joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001000
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
cmp byte [reloc.WLDAP32.dll_Ordinal_60], 0
movsd xmm0, qword [0x14008ded8]
mov eax, dword [0x14008dee0]
movsd qword [rsp + 0x20], xmm0
mov dword [rsp + 0x28], eax
je 0x14000119f
xor ecx, ecx
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x140001157
movdqa xmm2, xmmword [0x14008e3f0]
mov eax, 5
movdqa xmm3, xmmword [0x14008e400]
movdqa xmm1, xmm2
movdqa xmm4, xmmword [0x14008e490]
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
mov ecx, 8
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
movaps xmmword [rsp + 0x30], xmm6
movd xmm6, eax
mov eax, Ordinal_33
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
movd xmm5, eax
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x14008e410]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [0x14008ded8]
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
pand xmm2, xmmword [0x14008e470]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.1111111111111111]
pxor xmm2, xmm0
punpckldq xmm1, xmm3
movd dword [rsp + 0x20], xmm2
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movaps xmm6, xmmword [rsp + 0x30]
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x14008e410]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [rsp + 0x24]
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x14008e470]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.1111111111111111]
pxor xmm2, xmm0
movd dword [rsp + 0x24], xmm2
movsxd rax, ecx
lea r8, [rsp + 0x20]
add r8, rax
nop dword [rax]
nop word [rax + rax]
mov eax, 0x8fb823ef
lea r8, [r8 + 1]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x39
movzx eax, cl
inc ecx
sub al, dl
add al, 0x31
xor byte [r8 - 1], al
cmp ecx, 0xc
jl 0x140001170
lea rax, [rsp + 0x20]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400011b0
lea rdx, [rsp + 0x20]
lea rcx, [0x14009c330]
call fcn.14000c690
lea rcx, [0x14007cdf0]
add rsp, 0x48
jmp fcn.140079fa4
Function at 0x1400034e0
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push rbx
push rdi
push r12
push r14
sub rsp, 0x68
mov rax, qword [0x14009b080]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rdi, qword [r8]
xor r12d, r12d
mov qword [rsp + 0x28], rcx
mov r14, rdx
mov rbx, rcx
test rdi, rdi
jne 0x140003532
xorps xmm0, xmm0
lea rdx, [0x14008c5eb]
movups xmmword [rcx], xmm0
xor r8d, r8d
mov qword [rcx + 0x10], r12
mov qword [rcx + 0x18], r12
call fcn.14000c690
jmp 0x14000368f
mov qword [rsp + 0x98], rbp
mov rcx, rdi
mov qword [rsp + 0xa8], rsi
mov rsi, r12
mov qword [rsp + 0x60], r15
and ecx, 3
jne 0x140003565
cmp byte [rdi + rdx - 1], 0x3d
lea rax, [rdi + rdx]
je 0x140003569
mov rbp, r12
mov r15, r12
jmp 0x140003582
lea rax, [rdx + rdi]
mov ebp, 1
cmp rcx, 2
ja 0x14000357f
cmp byte [rax - 2], 0x3d
jne 0x14000357f
mov r15, r12
jmp 0x140003582
mov r15, rbp
sub rdi, rbp
lea rcx, [rsp + 0x30]
and rdi, 0xfffffffffffffffc
mov rdx, rdi
shr rdx, 2
lea rax, [r15 + rdx*2]
add rdx, rax
add rdx, rbp
call fcn.1400097a0
cmp qword [rsp + 0x48], 0x10
lea r9, [rsp + 0x30]
lea r10, [0x14008dfa0]
cmovae r9, qword [rsp + 0x30]
test rdi, rdi
je 0x140003623
lea rdx, [rdi - 1]
shr rdx, 2
lea r8, [r14 + 2]
inc rdx
movzx eax, byte [r8 - 2]
lea r8, [r8 + 4]
mov ecx, dword [r10 + rax*4]
movzx eax, byte [r8 - 5]
shl ecx, 6
or ecx, dword [r10 + rax*4]
movzx eax, byte [r8 - 4]
shl ecx, 6
or ecx, dword [r10 + rax*4]
movzx eax, byte [r8 - 3]
shl ecx, 6
or ecx, dword [r10 + rax*4]
mov eax, ecx
sar eax, 0x10
mov byte [r9 + rsi], al
mov eax, ecx
sar eax, 8
mov byte [r9 + rsi + 1], al
mov byte [r9 + rsi + 2], cl
add rsi, 3
sub rdx, 1
jne 0x1400035d0
test rbp, rbp
mov rbp, qword [rsp + 0x98]
je 0x140003671
movzx eax, byte [rdi + r14]
movzx ecx, byte [rdi + r14 + 1]
mov edx, dword [r10 + rax*4]
shl edx, 6
or edx, dword [r10 + rcx*4]
shl edx, 0xc
mov eax, edx
sar eax, 0x10
mov byte [r9 + rsi], al
test r15, r15
je 0x140003671
movzx eax, byte [rdi + r14 + 2]
sar edx, 8
mov ecx, dword [r10 + rax*4]
shl ecx, 6
sar ecx, 8
or dl, cl
mov byte [r9 + rsi + 1], dl
movups xmm0, xmmword [rsp + 0x30]
mov r15, qword [rsp + 0x60]
movups xmm1, xmmword [rsp + 0x40]
mov rsi, qword [rsp + 0xa8]
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm1
mov rax, rbx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140079d10
add rsp, 0x68
pop r14
pop r12
pop rdi
pop rbx
ret
Function at 0x1400077e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rsi
push rdi
push r12
push r13
push r14
push r15
mov r14, qword [rsp + 0x58]
xor r15d, r15d
mov r11, qword [rsp + 0x70]
mov r13, rdx
mov rax, qword [rsp + 0x60]
mov qword [r14], r8
mov qword [r11], rax
mov rdi, qword [r14]
cmp rdi, r9
je 0x140007973
mov r12, qword [rsp + 0x68]
lea r8d, [r15 + 1]
mov rsi, qword [r11]
mov r9d, 0x3ff
mov r10d, 0x2400
mov ebx, 0x2800
cmp rsi, r12
je 0x140007973
movzx edx, word [r13]
xor bpl, bpl
movzx ecx, word [rdi]
cmp r8w, dx
jae 0x140007879
lea eax, [r10 + rcx]
cmp ax, r9w
ja 0x140007997
mov eax, edx
sub ecx, 0xdc00
shl eax, 0xa
or eax, ecx
jmp 0x14000788f
mov eax, ecx
add cx, bx
cmp cx, r9w
ja 0x14000788f
shl eax, 0xa
mov bpl, 1
sub eax, 0x35f0000
cmp eax, 0x80
jae 0x1400078a2
movzx r9d, al
mov r10d, r15d
mov ebx, r15d
jmp 0x1400078ed
mov r9d, eax
cmp eax, 0x800
jae 0x1400078bc
shr r9d, 6
mov r10d, r8d
or r9b, 0xc0
mov ebx, r8d
jmp 0x1400078ed
cmp eax, 0x10000
jae 0x1400078d6
shr r9d, 0xc
mov r10d, 2
or r9b, 0xe0
mov ebx, r10d
jmp 0x1400078ed
shr r9d, 0x12
mov r10d, 3
movzx ebx, bpl
or r9b, 0xf0
xor ebx, 1
add ebx, ebx
lea r8d, [rbx + 1]
mov rdx, r12
sub rdx, rsi
mov ecx, r8d
cmp rdx, rcx
jl 0x140007973
lea rcx, [rdi + 2]
mov qword [r14], rcx
test bpl, bpl
jne 0x140007911
cmp r10d, 3
jae 0x14000791d
mov rcx, qword [r11]
mov r8d, ebx
mov byte [rcx], r9b
inc qword [r11]
mov r9, qword [r11]
test r8d, r8d
jle 0x14000794e
lea ecx, [r10 + r10*2]
add ecx, ecx
nop dword [rax + rax]
sub ecx, 6
mov edx, eax
shr edx, cl
dec r8d
and dl, 0x3f
or dl, 0x80
mov byte [r9], dl
inc qword [r11]
mov r9, qword [r11]
test r8d, r8d
jg 0x140007930
shr eax, 0xa
mov r8d, 1
test bpl, bpl
mov ecx, r8d
cmovne ecx, eax
mov word [r13], cx
mov rdi, qword [r14]
cmp rdi, qword [rsp + 0x50]
jne 0x14000782e
mov rax, qword [rsp + 0x48]
cmp rax, qword [r14]
sete r15b
mov eax, r15d
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
mov eax, 2
jmp 0x140007982
Function at 0x140019be0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 7], dil
je 0x140019c14
mov eax, edi
nop dword [rax]
lea ecx, [rax + 0x58]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x140019c00
mov byte [r8 + 7], dil
lea rax, [r8 + 6]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x140019c44
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x140019c5e
mov qword [rsp + 0x30], 6
mov eax, dword [r8]
mov dword [rsp + 0x20], eax
movzx eax, word [r8 + 4]
mov word [rsp + 0x24], ax
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x140019c6c
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.1400250a0
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140019ce6
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019ce1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140019ce1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140079fc4
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x140019d00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rbx, rcx
mov qword [rbp - 0x10], rcx
xor r9d, r9d
cmp byte [r8 + 8], r9b
je 0x140019d44
mov ecx, r9d
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x58]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 7
jb 0x140019d30
mov byte [r8 + 8], r9b
lea rax, [r8 + 7]
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], r9
mov qword [rbp - 0x40], r9
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x140019d6e
mov qword [rbp - 0x48], r9
mov byte [rbp - 0x58], r9b
jmp 0x140019d8d
mov qword [rbp - 0x48], 7
mov eax, dword [r8]
mov dword [rbp - 0x58], eax
movzx eax, word [r8 + 4]
mov word [rbp - 0x54], ax
movzx eax, byte [r8 + 6]
mov byte [rbp - 0x52], al
cmp byte [rdx + 9], 0
je 0x140019db3
mov rcx, r9
nop word [rax + rax]
lea eax, [rcx + 0x58]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 8
jb 0x140019da0
mov byte [rdx + 9], 0
lea rax, [rdx + 8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], r9
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
cmp rdx, rax
jne 0x140019ddd
mov qword [rbp - 0x28], r9
mov byte [rbp - 0x38], 0
jmp 0x140019dec
mov qword [rbp - 0x28], 8
mov rax, qword [rdx]
mov qword [rbp - 0x38], rax
lea r9, [rbp - 0x58]
lea r8, [rbp - 0x38]
movzx edx, byte [rbp - 0x60]
mov rcx, rbx
call fcn.14001fd90
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x140019e40
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019e3a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140019e3a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140079fc4
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x140019e7e
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019e79
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140019e79
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140079fc4
mov rax, rbx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rbp
ret
Function at 0x140019ea0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 9], dil
je 0x140019ed4
mov eax, edi
nop dword [rax]
lea ecx, [rax + 0x58]
xor byte [r8 + rax], cl
inc rax
cmp rax, 8
jb 0x140019ec0
mov byte [r8 + 9], dil
lea rax, [r8 + 8]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x140019f04
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x140019f15
mov qword [rsp + 0x30], 8
mov rax, qword [r8]
mov qword [rsp + 0x20], rax
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x140019f23
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.1400250a0
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140019f9d
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019f98
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140019f98
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140079fc4
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x140019fb0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rbx, rcx
mov qword [rbp - 0x10], rcx
xor r9d, r9d
cmp byte [r8 + 6], r9b
je 0x140019ff4
mov ecx, r9d
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x58]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x140019fe0
mov byte [r8 + 6], r9b
lea rax, [r8 + 5]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], r9
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x14001a01e
mov qword [rbp - 0x28], r9
mov byte [rbp - 0x38], r9b
jmp 0x14001a034
mov qword [rbp - 0x28], 5
mov eax, dword [r8]
mov dword [rbp - 0x38], eax
movzx eax, byte [r8 + 4]
mov byte [rbp - 0x34], al
cmp byte [rdx + 0xa], 0
je 0x14001a053
mov rcx, r9
nop dword [rax]
lea eax, [rcx + 0x58]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 9
jb 0x14001a040
mov byte [rdx + 0xa], 0
lea rax, [rdx + 9]
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], r9
mov qword [rbp - 0x40], r9
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
cmp rdx, rax
jne 0x14001a07d
mov qword [rbp - 0x48], r9
mov byte [rbp - 0x58], 0
jmp 0x14001a095
mov qword [rbp - 0x48], 9
movsd xmm0, qword [rdx]
movsd qword [rbp - 0x58], xmm0
movzx eax, byte [rdx + 8]
mov byte [rbp - 0x50], al
lea r9, [rbp - 0x38]
lea r8, [rbp - 0x58]
movzx edx, byte [rbp - 0x60]
mov rcx, rbx
call fcn.14001fd90
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x14001a0e9
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a0e3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001a0e3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140079fc4
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x14001a127
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a122
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001a122
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140079fc4
mov rax, rbx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rbp
ret
Function at 0x14001a140
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 0xa], dil
je 0x14001a174
mov eax, edi
nop dword [rax]
lea ecx, [rax + 0x58]
xor byte [r8 + rax], cl
inc rax
cmp rax, 9
jb 0x14001a160
mov byte [r8 + 0xa], dil
lea rax, [r8 + 9]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x14001a1a4
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x14001a1c1
mov qword [rsp + 0x30], 9
movsd xmm0, qword [r8]
movsd qword [rsp + 0x20], xmm0
movzx eax, byte [r8 + 8]
mov byte [rsp + 0x28], al
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x14001a1cf
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.1400250a0
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14001a249
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a244
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001a244
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140079fc4
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x14001a260
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rbx, rcx
mov qword [rbp - 0x10], rcx
xor r9d, r9d
cmp byte [r8 + 0xb], r9b
je 0x14001a2a4
mov ecx, r9d
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x58]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x14001a290
mov byte [r8 + 0xb], r9b
lea rax, [r8 + 0xa]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], r9
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x14001a2ce
mov qword [rbp - 0x28], r9
mov byte [rbp - 0x38], r9b
jmp 0x14001a2e9
mov qword [rbp - 0x28], 0xa
movsd xmm0, qword [r8]
movsd qword [rbp - 0x38], xmm0
movzx eax, word [r8 + 8]
mov word [rbp - 0x30], ax
cmp byte [rdx + 0xb], 0
je 0x14001a313
mov rcx, r9
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x58]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x14001a300
mov byte [rdx + 0xb], 0
lea rax, [rdx + 0xa]
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], r9
mov qword [rbp - 0x40], r9
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
cmp rdx, rax
jne 0x14001a33d
mov qword [rbp - 0x48], r9
mov byte [rbp - 0x58], 0
jmp 0x14001a356
mov qword [rbp - 0x48], 0xa
movsd xmm0, qword [rdx]
movsd qword [rbp - 0x58], xmm0
movzx eax, word [rdx + 8]
mov word [rbp - 0x50], ax
lea r9, [rbp - 0x38]
lea r8, [rbp - 0x58]
movzx edx, byte [rbp - 0x60]
mov rcx, rbx
call fcn.14001fd90
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x14001a3aa
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a3a4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001a3a4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140079fc4
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x14001a3e8
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a3e3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001a3e3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140079fc4
mov rax, rbx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rbp
ret
Function at 0x14001a400
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 0xc], dil
je 0x14001a434
mov eax, edi
nop dword [rax]
lea ecx, [rax + 0x58]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0xb
jb 0x14001a420
mov byte [r8 + 0xc], dil
lea rax, [r8 + 0xb]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x14001a464
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x14001a48b
mov qword [rsp + 0x30], select
movsd xmm0, qword [r8]
movsd qword [rsp + 0x20], xmm0
movzx eax, word [r8 + 8]
mov word [rsp + 0x28], ax
movzx eax, byte [r8 + 0xa]
mov byte [rsp + 0x2a], al
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x14001a499
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.1400250a0
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14001a513
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a50e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001a50e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140079fc4
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret

Function at 0x1400209e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 9], al
je 0x140020a03
lea edx, [rax + 0x58]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x1400209f0
mov byte [rcx + 9], 0
lea r8, [rcx + 8]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.140010ed0
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140020a20
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0x10], al
je 0x140020a43
lea edx, [rax + 0x58]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xf
jb 0x140020a30
mov byte [rcx + 0x10], 0
lea r8, [rcx + 0xf]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.140010ed0
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140021460
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x140021483
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x58]
xor byte [rax + rcx], dl
inc rax
cmp rax, 4
jb 0x140021470
mov byte [rcx + 5], 0
mov rax, rcx
ret

Function at 0x140021490
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x136], 0
je 0x1400214b8
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x58]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x135
jb 0x1400214a0
mov byte [rcx + 0x136], 0
mov rax, rcx
ret
Function at 0x1400214c0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x44], 0
je 0x1400214e3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x58]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x43
jb 0x1400214d0
mov byte [rcx + 0x44], 0
mov rax, rcx
ret

Function at 0x1400214f0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x140021513
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x58]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x46
jb 0x140021500
mov byte [rcx + 0x47], 0
mov rax, rcx
ret