joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400146b0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov rdx, qword [rsi]
movabs rax, 0x8000000000000001
mov rcx, rdx
add rcx, rax
xor eax, eax
movabs r8, 0x8000000000000002
mov r9, rdx
sub r9, r8
cmovl rax, rcx
test rax, rax
je 0x140014748
jmp 0x1400146e9
sub rax, 1
je 0x140014822
jmp 0x1400146f5
mov eax, dword [0x1400d4530]
and eax, dword [0x1400d4534]
imul eax, eax, 0x15097b53
and eax, 0xdfeb7457
add eax, 0x9d72cc75
cmp eax, 0x35bec6c3
jbe 0x1400148c2
jmp 0x14001471e
mov eax, dword [str.5_d]
xor eax, dword [0x1400d453c]
add eax, 0x1d5bf496
imul eax, eax, 0xd72420f
or eax, 0x69cb21f1
cmp eax, 0x36fcda8e
je 0x14001471e
add rsp, 0x28
pop rdi
pop rsi
ret
movzx eax, byte [rsi + 0x38]
test eax, eax
je 0x140014762
jmp 0x140014752
mov ecx, eax
sub ecx, 3
je 0x140014799
jmp 0x14001475b
sub eax, 4
je 0x1400147a7
jmp 0x1400146f5
cmp rdx, 0
je 0x140014777
mov rcx, qword [rsi + 8]
mov r8d, 1
call fcn.1400541d0
mov rdx, qword [rsi + 0x18]
cmp rdx, 0
je 0x1400146f5
mov rcx, qword [rsi + 0x20]
mov r8d, 1
call fcn.1400541d0
jmp 0x1400146f5
mov rcx, rsi
add rcx, 0x40
call fcn.140014360
jmp 0x1400147bf
mov rcx, rsi
add rcx, 0x68
call fcn.1400162f0
mov rcx, rsi
add rcx, 0x40
call fcn.140014ce0
cmp byte [rsi + 0x39], 0
je 0x1400146f5
mov eax, dword [0x1400d4540]
xor eax, dword [0x1400d4544]
xor eax, 0x29e7f1f5
xor eax, 0x63e11e3
or eax, 0x8c5bc817
cmp eax, 0x38efa7a3
jbe 0x1400148d3
mov eax, dword [0x1400d4548]
xor eax, dword [0x1400d454c]
imul eax, eax, 0x3a4c88b0
or eax, 0x9e820629
mov ecx, 0xb10ee0bd
xor edx, edx
div ecx
mov rdx, qword [rsi]
cmp eax, 0xf3cd6681
ja 0x1400148d3
jmp 0x140014762
cmp qword [rsi + 8], 0
je 0x1400146f5
mov rdi, qword [rsi + 0x10]
mov rsi, qword [rsi + 0x18]
cmp rdi, 0
je 0x1400146f5
mov rax, qword [rsi]
cmp rax, 0
je 0x14001484d
mov rcx, rdi
call rax
mov eax, dword [0x1400d4550]
imul eax, dword [0x1400d4554]
mov ecx, 0xa24daf07
xor edx, edx
div ecx
add eax, 0xab70d858
sub eax, 0x8cbb5740
cmp eax, 0x820b72d0
jae 0x1400148e4
jmp 0x140014876
mov ecx, dword [0x1400d4558]
xor ecx, dword [0x1400d455c]
sub ecx, 0x5d152c62
sub ecx, 0xf2f4ca48
add ecx, 0x9a934316
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
cmp rdx, 0
sete al
cmp ecx, 0xa0670505
jae 0x140014876
test al, 1
jne 0x1400146f5
jmp 0x1400148b5
mov rcx, rdi
call fcn.1400541d0
jmp 0x1400146f5
invalid
and edi, dword [rdx - 0x19]
not dword [rdx - 0x15]
and byte [rdx], bh
lahf
shr ecx, cl
push rbp
jmp 0x1400147ef
pushfq
push rdx
jmp 0x140014963
xor edx, dword [rsi]
cmc
Function at 0x140016fd0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rdx, qword [rsi]
movabs rax, 0x8000000000000000
cmp rdx, rax
je 0x140017023
cmp rdx, 0
je 0x140017001
mov rcx, qword [rsi + 8]
mov r8d, 1
call fcn.1400541d0
mov rdx, qword [rsi + 0x18]
cmp rdx, 0
je 0x1400170d9
mov rcx, qword [rsi + 0x20]
mov r8d, 1
call fcn.1400541d0
jmp 0x1400170d9
mov eax, dword [0x1400d4730]
xor eax, dword [0x1400d4734]
and eax, 0xe2652e7e
imul eax, eax, 0x892218e3
mov ecx, 0x164727f0
xor edx, edx
div ecx
cmp eax, 0x3e85722c
je 0x1400170e2
jmp 0x140017050
mov edx, dword [0x1400d4738]
xor edx, dword [0x1400d473c]
sub edx, 0x2ad65f
xor edx, 0x64cc8880
xor edx, 0x50c84973
mov rax, qword [rsi + 8]
mov rcx, rax
and rcx, 3
cmp edx, 0xffbf42e7
ja 0x140017050
lea rdx, [0x1400b4310]
movsxd rcx, dword [rdx + rcx*4]
add rcx, rdx
jmp rcx
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
or dword [rbx + 0x378911fd], eax
invalid
Function at 0x140028520
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x70
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov rcx, rsi
call fcn.140061fa0
cmp rax, 0
je 0x14002858a
mov qword [rsp + 0x30], rax
lea r14, [rsp + 0x30]
add r14, 8
mov qword [rsp + 0x38], rdx
lea rax, [rsp + 0x30]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rdi
lea r15, [rsp + 0x2e]
add r15, 1
jmp 0x140028591
mov bl, 2
jmp 0x140028677
call fcn.140062da0
mov rdi, rax
mov rbx, rdi
add rbx, 0x50
movzx eax, byte [rdi + 0x50]
test rax, rax
mov bpl, 2
je 0x1400285b8
jmp 0x1400285ae
sub rax, 1
je 0x1400285ca
jmp 0x1400285b6
jmp 0x1400285da
lea rdx, [0x14003a350]
mov rcx, rdi
call fcn.140078ee0
mov byte [rbx], 1
mov bpl, byte [rdi + 0x4c]
mov r12b, byte [rdi + 0x4d]
mov byte [rdi + 0x4c], 1
mov byte [rdi + 0x4d], 0x80
mov eax, dword [0x1400d4e80]
or eax, dword [0x1400d4e84]
xor eax, 0x703fbf83
xor eax, 0x66eaf73f
sub eax, 0xf879bfdf
cmp eax, 0xc62380de
je 0x140028688
jmp 0x140028602
mov eax, dword [0x1400d4e88]
xor eax, dword [0x1400d4e8c]
and eax, 0x5974f1c2
imul edi, eax, 0x3c7c3acf
add edi, 0x51348b38
mov byte [rsp + 0x2e], bpl
mov byte [r15], r12b
lea rcx, [rsp + 0x40]
lea rdx, [rsp + 0x50]
call fcn.14002de90
mov bl, al
cmp byte [rsp + 0x2e], 2
sete al
cmp edi, 0xdafeb78d
ja 0x140028602
test al, 1
jne 0x140028658
jmp 0x14002864e
lea rcx, [rsp + 0x2e]
call fcn.140065a40
cmp bl, 2
je 0x14002866a
mov rax, qword [rsp + 0x30]
mov rcx, qword [r14]
call qword [rax + 0x18]
jmp 0x140028677
mov rcx, rsi
call fcn.140062010
jmp 0x140028591
mov al, bl
add rsp, 0x70
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea ecx, [rdx + 0x3b]
invalid
Function at 0x140039770
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x20
mov r8, rdx
add r8, 8
mov rax, qword [rdx + 8]
cmp rax, 0
je 0x1400397a8
mov r10, qword [rdx]
mov r11, r10
add r11, 1
mov rsi, rax
add rsi, 0xffffffffffffffff
mov r9b, byte [r10]
mov qword [rdx], r11
mov qword [r8], rsi
cmp r9b, 0xfb
jb 0x1400397d6
jmp 0x1400397b8
mov byte [rcx], 0
mov qword [rcx + 8], 1
jmp 0x140039914
add r9b, 5
movzx esi, r9b
sub r9b, 3
ja 0x14003983c
lea r9, [0x1400b5498]
movsxd rsi, dword [r9 + rsi*4]
add rsi, r9
jmp rsi
mov eax, dword [0x1400d5668]
sub eax, dword [0x1400d566c]
mov r8d, 0xcf6e7752
xor edx, edx
div r8d
mov r8d, 0xa2ae58a6
xor edx, edx
div r8d
sub eax, 0xbe1b906c
cmp eax, 0xfe8a62bd
jae 0x14003991a
jmp 0x14003980a
mov eax, dword [0x1400d5670]
sub eax, dword [0x1400d5674]
xor eax, 0xeccb12f3
xor eax, 0xdb21ff67
sub eax, 0x62e7dae2
movzx edx, r9b
mov qword [rcx + 8], rdx
mov byte [rcx], 0x11
cmp eax, 0xc45b61ee
ja 0x14003980a
jmp 0x140039914
mov edx, 3
mov r8d, 0xc
call fcn.1400af2d0
jmp 0x140039914
cmp rax, 3
jb 0x1400398a6
jmp 0x140039882
cmp rax, 5
jb 0x1400398d7
jmp 0x1400398b7
cmp rax, 9
jb 0x140039905
jmp 0x1400398e8
mov edx, 3
mov r8d, 4
call fcn.1400af2d0
jmp 0x140039914
add r10, 3
add rax, 0xfffffffffffffffd
mov r9w, word [r11]
mov qword [rdx], r10
mov qword [r8], rax
rol r9w, 8
movzx eax, r9w
mov qword [rcx + 8], rax
mov byte [rcx], 0x11
jmp 0x140039914
mov edx, 3
sub rdx, rax
mov byte [rcx], 0
mov qword [rcx + 8], rdx
jmp 0x140039914
add r10, 5
add rax, 0xfffffffffffffffb
mov r9d, dword [r11]
mov qword [rdx], r10
mov qword [r8], rax
bswap r9d
mov eax, r9d
mov qword [rcx + 8], rax
mov byte [rcx], 0x11
jmp 0x140039914
mov edx, 5
sub rdx, rax
mov byte [rcx], 0
mov qword [rcx + 8], rdx
jmp 0x140039914
add r10, 9
add rax, 0xfffffffffffffff7
mov r9, qword [r11]
mov qword [rdx], r10
mov qword [r8], rax
bswap r9
mov qword [rcx + 8], r9
mov byte [rcx], 0x11
jmp 0x140039914
mov edx, 9
sub rdx, rax
mov byte [rcx], 0
mov qword [rcx + 8], rdx
add rsp, 0x20
pop rsi
ret
mov eax, 0x68c034f5
loopne 0x1400399a1
ret 0x92eb
ror byte [rax - 0x77], 0xc1
Function at 0x14003f190
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rdi, r8
mov r8, rdx
mov rsi, rcx
lea rbx, [rsp + 0x48]
mov qword [rsp + 0x50], 0
mov eax, 1
movq xmm0, rax
xor eax, eax
test rdi, rdi
je 0x14003f31b
jmp 0x14003f1c6
mov eax, dword [0x1400d5918]
xor edx, edx
div dword [0x1400d591c]
xor eax, 0x15c9d60c
imul eax, eax, 0x5ba19776
xor eax, 0x920ad931
cmp eax, 0xfe0e6119
ja 0x14003f369
jmp 0x14003f1f1
mov eax, dword [0x1400d5920]
or eax, dword [0x1400d5924]
add eax, 0x4f74fb15
mov ecx, 0x77814a31
xor edx, edx
div ecx
sub eax, 0x66c4723d
mov bpl, byte [r8]
mov rcx, r8
add rcx, 1
mov rdx, rdi
add rdx, 0xffffffffffffffff
mov qword [rsp + 0x40], rcx
mov qword [rbx], rdx
cmp bpl, 2
setb cl
cmp eax, 0x77512903
jb 0x14003f1f1
mov eax, 1
movq xmm0, rax
mov al, 7
test cl, 1
jne 0x14003f24d
jmp 0x14003f31b
lea rcx, [rsp + 0x20]
lea rdx, [rsp + 0x40]
call fcn.140048250
mov al, byte [rsp + 0x20]
cmp al, 0x11
je 0x14003f28f
mov bpl, byte [rsp + 0x21]
mov ecx, dword [rsp + 0x22]
movzx edx, word [rsp + 0x26]
shl rdx, 0x20
or rcx, rdx
movups xmm0, xmmword [rsp + 0x28]
mov r9, qword [rsp + 0x38]
mov rdx, r9
shr rdx, 8
jmp 0x14003f31b
mov eax, dword [0x1400d5928]
xor edx, edx
div dword [0x1400d592c]
or eax, 0xea03c18f
and eax, 0xe3bee263
mov ecx, 0x7c7c0172
xor edx, edx
div ecx
cmp eax, 0xd32f2666
ja 0x14003f38c
jmp 0x14003f2bd
mov ecx, dword [0x1400d5930]
mov eax, dword [0x1400d5934]
and ecx, eax
and ecx, 0xc59c219d
add ecx, 0xfbec2221
xor ecx, 0xa8b8b15c
mov rax, qword [rsp + 0x28]
mov rdx, rax
shr rdx, 0x10
movups xmm0, xmmword [rsp + 0x30]
mov byte [rsi], al
mov byte [rsi + 1], ah
shr rax, 0x30
mov word [rsi + 6], ax
mov dword [rsi + 2], edx
movdqu xmmword [rsi + 8], xmm0
mov byte [rsi + 0x18], bpl
mov rax, rdi
sub rax, qword [rbx]
mov qword [rsi + 0x20], rax
cmp ecx, 0x204380f6
je 0x14003f2bd
jmp 0x14003f35d
mov byte [rsi + 8], al
mov byte [rsi + 9], bpl
mov rax, rcx
shr rax, 0x20
mov word [rsi + 0xe], ax
mov dword [rsi + 0xa], ecx
movups xmmword [rsi + 0x10], xmm0
mov byte [rsi + 0x20], r9b
mov rax, rdx
shr rax, 0x30
mov byte [rsi + 0x27], al
mov rax, rdx
shr rax, 0x20
mov word [rsi + 0x25], ax
mov dword [rsi + 0x21], edx
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rax, rsi
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
ret
add byte [rdx - 0x4bc29cb5], ch
mov rax, r8
add rax, 1
mov rcx, rdi
add rcx, 0xffffffffffffffff
mov qword [rsp + 0x40], rax
mov qword [rbx], rcx
jmp 0x14003f1ef
xlatb
mov dl, 0xcf
test eax, 0x8766a38b
invalid
Function at 0x140041020
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rax, qword [rsi]
cmp rax, 0
je 0x140041192
mov ecx, dword [0x1400d59f0]
sub ecx, dword [0x1400d59f4]
imul ecx, ecx, 0xfa1ad173
sub ecx, 0xe4ca36ea
and ecx, 0x89d4b281
cmp ecx, 0x62717003
je 0x14004121e
jmp 0x14004106c
mov ecx, dword [0x1400d59f8]
and ecx, dword [0x1400d59fc]
imul edx, ecx, 0xd4d06fbd
and edx, 0xf2605550
xor edx, 0xd6c3467d
lock dec qword [rax]
sete cl
cmp edx, 0x87783814
ja 0x14004106c
test cl, 1
jne 0x1400410a0
jmp 0x1400410a8
mov rcx, rsi
call fcn.140041bb0
mov r14, rsi
add r14, 0x28
mov rbx, rsi
add rbx, 0x30
mov r15, qword [rsi + 0x30]
mov r12, qword [rsi + 0x38]
cmp r12, 0
je 0x140041156
xor r13d, r13d
jmp 0x1400410cd
mov rax, r13
mov rcx, rax
shl rcx, 3
mov rdi, r15
add rdi, rcx
add r13, 1
mov rax, qword [r15 + rax*8]
lock dec qword [rax]
sete al
test al, 1
je 0x14004114b
mov eax, dword [0x1400d5a00]
and eax, dword [0x1400d5a04]
xor eax, 0xa2d29a82
and eax, 0xd818e619
and eax, 0xe8d264f7
cmp eax, 0x19a43c7e
jae 0x140041236
jmp 0x140041118
mov ebp, dword [0x1400d5a08]
mov eax, dword [0x1400d5a0c]
xor ebp, eax
or ebp, 0x2fb7fffc
mov eax, 0xba04802d
imul rbp, rax
shr rbp, 0x3f
mov rcx, rdi
call fcn.140041f40
cmp ebp, 0xe6893448
ja 0x140041118
jmp 0x14004114b
cmp r13, r12
jne 0x1400410cd
jmp 0x140041156
mov rdx, qword [r14]
cmp rdx, 0
je 0x140041171
mov rcx, qword [rbx]
shl rdx, 3
mov r8d, 8
call fcn.1400541d0
mov rax, rsi
add rax, 8
mov rcx, qword [rsi + 8]
lock dec qword [rcx]
sete cl
test cl, 1
je 0x1400411ad
mov rcx, qword [rax]
call fcn.140041fb0
jmp 0x1400411ad
mov rcx, rsi
add rcx, 8
mov rax, qword [rsi + 8]
lock dec qword [rax]
sete al
test al, 1
je 0x1400411ad
call fcn.140042370
cmp dword [rsi + 0x80], 0x3b9aca00
je 0x14004120c
mov rdi, qword [rsi + 0x58]
mov rsi, qword [rsi + 0x60]
cmp rsi, 0
je 0x14004120c
xor eax, eax
xor ebx, ebx
jmp 0x1400411cd
add rbx, 1
imul rax, rax, 0x28
mov rcx, rdi
add rcx, rax
add rcx, 8
mov rcx, qword [rcx]
mov edx, 0x1860
mov r8d, 8
call fcn.1400541d0
cmp rbx, rsi
mov rax, rbx
jne 0x1400411cd
imul rdx, rsi, 0x28
mov rcx, rdi
mov r8d, 8
call fcn.1400541d0
nop
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
jrcxz 0x1400411cb
bnd jne 0x14004122d
xor esi, dword [rbx - 6]
jb 0x14004124a
stosb byte [rdi], al
int1
lock dec qword [rax]
sete cl
jmp 0x14004106a
or byte [rdi], cl
xchg esp, eax
shr ecx, 0x34
invalid
cmp byte [rdi], cl
and byte [rax + rbp*4 + 0x5b], cl
sbb bh, byte [rcx - 0x65]
pop rbp
shr bh, cl
mov rcx, rdi
call fcn.140041f40
jmp 0x140041116
Function at 0x1400412a0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x20
mov eax, dword [0x1400d5a10]
xor edx, edx
div dword [0x1400d5a14]
add eax, 0xb50f88ae
and eax, 0xc71dd57d
and eax, 0xe90fa8f2
cmp eax, 0x16ba4a8f
jbe 0x1400413a8
jmp 0x1400412cf
mov eax, dword [0x1400d5a18]
xor eax, dword [0x1400d5a1c]
imul edx, eax, 0xedb7d1a4
sub edx, 0x953b6fb3
xor edx, 0x1cdf40ff
mov rsi, qword [rcx]
cmp qword [rsi + 0x10], 1
sete al
cmp edx, 0x405bba94
jbe 0x1400412cf
test al, 1
jne 0x140041306
jmp 0x140041322
mov rcx, qword [rsi + 0x18]
mov rdx, qword [rsi + 0x20]
mov byte [rcx], 0
cmp rdx, 0
je 0x140041322
mov r8d, 1
call fcn.1400541d0
mov rax, 0xffffffffffffffff
cmp rsi, rax
je 0x140041353
mov rax, rsi
add rax, 8
lock dec qword [rax]
sete al
test al, 1
je 0x140041353
mov rcx, rsi
mov edx, 0x38
mov r8d, 8
call fcn.1400541d0
mov eax, dword [0x1400d5a20]
xor eax, dword [0x1400d5a24]
mov ecx, 0x9a76f91c
xor edx, edx
div ecx
xor eax, 0x6ae05388
sub eax, 0x1cdd4a0
cmp eax, 0xd187dab9
je 0x1400413b9
jmp 0x14004137b
mov eax, dword [0x1400d5a28]
or eax, dword [0x1400d5a2c]
imul eax, eax, 0xae14b52
add eax, 0x8ecf53c8
mov ecx, 0x31ba67f9
xor edx, edx
div ecx
cmp eax, 0xb97bc753
jae 0x14004137b
add rsp, 0x20
pop rsi
ret
out 0xa2, al
cmp al, 0xa0
sub edx, dword [rbp + 0x29]
in al, dx
invalid
out 0xf0, al
xchg dword [rcx + 0x1ccec00f], ebx
jmp 0x140041379
Function at 0x140041890
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, qword [rcx]
mov rax, qword [rsi + 0x10]
mov rdi, rsi
add rdi, 0x18
cmp rax, 0
jne 0x14004199f
mov r8, qword [rdi]
movabs rax, 0x8000000000000000
cmp r8, rax
je 0x14004197b
mov eax, dword [0x1400d5a30]
sub eax, dword [0x1400d5a34]
add eax, 0xde02099f
imul eax, eax, 0x917798f4
or eax, 0xe437c0c2
cmp eax, 0x27718d3f
je 0x140041abe
jmp 0x1400418ed
mov eax, dword [0x1400d5a38]
add eax, dword [0x1400d5a3c]
sub eax, 0x9d3fe53a
sub eax, 0x347183c6
mov ecx, 0x184305a4
xor edx, edx
div ecx
mov rdx, qword [rsi + 0x38]
cmp rdx, 0
sete cl
cmp eax, 0xda94fa2a
je 0x1400418ed
test cl, 1
jne 0x14004193b
jmp 0x140041925
mov rcx, qword [rsi + 0x30]
shl rdx, 5
mov r8d, 8
call fcn.1400541d0
mov r8, qword [rdi]
cmp r8, 0
je 0x140041957
mov rcx, qword [rsi + 0x20]
shl r8, 4
mov rdx, r8
mov r8d, 8
call fcn.1400541d0
mov rcx, rsi
add rcx, 0x40
mov rax, qword [rsi + 0x40]
lock dec qword [rax]
sete al
test al, 1
je 0x140041a25
call fcn.140041bb0
jmp 0x140041a25
mov rcx, rsi
add rcx, 0x20
mov rax, qword [rsi + 0x20]
lock dec qword [rax]
sete al
test al, 1
je 0x140041a25
call fcn.140042370
jmp 0x140041a25
mov rdx, qword [rdi]
movabs rax, 0x8000000000000000
cmp rdx, rax
je 0x140041a0a
mov rax, qword [rsi + 0x38]
cmp rax, 0
je 0x1400419d4
mov rcx, qword [rsi + 0x30]
shl rax, 5
mov rdx, rax
mov r8d, 8
call fcn.1400541d0
mov rdx, qword [rdi]
cmp rdx, 0
je 0x1400419ed
mov rcx, qword [rsi + 0x20]
shl rdx, 4
mov r8d, 8
call fcn.1400541d0
mov rcx, rsi
add rcx, 0x40
mov rax, qword [rsi + 0x40]
lock dec qword [rax]
sete al
test al, 1
je 0x140041a25
call fcn.140041bb0
jmp 0x140041a25
mov rcx, rsi
add rcx, 0x20
mov rax, qword [rsi + 0x20]
lock dec qword [rax]
sete al
test al, 1
je 0x140041a25
call fcn.140042370
mov rax, 0xffffffffffffffff
cmp rsi, rax
je 0x140041ab7
mov rax, rsi
add rax, 8
lock dec qword [rax]
sete al
test al, 1
je 0x140041ab7
mov eax, dword [0x1400d5a40]
add eax, dword [0x1400d5a44]
or eax, 0xa093a4fb
imul eax, eax, 0x293c7cbb
and eax, 0x2011ee13
cmp eax, 0xfbb9bc8c
jae 0x140041acb
jmp 0x140041a6c
mov edi, dword [str.i_b]
mov eax, dword [0x1400d5a4c]
and edi, eax
and edi, 0x91211c2b
imul rax, rdi, 0x3c7c5d3
shr rax, 0x20
sub edi, eax
shr edi, 1
add edi, eax
shr edi, 0x1c
xor edi, 0xf50b4ac4
mov rcx, rsi
mov edx, 0x58
mov r8d, 8
call fcn.1400541d0
cmp edi, 0xbc7efcea
jb 0x140041a6c
jmp 0x140041ab7
add rsp, 0x28
pop rdi
pop rsi
ret
invalid
push rbp
lodsd eax, dword [rsi]
xchg edx, eax
push rdi
imul ebp, dword [rcx + 0x42], 0xe0f4c978
invalid
Function at 0x1400426b0
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov rdi, rcx
mov bl, byte [rdx]
mov r14, rsi
add r14, 0x10
mov rdx, qword [rsi + 0x10]
cmp qword [rsi], rdx
je 0x1400426d3
jmp 0x1400426f3
mov rcx, rsi
mov r8d, 1
mov r9d, 1
mov qword [rsp + 0x20], 1
call fcn.140053080
mov rdx, qword [r14]
mov eax, dword [0x1400d5aa0]
sub eax, dword [0x1400d5aa4]
add eax, 0x542e2372
imul eax, eax, 0x426509a8
and eax, 0xde605d49
cmp eax, 0xb84ee90f
ja 0x14004275f
jmp 0x140042718
mov eax, dword [0x1400d5aa8]
or eax, dword [0x1400d5aac]
sub eax, 0xcca2f964
or eax, 0xa1bc0057
xor eax, 0x44d7cde6
mov rcx, qword [rsi + 8]
mov byte [rcx + rdx], bl
mov rcx, rdx
add rcx, 1
mov qword [r14], rcx
mov qword [rdi], 8
cmp eax, 0xe5d4b15
jb 0x140042718
mov rax, rdi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
insb byte [rdi], dx
wait
sbb byte [rbx], 0xa1
jnp 0x140042794
cmp ch, byte [rax + 0x486f25dc]
mov eax, dword [rsi + 8]
mov byte [rax + rdx], bl
mov rax, rdx
add rax, 1
mov qword [r14], rax
mov qword [rdi], 8
jmp 0x140042716
Function at 0x1400464c0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
cmp byte [rcx + 0x68], 3
je 0x140046522
mov eax, dword [0x1400d5d60]
imul eax, dword [0x1400d5d64]
imul eax, eax, 0x85018a4a
xor eax, 0xaa04138c
imul eax, eax, 0x5ce394fd
cmp eax, 0x14604a86
jb 0x140046667
jmp 0x1400464f8
mov eax, dword [0x1400d5d68]
or eax, dword [0x1400d5d6c]
or eax, 0x544a97ae
sub eax, 0xce6c8081
or eax, 0x887ec0dd
cmp eax, 0x41b2ba27
je 0x1400464f8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov rdi, rcx
add rdi, 0x20
movzx eax, byte [rcx + 0x60]
test eax, eax
je 0x14004653e
jmp 0x140046533
sub eax, 3
je 0x140046659
jmp 0x1400464cd
mov rbx, rcx
add rbx, 0x28
mov rsi, qword [rcx + 0x28]
cmp rsi, 0
je 0x14004664b
mov rcx, rsi
call fcn.140072430
mov rax, qword [rsi]
lock dec qword [rax]
sete al
test al, 1
je 0x140046571
mov rcx, rsi
call fcn.140041bb0
mov eax, dword [0x1400d5d70]
xor eax, dword [0x1400d5d74]
imul eax, eax, 0x9828c326
mov ecx, 0x47a2bfa9
xor edx, edx
div ecx
add eax, 0xcbdc9e92
cmp eax, 0xbf22d39d
jbe 0x140046674
jmp 0x14004659e
mov eax, dword [0x1400d5d78]
or eax, dword [0x1400d5d7c]
sub eax, 0x165fb067
and eax, 0x1751f57c
mov ecx, 0x68559a8b
xor edx, edx
div ecx
mov rcx, rsi
add rcx, 8
mov rdx, qword [rsi + 8]
lock dec qword [rdx]
sete dl
cmp eax, 0xba810a12
ja 0x14004659e
test dl, 1
jne 0x1400465dd
jmp 0x1400465e2
call fcn.140042210
mov eax, dword [0x1400d5d80]
add eax, dword [0x1400d5d84]
and eax, 0x21d06da8
and eax, 0xa78ea3e2
or eax, 0xfc69d3b6
cmp eax, 0x84c02f62
je 0x14004668c
add byte [rax], al
add bl, ch
add byte [rbx + 0x8f77805], cl
add byte [rdi], cl
scasd eax, dword [rdi]
add eax, 0x8f775
jmp 0x14004660a
mov eax, dword [0x1400d5d88]
js 0x140046605
or byte [rax], al
imul eax, dword [0x1400d5d8c]
jne 0x14004660c
or byte [rax], al
mov ecx, 0x1981602
xor edx, edx
div ecx
mov esi, eax
xor esi, 0xcc5cba0b
add esi, 0xf39e78d8
mov rcx, qword [rbx]
mov edx, 0x20
mov r8d, 8
call fcn.1400541d0
cmp esi, 0xef6f5e6c
je 0x14004660a
jmp 0x14004664b
mov rcx, qword [rdi]
call qword [sym.imp.ws2_32.dll_closesocket]
jmp 0x1400464cd
add rcx, 0x30
call fcn.140045fc0
jmp 0x1400464cd
loopne 0x140046613
and eax, 0xe9d0d154
invalid
xchg edx, eax
push rdi
or ebp, edi
jp 0x140046617
add byte [rdi + 0x8468b48], cl
lock dec qword [rax]
sete al
jmp 0x14004659c
push rcx
movsd dword [rdi], dword [rsi]
cdq
or edx, dword [rdx]
push rbp
push rcx
out dx, eax
mov rcx, qword [rbx]
mov edx, 0x20
mov r8d, 8
call fcn.1400541d0
jmp 0x140046608
Function at 0x140047050
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x140047092
mov r10d, 8
sub r10, r11
cmp r10, r8
mov rdi, r8
cmovb rdi, r10
cmp rdi, 4
jb 0x14004709a
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x1400470ab
jmp 0x1400470c2
xor r10d, r10d
jmp 0x14004714d
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x1400470c2
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x1400470d9
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x1400470f9
add r11, r8
jmp 0x14004722a
mov rcx, qword [rax + 0x18]
xor rcx, rsi
mov r11, qword [rax + 0x10]
mov r9, qword [rax]
add r9, r11
mov rdi, qword [rax + 8]
add rdi, rcx
rol r11, 0xd
xor r11, r9
rol rcx, 0x10
rol r9, 0x20
xor rcx, rdi
add rdi, r11
rol r11, 0x11
add r9, rcx
xor r11, rdi
rol rcx, 0x15
mov qword [rax + 0x10], r11
xor rcx, r9
rol rdi, 0x20
mov qword [rax + 0x18], rcx
mov qword [rax + 8], rdi
xor r9, rsi
mov qword [rax], r9
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x1400471c2
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
mov rbx, qword [rdx + r10]
xor rdi, rbx
add rcx, rsi
rol rsi, 0xd
add r9, rdi
xor rsi, rcx
rol rdi, 0x10
xor rdi, r9
rol rcx, 0x20
add r9, rsi
add rcx, rdi
rol rsi, 0x11
xor rsi, r9
rol rdi, 0x15
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x140047170
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x1400471e0
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x1400471f2
jmp 0x14004720c
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x14004720c
lea rcx, [r8 + r10]
movzx esi, word [rdx + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x140047226
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret