joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14020c310
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x20
call fcn.1402d2bf0
sub rsp, rax
lea eax, [rdx + 0x3f]
mov rdi, r8
sar eax, 6
mov esi, edx
mov rbx, rcx
test eax, eax
jle 0x14020c348
movsxd r8, eax
xor edx, edx
shl r8, 3
call fcn.14029e460
cmp esi, 0x68
jl 0x14020c380
mov eax, 0x4ec4ec4f
mul esi
shr edx, 5
imul eax, edx, 0xffffff98
mov ecx, edx
add esi, eax
nop
mov rax, qword [rdi]
mov qword [rbx], rax
mov rax, qword [rdi + 8]
add rdi, 0x10
shl rax, 4
xor qword [rbx + 6], rax
add rbx, 0xd
sub rcx, 1
jne 0x14020c360
cmp esi, 0x34
jle 0x14020c3f0
mov rax, qword [rdi]
mov byte [rbx], al
shr rax, 8
mov byte [rbx + 1], al
shr rax, 8
mov byte [rbx + 2], al
shr rax, 8
mov byte [rbx + 3], al
shr rax, 8
mov byte [rbx + 4], al
shr rax, 8
mov byte [rbx + 5], al
add rbx, 6
shr rax, 8
mov byte [rbx], al
movzx eax, word [rdi + 6]
mov rcx, qword [rdi + 8]
shl rcx, 4
or rcx, rax
lea eax, [rsi - 0x2d]
sar eax, 3
test eax, eax
jle 0x14020c411
mov byte [rbx], cl
lea rbx, [rbx + 1]
shr rcx, 8
dec eax
test eax, eax
jg 0x14020c3d0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
test esi, esi
je 0x14020c411
mov rcx, qword [rdi]
lea eax, [rsi + 7]
sar eax, 3
test eax, eax
jle 0x14020c411
mov byte [rbx], cl
lea rbx, [rbx + 1]
shr rcx, 8
dec eax
test eax, eax
jg 0x14020c401
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1402193d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
mov eax, 0x50
call fcn.1402d2bf0
sub rsp, rax
mov rax, qword [0x1403bf008]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r15, qword [rbp + 0x60]
mov rdi, rcx
mov r13, qword [rbp + 0x68]
mov r12, rdx
xor r14d, r14d
mov qword [rbp - 0x28], r9
mov esi, r8d
mov qword [rbp - 0x20], r13
movzx eax, byte [r15 + 1]
movzx r10d, byte [r15]
movzx edx, byte [r15 + 4]
movzx ecx, byte [r15 + 7]
mov ebx, dword [r13]
shl eax, 8
or r10d, eax
shl ecx, 8
movzx eax, byte [r15 + 2]
shl eax, 0x10
or r10d, eax
movzx eax, byte [r15 + 3]
shl eax, 0x18
or r10d, eax
movzx eax, byte [r15 + 5]
shl eax, 8
or edx, eax
mov dword [rbp - 0x30], r10d
movzx eax, byte [r15 + 6]
or ecx, eax
mov byte [rbp - 0x18], r10b
shl ecx, 0x10
mov eax, r10d
shr eax, 8
or edx, ecx
mov byte [rbp - 0x17], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0x16], al
mov eax, r10d
shr eax, 0x18
mov byte [rbp - 0x15], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0x13], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0x12], al
mov eax, edx
shr eax, 0x18
mov dword [rbp - 0x2c], edx
mov byte [rbp - 0x14], dl
mov byte [rbp - 0x11], al
test r8d, r8d
je 0x140219584
mov r13, qword [rbp - 0x28]
sub r12, rdi
movzx r8d, dl
movzx r9d, r10b
nop
dec esi
test ebx, ebx
jne 0x140219525
lea r8d, [rbx + 1]
mov rdx, r13
lea rcx, [rbp - 0x30]
call fcn.140215750
mov r10d, dword [rbp - 0x30]
mov eax, r10d
mov edx, dword [rbp - 0x2c]
movzx r9d, byte [rbp - 0x30]
movzx r8d, byte [rbp - 0x2c]
shr eax, 8
mov byte [rbp - 0x17], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0x16], al
mov eax, r10d
shr eax, 0x18
mov byte [rbp - 0x15], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0x13], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0x12], al
mov eax, edx
shr eax, 0x18
mov byte [rbp - 0x11], al
inc r14d
mov byte [rbp - 0x18], r9b
mov byte [rbp - 0x14], r8b
movsxd rax, ebx
movzx ecx, byte [rbp + rax - 0x18]
xor cl, byte [rdi]
mov byte [r12 + rdi], cl
inc rdi
inc ebx
and ebx, 7
test esi, esi
jne 0x1402194c0
mov r13, qword [rbp - 0x20]
test r14d, r14d
je 0x140219584
mov eax, r10d
mov byte [r15], r9b
shr eax, 8
mov byte [r15 + 1], al
mov eax, r10d
shr eax, 0x10
mov byte [r15 + 2], al
mov eax, edx
shr eax, 8
mov byte [r15 + 5], al
mov eax, edx
shr eax, 0x10
shr r10d, 0x18
shr edx, 0x18
mov byte [r15 + 7], dl
mov byte [r15 + 3], r10b
mov byte [r15 + 4], r8b
mov byte [r15 + 6], al
mov dword [r13], ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400adbc0
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14021a240
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x60
call fcn.1402d2bf0
sub rsp, rax
mov rax, qword [0x1403bf008]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov r14, qword [rsp + 0xd0]
mov rdi, rcx
mov rax, qword [rsp + 0xc0]
mov r13, r9
mov rcx, qword [rsp + 0xc8]
mov r15, rdx
mov r12, qword [rsp + 0xd8]
xor ebp, ebp
movzx r9d, byte [r14]
mov esi, r8d
movzx edx, byte [r14 + 4]
mov qword [rsp + 0x28], rax
movzx eax, byte [r14 + 1]
mov ebx, dword [r12]
shl eax, 8
or r9d, eax
mov qword [rsp + 0x30], rcx
movzx eax, byte [r14 + 2]
movzx ecx, byte [r14 + 7]
shl eax, 0x10
or r9d, eax
shl ecx, 8
movzx eax, byte [r14 + 3]
shl eax, 0x18
or r9d, eax
mov qword [rsp + 0x38], r14
movzx eax, byte [r14 + 5]
shl eax, 8
or edx, eax
mov qword [rsp + 0x40], r12
movzx eax, byte [r14 + 6]
or ecx, eax
mov dword [rsp + 0x20], r9d
shl ecx, 0x10
mov eax, r9d
shr eax, 8
or edx, ecx
mov byte [rsp + 0x49], al
mov eax, r9d
shr eax, 0x10
mov byte [rsp + 0x4a], al
mov eax, r9d
shr eax, 0x18
mov byte [rsp + 0x4b], al
mov eax, edx
shr eax, 8
mov byte [rsp + 0x4d], al
mov eax, edx
shr eax, 0x10
mov byte [rsp + 0x4e], al
mov eax, edx
shr eax, 0x18
mov dword [rsp + 0x24], edx
mov byte [rsp + 0x48], r9b
mov byte [rsp + 0x4c], dl
mov byte [rsp + 0x4f], al
test r8d, r8d
je 0x14021a42a
mov r12, qword [rsp + 0x28]
sub r15, rdi
mov r14, qword [rsp + 0x30]
nop dword [rax + rax]
dec esi
test ebx, ebx
jne 0x14021a3c6
mov r9, r14
lea rcx, [rsp + 0x20]
mov r8, r12
mov rdx, r13
call fcn.140217d00
mov r9d, dword [rsp + 0x20]
mov eax, r9d
mov edx, dword [rsp + 0x24]
shr eax, 8
mov byte [rsp + 0x49], al
mov eax, r9d
shr eax, 0x10
mov byte [rsp + 0x4a], al
mov eax, r9d
shr eax, 0x18
mov byte [rsp + 0x4b], al
mov eax, edx
shr eax, 8
mov byte [rsp + 0x4d], al
mov eax, edx
shr eax, 0x10
mov byte [rsp + 0x4e], al
mov eax, edx
shr eax, 0x18
mov byte [rsp + 0x4f], al
inc ebp
mov byte [rsp + 0x48], r9b
mov byte [rsp + 0x4c], dl
movsxd rax, ebx
movzx ecx, byte [rsp + rax + 0x48]
xor cl, byte [rdi]
mov byte [r15 + rdi], cl
inc rdi
inc ebx
and ebx, 7
test esi, esi
jne 0x14021a360
mov r14, qword [rsp + 0x38]
mov r12, qword [rsp + 0x40]
test ebp, ebp
je 0x14021a42a
mov eax, r9d
mov byte [r14], r9b
shr eax, 8
mov byte [r14 + 1], al
mov eax, r9d
shr eax, 0x10
mov byte [r14 + 2], al
mov eax, edx
shr eax, 8
mov byte [r14 + 5], al
mov eax, edx
shr eax, 0x10
shr r9d, 0x18
mov byte [r14 + 4], dl
shr edx, 0x18
mov byte [r14 + 7], dl
mov byte [r14 + 3], r9b
mov byte [r14 + 6], al
mov dword [r12], ebx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400adbc0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14021bdf0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
mov eax, 0x50
call fcn.1402d2bf0
sub rsp, rax
mov rax, qword [0x1403bf008]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r13, qword [rbp + 0x68]
xor r15d, r15d
mov r14, qword [rbp + 0x60]
mov esi, r8d
mov qword [rbp - 0x28], r9
mov r12, rdx
mov rdi, rcx
mov qword [rbp - 0x20], r13
mov ebx, dword [r13]
test ebx, ebx
jns 0x14021be4f
mov dword [r13], 0xffffffff
jmp 0x14021bfaf
movzx edx, byte [r14]
movzx eax, byte [r14 + 1]
movzx r8d, byte [r14 + 4]
movzx ecx, byte [r14 + 6]
shl eax, 0x10
shl edx, 0x18
or edx, eax
shl r8d, 0x18
movzx eax, byte [r14 + 2]
shl eax, 8
or edx, eax
shl ecx, 8
movzx eax, byte [r14 + 3]
or edx, eax
movzx eax, byte [r14 + 5]
shl eax, 0x10
or r8d, eax
mov dword [rbp - 0x30], edx
movzx eax, byte [r14 + 7]
or ecx, eax
mov byte [rbp - 0x15], dl
or r8d, ecx
mov eax, edx
shr eax, 0x18
mov byte [rbp - 0x18], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0x17], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0x16], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0x14], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0x13], al
mov eax, r8d
shr eax, 8
mov dword [rbp - 0x2c], r8d
mov byte [rbp - 0x12], al
mov byte [rbp - 0x11], r8b
test esi, esi
je 0x14021bfab
mov r13, qword [rbp - 0x28]
sub r12, rdi
movzx r10d, r8b
movzx r9d, dl
nop
dec esi
test ebx, ebx
jne 0x14021bf4c
mov rdx, r13
lea rcx, [rbp - 0x30]
call fcn.14021b3b0
mov edx, dword [rbp - 0x30]
mov eax, edx
mov r8d, dword [rbp - 0x2c]
mov r9d, edx
shr eax, 0x18
mov r10d, r8d
mov byte [rbp - 0x18], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0x17], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0x16], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0x14], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0x13], al
mov eax, r8d
shr eax, 8
mov byte [rbp - 0x12], al
inc r15d
mov byte [rbp - 0x15], dl
mov byte [rbp - 0x11], r10b
movsxd rax, ebx
movzx ecx, byte [rbp + rax - 0x18]
xor cl, byte [rdi]
mov byte [r12 + rdi], cl
inc rdi
inc ebx
and ebx, 7
test esi, esi
jne 0x14021bef0
mov r13, qword [rbp - 0x20]
test r15d, r15d
je 0x14021bfab
mov eax, edx
mov byte [r14 + 3], r9b
shr eax, 0x18
mov byte [r14], al
mov eax, edx
shr eax, 0x10
mov byte [r14 + 1], al
mov eax, r8d
shr eax, 0x18
mov byte [r14 + 4], al
mov eax, r8d
shr eax, 0x10
shr edx, 8
shr r8d, 8
mov byte [r14 + 6], r8b
mov byte [r14 + 2], dl
mov byte [r14 + 5], al
mov byte [r14 + 7], r10b
mov dword [r13], ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400adbc0
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14021ce50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
mov eax, 0x50
call fcn.1402d2bf0
sub rsp, rax
mov rax, qword [0x1403bf008]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r15, qword [rbp + 0x60]
mov rdi, rcx
mov r13, qword [rbp + 0x68]
mov r12, rdx
xor r14d, r14d
mov qword [rbp - 0x28], r9
mov esi, r8d
mov qword [rbp - 0x20], r13
movzx eax, byte [r15 + 1]
movzx r10d, byte [r15]
movzx edx, byte [r15 + 4]
movzx ecx, byte [r15 + 7]
mov ebx, dword [r13]
shl eax, 8
or r10d, eax
shl ecx, 8
movzx eax, byte [r15 + 2]
shl eax, 0x10
or r10d, eax
movzx eax, byte [r15 + 3]
shl eax, 0x18
or r10d, eax
movzx eax, byte [r15 + 5]
shl eax, 8
or edx, eax
mov dword [rbp - 0x30], r10d
movzx eax, byte [r15 + 6]
or ecx, eax
mov byte [rbp - 0x18], r10b
shl ecx, 0x10
mov eax, r10d
shr eax, 8
or edx, ecx
mov byte [rbp - 0x17], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0x16], al
mov eax, r10d
shr eax, 0x18
mov byte [rbp - 0x15], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0x13], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0x12], al
mov eax, edx
shr eax, 0x18
mov dword [rbp - 0x2c], edx
mov byte [rbp - 0x14], dl
mov byte [rbp - 0x11], al
test r8d, r8d
je 0x14021d000
mov r13, qword [rbp - 0x28]
sub r12, rdi
movzx r8d, dl
movzx r9d, r10b
nop
dec esi
test ebx, ebx
jne 0x14021cfa1
mov rdx, r13
lea rcx, [rbp - 0x30]
call fcn.14021cad0
mov r10d, dword [rbp - 0x30]
mov eax, r10d
mov edx, dword [rbp - 0x2c]
movzx r9d, byte [rbp - 0x30]
movzx r8d, byte [rbp - 0x2c]
shr eax, 8
mov byte [rbp - 0x17], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0x16], al
mov eax, r10d
shr eax, 0x18
mov byte [rbp - 0x15], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0x13], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0x12], al
mov eax, edx
shr eax, 0x18
mov byte [rbp - 0x11], al
inc r14d
mov byte [rbp - 0x18], r9b
mov byte [rbp - 0x14], r8b
movsxd rax, ebx
movzx ecx, byte [rbp + rax - 0x18]
xor cl, byte [rdi]
mov byte [r12 + rdi], cl
inc rdi
inc ebx
and ebx, 7
test esi, esi
jne 0x14021cf40
mov r13, qword [rbp - 0x20]
test r14d, r14d
je 0x14021d000
mov eax, r10d
mov byte [r15], r9b
shr eax, 8
mov byte [r15 + 1], al
mov eax, r10d
shr eax, 0x10
mov byte [r15 + 2], al
mov eax, edx
shr eax, 8
mov byte [r15 + 5], al
mov eax, edx
shr eax, 0x10
shr r10d, 0x18
shr edx, 0x18
mov byte [r15 + 7], dl
mov byte [r15 + 3], r10b
mov byte [r15 + 4], r8b
mov byte [r15 + 6], al
mov dword [r13], ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400adbc0
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14021e510
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
mov eax, 0x50
call fcn.1402d2bf0
sub rsp, rax
mov rax, qword [0x1403bf008]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r15, qword [rbp + 0x60]
mov r12, rdx
mov r13, qword [rbp + 0x68]
mov rdi, rcx
xor r14d, r14d
mov qword [rbp - 0x28], r9
mov esi, r8d
mov qword [rbp - 0x20], r13
movzx r10d, byte [r15]
movzx eax, byte [r15 + 1]
movzx edx, byte [r15 + 4]
movzx ecx, byte [r15 + 6]
mov ebx, dword [r13]
shl eax, 0x10
shl r10d, 0x18
or r10d, eax
shl edx, 0x18
movzx eax, byte [r15 + 2]
shl eax, 8
or r10d, eax
shl ecx, 8
movzx eax, byte [r15 + 3]
or r10d, eax
movzx eax, byte [r15 + 5]
shl eax, 0x10
or edx, eax
mov dword [rbp - 0x30], r10d
movzx eax, byte [r15 + 7]
or ecx, eax
mov byte [rbp - 0x15], r10b
or edx, ecx
mov eax, r10d
shr eax, 0x18
mov byte [rbp - 0x18], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0x17], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0x16], al
mov eax, edx
shr eax, 0x18
mov byte [rbp - 0x14], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0x13], al
mov eax, edx
shr eax, 8
mov dword [rbp - 0x2c], edx
mov byte [rbp - 0x12], al
mov byte [rbp - 0x11], dl
test r8d, r8d
je 0x14021e6bb
mov r13, qword [rbp - 0x28]
sub r12, rdi
movzx r9d, dl
movzx r8d, r10b
dec esi
test ebx, ebx
jne 0x14021e65c
mov rdx, r13
lea rcx, [rbp - 0x30]
call fcn.14021de50
mov edx, dword [rbp - 0x2c]
mov r9d, edx
mov r10d, dword [rbp - 0x30]
mov eax, r10d
shr eax, 0x18
mov r8d, r10d
mov byte [rbp - 0x18], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0x17], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0x16], al
mov eax, edx
shr eax, 0x18
mov byte [rbp - 0x14], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0x13], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0x12], al
inc r14d
mov byte [rbp - 0x15], r8b
mov byte [rbp - 0x11], dl
movsxd rax, ebx
movzx ecx, byte [rbp + rax - 0x18]
xor cl, byte [rdi]
mov byte [r12 + rdi], cl
inc rdi
inc ebx
and ebx, 7
test esi, esi
jne 0x14021e600
mov r13, qword [rbp - 0x20]
test r14d, r14d
je 0x14021e6bb
mov eax, r10d
mov byte [r15 + 3], r8b
shr eax, 0x18
mov byte [r15], al
mov eax, r10d
shr eax, 0x10
mov byte [r15 + 1], al
mov eax, edx
shr eax, 0x18
mov byte [r15 + 4], al
mov eax, edx
shr eax, 0x10
shr r10d, 8
shr edx, 8
mov byte [r15 + 6], dl
mov byte [r15 + 2], r10b
mov byte [r15 + 5], al
mov byte [r15 + 7], r9b
mov dword [r13], ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400adbc0
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140220fe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
mov eax, 0x50
call fcn.1402d2bf0
sub rsp, rax
mov rax, qword [0x1403bf008]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r15, qword [rbp + 0x60]
mov r12, rdx
mov r13, qword [rbp + 0x68]
mov rdi, rcx
xor r14d, r14d
mov qword [rbp - 0x28], r9
mov esi, r8d
mov qword [rbp - 0x20], r13
movzx r10d, byte [r15]
movzx eax, byte [r15 + 1]
movzx edx, byte [r15 + 4]
movzx ecx, byte [r15 + 6]
mov ebx, dword [r13]
shl eax, 0x10
shl r10d, 0x18
or r10d, eax
shl edx, 0x18
movzx eax, byte [r15 + 2]
shl eax, 8
or r10d, eax
shl ecx, 8
movzx eax, byte [r15 + 3]
or r10d, eax
movzx eax, byte [r15 + 5]
shl eax, 0x10
or edx, eax
mov dword [rbp - 0x30], r10d
movzx eax, byte [r15 + 7]
or ecx, eax
mov byte [rbp - 0x15], r10b
or edx, ecx
mov eax, r10d
shr eax, 0x18
mov byte [rbp - 0x18], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0x17], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0x16], al
mov eax, edx
shr eax, 0x18
mov byte [rbp - 0x14], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0x13], al
mov eax, edx
shr eax, 8
mov dword [rbp - 0x2c], edx
mov byte [rbp - 0x12], al
mov byte [rbp - 0x11], dl
test r8d, r8d
je 0x14022118b
mov r13, qword [rbp - 0x28]
sub r12, rdi
movzx r9d, dl
movzx r8d, r10b
dec esi
test ebx, ebx
jne 0x14022112c
mov rdx, r13
lea rcx, [rbp - 0x30]
call fcn.1402208f0
mov edx, dword [rbp - 0x2c]
mov r9d, edx
mov r10d, dword [rbp - 0x30]
mov eax, r10d
shr eax, 0x18
mov r8d, r10d
mov byte [rbp - 0x18], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0x17], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0x16], al
mov eax, edx
shr eax, 0x18
mov byte [rbp - 0x14], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0x13], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0x12], al
inc r14d
mov byte [rbp - 0x15], r8b
mov byte [rbp - 0x11], dl
movsxd rax, ebx
movzx ecx, byte [rbp + rax - 0x18]
xor cl, byte [rdi]
mov byte [r12 + rdi], cl
inc rdi
inc ebx
and ebx, 7
test esi, esi
jne 0x1402210d0
mov r13, qword [rbp - 0x20]
test r14d, r14d
je 0x14022118b
mov eax, r10d
mov byte [r15 + 3], r8b
shr eax, 0x18
mov byte [r15], al
mov eax, r10d
shr eax, 0x10
mov byte [r15 + 1], al
mov eax, edx
shr eax, 0x18
mov byte [r15 + 4], al
mov eax, edx
shr eax, 0x10
shr r10d, 8
shr edx, 8
mov byte [r15 + 6], dl
mov byte [r15 + 2], r10b
mov byte [r15 + 5], al
mov byte [r15 + 7], r9b
mov dword [r13], ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400adbc0
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140221650
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rsi
push rdi
push r12
push r15
mov eax, gethostbyaddr
call fcn.1402d2bf0
sub rsp, rax
mov rsi, qword [rsp + 0x88]
mov r10, r9
mov rdi, r8
mov r15, rdx
mov r12, rcx
mov ebx, dword [rsi]
test ebx, ebx
jns 0x140221695
mov dword [rsi], 0xffffffff
add rsp, 0x30
pop r15
pop r12
pop rdi
pop rsi
pop rbx
ret
mov qword [rsp + 0x60], rbp
mov rbp, qword [rsp + 0x80]
test ebx, ebx
je 0x1402216c8
test rdi, rdi
je 0x1402216c8
mov eax, ebx
dec rdi
movzx ecx, byte [rax + rbp]
xor cl, byte [r12]
inc r12
mov byte [r15], cl
inc r15
inc ebx
and ebx, 0xf
jne 0x1402216a6
mov r9, qword [rsp + 0x90]
cmp rdi, 0x10
jb 0x140221799
mov qword [rsp + 0x28], r13
mov rsi, r15
mov r13, rdi
mov qword [rsp + 0x20], r14
shr r13, 4
mov r14, r12
imul rax, r13, 0xfffffffffffffff0
sub rsi, rbp
sub r14, rbp
add rdi, rax
mov rax, r13
shl rax, 4
add r15, rax
mov qword [rsp + 0x68], r15
add r12, rax
mov r15, qword [rsp + 0x78]
nop word [rax + rax]
mov r8, r15
mov rdx, rbp
mov rcx, rbp
call r9
cmp ebx, 0x10
jae 0x140221765
mov edx, reloc.WS2_32.dll_ntohs
mov eax, ebx
sub edx, ebx
add rax, rbp
shr edx, 3
inc edx
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [r14 + rax]
xor rcx, qword [rax]
mov qword [rsi + rax], rcx
lea rax, [rax + 8]
sub rdx, 1
jne 0x140221750
mov r9, qword [rsp + 0x90]
add rsi, 0x10
add r14, 0x10
xor ebx, ebx
sub r13, 1
jne 0x140221720
mov r15, qword [rsp + 0x68]
mov r10, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x88]
mov r14, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
test rdi, rdi
je 0x1402217c6
mov r8, r10
mov rdx, rbp
mov rcx, rbp
call r9
nop word [rax + rax]
mov ecx, ebx
inc ebx
movzx eax, byte [rcx + r12]
xor al, byte [rcx + rbp]
mov byte [rcx + r15], al
sub rdi, 1
jne 0x1402217b0
mov dword [rsi], ebx
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x140223190
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r12
push r13
push r14
mov eax, 0x20
call fcn.1402d2bf0
sub rsp, rax
mov r13, qword [rcx + 0x160]
lea r14, [rcx + 0x40]
xor r12d, r12d
mov rdi, r8
mov qword [rcx + 0x30], r12
mov rsi, rdx
mov qword [rcx + 0x38], r12
mov rbx, rcx
mov qword [rcx + 0x170], r12
cmp r8, 0xc
jne 0x1402231f4
movsd xmm0, qword [rdx]
lea edi, [r8 - 0xb]
movsd qword [rcx], xmm0
mov eax, dword [rdx + 8]
mov dword [rcx + 8], eax
mov dword [rcx + 0xc], 0x1000000
jmp 0x14022330c
mov qword [rsp + 0x50], rbp
mov rbp, rdi
mov qword [rsp + 0x58], r15
lea r15, [rcx + 0x60]
mov qword [r14], r12
mov qword [rcx + 0x48], r12
cmp rdi, 0x10
jb 0x1402232b6
mov r12, rdi
shr r12, 4
imul rax, r12, 0xfffffffffffffff0
add rdi, rax
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rsi]
mov rdx, r15
xor byte [r14], al
mov rcx, r14
movzx eax, byte [rsi + 1]
xor byte [rbx + 0x41], al
movzx eax, byte [rsi + 2]
xor byte [rbx + 0x42], al
movzx eax, byte [rsi + 3]
xor byte [rbx + 0x43], al
movzx eax, byte [rsi + 4]
xor byte [rbx + 0x44], al
movzx eax, byte [rsi + 5]
xor byte [rbx + 0x45], al
movzx eax, byte [rsi + 6]
xor byte [rbx + 0x46], al
movzx eax, byte [rsi + 7]
xor byte [rbx + 0x47], al
movzx eax, byte [rsi + 8]
xor byte [rbx + 0x48], al
movzx eax, byte [rsi + 9]
xor byte [rbx + 0x49], al
movzx eax, byte [rsi + 0xa]
xor byte [rbx + 0x4a], al
movzx eax, byte [rsi + 0xb]
xor byte [rbx + 0x4b], al
movzx eax, byte [rsi + 0xc]
xor byte [rbx + 0x4c], al
movzx eax, byte [rsi + 0xd]
xor byte [rbx + 0x4d], al
movzx eax, byte [rsi + 0xe]
xor byte [rbx + 0x4e], al
movzx eax, byte [rsi + 0xf]
xor byte [rbx + 0x4f], al
call r13
add rsi, 0x10
sub r12, 1
jne 0x140223230
test rdi, rdi
je 0x1402232db
mov rcx, r14
sub rsi, rbx
movzx eax, byte [rsi + rcx - 0x40]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub rdi, 1
jne 0x1402232c1
mov rdx, r15
mov rcx, r14
call r13
shl rbp, 3
mov rdx, r15
bswap rbp
xor qword [rbx + 0x48], rbp
mov rcx, r14
call r13
mov rax, qword [r14]
mov edi, dword [rbx + 0x4c]
mov r15, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
mov qword [rbx], rax
mov rax, qword [rbx + 0x48]
mov qword [rbx + 8], rax
bswap edi
mov qword [r14], r12
lea rdx, [rbx + 0x20]
mov qword [rbx + 0x48], r12
mov rcx, rbx
mov r8, qword [rbx + 0x180]
call qword [rbx + 0x178]
inc edi
bswap edi
mov dword [rbx + 0xc], edi
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret