joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006d6f0
Capabilities:
Connect socket

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x1403e3c28]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor ebx, ebx
mov dword [rsp + 0x20], r8d
mov r9d, reloc.WS2_32.dll_recv
mov byte [rcx + 0x24], bl
mov rbp, rdx
mov rdi, rcx
mov r8, rdx
add rcx, 0x3c
mov edx, r9d
mov esi, ebx
call fcn.140063dc0
cmp dword [rdi + 0x18], 2
jne 0x14006d75b
mov eax, 2
lea edx, [rbx + 0xe]
lea rcx, [rsp + 0x2a]
mov word [rsp + 0x28], ax
call fcn.140063da0
lea rbx, [rsp + 0x28]
mov esi, reloc.WS2_32.dll_recv
jmp 0x14006d781
cmp dword [rdi + 0x18], 0x17
jne 0x14006d781
mov esi, 0x1c
lea rcx, [rsp + 0x38]
mov edx, esi
call fcn.140063da0
mov eax, reloc.WS2_32.dll_socket
lea rbx, [rsp + 0x38]
mov word [rsp + 0x38], ax
mov r8d, esi
mov rdx, rbx
mov rcx, rdi
call fcn.14006d490
mov edx, 0x80000000
lea ecx, [rax + rdx]
test edx, ecx
jne 0x14006d7a5
cmp eax, 0xfffffff5
je 0x14006d7a5
mov dword [rdi + 0x28], eax
jmp 0x14006d813
cmp dword [rdi + 0x18], 0x17
jne 0x14006d7cc
mov rcx, qword [0x140400720]
lea r9, [rsp + 0x20]
add rcx, 0x90
mov r8, rbp
mov rdx, rbx
call fcn.140069cb0
mov rbp, rax
mov r8d, dword [rsp + 0x20]
mov rdx, rbp
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.WS2_32.dll_connect]
mov ebx, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
mov ecx, ebx
call fcn.140070040
mov ebx, eax
test eax, eax
jne 0x14006d80e
cmp byte [rdi + 0x4e], al
je 0x14006d80e
mov rcx, qword [0x140400720]
mov rcx, qword [rcx + 0x80]
call qword [sym.imp.WS2_32.dll_WSASetEvent]
mov dword [rdi + 0x28], ebx
mov eax, ebx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1401f11e0
mov rbx, qword [rsp + 0x98]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x14006dcf0
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x200
mov rax, qword [0x1403e3c28]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
mov rbx, qword [0x140400720]
mov ebp, edx
mov edi, ecx
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x20]
mov esi, r8d
call fcn.140081f00
test rbx, rbx
je 0x14006dd3d
mov eax, 0xffffffff
jmp 0x14006deed
mov r9, qword [rsp + 0x28]
mov edx, 0x64736f63
mov r8d, dword [rsp + 0x20]
mov ecx, 0x138
call fcn.14003f0f0
mov rbx, rax
test rax, rax
jne 0x14006dd66
lea eax, [rbx - 2]
jmp 0x14006deed
mov edx, 0x138
mov rcx, rbx
call fcn.140063da0
mov eax, dword [rsp + 0x20]
mov r8d, esi
mov dword [rbx + 0x60], eax
mov edx, ebp
mov rax, qword [rsp + 0x28]
mov ecx, edi
mov qword [rbx + 0x68], rax
mov dword [rbx + 0x58], 0x4f0
mov dword [rbx + 0x5c], reloc.WS2_32.dll_socket
mov dword [rbx + 0x74], 1
mov qword [0x140400720], rbx
call fcn.1400643f0
mov rdx, rbx
lea rcx, [fcn.14006f330]
call fcn.140064160
mov edx, 0x198
lea rcx, [rsp + 0x50]
call fcn.140063da0
mov ecx, 0x202
lea rdx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x14006ddf1
mov ecx, 0xffffffff
call fcn.14006df10
mov eax, 0xfffffffd
jmp 0x14006deed
movzx ecx, word [rsp + 0x50]
movzx eax, cx
shr ax, 8
movzx edx, al
movzx eax, cl
shl eax, 8
or edx, eax
mov dword [rbx + 0x70], edx
mov rdx, qword [rsp + 0x28]
mov ecx, dword [rsp + 0x20]
call fcn.14006a370
mov qword [rbx + 0xb0], rax
test rax, rax
jne 0x14006de39
mov ecx, 0xffffffff
call fcn.14006df10
mov eax, 0xfffffffc
jmp 0x14006deed
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 0x80], rax
test rax, rax
jne 0x14006de68
xor ecx, ecx
call fcn.14006df10
mov eax, 0xfffffffb
jmp 0x14006deed
lea rcx, [rbx + 0x88]
lea rdx, str.recv_event_crit
call fcn.14006bfa0
mov edx, SafeArrayPutElement
mov dword [rbx + 0x7c], 1
lea rcx, [rsp + 0x30]
call fcn.140063da0
lea rax, str.SocketRecv
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x30]
mov dword [rsp + 0x34], esi
lea rcx, [0x14006f9e0]
mov eax, dword [rbx + 0x74]
xor edx, edx
mov dword [rsp + 0x40], eax
call fcn.14006c2a0
test eax, eax
je 0x14006ded8
xor ecx, ecx
mov dword [rbx + 0x7c], 0
call fcn.14006df10
mov eax, 0xfffffffa
jmp 0x14006deed
mov r8, qword [rbx + 0x68]
lea rcx, [rbx + 0x90]
mov edx, dword [rbx + 0x60]
call fcn.140069c40
xor eax, eax
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.1401f11e0
mov rbx, qword [rsp + 0x238]
add rsp, 0x200
pop rdi
pop rsi
pop rbp
ret
Function at 0x14006e950
Capabilities:
Set socket configuration

Disassembly:
mov r9d, r8d
mov rcx, 0xffffffffffffffff
mov r8d, edx
mov rdx, qword [0x140400720]
mov edx, dword [rdx + 0x5c]
jmp 0x14006f7f0
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rsi, qword [0x140400720]
mov eax, 1
xor r14d, r14d
mov dword [r11 + 0x18], eax
cmp r8d, eax
mov dword [r11 - 0x38], r14d
mov r13d, r9d
mov ebp, r8d
mov r9, qword [rsi + 0x68]
mov r15d, edx
mov r8d, dword [rsi + 0x60]
mov rdi, rcx
mov r12d, 8
mov edx, 0x64736f63
mov ecx, 0x238
cmovne r12d, eax
call fcn.14003f0f0
mov rbx, rax
test rax, rax
je 0x14006f8ce
mov edx, 0x238
mov rcx, rax
call fcn.140063da0
cmp rdi, 0xffffffffffffffff
jne 0x14006f895
mov dword [rsp + 0x28], 1
xor r9d, r9d
mov r8d, r13d
mov dword [rsp + 0x20], r14d
mov edx, ebp
mov ecx, r15d
call qword [sym.imp.WS2_32.dll_WSASocketW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14006f8b9
mov r8, qword [rsi + 0x68]
mov ecx, r12d
mov edx, dword [rsi + 0x60]
call fcn.14006ab20
mov qword [rbx + 0x228], rax
mov rcx, rdi
test rax, rax
jne 0x14006f8d5
call qword [sym.imp.WS2_32.dll_closesocket]
mov r9, qword [rsi + 0x68]
mov edx, 0x64736f63
mov r8d, dword [rsi + 0x60]
mov rcx, rbx
call fcn.14003f110
xor eax, eax
jmp 0x14006f9be
lea r8, [rsp + 0x80]
mov dword [rbx + 0x220], 0xffffffff
mov edx, 0x8004667e
mov qword [rbx + 0x10], rdi
mov dword [rbx + 0x28], r14d
mov byte [rbx + 0x4f], 1
call qword [sym.imp.WS2_32.dll_ioctlsocket]
cmp ebp, 2
jne 0x14006f90e
mov edx, 0xffff
lea r8d, [rbp + 0x1e]
jmp 0x14006f919
cmp ebp, 3
jne 0x14006f932
xor edx, edx
lea r8d, [rbp - 1]
lea r9, [rsp + 0x80]
mov dword [rsp + 0x20], 4
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp r15d, 0x17
jne 0x14006f956
lea r9, [rsp + 0x30]
mov dword [rsp + 0x20], 4
lea edx, [r15 + 0x12]
mov rcx, rdi
lea r8d, [r15 + 4]
call qword [sym.imp.WS2_32.dll_setsockopt]
lea eax, [rbp - 2]
mov dword [rbx + 0x18], r15d
cmp eax, 1
mov dword [rbx + 0x1c], ebp
lea rcx, [rbx + 0x1c0]
mov dword [rbx + 0x20], r13d
setbe r14b
mov byte [rbx + 0x50], 1
mov edx, 0x20
mov byte [rbx + 0x4e], r14b
call fcn.140063da0
call qword [sym.imp.WS2_32.dll_WSACreateEvent]
lea rcx, [rbx + 0x1e0]
mov qword [rbx + 0x1d8], rax
lea rdx, str.recvthread
call fcn.14006bfa0
xor ecx, ecx
call fcn.14006bf70
mov rax, qword [rsi]
xor ecx, ecx
mov qword [rbx], rax
mov qword [rsi], rbx
call fcn.14006c200
mov rax, rbx
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14006eb80
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x1403e3c28]
xor rax, rsp
mov qword [rsp + 0x50], rax
cmp byte [rcx + 0x50], 0
mov esi, r8d
mov rdi, qword [rsp + 0xb0]
mov rbp, rdx
mov r14, qword [0x140400720]
mov rbx, rcx
je 0x14006ebe0
mov r9, rdx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], r8d
lea rcx, [r14 + 0xb8]
mov r8d, dword [rbx + 0x1c]
mov rdx, rbx
call fcn.14006b470
test eax, eax
jg 0x14006ecc6
cmp qword [rbx + 0x10], 0xffffffffffffffff
jne 0x14006ebf8
mov dword [rbx + 0x28], 0xfffffff5
mov eax, 0xfffffff5
jmp 0x14006ecc6
mov edx, dword [rbx + 0x1c]
lea rcx, [rbx + 0x54]
lea r9, str.send
mov r8d, esi
call fcn.14006b0c0
mov esi, eax
test eax, eax
je 0x14006ecc6
test rdi, rdi
jne 0x14006ec32
mov rcx, qword [rbx + 0x10]
xor r9d, r9d
mov r8d, esi
mov rdx, rbp
call qword [sym.imp.WS2_32.dll_send]
jmp 0x14006eca0
cmp dword [rbx + 0x18], 0x17
jne 0x14006ec7d
mov edx, 0x1c
lea rcx, [rsp + 0x30]
call fcn.140063da0
mov eax, reloc.WS2_32.dll_socket
mov dword [rsp + 0xb8], 0x1c
lea rcx, [r14 + 0x90]
mov word [rsp + 0x30], ax
lea r9, [rsp + 0xb8]
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.140069cb0
lea rdi, [rsp + 0x30]
mov eax, dword [rsp + 0xb8]
xor r9d, r9d
mov rcx, qword [rbx + 0x10]
mov r8d, esi
mov dword [rsp + 0x28], eax
mov rdx, rbp
mov qword [rsp + 0x20], rdi
call qword [sym.imp.WS2_32.dll_sendto]
lea rcx, [rbx + 0x54]
mov edx, eax
lea r8, str.send
mov edi, eax
call fcn.14006b290
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
mov ecx, edi
call fcn.140070040
mov dword [rbx + 0x28], eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1401f11e0
add rsp, 0x60
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14006f7f0
Capabilities:
Set socket configuration

Disassembly:
mov r9d, r8d
mov rcx, 0xffffffffffffffff
mov r8d, edx
mov rdx, qword [0x140400720]
mov edx, dword [rdx + 0x5c]
jmp 0x14006f7f0
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rsi, qword [0x140400720]
mov eax, 1
xor r14d, r14d
mov dword [r11 + 0x18], eax
cmp r8d, eax
mov dword [r11 - 0x38], r14d
mov r13d, r9d
mov ebp, r8d
mov r9, qword [rsi + 0x68]
mov r15d, edx
mov r8d, dword [rsi + 0x60]
mov rdi, rcx
mov r12d, 8
mov edx, 0x64736f63
mov ecx, 0x238
cmovne r12d, eax
call fcn.14003f0f0
mov rbx, rax
test rax, rax
je 0x14006f8ce
mov edx, 0x238
mov rcx, rax
call fcn.140063da0
cmp rdi, 0xffffffffffffffff
jne 0x14006f895
mov dword [rsp + 0x28], 1
xor r9d, r9d
mov r8d, r13d
mov dword [rsp + 0x20], r14d
mov edx, ebp
mov ecx, r15d
call qword [sym.imp.WS2_32.dll_WSASocketW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14006f8b9
mov r8, qword [rsi + 0x68]
mov ecx, r12d
mov edx, dword [rsi + 0x60]
call fcn.14006ab20
mov qword [rbx + 0x228], rax
mov rcx, rdi
test rax, rax
jne 0x14006f8d5
call qword [sym.imp.WS2_32.dll_closesocket]
mov r9, qword [rsi + 0x68]
mov edx, 0x64736f63
mov r8d, dword [rsi + 0x60]
mov rcx, rbx
call fcn.14003f110
xor eax, eax
jmp 0x14006f9be
lea r8, [rsp + 0x80]
mov dword [rbx + 0x220], 0xffffffff
mov edx, 0x8004667e
mov qword [rbx + 0x10], rdi
mov dword [rbx + 0x28], r14d
mov byte [rbx + 0x4f], 1
call qword [sym.imp.WS2_32.dll_ioctlsocket]
cmp ebp, 2
jne 0x14006f90e
mov edx, 0xffff
lea r8d, [rbp + 0x1e]
jmp 0x14006f919
cmp ebp, 3
jne 0x14006f932
xor edx, edx
lea r8d, [rbp - 1]
lea r9, [rsp + 0x80]
mov dword [rsp + 0x20], 4
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp r15d, 0x17
jne 0x14006f956
lea r9, [rsp + 0x30]
mov dword [rsp + 0x20], 4
lea edx, [r15 + 0x12]
mov rcx, rdi
lea r8d, [r15 + 4]
call qword [sym.imp.WS2_32.dll_setsockopt]
lea eax, [rbp - 2]
mov dword [rbx + 0x18], r15d
cmp eax, 1
mov dword [rbx + 0x1c], ebp
lea rcx, [rbx + 0x1c0]
mov dword [rbx + 0x20], r13d
setbe r14b
mov byte [rbx + 0x50], 1
mov edx, 0x20
mov byte [rbx + 0x4e], r14b
call fcn.140063da0
call qword [sym.imp.WS2_32.dll_WSACreateEvent]
lea rcx, [rbx + 0x1e0]
mov qword [rbx + 0x1d8], rax
lea rdx, str.recvthread
call fcn.14006bfa0
xor ecx, ecx
call fcn.14006bf70
mov rax, qword [rsi]
xor ecx, ecx
mov qword [rbx], rax
mov qword [rsi], rbx
call fcn.14006c200
mov rax, rbx
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14006ff00
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x1403e3c28]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r15, qword [rsp + 0xc0]
xor esi, esi
cmp qword [rcx + 0x10], 0xffffffffffffffff
mov rbx, r9
mov r12, qword [rsp + 0xc8]
mov ebp, r8d
mov r14, rdx
mov rdi, rcx
jne 0x14006ff52
mov dword [rcx + 0x28], 0xfffffff5
lea eax, [rsi - 0xb]
jmp 0x14007001c
test rbx, rbx
je 0x14006fff9
cmp dword [rcx + 0x18], 2
jne 0x14006ff7a
mov rcx, qword [rcx + 0x10]
xor r9d, r9d
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rbx
call qword [sym.imp.WS2_32.dll_recvfrom]
mov esi, eax
cmp dword [rdi + 0x18], 0x17
jne 0x14006ffdd
mov rcx, qword [rdi + 0x10]
mov eax, 2
mov word [rsp + 0x38], ax
xor r9d, r9d
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0x1c
mov qword [rsp + 0x28], rax
mov r8d, ebp
lea rax, [rsp + 0x38]
mov rdx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_recvfrom]
mov esi, eax
test eax, eax
jle 0x14006ffdd
mov rcx, qword [0x140400720]
lea r8, [rsp + 0x38]
add rcx, 0x90
mov r9, r15
mov rdx, rbx
call fcn.140069cb0
call fcn.140064500
mov byte [rbx + 0xb], al
shr eax, 8
mov byte [rbx + 0xa], al
shr eax, 8
mov byte [rbx + 9], al
shr eax, 8
mov byte [rbx + 8], al
jmp 0x140070008
mov rcx, qword [rcx + 0x10]
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
mov esi, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2738
mov dword [r12], eax
cmove esi, ebp
mov eax, esi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1401f11e0
add rsp, 0x60
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140075e90
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov rax, rdx
mov edx, 0x304
cmp word [rcx + 0x1a78], dx
jae 0x140075f34
mov rcx, qword [rcx + 0x38]
cmp byte [rcx + 7], 3
je 0x140075f34
mov rdx, qword [rsp + 0x28]
movzx ecx, byte [rdx]
mov byte [rax], cl
movzx ecx, byte [rdx + 1]
mov byte [rax + 1], cl
movzx ecx, byte [rdx + 2]
mov byte [rax + 2], cl
movzx ecx, byte [rdx + 3]
mov byte [rax + 3], cl
test r9, r9
jne 0x140075f22
mov rcx, r8
shr rcx, 0x38
mov byte [rax + 4], cl
mov rcx, r8
shr rcx, 0x30
mov byte [rax + 5], cl
mov rcx, r8
shr rcx, 0x28
mov byte [rax + 6], cl
mov rcx, r8
shr rcx, 0x20
mov byte [rax + 7], cl
mov rcx, r8
shr rcx, 0x18
mov byte [rax + 8], cl
mov rcx, r8
shr rcx, 0x10
mov byte [rax + 9], cl
mov rcx, r8
shr rcx, 8
mov byte [rax + 0xa], cl
mov byte [rax + 0xb], r8b
ret
mov r8d, 8
lea rcx, [rax + 4]
mov rdx, r9
jmp fcn.140063db0
mov rcx, r8
mov byte [rax + 0xb], r8b
shr rcx, 0x38
mov edx, recv
mov byte [rax + 4], cl
mov rcx, r8
shr rcx, 0x30
mov byte [rax + 5], cl
mov rcx, r8
shr rcx, 0x28
mov byte [rax + 6], cl
mov rcx, r8
shr rcx, 0x20
mov byte [rax + 7], cl
mov rcx, r8
shr rcx, 0x18
mov byte [rax + 8], cl
mov rcx, r8
shr rcx, 0x10
mov byte [rax + 9], cl
mov rcx, r8
mov r8, qword [rsp + 0x28]
shr rcx, 8
mov byte [rax + 0xa], cl
sub r8, rax
mov dword [rax], 0
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x140075f91
ret
Function at 0x140081d20
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov edi, edx
mov rcx, qword [0x140400750]
test rcx, rcx
je 0x140081d4c
mov r8, rbx
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x140081dcc
cmp dword [0x140400758], 0
jne 0x140081d60
call fcn.140064500
mov dword [0x140400758], eax
call fcn.140064500
add dword [0x14040075c], eax
inc dword [0x140400760]
mov edx, dword [0x140400764]
xor ecx, ecx
mov dword [rsp + 0x40], ecx
nop dword [rax]
movsxd rax, ecx
inc ecx
add edx, dword [rsp + rax*4 + 0x40]
mov dword [rsp + 0x40], ecx
cmp ecx, 0x20
jl 0x140081d80
mov dword [0x140400764], edx
test rbx, rbx
je 0x140081dcc
mov r9d, 3
lea rdx, [0x140400758]
lea rcx, [0x140400770]
lea r8d, [r9 + 0xd]
call fcn.140065450
mov r8d, edi
lea rcx, [0x140400770]
mov rdx, rbx
call fcn.1400653c0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140081de0
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
sub rsp, 0x38
cmp dword [0x140400758], 0
jne 0x140081df8
call fcn.140064500
mov dword [0x140400758], eax
call fcn.140064500
add dword [0x14040075c], eax
inc dword [0x140400760]
mov edx, dword [0x140400764]
xor ecx, ecx
mov dword [rsp + 0x40], ecx
nop word [rax + rax]
movsxd rax, ecx
inc ecx
add edx, dword [rsp + rax*4 + 0x40]
mov dword [rsp + 0x40], ecx
cmp ecx, 0x20
jl 0x140081e20
mov dword [0x140400764], edx
lea rcx, [0x140400750]
xor edx, edx
mov dword [rsp + 0x20], 0
mov r9d, 1
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x140081e98
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x140081e98
mov r9d, 1
mov dword [rsp + 0x20], 8
xor r8d, r8d
lea rcx, [0x140400750]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x140081e98
mov qword [0x140400750], 0
add rsp, 0x38
ret
Function at 0x140086250
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
lea rsi, [0x14029cfd0]
mov r15d, r9d
mov rdi, rcx
mov r14d, 4
cmp r8d, 0x10
jne 0x14008627c
lea eax, [r14 + 6]
mov r10d, r14d
jmp 0x140086291
cmp r8d, 0x20
jne 0x1400864e6
mov eax, recvfrom
mov r10d, 8
mov qword [rsp + 0x20], rbx
lea rbx, [rcx + 4]
mov qword [rsp + 0x28], rbp
mov word [rcx], ax
mov word [rcx + 2], r10w
test r10d, r10d
je 0x1400862f1
add rdx, 2
mov r9d, r10d
mov r8, rbx
nop word [rax + rax]
movzx eax, byte [rdx - 1]
lea r8, [r8 + 4]
movzx ecx, byte [rdx - 2]
lea rdx, [rdx + 4]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx - 4]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx - 3]
shl ecx, 8
or ecx, eax
mov dword [r8 - 4], ecx
sub r9, 1
jne 0x1400862c0
movzx eax, word [rdi]
mov r9d, r10d
lea ebp, [rax*4 + 4]
cmp r10d, ebp
jae 0x1400863f9
mov eax, r10d
mov qword [rsp + 0x30], r12
lea r12, str.cw
lea r11, [rbx + rax*4]
nop word [rax + rax]
lea eax, [r9 - 1]
xor edx, edx
mov ecx, dword [rbx + rax*4]
mov eax, r9d
div r10d
test edx, edx
jne 0x140086384
mov eax, ecx
shr rax, 0x10
movzx edx, al
mov eax, ecx
shr rax, 8
movzx r8d, byte [rdx + r12]
movzx edx, al
shl r8d, 8
movzx eax, byte [rdx + r12]
or r8d, eax
movzx edx, cl
shl r8d, 8
movzx eax, byte [rdx + r12]
or r8d, eax
mov eax, ecx
shr rax, 0x18
shl r8d, 8
mov ecx, r8d
movzx eax, byte [rax + r12]
or ecx, eax
movzx eax, byte [rsi]
shl eax, 0x18
xor ecx, eax
inc rsi
cmp r10d, 8
jne 0x1400863d9
mov eax, r9d
and al, 7
cmp al, r14b
jne 0x1400863d9
mov eax, ecx
shr rax, 0x10
movzx edx, al
mov eax, ecx
shr rax, 0x18
movzx r8d, byte [rdx + r12]
movzx eax, byte [rax + r12]
shl eax, 8
or r8d, eax
mov eax, ecx
shr rax, 8
movzx edx, al
shl r8d, 8
movzx eax, byte [rdx + r12]
or r8d, eax
movzx eax, cl
shl r8d, 8
mov ecx, r8d
movzx edx, byte [rax + r12]
or ecx, edx
mov eax, r9d
inc r9d
sub eax, r10d
xor ecx, dword [rbx + rax*4]
mov dword [r11], ecx
add r11, r14
cmp r9d, ebp
jb 0x140086320
mov r12, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
cmp r15d, 1
jne 0x1400864e6
movzx eax, word [rdi]
shl eax, 2
cmp eax, r14d
jbe 0x1400864e6
nop dword [rax]
mov eax, r14d
mov ecx, dword [rdi + rax*4 + 4]
mov r9d, ecx
and r9d, 0x80808080
mov eax, r9d
shr eax, 7
sub r9d, eax
lea eax, [rcx + rcx]
and eax, 0xfefefefe
and r9d, 0x1b1b1b1b
xor r9d, eax
mov r8d, r9d
and r8d, 0x80808080
mov eax, r8d
shr eax, 7
sub r8d, eax
lea eax, [r9 + r9]
and eax, 0xfefefefe
and r8d, 0x1b1b1b1b
xor r8d, eax
mov edx, r8d
and edx, 0x80808080
mov eax, edx
shr eax, 7
sub edx, eax
lea eax, [r8 + r8]
and eax, 0xfefefefe
and edx, 0x1b1b1b1b
xor edx, eax
mov eax, edx
xor edx, r8d
xor eax, ecx
xor edx, r9d
xor r9d, eax
xor r8d, eax
mov ecx, eax
shr eax, 8
shl ecx, 0x18
or ecx, eax
mov eax, r8d
shr eax, 0x10
shl r8d, 0x10
or eax, r8d
xor ecx, eax
mov eax, r9d
shr eax, 0x18
shl r9d, 8
or eax, r9d
xor ecx, eax
mov eax, r14d
xor ecx, edx
inc r14d
mov dword [rdi + rax*4 + 4], ecx
movzx eax, word [rdi]
shl eax, 2
cmp r14d, eax
jb 0x140086420
mov rsi, qword [rsp + 0x38]
pop r15
pop r14
pop rdi
ret
Function at 0x140087610
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov ebx, r8d
mov edx, 0x40
mov rsi, rcx
call fcn.140063da0
mov r8d, ebx
mov rdx, rdi
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x140087d90
movzx eax, byte [rdx + 2]
mov r10, rcx
movzx r9d, byte [rdx + 3]
shl r9d, 8
or r9d, eax
movzx eax, byte [rdx + 1]
shl r9d, 8
or r9d, eax
movzx eax, byte [rdx]
shl r9d, 8
or r9d, eax
mov dword [rcx + 0x10], r9d
movzx eax, byte [rdx + 6]
movzx ecx, byte [rdx + 7]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 4]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x14], ecx
movzx eax, byte [rdx + 0xa]
movzx ecx, byte [rdx + 0xb]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 8]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x18], ecx
movzx eax, byte [rdx + 0xe]
movzx ecx, byte [rdx + 0xf]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0xd]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0xc]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x1c], ecx
cmp r8d, 0x20
jne 0x140087e38
add rdx, 0x10
lea r8, str.expand_32_byte_kexpand_16_byte_k
jmp 0x140087e3f
lea r8, [0x14029d018]
movzx eax, byte [rdx + 2]
movzx ecx, byte [rdx + 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x20], ecx
movzx eax, byte [rdx + 6]
movzx ecx, byte [rdx + 7]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 4]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x24], ecx
movzx eax, byte [rdx + 0xa]
movzx ecx, byte [rdx + 0xb]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 8]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x28], ecx
movzx eax, byte [rdx + 0xe]
movzx ecx, byte [rdx + 0xf]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0xd]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0xc]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x2c], ecx
movsx eax, byte [r8 + 2]
movsx ecx, byte [r8 + 3]
shl ecx, 8
or ecx, eax
movsx eax, byte [r8 + 1]
shl ecx, 8
or ecx, eax
movsx eax, byte [r8]
shl ecx, 8
or ecx, eax
mov dword [r10], ecx
movsx eax, byte [r8 + 6]
movsx ecx, byte [r8 + 7]
shl ecx, 8
or ecx, eax
movsx eax, byte [r8 + 5]
shl ecx, 8
or ecx, eax
movsx eax, byte [r8 + 4]
shl ecx, 8
or ecx, eax
mov dword [r10 + 4], ecx
movsx eax, byte [r8 + 0xa]
movsx ecx, byte [r8 + 0xb]
shl ecx, 8
or ecx, eax
movsx eax, byte [r8 + 9]
shl ecx, 8
or ecx, eax
movsx eax, byte [r8 + 8]
shl ecx, 8
or ecx, eax
mov dword [r10 + 8], ecx
movsx ecx, byte [r8 + 0xf]
movsx eax, byte [r8 + 0xe]
shl ecx, 8
or ecx, eax
movsx eax, byte [r8 + 0xd]
shl ecx, 8
or ecx, eax
movsx eax, byte [r8 + 0xc]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0xc], ecx
ret