joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180017958
Capabilities:
Hash data using sha1

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
xor ebx, ebx
mov dword [rbp - 0x29], 0x67452301
mov r14, r8
mov qword [rbp - 0x15], rbx
mov rsi, rcx
mov qword [rbp + 0x33], rbx
mov edx, ebx
mov dword [rbp - 0x25], 0xefcdab89
lea edi, [rbx + 0xe]
mov dword [rbp - 0x21], 0x98badcfe
lea r15d, [rbx + 1]
mov dword [rbp - 0x1d], 0x10325476
mov dword [rbp - 0x19], 0xc3d2e1f0
mov eax, ebx
mov dword [rbp + 0x3b], ebx
dec edi
test eax, eax
jne 0x180017ac0
mov al, byte [rsi]
movsxd rcx, edx
mov byte [rbp + rcx - 0xd], al
mov edx, dword [rbp + 0x33]
mov eax, dword [rbp + 0x3b]
inc edx
add dword [rbp - 0x15], 8
mov dword [rbp + 0x33], edx
jne 0x1800179e7
add dword [rbp - 0x11], r15d
cmove eax, r15d
mov dword [rbp + 0x3b], eax
cmp edx, 0x40
jne 0x1800179fb
lea rcx, [rbp - 0x29]
call fcn.18001775c
mov eax, dword [rbp + 0x3b]
mov edx, dword [rbp + 0x33]
add rsi, r15
test edi, edi
jne 0x1800179b8
test eax, eax
jne 0x180017ac0
cmp dword [rbp + 0x37], ebx
jne 0x180017ac0
movsxd rax, edx
mov byte [rbp + rax - 0xd], 0x80
mov eax, dword [rbp + 0x33]
add eax, r15d
mov dword [rbp + 0x33], eax
cmp edx, 0x37
jle 0x180017a72
jmp 0x180017a3a
cdqe
mov byte [rbp + rax - 0xd], bl
mov eax, dword [rbp + 0x33]
add eax, r15d
mov dword [rbp + 0x33], eax
cmp eax, 0x40
jl 0x180017a2b
lea rcx, [rbp - 0x29]
call fcn.18001775c
mov eax, dword [rbp + 0x33]
jmp 0x180017a5c
cdqe
mov byte [rbp + rax - 0xd], bl
mov eax, dword [rbp + 0x33]
add eax, r15d
mov dword [rbp + 0x33], eax
cmp eax, 0x38
jl 0x180017a4d
jmp 0x180017a77
cdqe
mov byte [rbp + rax - 0xd], bl
mov eax, dword [rbp + 0x33]
add eax, r15d
mov dword [rbp + 0x33], eax
cmp eax, 0x38
jl 0x180017a63
mov ecx, dword [rbp - 0x11]
mov eax, ecx
shr eax, 0x18
mov byte [rbp + 0x2b], al
mov eax, ecx
shr eax, 0x10
mov byte [rbp + 0x2c], al
mov eax, ecx
shr eax, 8
mov byte [rbp + 0x2d], al
mov byte [rbp + 0x2e], cl
mov ecx, dword [rbp - 0x15]
mov eax, ecx
shr eax, 0x18
mov byte [rbp + 0x2f], al
mov eax, ecx
shr eax, 0x10
mov byte [rbp + 0x30], al
mov eax, ecx
shr eax, 8
mov byte [rbp + 0x32], cl
lea rcx, [rbp - 0x29]
mov byte [rbp + 0x31], al
call fcn.18001775c
mov dword [rbp + 0x37], r15d
lea r8, [rbp - 0x27]
mov al, byte [r8 + 1]
lea edx, [rbx*4]
lea ecx, [rdx + 1]
mov byte [rdx + r14], al
mov al, byte [r8]
add ebx, r15d
mov byte [rcx + r14], al
lea ecx, [rdx + 2]
mov al, byte [r8 - 1]
lea r8, [r8 + 4]
mov byte [rcx + r14], al
lea ecx, [rdx + 3]
mov al, byte [r8 - 6]
mov byte [rcx + r14], al
cmp ebx, 5
jb 0x180017ac4
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x180019fe4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
lea r9d, [r8 - 0x21524111]
mov r10, rdx
add r9d, edx
mov rbx, rcx
mov r11d, r9d
mov edi, r9d
cmp rdx, 0xc
jbe 0x18001a0fe
lea r8, [rdx - 0xd]
movabs rax, 0xaaaaaaaaaaaaaaab
mul r8
mov rsi, rdx
shr rsi, 3
inc rsi
imul rax, rsi, 0xfffffffffffffff4
add r10, rax
movzx eax, byte [rbx + 6]
movzx ecx, byte [rbx + 7]
movzx r8d, byte [rbx + 4]
movzx edx, byte [rbx + 8]
add r8d, r11d
shl ecx, 8
add edx, r9d
add ecx, eax
movzx eax, byte [rbx + 5]
shl ecx, 8
add ecx, eax
movzx eax, byte [rbx + 0xa]
shl ecx, 8
add r8d, ecx
movzx ecx, byte [rbx + 0xb]
shl ecx, 8
add ecx, eax
movzx eax, byte [rbx + 9]
shl ecx, 8
add ecx, eax
movzx eax, byte [rbx + 2]
shl ecx, 8
add edx, ecx
movzx ecx, byte [rbx + 3]
shl ecx, 8
mov r9d, edx
add ecx, eax
ror r9d, 0x1c
movzx eax, byte [rbx + 1]
shl ecx, 8
add ecx, eax
movzx eax, byte [rbx]
shl ecx, 8
add rbx, 0xc
add ecx, eax
sub ecx, edx
add edx, r8d
add ecx, edi
xor r9d, ecx
sub r8d, r9d
mov eax, r9d
add r9d, edx
ror eax, 0x1a
xor eax, r8d
sub edx, eax
mov ecx, eax
add eax, r9d
ror ecx, 0x18
xor ecx, edx
sub r9d, ecx
mov edi, ecx
add ecx, eax
ror edi, 0x10
xor edi, r9d
sub eax, edi
mov r11d, edi
ror r11d, 0xd
add edi, ecx
xor r11d, eax
sub ecx, r11d
mov r9d, r11d
ror r9d, 0x1c
add r11d, edi
xor r9d, ecx
sub rsi, 1
jne 0x18001a035
cmp r10, 6
ja 0x18001a142
je 0x18001a19f
test r10, r10
je 0x18001a224
sub r10, 1
je 0x18001a1cb
sub r10, 1
je 0x18001a1c2
sub r10, 1
je 0x18001a1b9
sub r10, 1
je 0x18001a1b0
cmp r10, 1
je 0x18001a1a9
jmp 0x18001a1d0
sub r10, 7
je 0x18001a195
sub r10, 1
je 0x18001a18b
sub r10, 1
je 0x18001a184
sub r10, 1
je 0x18001a17a
sub r10, 1
je 0x18001a170
cmp r10, 1
jne 0x18001a1d0
movzx eax, byte [rbx + 0xb]
shl eax, 0x18
add r9d, eax
movzx eax, byte [rbx + 0xa]
shl eax, 0x10
add r9d, eax
movzx eax, byte [rbx + 9]
shl eax, 8
add r9d, eax
movzx eax, byte [rbx + 8]
add r9d, eax
movzx eax, byte [rbx + 7]
shl eax, 0x18
add r11d, eax
movzx eax, byte [rbx + 6]
shl eax, 0x10
add r11d, eax
movzx eax, byte [rbx + 5]
shl eax, 8
add r11d, eax
movzx eax, byte [rbx + 4]
add r11d, eax
movzx eax, byte [rbx + 3]
shl eax, 0x18
add edi, eax
movzx eax, byte [rbx + 2]
shl eax, 0x10
add edi, eax
movzx eax, byte [rbx + 1]
shl eax, 8
add edi, eax
movzx eax, byte [rbx]
add edi, eax
xor r9d, r11d
mov eax, r11d
ror eax, 0x12
sub r9d, eax
mov eax, r9d
mov edx, r9d
ror eax, 0x15
xor edx, edi
sub edx, eax
xor r11d, edx
mov eax, edx
ror eax, 7
sub r11d, eax
xor r9d, r11d
mov eax, r11d
ror eax, 0x10
sub r9d, eax
mov eax, r9d
mov ecx, r9d
ror eax, 0x1c
xor ecx, edx
sub ecx, eax
xor r11d, ecx
mov eax, ecx
ror eax, 0x12
sub r11d, eax
mov eax, r11d
xor r9d, r11d
ror eax, 8
sub r9d, eax
mov rbx, qword [rsp + 8]
mov eax, r9d
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
Function at 0x18001b59c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
xor eax, eax
test eax, eax
je 0x18001b5ad
jmp 0x18001b5a5
mov rax, qword [rsp + 0x60]
mov eax, dword [rax + 0x3c]
add rax, qword [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax + 0xc], 0
je 0x18001b61b
xor eax, eax
test eax, eax
je 0x18001b60b
jmp 0x18001b603
mov rax, qword [rsp + 0x30]
add rax, 0x14
mov qword [rsp + 0x30], rax
jmp 0x18001b5f8
xor eax, eax
test eax, eax
je 0x18001b623
jmp 0x18001b61b
mov eax, dword [0x18002b0c8]
mov r8d, eax
mov rdx, qword [rsp + 0x28]
mov rcx, qword [0x18002b0c0]
call fcn.18000cae4
test eax, eax
je 0x18001b6f0
xor eax, eax
test eax, eax
je 0x18001b64d
jmp 0x18001b645
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x24], 0
mov eax, dword [0x18002b0c8]
lea r9, [rsp + 0x20]
mov r8d, 0x40
mov edx, eax
mov rcx, qword [rsp + 0x28]
mov rax, qword [0x18002b0d8]
call qword [rax + 0x1f8]
test eax, eax
jne 0x18001b695
xor eax, eax
test eax, eax
je 0x18001b68e
jmp 0x18001b686
mov eax, 0xffffffff
jmp 0x18001b6fa
mov eax, dword [0x18002b0c8]
mov r8d, eax
mov rdx, qword [0x18002b0c0]
mov rcx, qword [rsp + 0x28]
call fcn.18000c9dc
mov eax, dword [0x18002b0c8]
lea r9, [rsp + 0x24]
mov r8d, dword [rsp + 0x20]
mov edx, eax
mov rcx, qword [rsp + 0x28]
mov rax, qword [0x18002b0d8]
call qword [rax + 0x1f8]
test eax, eax
jne 0x18001b6e6
xor eax, eax
test eax, eax
je 0x18001b6df
jmp 0x18001b6d7
mov eax, 0xffffffff
jmp 0x18001b6fa
xor eax, eax
test eax, eax
je 0x18001b6ee
jmp 0x18001b6e6
jmp 0x18001b6f8
xor eax, eax
test eax, eax
je 0x18001b6f8
jmp 0x18001b6f0
xor eax, eax
add rsp, 0x58
ret
Function at 0x18001c234
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov r8d, 1
mov dword [rdx], ecx
mov dword [rdx + 0x9c0], r8d
movsxd rcx, r8d
mov eax, dword [rdx + rcx*4 - 4]
shr eax, 0x1e
xor eax, dword [rdx + rcx*4 - 4]
imul eax, eax, 0x6c078965
add eax, r8d
mov dword [rdx + rcx*4], eax
mov r8d, dword [rdx + 0x9c0]
inc r8d
mov dword [rdx + 0x9c0], r8d
cmp r8d, 0x270
jl 0x18001c243
ret

Function at 0x18001c278
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, dword [rcx + 0x9c0]
mov r8, rcx
cmp r9d, 0x270
jl 0x18001c33e
xor r9d, r9d
lea rbx, [0x180028040]
mov r10d, r9d
mov r11d, 0x7fffffff
mov edx, 0xe3
mov ecx, dword [r8 + r10*4]
xor ecx, dword [r8 + r10*4 + 4]
and ecx, r11d
xor ecx, dword [r8 + r10*4]
mov eax, ecx
shr ecx, 1
and eax, 1
xor ecx, dword [rbx + rax*4]
xor ecx, dword [r8 + r10*4 + 0x634]
mov dword [r8 + r10*4], ecx
inc r10
cmp r10, rdx
jl 0x18001c2ac
mov ecx, dword [r8 + rdx*4]
xor ecx, dword [r8 + rdx*4 + 4]
and ecx, r11d
xor ecx, dword [r8 + rdx*4]
mov eax, ecx
shr ecx, 1
and eax, 1
xor ecx, dword [rbx + rax*4]
xor ecx, dword [r8 + rdx*4 - 0x38c]
mov dword [r8 + rdx*4], ecx
inc rdx
cmp rdx, 0x26f
jl 0x18001c2da
mov eax, dword [r8 + 0x9bc]
mov edx, eax
xor edx, dword [r8]
and edx, r11d
xor edx, eax
mov eax, edx
shr edx, 1
and eax, 1
mov ecx, dword [rbx + rax*4]
xor ecx, dword [r8 + 0x630]
xor ecx, edx
mov dword [r8 + 0x9bc], ecx
mov dword [r8 + 0x9c0], r9d
mov rbx, qword [rsp + 8]
movsxd rax, r9d
mov ecx, dword [r8 + rax*4]
lea eax, [r9 + 1]
mov dword [r8 + 0x9c0], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
ret
Function at 0x18001f340
Capabilities:
Hash data with crc32

Disassembly:
mov r8d, ecx
lea r9, [0x180022cc0]
shr r8d, 8
movzx ecx, cl
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx edx, r8b
shr r8d, 8
xor r8d, dword [r9 + rdx*4]
mov eax, r8d
ret
Function at 0x1400051a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 7], dil
je 0x1400051d4
mov eax, edi
nop dword [rax]
lea ecx, [rax - 0xb]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x1400051c0
mov byte [r8 + 7], dil
lea rax, [r8 + 6]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x140005204
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x14000521e
mov qword [rsp + 0x30], 6
mov eax, dword [r8]
mov dword [rsp + 0x20], eax
movzx eax, word [r8 + 4]
mov word [rsp + 0x24], ax
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x14000522c
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140012dd0
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1400052a6
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400052a1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400052a1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140067bdc
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x1400052c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 9], dil
je 0x1400052f4
mov eax, edi
nop dword [rax]
lea ecx, [rax - 0xb]
xor byte [r8 + rax], cl
inc rax
cmp rax, 8
jb 0x1400052e0
mov byte [r8 + 9], dil
lea rax, [r8 + 8]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x140005324
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x140005335
mov qword [rsp + 0x30], 8
mov rax, qword [r8]
mov qword [rsp + 0x20], rax
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x140005343
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140012dd0
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1400053bd
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400053b8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400053b8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140067bdc
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x1400053d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rbx, rcx
mov qword [rbp - 0x10], rcx
xor r9d, r9d
cmp byte [r8 + 6], r9b
je 0x140005414
mov ecx, r9d
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0xb]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x140005400
mov byte [r8 + 6], r9b
lea rax, [r8 + 5]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], r9
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x14000543e
mov qword [rbp - 0x28], r9
mov byte [rbp - 0x38], r9b
jmp 0x140005454
mov qword [rbp - 0x28], 5
mov eax, dword [r8]
mov dword [rbp - 0x38], eax
movzx eax, byte [r8 + 4]
mov byte [rbp - 0x34], al
cmp byte [rdx + 0xa], 0
je 0x140005473
mov rcx, r9
nop dword [rax]
lea eax, [rcx - 0xb]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 9
jb 0x140005460
mov byte [rdx + 0xa], 0
lea rax, [rdx + 9]
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], r9
mov qword [rbp - 0x40], r9
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
cmp rdx, rax
jne 0x14000549d
mov qword [rbp - 0x48], r9
mov byte [rbp - 0x58], 0
jmp 0x1400054b5
mov qword [rbp - 0x48], 9
movsd xmm0, qword [rdx]
movsd qword [rbp - 0x58], xmm0
movzx eax, byte [rdx + 8]
mov byte [rbp - 0x50], al
lea r9, [rbp - 0x38]
lea r8, [rbp - 0x58]
movzx edx, byte [rbp - 0x60]
mov rcx, rbx
call fcn.14000b830
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x140005509
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005503
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005503
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140067bdc
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x140005547
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005542
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005542
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140067bdc
mov rax, rbx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rbp
ret
Function at 0x140005560
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 0xa], dil
je 0x140005594
mov eax, edi
nop dword [rax]
lea ecx, [rax - 0xb]
xor byte [r8 + rax], cl
inc rax
cmp rax, 9
jb 0x140005580
mov byte [r8 + 0xa], dil
lea rax, [r8 + 9]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x1400055c4
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x1400055e1
mov qword [rsp + 0x30], 9
movsd xmm0, qword [r8]
movsd qword [rsp + 0x20], xmm0
movzx eax, byte [r8 + 8]
mov byte [rsp + 0x28], al
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x1400055ef
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140012dd0
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140005669
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005664
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005664
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140067bdc
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x140005680
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rbx, rcx
mov qword [rbp - 0x10], rcx
xor r9d, r9d
cmp byte [r8 + 0xb], r9b
je 0x1400056c4
mov ecx, r9d
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0xb]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x1400056b0
mov byte [r8 + 0xb], r9b
lea rax, [r8 + 0xa]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], r9
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x1400056ee
mov qword [rbp - 0x28], r9
mov byte [rbp - 0x38], r9b
jmp 0x140005709
mov qword [rbp - 0x28], 0xa
movsd xmm0, qword [r8]
movsd qword [rbp - 0x38], xmm0
movzx eax, word [r8 + 8]
mov word [rbp - 0x30], ax
cmp byte [rdx + 0xb], 0
je 0x140005733
mov rcx, r9
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0xb]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x140005720
mov byte [rdx + 0xb], 0
lea rax, [rdx + 0xa]
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], r9
mov qword [rbp - 0x40], r9
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
cmp rdx, rax
jne 0x14000575d
mov qword [rbp - 0x48], r9
mov byte [rbp - 0x58], 0
jmp 0x140005776
mov qword [rbp - 0x48], 0xa
movsd xmm0, qword [rdx]
movsd qword [rbp - 0x58], xmm0
movzx eax, word [rdx + 8]
mov word [rbp - 0x50], ax
lea r9, [rbp - 0x38]
lea r8, [rbp - 0x58]
movzx edx, byte [rbp - 0x60]
mov rcx, rbx
call fcn.14000b830
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x1400057ca
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400057c4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400057c4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140067bdc
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x140005808
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005803
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005803
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140067bdc
mov rax, rbx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rbp
ret
Function at 0x140005820
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rbx, rcx
mov qword [rbp - 0x10], rcx
xor r9d, r9d
cmp byte [r8 + 0xc], r9b
je 0x140005864
mov ecx, r9d
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0xb]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xb
jb 0x140005850
mov byte [r8 + 0xc], r9b
lea rax, [r8 + 0xb]
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], r9
mov qword [rbp - 0x40], r9
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x14000588e
mov qword [rbp - 0x48], r9
mov byte [rbp - 0x58], r9b
jmp 0x1400058b1
mov qword [rbp - 0x48], ntohl
movsd xmm0, qword [r8]
movsd qword [rbp - 0x58], xmm0
movzx eax, word [r8 + 8]
mov word [rbp - 0x50], ax
movzx eax, byte [r8 + 0xa]
mov byte [rbp - 0x4e], al
cmp byte [rdx + 0xb], 0
je 0x1400058d3
mov rcx, r9
nop word [rax + rax]
lea eax, [rcx - 0xb]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x1400058c0
mov byte [rdx + 0xb], 0
lea rax, [rdx + 0xa]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], r9
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
cmp rdx, rax
jne 0x1400058fd
mov qword [rbp - 0x28], r9
mov byte [rbp - 0x38], 0
jmp 0x140005916
mov qword [rbp - 0x28], 0xa
movsd xmm0, qword [rdx]
movsd qword [rbp - 0x38], xmm0
movzx eax, word [rdx + 8]
mov word [rbp - 0x30], ax
lea r9, [rbp - 0x58]
lea r8, [rbp - 0x38]
movzx edx, byte [rbp - 0x60]
mov rcx, rbx
call fcn.14000b830
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x14000596a
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005964
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005964
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140067bdc
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x1400059a8
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400059a3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400059a3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140067bdc
mov rax, rbx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rbp
ret
Function at 0x1400059c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 0xc], dil
je 0x1400059f4
mov eax, edi
nop dword [rax]
lea ecx, [rax - 0xb]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0xb
jb 0x1400059e0
mov byte [r8 + 0xc], dil
lea rax, [r8 + 0xb]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x140005a24
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x140005a4b
mov qword [rsp + 0x30], ntohl
movsd xmm0, qword [r8]
movsd qword [rsp + 0x20], xmm0
movzx eax, word [r8 + 8]
mov word [rsp + 0x28], ax
movzx eax, byte [r8 + 0xa]
mov byte [rsp + 0x2a], al
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x140005a59
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140012dd0
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140005ad3
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005ace
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005ace
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140067bdc
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret

Function at 0x14000ca20
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0x10], al
je 0x14000ca43
lea edx, [rax - 0xb]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xf
jb 0x14000ca30
mov byte [rcx + 0x10], 0
lea r8, [rcx + 0xf]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.140004be0
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x14000df50
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x14000df73
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0xb]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x46
jb 0x14000df60
mov byte [rcx + 0x47], 0
mov rax, rcx
ret