ja 0x140023db0
cmp rcx, r14
jae 0x140023e7a
lea rdx, [rbp - 1]
add rdx, rbx
cmp rsi, rdx
ja 0x140023dc5
cmp rcx, rbp
jae 0x140023e7a
cmp rbp, r8
ja 0x140023dd3
cmp rdx, r14
jae 0x140023e7a
cmp rbx, 0x10
jb 0x140023e2a
mov rdx, rbx
mov r8, rbx
and edx, 0xf
sub r8, rdx
mov r9, r14
mov rcx, rbp
sub r9, rbp
nop
movdqu xmm0, xmmword [rcx]
add rax, 0x10
movdqu xmm2, xmmword [r9 + rcx]
lea rcx, [rcx + 0x10]
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmm0, xmmword [rcx + r15 - 0x10]
movdqu xmmword [rcx - 0x10], xmm1
xorps xmm2, xmm0
movdqu xmmword [rcx + r15 - 0x10], xmm2
cmp rax, r8
jb 0x140023df0
cmp rdx, 8
jb 0x140023e75
mov rdx, rbx
and rdx, 0xfffffffffffffff8
mov r8, r14
lea rcx, [rax + rbp]
sub r8, rbp
mov r9, rsi
sub r9, rbp
movq xmm0, qword [rcx]
add rax, 8
movq xmm2, qword [rcx + r8]
lea rcx, [rcx + 8]
movdqa xmm1, xmm2
xorps xmm1, xmm0
movq xmm0, qword [r9 + rcx - 8]
movq qword [rcx - 8], xmm1
xorps xmm0, xmm2
movq qword [r9 + rcx - 8], xmm0
cmp rax, rdx
jb 0x140023e41
cmp rax, rbx
jae 0x140023ea6
mov rdx, rbp
lea rcx, [r14 + rax]
sub rdx, r14
sub rsi, r14
sub rbx, rax
nop word [rax + rax]
movzx eax, byte [rcx]
xor byte [rcx + rdx], al
movzx eax, byte [rcx]
xor byte [rsi + rcx], al
lea rcx, [rcx + 1]
sub rbx, 1
jne 0x140023e90
mov rax, qword [rdi]
mov rcx, qword [rdi + 8]
call qword [rax + 0x18]
mov r15, qword [rsp + 0x70]
mov esi, eax
test eax, eax
jne 0x140023ece
mov rax, qword [rdi]
mov rdx, rbp
mov rcx, qword [rdi + 8]
movsxd r8, dword [rax + 0x14]
call qword [rax + 0x20]
mov esi, eax
mov rbp, qword [rsp + 0xb8]
mov rax, qword [fcn.140065540]
lea rcx, [rsp + 0x20]
xor edx, edx
lea r8d, [rdx + 0x40]
call rax
mov eax, esi
mov rsi, qword [rsp + 0x78]
jmp 0x140023ef8
mov eax, 0xffffaf00
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140042de0
add rsp, 0x80
pop r14
pop rdi
pop rbx
ret
Function at 0x1400307e0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x20
mov rbx, rcx
mov rsi, rdx
mov rcx, qword [rcx]
mov r10, qword [rcx + 0x78]
test r10, r10
jne 0x140030830
cmp qword [rcx + 0x108], r10
je 0x140030820
cmp qword [rcx + 0x118], r10
je 0x140030820
cmp qword [rcx + 0x120], r10
je 0x140030820
cmp qword [rcx + 0x110], r10
jne 0x140030830
mov eax, 0xffff8a00
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
mov rdx, qword [rdx]
mov rax, r8
sub rax, rdx
mov qword [rsp + 0x38], rdi
cmp rax, 2
jl 0x140030941
movzx edi, byte [rdx]
movzx eax, byte [rdx + 1]
add rdx, 2
shl rdi, 8
or rdi, rax
mov qword [rsi], rdx
cmp rdi, 1
jb 0x140030941
sub r8, rdx
cmp rdi, r8
ja 0x140030941
test r10, r10
je 0x1400308e2
mov rcx, qword [rcx + 0x80]
mov r8, rdx
mov rdx, rbx
mov r9, rdi
call r10
test eax, eax
je 0x14003092c
cmp qword [rbx], 0
je 0x1400308cd
mov rax, qword [rbx + 0x140]
mov dl, 1
mov dword [rbx + 0x148], reloc.WS2_32.dll_setsockopt
mov rcx, rbx
mov qword [rbx + 0x150], 2
mov byte [rax], 2
mov rax, qword [rbx + 0x140]
mov byte [rax + 1], reloc.WS2_32.dll_WSAStartup
call fcn.140016fe0
mov rdi, qword [rsp + 0x38]
mov eax, 0xffff9380
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
cmp rdi, qword [rcx + 0x120]
jne 0x140030893
mov r9, qword [rcx + 0x118]
mov r8, rdi
sub r9, rdx
mov byte [rsp + 0x30], 0
nop dword [rax]
movzx eax, byte [r9 + rdx]
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
xor cl, al
movzx eax, byte [rsp + 0x30]
or cl, al
mov byte [rsp + 0x30], cl
sub r8, 1
jne 0x140030900
movzx eax, byte [rsp + 0x30]
test al, al
jne 0x140030893
add qword [rsi], rdi
mov rdi, qword [rsp + 0x38]
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
mov rdi, qword [rsp + 0x38]
mov eax, 0xffff8400
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
Function at 0x1400387f0
Capabilities:
Encode data using xor

Disassembly:
xor r9b, r9b
xor r10d, r10d
mov r11, rcx
test r8, r8
je 0x1400388a6
sub rdx, rcx
cmp r8, 0x20
jb 0x14003888c
mov rcx, r8
lea rax, [r11 + 0x10]
and rcx, 0xffffffffffffffe0
xorps xmm3, xmm3
xorps xmm2, xmm2
movdqu xmm0, xmmword [rax - 0x10]
add r10, 0x20
movdqu xmm1, xmmword [rdx + rax - 0x10]
lea rax, [rax + 0x20]
xorps xmm1, xmm0
orps xmm3, xmm1
movdqu xmm1, xmmword [rax - 0x20]
movdqu xmm0, xmmword [rdx + rax - 0x20]
xorps xmm1, xmm0
orps xmm2, xmm1
cmp r10, rcx
jb 0x140038820
orps xmm2, xmm3
movdqa xmm0, xmm2
psrldq xmm0, 8
orps xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
orps xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 2
orps xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 1
orps xmm2, xmm0
movd r9d, xmm2
cmp r10, r8
jae 0x1400388a6
lea rax, [r10 + r11]
sub r8, r10
movzx ecx, byte [rdx + rax]
xor cl, byte [rax]
lea rax, [rax + 1]
or r9b, cl
sub r8, 1
jne 0x140038893
movzx eax, r9b
ret
Function at 0x14003a150
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push r12
push r13
push r14
sub rsp, 0x88
mov rax, qword [0x140088040]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov r14, qword [rsp + 0xe0]
xorps xmm0, xmm0
xor esi, esi
mov r13, r9
mov r12, r8
mov dword [rsp + 0x20], esi
mov rbp, rdx
mov rbx, rcx
mov rax, qword [r14]
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
test rax, rax
je 0x14003a1ad
movzx eax, byte [rax + 0x10]
test rdx, rdx
je 0x14003a336
mov qword [rsp + 0xc8], rdi
mov qword [rsp + 0x80], r15
movzx r15d, al
nop word [rax + rax]
mov rax, qword [r14]
cmp rbp, r15
mov rdi, rbp
cmovae rdi, r15
test rax, rax
je 0x14003a321
mov rcx, qword [r14 + 8]
call qword [rax + 0x18]
mov esi, eax
test eax, eax
jne 0x14003a326
mov rax, qword [r14]
test rax, rax
je 0x14003a321
mov rcx, qword [r14 + 8]
mov r8, r13
mov rdx, r12
call qword [rax + 0x20]
mov esi, eax
test eax, eax
jne 0x14003a326
mov rax, qword [r14]
test rax, rax
je 0x14003a321
mov rcx, qword [r14 + 8]
lea r8d, [rsi + 4]
lea rdx, [rsp + 0x20]
call qword [rax + 0x20]
mov esi, eax
test eax, eax
jne 0x14003a326
mov rax, qword [r14]
test rax, rax
je 0x14003a321
mov rcx, qword [r14 + 8]
lea rdx, [rsp + 0x30]
call qword [rax + 0x28]
mov esi, eax
test eax, eax
jne 0x14003a326
xor ecx, ecx
test rdi, rdi
je 0x14003a312
cmp rdi, 0x40
jb 0x14003a300
lea rdx, [rbx - 1]
add rdx, rdi
lea rax, [rsp + rdi + 0x2f]
cmp rbx, rax
ja 0x14003a292
lea rax, [rsp + 0x30]
cmp rdx, rax
jae 0x14003a300
mov rax, rdi
and rax, 0xffffffffffffffc0
nop dword [rax]
movdqu xmm0, xmmword [rbx]
movdqu xmm1, xmmword [rsp + rcx + 0x30]
xorps xmm1, xmm0
movdqu xmmword [rbx], xmm1
movdqu xmm0, xmmword [rbx + 0x10]
movdqu xmm1, xmmword [rsp + rcx + 0x40]
xorps xmm1, xmm0
movdqu xmmword [rbx + 0x10], xmm1
movdqu xmm0, xmmword [rbx + 0x20]
movdqu xmm1, xmmword [rsp + rcx + 0x50]
xorps xmm1, xmm0
movdqu xmmword [rbx + 0x20], xmm1
movdqu xmm0, xmmword [rbx + 0x30]
movdqu xmm1, xmmword [rsp + rcx + 0x60]
add rcx, 0x40
xorps xmm1, xmm0
movdqu xmmword [rbx + 0x30], xmm1
add rbx, 0x40
cmp rcx, rax
jb 0x14003a2a0
cmp rcx, rdi
jae 0x14003a312
nop dword [rax]
movzx eax, byte [rsp + rcx + 0x30]
inc rcx
xor byte [rbx], al
inc rbx
cmp rcx, rdi
jb 0x14003a300
inc byte [rsp + 0x23]
sub rbp, rdi
jne 0x14003a1d0
jmp 0x14003a326
mov esi, 0xffffaf00
mov rdi, qword [rsp + 0xc8]
mov r15, qword [rsp + 0x80]
mov rax, qword [fcn.140065540]
lea rcx, [rsp + 0x30]
xor edx, edx
lea r8d, [rdx + 0x40]
call rax
mov eax, esi
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140042de0
add rsp, 0x88
pop r14
pop r13
pop r12
pop rsi
pop rbp
pop rbx
ret
Function at 0x14003d1e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x88
mov rax, qword [0x140088040]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, qword [rsp + 0xf8]
mov rsi, rdx
mov rdi, qword [rsp + 0xf0]
mov rax, qword [rsp + 0xd0]
mov rdx, qword [rsp + 0xe0]
mov rbp, qword [rsp + 0xe8]
test rbx, rbx
jne 0x14003d233
lea eax, [rbx - 0xd]
jmp 0x14003d360
mov qword [rsp + 0x50], rbx
lea r10, [rsp + 0x60]
mov qword [rsp + 0x48], r10
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x38], rdx
mov edx, 1
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r9
mov r9, r8
mov r8, rsi
call fcn.14003ccd0
mov r10d, eax
test eax, eax
jne 0x14003d35d
xor r10d, r10d
xor r8b, r8b
mov r9d, r10d
cmp rbx, 8
jb 0x14003d319
mov rdx, rbx
xorps xmm4, xmm4
and rdx, 0xfffffffffffffff8
xorps xmm3, xmm3
mov eax, r10d
nop dword [rax]
nop dword [rax + rax]
movd xmm2, dword [rax + rdi]
xorps xmm0, xmm0
movd xmm1, dword [rsp + rax + 0x60]
lea eax, [r8 + 4]
punpcklbw xmm2, xmm0
add r8b, 8
punpcklwd xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
movzx ecx, al
orps xmm4, xmm2
movzx eax, r8b
movd xmm2, dword [rcx + rdi]
movd xmm1, dword [rsp + rcx + 0x60]
punpcklbw xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
orps xmm3, xmm2
cmp rax, rdx
jb 0x14003d2a0
orps xmm3, xmm4
movdqa xmm0, xmm3
psrldq xmm0, 8
orps xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
orps xmm3, xmm0
movd r9d, xmm3
movzx eax, r8b
cmp rax, rbx
jae 0x14003d33c
movzx edx, byte [rax + rdi]
inc r8b
movzx ecx, byte [rsp + rax + 0x60]
xor edx, ecx
movzx eax, r8b
or r9d, edx
cmp rax, rbx
jb 0x14003d322
test r9d, r9d
je 0x14003d35d
test rsi, rsi
je 0x14003d357
mov rax, qword [fcn.140065540]
mov r8, rsi
xor edx, edx
mov rcx, rbp
call rax
mov r10d, 0xfffffff1
mov eax, r10d
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140042de0
add rsp, 0x88
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14003d380
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140088040]
xor rax, rsp
mov qword [rsp + 0x48], rax
xorps xmm0, xmm0
mov qword [rsp + 0x30], 0
lea rax, [rsp + 0x30]
mov r8d, reloc.WS2_32.dll_recv
lea r9, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x38]
mov rbx, rcx
movups xmmword [rsp + 0x38], xmm0
call fcn.14002de80
test eax, eax
jne 0x14003d549
movzx eax, byte [rsp + 0x39]
movzx r8d, byte [rsp + 0x38]
movzx r9d, byte [rsp + 0x40]
movzx ecx, byte [rsp + 0x3c]
shl r8d, 8
or r8d, eax
shl r9d, 8
movzx eax, byte [rsp + 0x3a]
shl r8d, 8
or r8d, eax
shl ecx, 8
movzx eax, byte [rsp + 0x3b]
shl r8d, 8
or r8, rax
mov qword [rbx + 0xd8], 0
movzx eax, byte [rsp + 0x3d]
or ecx, eax
shl r8, 0x20
movzx eax, byte [rsp + 0x3e]
shl ecx, 8
or eax, ecx
mov qword [rbx + 0x58], 0
movzx ecx, byte [rsp + 0x44]
shl eax, 8
or r8, rax
shl ecx, 8
movzx eax, byte [rsp + 0x3f]
or r8, rax
mov r10d, 4
movzx eax, byte [rsp + 0x41]
or r9d, eax
mov qword [rbx + 0x118], r8
movzx eax, byte [rsp + 0x42]
shl r9d, 8
or r9d, eax
movzx eax, byte [rsp + 0x43]
shl r9d, 8
or r9, rax
movzx eax, byte [rsp + 0x45]
or ecx, eax
shl r9, 0x20
movzx eax, byte [rsp + 0x46]
shl ecx, 8
or eax, ecx
shl eax, 8
or r9, rax
movzx eax, byte [rsp + 0x47]
or r9, rax
mov qword [rbx + 0x98], r9
mov eax, r9d
mov rcx, r8
and eax, 1
shl rcx, 0x3f
imul edx, eax, 0xe1000000
mov rax, r9
shr rax, 1
mov r9, rcx
or r9, rax
mov rax, r8
shr rax, 1
mov qword [rbx + r10*8 + 0x58], r9
mov ecx, edx
shl rcx, 0x20
mov r8, rcx
xor r8, rax
mov qword [rbx + r10*8 + 0xd8], r8
shr r10d, 1
jne 0x14003d4a1
mov r11d, 2
mov r8d, r11d
nop dword [rax]
mov r9, qword [rbx + r8*8 + 0xd8]
mov r10, qword [rbx + r8*8 + 0x58]
cmp r8, 1
jle 0x14003d538
lea rax, [rbx + 0x60]
lea rdx, [r8 - 1]
nop dword [rax + rax]
mov rcx, r9
xor rcx, qword [rax + 0x80]
mov qword [rax + r8*8 + 0x80], rcx
lea rax, [rax + 8]
mov rcx, r10
xor rcx, qword [rax - 8]
mov qword [rax + r8*8 - 8], rcx
sub rdx, 1
jne 0x14003d510
lea eax, [r11 + r11]
add r8, r8
mov r11d, eax
cmp eax, 8
jle 0x14003d4f0
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140042de0
add rsp, 0x50
pop rbx
ret