joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1409f3c3c
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
rol edx, 1
mov qword [rsp + rsi - 0x77b75d04], rbx
sal qword [rsp + rbx - 4], 0xc5
xor edx, 0xe3abb4ae
sal esi, 0x7a
sbb edx, 0x89a6358c
bswap edx
mov ecx, 0x897940d
xor rcx, rax
dec edx
ror edx, 2
neg sil
pop rbx
lea rsi, [rax + rax*8 + 0x720ee4bf]
xor edx, 0x1fba9f8c
sal r10, cl
push rax
sar r10w, 0x65
bswap edx
setne r10b
not edx
jne 0x140a0caa6
mov ebx, 0x1a99ec3a
call fcn.140a652ef
shl esi, 0xdc
mov qword [r9 + rdx], r10
movsx r10d, si
jbe 0x140a624f4
mov r11d, 0xff3c9c0f
or edx, dword [rdx + r8]
lea rbx, [rsi*2 + 0x66a20633]
push rbx
mov ecx, ebx
lea r8, [r8 + rsi - 0x1ffffffc]
not rsi
movsx eax, r10b
xor edx, ebp
inc esi
xchg qword [rsp + r10*2], rsi
xor edx, 0x13815686
call fcn.140a0e82e
Function at 0x140a04a7c
Capabilities:
Authenticate hmac

Disassembly:
xor dword [rsp + r10 - 0x11f7b846], r9d
mov rbp, qword [rsp + r10*2 - 0x23ef709c]
lea rax, [r10 + r8*4 + 0x3f8557af]
sal r8w, 0x4d
sbb byte [rsp + r10*2 - 0x23ef70a0], 0x9f
movsxd r9, r9d
add word [rsp + r10 - 0x11f7b850], dx
xchg cl, r10b
adc word [rsp + r8 - 0x1ff4], r8w
adc r11, r9
neg dl
mov rbx, qword [rsi + r10*4 - 0x47dee165]
lea rsi, [rsi + r8 - 0x200d]
mov qword [rsp + r8 - 0x1ff0], 0x1fb46d1c
sar qword [rsp + r10*2 - 0x23ef70a2], cl
xchg word [rsp + r10 - 0x11f7b855], ax
xor rbx, rbp
inc rbx
xchg word [rsp + r10 - 0x11f7b848], cx
shl byte [rsp + r10 - 0x11f7b844], 0xc7
neg rbx
or rdx, rdx
bswap rbx
ja 0x140a618aa
mov rbp, qword [rsp + r8*4 - 0x214]
mov dword [rsp + r9 - 0x368dd9ba], r8d
push rcx
ror r8b, 0x25
movsxd rbx, ebx
lea rax, [r9*4 - 0x40e2ddd4]
sar rdx, cl
mov qword [rsp + r8*2 - 0x80], 0xffffffffcb963b28
add r11, rbx
not r10b
add byte [rsp + r8 - 0x3c], 0x16
mov ebx, dword [r8 + rdi - 0x4c]
or r10w, word [rsp + r8*2 - 0x85]
add ecx, eax
lea rdi, [r9 + rdi - 0x368dd9b7]
lea rsi, [rsi + r9*2 - 0x6d1bb377]
xadd r9, r10
shr byte [rsp + r9*2 - 0x6d9f6810], 0x41
xadd dword [rsp + r9*2 - 0x6d9f67fa], ecx
movzx eax, byte [rsi + r9*2 - 0x6d9f6816]
xor al, bpl
sar dword [rsp + r8*2 - 0x89], cl
call fcn.140a5524f
neg r9d
mov qword [rsp + r10*2 - 0x23ef709c], rbp
dec ax
mov qword [rsp + r10 - 0x11f7b856], r8
jge 0x1409d777c
mov qword [rdi + r10 - 0x11f7b856], rbx
sar byte [rsp + r10 - 0x11f7b848], 7
shr qword [rsp + r10 - 0x11f7b852], cl
mov qword [rsp + r10*2 - 0x23ef70ac], r11
ret 8
dec rdx
shl r8b, 0xa7
ror rbx, 5
inc r8b
pop r8
inc rbx
xor rbp, rbx
xor dword [rsp + r10 - 0x11f7b850], r8d
jge 0x140a44a95
jb 0x1409e219e
rol r10d, cl
sbb r8d, 0xd61a9aa3
movsx eax, bx
not r8d
lea r8d, [r8 + rbx + 0x23ee4997]
push rbp
neg cx
xor dword [rsp + r10 - 0x78000], r8d
rol bx, 0xc
pop rbp
sar r10d, cl
movsxd r8, r8d
add r11, r8
movzx r9d, bl
sub r9, 0xffffffffb682873e
mov rbx, qword [r10 + rdi - 3]
mov r9, qword gs:[rbx + r10 - 3]
mov qword [r10 + rdi - 3], r9
jmp r11

Function at 0x140a08d10
Capabilities:
Authenticate hmac

Disassembly:
movsx ecx, al
lea r9d, [rdx + r9 - 0x2a180807]
mov qword [rsp + rcx], rcx
xor r9d, 0xc8b10d15
movsx r8d, al
xchg qword [rsp + rax + 0x5ff00018], rdx
inc r9d
and edx, edx
and dword [rsp + rax + 0x5ff00013], edx
inc rdx
not r9d
movzx ebx, byte [rsp + rcx]
call fcn.140a6ed4a

Function at 0x140a0cb37
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov qword [rsp + rbx - 0x43911df1], 0xffffffffe9abb402
movsxd r9, r9d
mov qword [rsp + rbx - 0x43911de9], rcx
setae byte [rsp + rbx - 0x43911def]
jae 0x140a559c0
push rbp
neg rbx
xor dword [rsp + r11 + 0x4af36c55], esi
inc r11
mov eax, 0x982e68be
sub r11d, ecx
pop rbp
neg dx
jae 0x140a2e01f
Function at 0x140a117e4
Capabilities:
Authenticate hmac

Disassembly:
add dword [rsp + rsi*8 + 0x19], r10d
ror dl, 1
sub byte [rsp + rsi + 0x25], r10b
push r11
add dl, 0x21
movsx eax, bl
ror word [rsp + rsi*2 + 5], 0x2d
xor dl, 0x2a
pop r10
neg byte [rsp + rsi*8 + 0x2c]
and rax, qword [rsp + rsi*2 + 0x23]
rol dl, 1
add dl, bl
rol dl, 1
add dl, 0x98
not r11
mov qword [rsp + rsi*2], r11
xor bpl, dl
push rbx
sal dword [rsp + rsi + 0x33], 0xcd
lea rdx, [rsp + rdx + 0x38]
adc r10w, 0x416
mov rbx, qword [rdx + rsi*2]
call fcn.1409bbe91

Function at 0x140a12e53
Capabilities:
Encode data using base64

Disassembly:
not al
lea r9, [rbx + r10 - 0x4047bce4]
jbe 0x140a3c957
mov ecx, 0x251fed91
mov eax, 0xe0b4e1ac
dec al
lea rsi, [rsi + rcx*2 - 0x4a3fdb26]
movsx edx, ax
mov eax, dword [rsi + rcx*2 - 0x4a3fdb22]
xor eax, ebp
not dx
call fcn.140a2015c
mov ecx, 0x182ee814
ror cx, 0xcc
mov r8d, dword [rdi + rcx - 0x182e814e]
mov edx, dword [rdi + rcx*2 - 0x305d0298]
push rcx
jb 0x1409f2f16
lea rbx, [rcx + rcx + 0x7a85901d]
add r8d, edx
mov dword [rdi + rcx - 0x182e814a], r8d
call fcn.1409e2471
lea r10, [rbx*2 - 0x206f7def]
xor al, bpl
mov qword [rsp + rbx*8 - 0x2b8], r10
ror al, 1
xadd dword [rsp + rbx*8 - 0x2b6], ebx
sbb al, 0xa2
add r10w, 0xba0e
jle 0x1409c61e4
add al, 0x91
jmp 0x140a2f37b

Function at 0x140a22053
Capabilities:
Encode data using base64

Disassembly:
not r9
pop r10
xor eax, ebp
inc eax
xor eax, 0x53a29a21
sar cx, 0xaf
setp cl
not ebx
rol eax, 2
or r9, 0xffffffffb412aebb
shr bl, 0x25
not cx
bswap eax
mov edx, r8d
add r9, rcx
xchg r9d, r8d
push rbp
movzx r10d, dl
xor dword [rsp + r9 - 0x2a], eax
dec r8w
shl rdx, cl
pop rbp
xadd dx, r8w
neg r9b
movsxd rax, eax
jno 0x140a27def

Function at 0x140a22f2e
Capabilities:
Encrypt data using chaskey

Disassembly:
mov si, word [r9]
call fcn.1409ac1ed

Function at 0x140a37147
Capabilities:
Encode data using base64

Disassembly:
and r8w, r9w
not r8w
mov word [rdx + rdi - 0x8717], r8w
lea rdi, [rdi + rdx - 0x8717]
shl byte [rsp + rdx - 0x871a], 0xa3
sar byte [rsp + rdx - 0x871d], 0xc6
mov qword [rsp + rdx*2 - 0x10e3a], r11
ret
add al, 7
mov qword [rsp + rcx], rbx
shl rbx, 0xbe
call fcn.140a1a93e
shr r8d, 0x53
pop rbp
mov edx, r10d
movsxd r9, r9d
je 0x140997084
xor rcx, rcx
adc r11, r9
or dx, ax
mov r9d, 0x8d8786b5
mov dx, word [rdi + rcx*8]
mov ax, word [rcx + rdi + 2]
xadd r10d, r8d
shr r8w, 9
dec r9w
or dx, ax
not dx
push r9
xchg r8w, r10w
push r10
add cx, dx
mov r9w, word [rdi + 4]
not cx
not r9w
movzx edx, r8w
and cx, r9w
xchg byte [rsp + rdx*2 - 0x1e230], dh
pop r8
mov r8w, cx
movzx ecx, dl
lea r9, [rdx + rcx*8 + 0x40810720]
sal byte [rsp + rdx*2 - 0x10e37], 0xc2
mov r9w, word [rdi + rdx - 0x8717]
jae 0x1409ab333

Function at 0x140a3e00c
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
sal cl, 0xa5
adc rdi, rdx
shl cl, 0x44
jae 0x140a20862
Function at 0x140a436d5
Capabilities:
Encode data using base64

Disassembly:
and qword [rsp + rdx - 0x540f9], 0xffffffff91ae8984
xor rbp, r10
jmp 0x1409c53e9
sub ecx, eax
rol r10, 4
mov qword [rsp + rdx*2 - 0xa8202], 0xffffffffab263d88
xor r10, 0xffffffff85340b30
lea r10, [r10 + rdx + 0x2fd454f9]
ror dword [rsp + rdx*2 - 0xa81f7], cl
rol r10, 7
jmp 0x140a1727a

Function at 0x140a496a0
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
sub rsi, 4
call fcn.1409dfe3c
mov ecx, 0xee203dab
sub rsi, 4
lea rdx, [rcx + rcx*2 + 0x25908fb3]
movsx eax, cl
mov r8d, dword [rsi]
dec ax
xor r8d, ebp
add ecx, 0xed058818
neg r8d
shr ecx, cl
mov r9d, 0x1b3b49a6
inc r8d
xor r8d, 0x243c5191
sar rdx, 0x2f
dec r8d
jmp 0x140a1d579
mov r10d, 0x9e2ad7a6
mov dword [rdi + 8], ebx
or r8d, r10d
mov dword [rdi + 4], ecx
add r10b, 0xa0
movsx eax, r10w
mov dword [rdi], edx
movsx ecx, ax
lea r9, [rax*2 - 0x3d5ac755]
jbe 0x1409bbe11
lea rax, [rsp + rax + 0x20]
not r11
mov word [rax + rdx*8 - 0x4f8], r10w
mov eax, esi
call fcn.140a66c7f
not r8d
push rbp
xor dword [rsp + rcx - 0x1b64b8b8], r8d
call fcn.140a414db
xor bp, ax
jmp 0x1409e64bd
dec r8d
sub ax, 0x3214
bswap r8d
not r8d
bswap r8d
pop r10
call fcn.140a4e567
mov edx, 0x6f20a631
sub dx, dx
mov eax, dword [rdi + rdx - 0x6f200000]
movzx r8d, dx
cpuid
lea rdi, [rdi + r8*4 - 0xc]
mov dword [rdi + r8 + 0xc], eax
not r8d
jp 0x1409d4851
ror ax, 1
shl word [rsp + 3], 0xe3
movzx edx, sil
dec ax
inc rdx
xchg r11d, esi
push rdx
xor ax, 0x758e
jmp 0x140a38b3f

Function at 0x140a49aa5
Capabilities:
Authenticate hmac

Disassembly:
mov dword [rdi - 8], ebx
pop rax
mov dword [rax + rdi - 0xa79d], ecx
mov dword [rdi + rax - 0xa7a1], edx
shr dword [rsp + rax*4 - 0x29e42], 0x6c
lea rdi, [rdi + rax - 0xa7a1]
or r8, r9
jle 0x1409af638
shr r9w, 0x44
mov r8d, dword [rsi + rax*2 - 0x14f27]
lea rsi, [rsi + rax*8 - 0x53c8d]
xor r8d, ebp
bswap r8d
or byte [rsp + rax*2 - 0x14f1e], ah
inc r8d
call fcn.140a27a9f
lea r8, [r8 + rsi - 0xe316]
lea rbx, [rsi + rsi*8 + 0x532390a1]
lea rcx, [rsi + rsi - 0x6a670fe3]
dec esi
xor r11d, ebp
xor r10b, r10b
movzx edx, r10b
cmovl r10w, bx
xor r11d, 0x7b0f0a3d
sal r10b, 0xa3
xadd esi, edx
inc r11d
bswap rbx
dec dl
rol r11d, 1
movzx eax, si
xchg esi, edx
lea r11d, [r11 + rdx*4 + 0x4126874a]
shl ax, 0xb
neg r11d
call fcn.140a61ca2
and word [rsp + rcx - 0xa791], dx
push rcx
mov eax, dword [r9 + rax*2 - 0x14f22]
not ecx
lea r9, [rcx + rcx*4 - 0x54ea1280]
sal cl, 0x44
cpuid
mov word [rsp + 0xa], 0xb136
movsx r10d, r9w
mov dword [rdi - 4], eax
jae 0x1409b1175
mov r10d, 0x8d3fe31a
mov r11d, dword [r8]
movzx esi, r10w
jmp 0x1409d21c5
mov qword [rsp + r8 - 0xa791], 0x2f32a83e
add r9b, 0x36
rol r9b, 1
lea rcx, [rdx*4 - 0x45e84fe1]
neg r9b
xor bpl, r9b
xchg r8, rcx
lea r9, [rsp + r9 + 8]
jmp 0x140a23f2d
Function at 0x140a4b260
Capabilities:
Encode data using base64

Disassembly:
jg 0x140a5b753
mov qword [rsp + rax*4], rbp
sbb esi, eax
xor dword [rsp + rax*2], ecx
pop rbp
call fcn.140a30ffe
add rdi, r10
dec rcx
jns 0x140a576c2
pop rbx
add rbx, 0xfffffffffffb9842
jmp rbx
mov ecx, dword [r8 + rax]
lea r8, [rax + r8 + 4]
movsx edx, al
mov qword [rsp + rax*2], rsi
movzx r10d, word [rsp + rax + 3]
xor ecx, ebp
dec ecx
xchg dword [rsp + rax*2 + 3], edx
movzx ebx, word [rsp + rax*2 + 4]
not ecx
dec ecx
xor ecx, 0xdbae550f
or dl, 0x1b
ja 0x140a301d8
mov ecx, 0x30202ab1
movsx edx, cx
or ecx, edx
mov dx, word [r9 + rcx - 0x30202ab1]
jae 0x1409e17b0
movzx r11d, byte [rbx + r8 - 0x470b909f]
and ax, bx
lea r8, [r8 + rax*2 - 0x12141]
xor r11b, bpl
or al, 0xb
call fcn.140a20979

Function at 0x140a4e69e
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
rep movsb byte [rdi], byte [rsi]
push qword [rsp + 8]
popfq
call fcn.140a2805e
movzx si, byte [r9]
mov edx, 0x88345d02
movsx ebx, dx
lea r10, [rdx + rbx*4 - 0x7a7ca6e2]
mov cl, byte [r9 + rbx*8 - 0x2e80e]
lea r9, [r9 + r10*8 - 0x6dc9513e]
call fcn.140a45f79
mov rax, qword [rdi]
call fcn.140a0aae2
lea r10, [rcx*8 + 0x1065daf]
xor rbp, r11
lea rax, [rsi*2 - 0x7d560bee]
call fcn.140a2ad75
mov qword [rsp + 8], rdi
pushfq
pop rdi
mov qword [rsp], rdi
jmp 0x140a4f4c4
mov rsi, rbx
mov edi, 0xd023de8d
not dil
mov rdi, rax
push 0x2b37e6af
neg qword [rsp]
cld
jmp 0x1409bc084

Function at 0x140a5640a
Capabilities:
Encode data using base64

Disassembly:
jge 0x1409c8399
mov edx, dword [r9]
mov esi, 0x7921642e
movzx r11d, sil
movsx ebx, r11w
mov r10d, dword [r9 + r11*4 - 0xb4]
lea r11, [rbx*8 + 0x3a843cbb]
sal r11, 0xb8
and edx, r10d
not edx
movsx eax, sil
shl r11, 0x7a
call fcn.1409cb9e5
movsxd rbx, ebx
add rdi, rbx
mov qword [rsp + rsi - 0x73538000], rdi
ret 8
neg ebx
mov qword [rsp + r11 - 0x83], rcx
xor word [rsp + r11*4 - 0x20c], cx
mov edx, 0xe2af1eb8
bswap ebx
jns 0x1409c15d3

Function at 0x140a60eb5
Capabilities:
Encode data using base64

Disassembly:
test ebx, ebx
lea rsp, [rsp + 8]
je 0x140a1376e

Function at 0x140a61fde
Capabilities:
Encode data using base64

Disassembly:
adc cl, 0x21
not dl
xor cl, 0x2a
bswap rbx
and r11d, 0x4e9139a2
rol cl, 1
movzx eax, bl
jmp 0x140a55d02
mov qword [rsp + rbx*4], r11
xor sil, 0x22
xor sil, dl
ror sil, 1
neg cx
xor bpl, sil
sar bx, 0x26
rol bx, 0xa9
shl qword [rsp + rbx], 0x7e
lea rsi, [rsp + rsi + 8]
or qword [rsp + rbx*2], r10
mov dword [rsi + rbx*2], eax
setb dl
pop rdx
or bl, 0x3d
movzx ecx, byte [r8 + rbx - 0x38]
lea r8, [r8 + rdx*8 + 6]
xor cl, bpl
sal r11b, 0x23
ror cl, 1
or ebx, 0x9123393c
jae 0x140a541d4
mov edx, r8d
mov r10d, r8d
mov word [rdi], bx
mov r9d, 0x34a1d515
and rdx, 0xffffffffb7318493
lea rsi, [rsi + r9 - 0x34a1d519]
mov r10d, dword [r9 + rsi - 0x34a1d515]
movzx ebx, r9b
not r9b
setb r8b
xor r10d, ebp
ror r10d, 1
call fcn.1409a74cf
Function at 0x140a6581d
Capabilities:
Encode data using base64

Disassembly:
mov rax, qword [rcx + r9 - 0x2988d2b4]
movzx esi, dx
mov ecx, dword [r9 + rcx - 0x2988d2ac]
shl esi, 0x8b
movsx r11d, dl
mov dword [rsi + rax - 0x2d98800], ecx
mov ecx, dword [r9 + rsi - 0x2d987f4]
push r11
movzx esi, byte [r8 + rsi - 0x2d98800]
xor sil, bpl
add sil, 0x93
movzx r10d, r11b
add dword [rsp + r11 - 0x2f], edx
rol sil, 1
jmp 0x140a43eb4
not r10b
sal r8b, 0x87
sub rcx, rax
sal al, 0x65
sub r10b, 0x3f
or cx, 0xb923
js 0x1409ce31e
xor eax, ebp
ror word [rsp + rcx - 0x60aa9e2b], 0xb
rol eax, 3
xchg rcx, rbx
call fcn.140995bb7
mov esi, 0x2fb8360c
xor cl, bpl
lea rdx, [rsi + rsi*2 + 0x6193c334]
mov r11d, 0xcd01e183
movsx r10d, r11w
neg cl
push rsi
lea rax, [r11*8 - 0x575e87c6]
inc cl
shl r10b, 0x63
sub byte [rsp + rsi - 0x2fb83607], dh
push r11
rol cl, 1
and r11d, dword [rsp + rsi - 0x2fb8360b]
or byte [rsp + r11 - 0x10181], 0xb4
xor cl, 0xa7
xor bpl, cl
shl qword [rsp + rsi - 0x2fb83604], 0x9c
jns 0x140a23b12
add ecx, ecx
rol rbx, 0xf2
xor r10b, 0x9d
or dx, bx
jp 0x1409c254c
lea rcx, [rsp + rcx + 0x10]
call fcn.140997350
jmp 0x1409df5ed
call fcn.1409e0b6c
mov ecx, 0x2988d2b4
lea rdx, [rcx*8 - 0x62f73a6f]
jmp 0x1409ad080
xor r10d, 0xa597a809
or rax, qword [rsp + rcx*4 - 0x408]
mov qword [rsp + rcx - 0x104], rcx
bswap r10d
push rcx
mov esi, r11d
mov qword [rsp + rcx*2 - 0x1f8], rbp
jns 0x140a58999
mov rbp, qword [rsp + rbx - 0x7c90]
movsxd rcx, ecx
push rdx
lea r10, [rbx + rbx + 0x4424e330]
add rdi, rcx
not word [rsp + r10 - 0x4425dc5b]
movzx r11d, al
movzx eax, byte [r10 + r8 - 0x4425dc6c]
push rdx
add bl, dh
call fcn.140a0231a
mov eax, dword [rax + r8 - 0x60aa9e2d]
jmp 0x140a03ab3

Function at 0x140a68b68
Capabilities:
Encode data using base64

Disassembly:
dec ebx
lea rsp, [rsp + 8]
jne 0x140a60ec2
mov eax, 0xb3b42db6
mov rax, qword [rbp + riz]
sub rsp, 0x20
jmp 0x140a2066d
call fcn.140a292de
rol eax, 3
lea rdx, [rsi + rsi*4 + 0x1a05059e]
add edx, esi
xor eax, 0xb0a45ea2
inc eax
lea rbx, [r10*8 - 0x65c04e64]
pop rbx
jmp 0x140a42eda
push 0x38a66e8d
lea rsp, [rsp + 8]
call rax
mov edi, 0xaea2822a
and di, di
mov rsp, qword [rbp + riz - 0x10]
movzx r8d, di
mov r11d, edi
mov rbp, qword [rbp + r8*2 - 0x1045c]
cmovp r11d, r8d
mov qword [r8 + rbp - 0x822a], rax
mov rdi, rbp
lea rdx, [r11 + r8 - 0x765c68e0]
movzx r10d, r11w
pop rbp
or r8w, 0x4d8e
jae 0x140a4a7c8
mov r8d, 0xf70f3dba
pop r11
js 0x140a1cf93
mov eax, 0x871f1887
jmp 0x140a11775
jmp 0x140a13761
Function at 0x140a70160
Capabilities:
Encode data using base64

Disassembly:
sub rax, rcx
pop rbp
jle 0x1409bdf49
ror r11d, 1
call fcn.1409f453a
lea edx, [rdx + rbx + 0xb85c90c]
xor edx, 0xc8b10d15
mov ecx, dword [rsp + r10*4 - 0xee000ad]
pop r8
call fcn.140a2df08
mov rax, qword [r9]
mov r10d, 0x19b5b25
xor r10d, r10d
mov cl, byte [r9 + r10*8 + 8]
adc r10w, r10w
lea r9, [r9 + r10 + 2]
ror r10d, 0x88
shl rax, cl
movzx ebx, r10w
mov esi, r10d
lea rbx, [r10*8 - 0x1ed08c5]
mov qword [r9 + r10*8], rax
movsx eax, si
mov r11d, dword [r10 + r8]
lea r8, [r8 + r10 + 4]
xor r11d, ebp
dec r11d
rol r11d, 3
or si, r10w
xor r11d, 0xb0a45ea2
inc r11d
push rbp
movzx ecx, bl
shl esi, 0x8f
movsx ebp, cl
xor dword [rsp + r10*4], r11d
jmp 0x140a12e25
Function at 0x180004470
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x180004493
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 9]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x46
jb 0x180004480
mov byte [rcx + 0x47], 0
mov rax, rcx
ret

Function at 0x1800044a0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 6], sil
je 0x1800044d4
mov ecx, esi
lea eax, [rcx - 9]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x1800044c0
mov byte [r8 + 6], sil
lea rax, [r8 + 5]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], sil
cmp r9, rax
je 0x180004509
mov r8d, 5
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.180007b10
nop
cmp byte [rbx + 0xa], 0
je 0x180004533
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 9]
xor byte [rcx + rbx], al
inc rcx
cmp rcx, 9
jb 0x180004520
mov byte [rbx + 0xa], 0
lea rax, [rbx + 9]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x180004568
mov r8d, 9
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.180007b10
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
movzx edx, byte [rsp + 0x20]
mov rcx, rdi
call fcn.180009d50
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x1800045c1
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800045bb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800045bb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800d1d78
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x180004601
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800045fc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800045fc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800d1d78
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x180004610
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x180004644
mov eax, esi
lea ecx, [rax - 9]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x180004630
mov byte [r8 + 7], sil
lea rax, [r8 + 6]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], sil
cmp r9, rax
je 0x180004679
mov r8d, 6
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.180007b10
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x180004687
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.18000ae60
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x1800046fe
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800046f9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800046f9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800d1d78
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x180004710
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x180004744
mov eax, esi
lea ecx, [rax - 9]
xor byte [r8 + rax], cl
inc rax
cmp rax, 9
jb 0x180004730
mov byte [r8 + 0xa], sil
lea rax, [r8 + 9]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], sil
cmp r9, rax
je 0x180004779
mov r8d, 9
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.180007b10
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x180004787
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.18000ae60
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x1800047fe
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800047f9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800047f9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800d1d78
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x180004810
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x136], 0
je 0x180004838
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 9]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x135
jb 0x180004820
mov byte [rcx + 0x136], 0
mov rax, rcx
ret
Function at 0x1800053c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 0xb], sil
je 0x1800053f4
mov ecx, esi
lea eax, [rcx - 9]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x1800053e0
mov byte [r8 + 0xb], sil
lea rax, [r8 + 0xa]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], sil
cmp r9, rax
je 0x180005429
mov r8d, 0xa
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.180007b10
nop
cmp byte [rbx + 0xb], 0
je 0x180005453
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 9]
xor byte [rcx + rbx], al
inc rcx
cmp rcx, 0xa
jb 0x180005440
mov byte [rbx + 0xb], 0
lea rax, [rbx + 0xa]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x180005488
mov r8d, 0xa
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.180007b10
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
movzx edx, byte [rsp + 0x20]
mov rcx, rdi
call fcn.180009d50
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x1800054e1
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800054db
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800054db
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800d1d78
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x180005521
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000551c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000551c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800d1d78
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x180005530
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x180005564
mov eax, esi
lea ecx, [rax - 9]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0xb
jb 0x180005550
mov byte [r8 + 0xc], sil
lea rax, [r8 + 0xb]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], sil
cmp r9, rax
je 0x180005599
mov r8d, listen
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.180007b10
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1800055a7
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.18000ae60
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x18000561e
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005619
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180005619
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800d1d78
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret