joyce8/EMBER2024-capa huggingface dataset:
Function at 0x608a60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
mov eax, 0x78
call fcn.00693bc0
sub rsp, rax
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x40], r14
mov r14, qword [rsp + 0xb0]
mov ebx, dword [r14]
mov qword [rsp + 0x38], r15
mov r15, qword [rsp + 0xa8]
test ebx, ebx
mov r10, r9
mov rdi, r8
mov rsi, rdx
mov rbp, rcx
je 0x608ad5
test rdi, rdi
je 0x608ad5
mov eax, ebx
inc rsi
inc rbp
movzx ecx, byte [rax + r15]
dec rdi
xor cl, byte [rbp - 1]
inc ebx
and ebx, 0xf
mov byte [rsi - 1], cl
jne 0x608ab3
mov r9, qword [rsp + 0xb8]
mov qword [rsp + 0x50], r12
mov r12d, reloc.WS2_32.dll_recv
cmp rdi, r12
mov qword [rsp + 0x48], r13
jb 0x608bf9
mov rcx, rdi
mov r13, rsi
mov r14, rbp
shr rcx, 4
sub r13, r15
sub r14, r15
mov rax, rcx
imul rax, rax, 0xfffffffffffffff0
add rdi, rax
mov rax, rcx
shl rax, 4
mov qword [rsp + 0x90], rdi
mov rdi, qword [rsp + 0xa0]
add rsi, rax
add rbp, rax
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x88], rsi
mov rbp, rcx
movsxd rsi, ebx
nop
nop
nop
mov r8, r10
mov rdx, r15
mov rcx, rdi
call r9
mov r11d, r12d
lea rcx, [rdi + 0x10]
nop
nop
nop
nop
movzx eax, byte [rcx - 1]
dec rcx
add r11d, 0xffffffff
inc al
mov byte [rcx], al
jne 0x608b86
test r11d, r11d
jne 0x608b70
cmp ebx, r12d
jae 0x608bb6
mov edx, reloc.WS2_32.dll_ntohs
lea rcx, [rsi + r15]
sub edx, ebx
shr edx, 3
inc edx
nop
nop
mov rax, qword [r14 + rcx]
add rcx, 8
xor rax, qword [rcx - 8]
dec rdx
mov qword [r13 + rcx - 8], rax
jne 0x608ba0
mov r9, qword [rsp + 0xb8]
mov r10, qword [rsp + 0x98]
add r13, r12
add r14, r12
xor ebx, ebx
xor esi, esi
dec rbp
jne 0x608b50
mov rdi, qword [rsp + 0x90]
mov rsi, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x80]
mov r14, qword [rsp + 0xb0]
test rdi, rdi
je 0x608c63
mov r13, qword [rsp + 0xa0]
mov r8, r10
mov rdx, r15
mov rcx, r13
call r9
lea rcx, [r13 + 0x10]
nop
nop
nop
movzx eax, byte [rcx - 1]
dec rcx
add r12d, 0xffffffff
inc al
mov byte [rcx], al
jne 0x608c36
test r12d, r12d
jne 0x608c20
movsxd rcx, ebx
sub rbp, r15
sub rsi, r15
add rcx, r15
add ebx, edi
nop
nop
nop
movzx eax, byte [rcx + rbp]
inc rcx
xor al, byte [rcx - 1]
dec rdi
mov byte [rcx + rsi - 1], al
jne 0x608c50
mov r15, qword [rsp + 0x38]
mov r13, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov dword [r14], ebx
mov r14, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x70]
add rsp, 0x78
ret
Function at 0x608cd0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
mov eax, 0x78
call fcn.00693bc0
sub rsp, rax
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x60], rsi
mov rbx, r8
mov r8, qword [rsp + 0xb0]
mov qword [rsp + 0x58], rdi
mov edi, dword [r8]
mov rsi, rdx
mov rbp, rcx
test edi, edi
mov dword [rsp + 0x90], edi
je 0x608d48
mov rdx, qword [rsp + 0xa8]
nop
test rbx, rbx
je 0x608d41
mov eax, edi
inc rsi
inc rbp
movzx ecx, byte [rax + rdx]
dec rbx
xor cl, byte [rbp - 1]
inc edi
and edi, 0xf
mov byte [rsi - 1], cl
jne 0x608d20
mov dword [rsp + 0x90], edi
cmp rbx, 0x10
mov rax, qword [rsp + 0xa0]
mov r10, qword [rsp + 0xb8]
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r15
mov r15d, dword [rax + 0xc]
lea r12, [rax + 0xc]
bswap r15d
mov r14d, reloc.WS2_32.dll_inet_ntoa
jb 0x608e47
mov rdi, qword [rsp + 0xa0]
mov eax, 0x10000000
nop
nop
nop
mov r13, rbx
shr r13, 4
cmp r13, rax
cmova r13, rax
add r15d, r13d
mov eax, r15d
cmp rax, r13
jae 0x608dbf
sub r13, rax
xor r15d, r15d
mov r8, r13
mov rdx, rsi
mov rcx, rbp
mov qword [rsp + 0x20], rdi
call r10
test r15d, r15d
mov r11d, r15d
bswap r11d
mov dword [r12], r11d
jne 0x608e04
mov ecx, r14d
mov rdx, r12
nop
nop
nop
movzx eax, byte [rdx - 1]
dec rdx
add ecx, 0xffffffff
inc al
mov byte [rdx], al
jne 0x608e04
test ecx, ecx
jne 0x608df0
mov r10, qword [rsp + 0xb8]
mov r9, qword [rsp + 0x98]
shl r13, 4
sub rbx, r13
add rsi, r13
add rbp, r13
cmp rbx, 0x10
mov eax, 0x10000000
jae 0x608da0
mov edi, dword [rsp + 0x90]
mov rax, qword [rsp + 0xa0]
mov r8, qword [rsp + 0xb0]
test rbx, rbx
je 0x608ecf
mov r13, qword [rsp + 0xa8]
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov qword [r13], rcx
lea r8d, [rcx + 1]
mov qword [r13 + 8], rcx
mov rcx, r13
mov rdx, r13
call r10
inc r15d
bswap r15d
mov dword [r12], r15d
jne 0x608e9a
movzx eax, byte [r12 - 1]
dec r12
add r14d, 0xffffffff
inc al
mov byte [r12], al
jne 0x608e9a
test r14d, r14d
jne 0x608e80
movsxd rcx, edi
sub rbp, r13
sub rsi, r13
add rcx, r13
add edi, ebx
nop
nop
movzx eax, byte [rcx + rbp]
inc rcx
xor al, byte [rcx - 1]
dec rbx
mov byte [rsi + rcx - 1], al
jne 0x608eb0
mov rax, qword [rsp + 0xb0]
mov dword [rax], edi
jmp 0x608ed2
mov dword [r8], edi
mov r15, qword [rsp + 0x38]
mov r14, qword [rsp + 0x40]
mov r13, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x70]
add rsp, 0x78
ret
Function at 0x631e60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x88
call fcn.00693bc0
sub rsp, rax
mov rax, qword [0x0072f1d0]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x78], rbp
movzx r10d, byte [rax]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x68], rdi
lea rdi, [rax + 1]
mov qword [rsp + 0x60], r12
movzx eax, byte [rdi]
mov rbp, rcx
movzx ecx, byte [rdi + 6]
shl eax, 8
mov qword [rsp + 0x58], r13
mov r12, rdx
movzx edx, byte [rdi + 3]
or r10d, eax
movzx eax, byte [rdi + 1]
shl eax, 0x10
shl ecx, 8
mov qword [rsp + 0x50], r14
mov r14, qword [rsp + 0xb8]
or r10d, eax
movzx eax, byte [rdi + 2]
mov ebx, dword [r14]
shl eax, 0x18
mov qword [rsp + 0x48], r15
or r10d, eax
movzx eax, byte [rdi + 4]
mov r15, r9
shl eax, 8
lea r9, [rdi + 5]
xor r13d, r13d
or edx, eax
movzx eax, byte [r9]
mov esi, r8d
or ecx, eax
mov eax, r10d
mov dword [rsp + 0x20], r10d
shr eax, 8
shl ecx, 0x10
mov byte [rsp + 0x30], r10b
mov byte [rsp + 0x31], al
or edx, ecx
mov eax, r10d
shr eax, 0x10
mov dword [rsp + 0x24], edx
mov byte [rsp + 0x34], dl
mov byte [rsp + 0x32], al
mov eax, r10d
shr eax, 0x18
mov byte [rsp + 0x33], al
mov eax, edx
shr eax, 8
mov byte [rsp + 0x35], al
mov eax, edx
shr eax, 0x10
mov byte [rsp + 0x36], al
mov eax, edx
shr eax, 0x18
test r8d, r8d
mov byte [rsp + 0x37], al
je 0x63203f
movzx r8d, dl
movzx r9d, r10b
nop
dec esi
test ebx, ebx
jne 0x631fdc
lea rcx, [rsp + 0x20]
mov rdx, r15
call fcn.00631060
mov r10d, dword [rsp + 0x20]
mov edx, dword [rsp + 0x24]
mov r9b, byte [rsp + 0x20]
mov r8b, byte [rsp + 0x24]
mov eax, r10d
shr eax, 8
mov byte [rsp + 0x30], r9b
mov byte [rsp + 0x34], r8b
mov byte [rsp + 0x31], al
mov eax, r10d
shr eax, 0x10
mov byte [rsp + 0x32], al
mov eax, r10d
shr eax, 0x18
mov byte [rsp + 0x33], al
mov eax, edx
shr eax, 8
mov byte [rsp + 0x35], al
mov eax, edx
shr eax, 0x10
mov byte [rsp + 0x36], al
mov eax, edx
shr eax, 0x18
inc r13d
mov byte [rsp + 0x37], al
movsxd rax, ebx
inc r12
inc rbp
movzx ecx, byte [rsp + rax + 0x30]
xor cl, byte [rbp - 1]
inc ebx
mov byte [r12 - 1], cl
and ebx, 7
test esi, esi
jne 0x631f70
test r13d, r13d
je 0x63203f
mov rax, qword [rsp + 0x28]
mov byte [rax], r9b
mov eax, r10d
shr eax, 8
mov byte [rdi], al
mov eax, r10d
shr r10d, 0x18
shr eax, 0x10
mov byte [rdi + 1], al
mov byte [rdi + 2], r10b
mov byte [rdi + 3], r8b
mov eax, edx
shr eax, 8
mov byte [rdi + 4], al
mov eax, edx
shr eax, 0x10
shr edx, 0x18
mov byte [rdi + 5], al
mov byte [rdi + 6], dl
mov r15, qword [rsp + 0x48]
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov dword [r14], ebx
mov r14, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
call fcn.00693b90
add rsp, 0x88
ret
Function at 0x632080
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push rbx
mov eax, r9d
mov r9d, 0x80
mov r11, r8
cmp edx, r9d
mov r10, rcx
mov byte [rcx], 0
cmovg edx, r9d
test eax, eax
mov ebx, 0x400
jle 0x6320ab
cmp eax, ebx
cmovg eax, ebx
mov ebx, eax
movsxd rdx, edx
test rdx, rdx
jle 0x6320d0
sub r11, r10
mov r8, rdx
nop
nop
movzx eax, byte [r11 + rcx]
inc rcx
dec r8
mov byte [rcx - 1], al
jne 0x6320c0
cmp rdx, r9
movzx ecx, byte [rdx + r10 - 1]
lea r11, [0x006d3370]
jge 0x63210b
mov r8, r10
sub r8, rdx
nop
nop
mov al, byte [r8 + rdx]
inc rdx
add eax, ecx
cmp rdx, r9
movzx ecx, al
movzx ecx, byte [rcx + r11]
mov byte [rdx + r10 - 1], cl
jl 0x6320f0
lea edx, [rbx + 7]
neg ebx
mov eax, 0xff
sar edx, 3
and ebx, 7
sub r9d, edx
movzx ecx, bl
sar eax, cl
movsxd r8, r9d
movsxd r9, edx
mov ecx, eax
movzx eax, byte [r8 + r10]
and rcx, rax
test r8, r8
movzx eax, byte [rcx + r11]
mov byte [r8 + r10], al
je 0x632168
lea rdx, [r8 + r10]
nop
nop
nop
movzx ecx, byte [rdx + r9 - 1]
dec rdx
xor rcx, rax
dec r8
movzx eax, byte [rcx + r11]
mov byte [rdx], al
jne 0x632150
lea r8, [r10 + 0xfc]
lea rdx, [r10 + 0x7e]
mov r9d, 0x40
nop
nop
movzx eax, byte [rdx]
movzx ecx, byte [rdx + 1]
sub r8, 4
shl ecx, 8
sub rdx, 2
or ecx, eax
dec r9
movzx eax, cx
mov dword [r8 + 4], eax
jne 0x632180
pop rbx
ret
Function at 0x633a50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x88
call fcn.00693bc0
sub rsp, rax
mov rax, qword [0x0072f1d0]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x78], rbp
movzx r10d, byte [rax]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x68], rdi
lea rdi, [rax + 1]
mov esi, r8d
movzx eax, byte [rdi]
movzx r8d, byte [rdi + 3]
shl r10d, 0x18
shl eax, 0x10
mov qword [rsp + 0x60], r12
mov rbp, rcx
movzx ecx, byte [rdi + 5]
or r10d, eax
movzx eax, byte [rdi + 1]
shl eax, 8
shl r8d, 0x18
shl ecx, 8
or r10d, eax
movzx eax, byte [rdi + 2]
mov qword [rsp + 0x58], r13
or r10d, eax
movzx eax, byte [rdi + 4]
mov r12, rdx
shl eax, 0x10
lea rdx, [rdi + 5]
mov qword [rsp + 0x50], r14
mov r14, qword [rsp + 0xb8]
or r8d, eax
movzx eax, byte [rdx + 1]
mov ebx, dword [r14]
or ecx, eax
mov eax, r10d
shr eax, 0x18
or r8d, ecx
xor r13d, r13d
mov byte [rsp + 0x30], al
mov eax, r10d
mov qword [rsp + 0x48], r15
shr eax, 0x10
mov r15, r9
mov dword [rsp + 0x20], r10d
mov byte [rsp + 0x31], al
mov eax, r10d
mov dword [rsp + 0x24], r8d
shr eax, 8
mov byte [rsp + 0x33], r10b
mov byte [rsp + 0x37], r8b
mov byte [rsp + 0x32], al
mov eax, r8d
shr eax, 0x18
mov byte [rsp + 0x34], al
mov eax, r8d
shr eax, 0x10
mov byte [rsp + 0x35], al
mov eax, r8d
shr eax, 8
test esi, esi
mov byte [rsp + 0x36], al
je 0x633c3a
movzx edx, r8b
movzx r9d, r10b
dec esi
test ebx, ebx
jne 0x633bd4
lea rcx, [rsp + 0x20]
mov rdx, r15
call fcn.00632c20
mov r10d, dword [rsp + 0x20]
mov r8d, dword [rsp + 0x24]
mov eax, r10d
mov r9b, r10b
mov byte [rsp + 0x33], r10b
shr eax, 0x18
mov dl, r8b
mov byte [rsp + 0x37], r8b
mov byte [rsp + 0x30], al
mov eax, r10d
shr eax, 0x10
mov byte [rsp + 0x31], al
mov eax, r10d
shr eax, 8
mov byte [rsp + 0x32], al
mov eax, r8d
shr eax, 0x18
mov byte [rsp + 0x34], al
mov eax, r8d
shr eax, 0x10
mov byte [rsp + 0x35], al
mov eax, r8d
shr eax, 8
inc r13d
mov byte [rsp + 0x36], al
movsxd rax, ebx
inc r12
inc rbp
movzx ecx, byte [rsp + rax + 0x30]
xor cl, byte [rbp - 1]
inc ebx
mov byte [r12 - 1], cl
and ebx, 7
test esi, esi
jne 0x633b68
test r13d, r13d
je 0x633c3a
mov rcx, qword [rsp + 0x28]
mov eax, r10d
shr eax, 0x18
mov byte [rcx], al
mov eax, r10d
shr r10d, 8
shr eax, 0x10
mov byte [rdi], al
mov byte [rdi + 1], r10b
mov byte [rdi + 2], r9b
mov eax, r8d
shr eax, 0x18
mov byte [rdi + 3], al
mov eax, r8d
shr eax, 0x10
shr r8d, 8
mov byte [rdi + 4], al
mov byte [rdi + 5], r8b
mov byte [rdi + 6], dl
mov r15, qword [rsp + 0x48]
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov dword [r14], ebx
mov r14, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
call fcn.00693b90
add rsp, 0x88
ret
Function at 0x634360
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0xa8
call fcn.00693bc0
sub rsp, rax
mov rax, qword [0x0072f1d0]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0x98], rbp
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x88], rdi
lea rdi, [rax + 1]
mov qword [rsp + 0x80], r12
mov rbp, rcx
mov rcx, qword [rsp + 0xd8]
mov qword [rsp + 0x78], r13
mov esi, r8d
movzx r8d, byte [rdi + 3]
mov qword [rsp + 0x28], rcx
movzx ecx, byte [rdi + 6]
mov qword [rsp + 0x70], r14
mov r14, qword [rsp + 0xe8]
shl ecx, 8
mov qword [rsp + 0x68], r15
mov ebx, dword [r14]
mov r15, r9
movzx r9d, byte [rax]
movzx eax, byte [rdi]
xor r13d, r13d
mov r12, rdx
shl eax, 8
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x30], rdi
or r9d, eax
movzx eax, byte [rdi + 1]
shl eax, 0x10
or r9d, eax
movzx eax, byte [rdi + 2]
shl eax, 0x18
or r9d, eax
movzx eax, byte [rdi + 4]
shl eax, 8
mov dword [rsp + 0x20], r9d
mov byte [rsp + 0x50], r9b
or r8d, eax
movzx eax, byte [rdi + 5]
or ecx, eax
mov eax, r9d
shr eax, 8
shl ecx, 0x10
mov byte [rsp + 0x51], al
or r8d, ecx
mov eax, r9d
shr eax, 0x10
mov dword [rsp + 0x24], r8d
mov byte [rsp + 0x54], r8b
mov byte [rsp + 0x52], al
mov eax, r9d
shr eax, 0x18
mov byte [rsp + 0x53], al
mov eax, r8d
shr eax, 8
mov byte [rsp + 0x55], al
mov eax, r8d
shr eax, 0x10
mov byte [rsp + 0x56], al
mov eax, r8d
shr eax, 0x18
test esi, esi
mov byte [rsp + 0x57], al
je 0x634589
mov r14, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x28]
dec esi
test ebx, ebx
jne 0x634518
lea rcx, [rsp + 0x20]
mov r9, rdi
mov r8, r14
mov rdx, r15
call fcn.0061ee80
mov r9d, dword [rsp + 0x20]
mov r8d, dword [rsp + 0x24]
movzx eax, r9b
mov eax, r9d
mov byte [rsp + 0x50], r9b
shr eax, 8
mov byte [rsp + 0x54], r8b
mov byte [rsp + 0x51], al
mov eax, r9d
shr eax, 0x10
mov byte [rsp + 0x52], al
mov eax, r9d
shr eax, 0x18
mov byte [rsp + 0x53], al
movzx eax, r8b
mov eax, r8d
shr eax, 8
mov byte [rsp + 0x55], al
mov eax, r8d
shr eax, 0x10
mov byte [rsp + 0x56], al
mov eax, r8d
shr eax, 0x18
inc r13d
mov byte [rsp + 0x57], al
movsxd rax, ebx
inc r12
inc rbp
movzx ecx, byte [rsp + rax + 0x50]
xor cl, byte [rbp - 1]
inc ebx
mov byte [r12 - 1], cl
and ebx, 7
test esi, esi
jne 0x6344a4
test r13d, r13d
mov rdi, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
je 0x634589
mov rax, qword [rsp + 0x48]
mov byte [rax], r9b
mov eax, r9d
shr eax, 8
mov byte [rdi], al
mov eax, r9d
shr r9d, 0x18
shr eax, 0x10
mov byte [rdi + 1], al
mov byte [rdi + 2], r9b
mov byte [rdi + 3], r8b
mov eax, r8d
shr eax, 8
mov byte [rdi + 4], al
mov eax, r8d
shr eax, 0x10
shr r8d, 0x18
mov byte [rdi + 5], al
mov byte [rdi + 6], r8b
mov r15, qword [rsp + 0x68]
mov r13, qword [rsp + 0x78]
mov r12, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x98]
mov dword [r14], ebx
mov r14, qword [rsp + 0x70]
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x58]
call fcn.00693b90
add rsp, 0xa8
ret
Function at 0x635200
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x88
call fcn.00693bc0
sub rsp, rax
mov rax, qword [0x0072f1d0]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x78], rbp
movzx r10d, byte [rax]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x68], rdi
lea rdi, [rax + 1]
mov qword [rsp + 0x60], r12
movzx eax, byte [rdi]
mov rbp, rcx
movzx ecx, byte [rdi + 6]
shl eax, 8
mov qword [rsp + 0x58], r13
mov r12, rdx
movzx edx, byte [rdi + 3]
or r10d, eax
movzx eax, byte [rdi + 1]
shl eax, 0x10
shl ecx, 8
mov qword [rsp + 0x50], r14
mov r14, qword [rsp + 0xb8]
or r10d, eax
movzx eax, byte [rdi + 2]
mov ebx, dword [r14]
shl eax, 0x18
mov qword [rsp + 0x48], r15
or r10d, eax
movzx eax, byte [rdi + 4]
mov r15, r9
shl eax, 8
lea r9, [rdi + 5]
xor r13d, r13d
or edx, eax
movzx eax, byte [r9]
mov esi, r8d
or ecx, eax
mov eax, r10d
mov dword [rsp + 0x20], r10d
shr eax, 8
shl ecx, 0x10
mov byte [rsp + 0x30], r10b
mov byte [rsp + 0x31], al
or edx, ecx
mov eax, r10d
shr eax, 0x10
mov dword [rsp + 0x24], edx
mov byte [rsp + 0x34], dl
mov byte [rsp + 0x32], al
mov eax, r10d
shr eax, 0x18
mov byte [rsp + 0x33], al
mov eax, edx
shr eax, 8
mov byte [rsp + 0x35], al
mov eax, edx
shr eax, 0x10
mov byte [rsp + 0x36], al
mov eax, edx
shr eax, 0x18
test r8d, r8d
mov byte [rsp + 0x37], al
je 0x6353e3
movzx r8d, dl
movzx r9d, r10b
nop
dec esi
test ebx, ebx
jne 0x635380
lea r8d, [rbx + 1]
lea rcx, [rsp + 0x20]
mov rdx, r15
call fcn.0061e7e0
mov r10d, dword [rsp + 0x20]
mov edx, dword [rsp + 0x24]
mov r9b, byte [rsp + 0x20]
mov r8b, byte [rsp + 0x24]
mov eax, r10d
shr eax, 8
mov byte [rsp + 0x30], r9b
mov byte [rsp + 0x34], r8b
mov byte [rsp + 0x31], al
mov eax, r10d
shr eax, 0x10
mov byte [rsp + 0x32], al
mov eax, r10d
shr eax, 0x18
mov byte [rsp + 0x33], al
mov eax, edx
shr eax, 8
mov byte [rsp + 0x35], al
mov eax, edx
shr eax, 0x10
mov byte [rsp + 0x36], al
mov eax, edx
shr eax, 0x18
inc r13d
mov byte [rsp + 0x37], al
movsxd rax, ebx
inc r12
inc rbp
movzx ecx, byte [rsp + rax + 0x30]
xor cl, byte [rbp - 1]
inc ebx
mov byte [r12 - 1], cl
and ebx, 7
test esi, esi
jne 0x635310
test r13d, r13d
je 0x6353e3
mov rax, qword [rsp + 0x28]
mov byte [rax], r9b
mov eax, r10d
shr eax, 8
mov byte [rdi], al
mov eax, r10d
shr r10d, 0x18
shr eax, 0x10
mov byte [rdi + 1], al
mov byte [rdi + 2], r10b
mov byte [rdi + 3], r8b
mov eax, edx
shr eax, 8
mov byte [rdi + 4], al
mov eax, edx
shr eax, 0x10
shr edx, 0x18
mov byte [rdi + 5], al
mov byte [rdi + 6], dl
mov r15, qword [rsp + 0x48]
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov dword [r14], ebx
mov r14, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
call fcn.00693b90
add rsp, 0x88
ret
Function at 0x649e00
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x88
call fcn.00693bc0
sub rsp, rax
mov rax, qword [0x0072f1d0]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x60], r12
mov r12, qword [rsp + 0xb0]
lea edi, [rdx - 1]
mov qword [rsp + 0x58], r13
lea eax, [rdi - 0x29]
mov esi, r9d
mov r13, r8
cmp r9d, eax
jle 0x649e6d
mov edx, 0x79
lea r9, [0x00768ec8]
mov dword [rsp + 0x20], reloc.WLDAP32.dll_Ordinal_46
lea ecx, [rdx - 0x75]
lea r8d, [rdx - 0xb]
call fcn.005ad900
xor eax, eax
jmp 0x64a04e
cmp edi, 0x29
jge 0x649e99
mov edx, 0x79
lea r9, [0x00768ee0]
mov dword [rsp + 0x20], reloc.WS2_32.dll_gethostbyname
lea ecx, [rdx - 0x75]
lea r8d, [rdx - 1]
call fcn.005ad900
xor eax, eax
jmp 0x64a04e
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x78], rbp
mov byte [rcx], 0
lea rbp, [rcx + 0x15]
lea rbx, [rcx + 1]
call fcn.005b3d00
movsxd rdx, dword [rsp + 0xb8]
xor r9d, r9d
mov r8, rbp
mov rcx, r12
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
call fcn.005d2f80
test eax, eax
je 0x649f64
mov eax, edi
lea rcx, [rbp + 0x14]
xor edx, edx
sub eax, esi
sub eax, 0x29
movsxd r8, eax
call sub.msvcrt.dll_memset
movsxd rax, esi
movsxd r11, edi
sub r11, rax
mov r8, rsi
mov rdx, r13
lea rcx, [r11 + rbp - 0x14]
mov byte [r11 + rbp - 0x15], 1
call sub.msvcrt.dll_memcpy
mov edx, reloc.WS2_32.dll_sendto
mov rcx, rbx
call fcn.005b4190
test eax, eax
jle 0x649f64
add edi, 0xffffffec
lea rdx, [0x00768ef8]
mov r8d, Ordinal_79
mov ecx, edi
call fcn.005bde70
test rax, rax
mov rsi, rax
jne 0x649f6b
lea r9, [0x00768f10]
lea edx, [rax + 0x79]
lea ecx, [rax + 4]
lea r8d, [rax + 0x41]
mov dword [rsp + 0x20], Ordinal_79
call fcn.005ad900
xor eax, eax
jmp 0x64a041
mov r9d, reloc.WS2_32.dll_sendto
mov r8, rbx
mov edx, edi
mov rcx, rax
call fcn.00649da0
test eax, eax
js 0x649f64
test edi, edi
jle 0x649fb0
mov r11, rsi
mov rcx, rbp
mov r10d, edi
sub r11, rbp
nop
nop
nop
nop
movzx eax, byte [r11 + rcx]
inc rcx
xor byte [rcx - 1], al
dec r10
jne 0x649fa0
call fcn.005b3d00
lea rcx, [rsp + 0x30]
mov r9d, edi
mov r8, rbp
mov edx, reloc.WS2_32.dll_sendto
mov qword [rsp + 0x20], rax
call fcn.00649bc0
test eax, eax
js 0x649f64
lea rdx, [rsp + 0x30]
lea r8, [rsp + 0x31]
lea r9, [rsp + 0x32]
lea r10, [rsp + 0x33]
lea r11, [rsp + 0x34]
sub rdx, rbx
sub r8, rbx
sub r9, rbx
sub r10, rbx
sub r11, rbx
mov ecx, 4
movzx eax, byte [rdx + rbx]
add rbx, 5
xor byte [rbx - 5], al
movzx eax, byte [r8 + rbx - 5]
xor byte [rbx - 4], al
movzx eax, byte [r9 + rbx - 5]
xor byte [rbx - 3], al
movzx eax, byte [r10 + rbx - 5]
xor byte [rbx - 2], al
movzx eax, byte [r11 + rbx - 5]
xor byte [rbx - 1], al
dec rcx
jne 0x64a000
mov rcx, rsi
call fcn.005be2c0
mov eax, 1
mov rbx, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x48]
call fcn.00693b90
add rsp, 0x88
ret
Function at 0x64a510
Capabilities:
Check for software breakpoints

Disassembly:
push rbx
mov eax, gethostbyaddr
call fcn.00693bc0
sub rsp, rax
cmp dword [rsp + 0x60], r9d
mov r10, rcx
jne 0x64a5d1
movzx eax, byte [r8]
cmp al, 0x6a
je 0x64a53d
cmp al, 0x6b
jne 0x64a5d1
cmp al, 0x6b
lea rdx, [r8 + 1]
jne 0x64a59a
lea ebx, [r9 - 3]
xor eax, eax
test ebx, ebx
jle 0x64a566
nop
movzx ecx, byte [rdx]
inc rdx
cmp cl, 0xba
je 0x64a566
cmp cl, 0xbb
jne 0x64a583
inc eax
cmp eax, ebx
jl 0x64a550
sub ebx, eax
test eax, eax
jne 0x64a59e
mov dword [rsp + 0x20], Ordinal_143
lea r9, [0x00768fe8]
mov r8d, Ordinal_143
jmp 0x64a5e6
mov dword [rsp + 0x20], 0x81
lea r9, [0x00768fd0]
mov r8d, Ordinal_143
jmp 0x64a5e6
lea ebx, [r9 - 2]
movsxd rax, ebx
cmp byte [rax + rdx], 0xcc
je 0x64a5be
mov dword [rsp + 0x20], __WSAFDIsSet
lea r9, str..crypto_rsa_rsa_x931.c
mov r8d, Ordinal_143
jmp 0x64a5e6
mov r8d, ebx
mov rcx, r10
call sub.msvcrt.dll_memcpy
mov eax, ebx
add rsp, 0x30
pop rbx
ret
mov dword [rsp + 0x20], WSAStartup
lea r9, [0x00768fb8]
mov r8d, 0x89
mov edx, 0x80
lea ecx, [rdx - 0x7c]
call fcn.005ad900
mov eax, 0xffffffff
add rsp, 0x30
pop rbx
ret