joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400984d0
Capabilities:
Encode data using xor

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r15
mov eax, 0x58
call fcn.140103e70
sub rsp, rax
mov esi, dword [rsp + 0xb0]
mov r15, rcx
movsxd r12, edx
mov ecx, esi
mov edi, 1
mov edx, r12d
shl edi, cl
mov rcx, r15
mov r13d, r9d
mov rbx, r8
call fcn.14004ace0
test rax, rax
jne 0x140098529
add rsp, 0x58
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
cmp esi, 3
mov qword [rsp + 0xa0], r12
jg 0x1400985a6
xor r10d, r10d
test r12d, r12d
jle 0x140098763
movsxd rsi, edi
shl rsi, 3
nop dword [rax]
xor r9d, r9d
xor edx, edx
test edi, edi
jle 0x14009858e
mov r8, rbx
nop dword [rax]
mov ecx, edx
inc edx
add r8, 8
xor ecx, r13d
lea eax, [rcx - 1]
not ecx
shr ecx, 0x1f
shr eax, 0x1f
and ecx, eax
mov rax, qword [r8 - 8]
neg ecx
and ecx, 1
neg rcx
and rcx, rax
or r9, rcx
cmp edx, edi
jl 0x140098560
mov rax, qword [r15]
inc r10
add rbx, rsi
cmp r10, r12
mov qword [rax + r10*8 - 8], r9
jl 0x140098550
jmp 0x140098763
lea ecx, [rsi - 2]
mov edx, r13d
mov r8d, 1
sar edx, cl
shl r8d, cl
mov qword [rsp + 0xa8], rbp
lea ecx, [rdx - 1]
lea eax, [r8 - 1]
mov qword [rsp + 0x50], r14
and r13d, eax
shr ecx, 0x1f
mov eax, edx
not eax
xor r14d, r14d
movsxd rbp, r8d
shr eax, 0x1f
mov qword [rsp + 0x20], r14
and eax, ecx
mov ecx, edx
neg eax
xor ecx, 1
and eax, 1
neg rax
mov qword [rsp + 0x30], rax
lea eax, [rcx - 1]
not ecx
shr ecx, 0x1f
shr eax, 0x1f
and eax, ecx
mov ecx, edx
xor edx, 3
xor ecx, 2
neg eax
and eax, 1
neg rax
mov qword [rsp + 0x38], rax
lea eax, [rcx - 1]
not ecx
shr ecx, 0x1f
shr eax, 0x1f
and eax, ecx
lea ecx, [rdx - 1]
not edx
shr ecx, 0x1f
neg eax
shr edx, 0x1f
and ecx, edx
and eax, 1
neg ecx
neg rax
and ecx, 1
mov qword [rsp + 0x40], rax
neg rcx
mov qword [rsp + 0x28], rcx
test r12d, r12d
jle 0x140098756
movsxd rax, edi
shl rax, 3
mov qword [rsp + 0x48], rax
mov rax, r12
nop word [rax + rax]
xor r12d, r12d
xor r11d, r11d
xor r10d, r10d
test rbp, rbp
jle 0x14009872b
mov r15, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
mov r9, rbp
lea rax, [rbp + rbp*2]
shl r9, 4
lea rdi, [rbx + rbp*8]
add r9, rbx
lea rsi, [rbx + rax*8]
nop word [rax + rax]
mov rax, qword [rsi]
mov r8d, r11d
inc r10
and rax, rcx
mov rcx, qword [r9]
mov rdx, qword [rdi]
and rcx, qword [rsp + 0x40]
xor r8d, r13d
and rdx, r14
or rcx, rax
mov rax, qword [rbx + r10*8 - 8]
inc r11d
or rdx, rcx
lea ecx, [r8 - 1]
and rax, r15
shr ecx, 0x1f
or rax, rdx
not r8d
shr r8d, 0x1f
add rsi, 8
add r9, 8
and ecx, r8d
add rdi, 8
neg ecx
and ecx, 1
neg rcx
and rcx, rax
or r12, rcx
cmp r10, rbp
mov rcx, qword [rsp + 0x28]
jl 0x1400986b0
mov r14, qword [rsp + 0x20]
mov r15, qword [rsp + 0x90]
mov rax, qword [rsp + 0xa0]
mov rcx, qword [r15]
add rbx, qword [rsp + 0x48]
inc r14
cmp r14, rax
mov qword [rcx + r14*8 - 8], r12
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x20], r14
jl 0x140098670
mov r12d, dword [rsp + 0x98]
mov rbp, qword [rsp + 0xa8]
mov r14, qword [rsp + 0x50]
mov dword [r15 + 8], r12d
mov eax, 1
add rsp, 0x58
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x14009b4a0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
xor ebx, ebx
mov r10, rdx
test rcx, rcx
je 0x14009b4bc
test byte [rcx + 0x5c], 2
lea r11, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz._
jne 0x14009b4c3
lea r11, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
test r9d, r9d
jle 0x14009b5b0
nop dword [rax]
cmp r9d, 3
movzx ecx, byte [r8]
jl 0x14009b533
movzx eax, byte [r8 + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8 + 2]
shl ecx, 8
or ecx, eax
mov eax, ecx
mov edx, ecx
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rax + r11]
mov byte [r10], al
mov eax, ecx
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rax + r11]
mov byte [r10 + 1], al
mov eax, ecx
shr rax, 6
and eax, 0x3f
and edx, 0x3f
movzx eax, byte [rax + r11]
mov byte [r10 + 2], al
movzx eax, byte [rdx + r11]
mov byte [r10 + 3], al
jmp 0x14009b58c
shl ecx, 0x10
cmp r9d, 2
jne 0x14009b546
movzx eax, byte [r8 + 1]
shl eax, 8
or ecx, eax
mov rax, rcx
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rax + r11]
mov byte [r10], al
mov rax, rcx
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rax + r11]
mov byte [r10 + 1], al
cmp r9d, 1
jne 0x14009b577
lea eax, [r9 + 0x3c]
jmp 0x14009b583
shr rcx, 6
and ecx, 0x3f
movzx eax, byte [rcx + r11]
mov byte [r10 + 2], al
mov byte [r10 + 3], 0x3d
sub r9d, 3
add r10, 4
add ebx, 4
add r8, 3
test r9d, r9d
jg 0x14009b4d0
mov byte [r10], 0
mov eax, ebx
mov rbx, qword [rsp + 8]
ret
mov byte [rdx], bl
mov eax, ebx
mov rbx, qword [rsp + 8]
ret

Function at 0x14009b5c0
Capabilities:
Encode data using base64

Disassembly:
mov eax, 0x28
call fcn.140103e70
sub rsp, rax
mov r9d, r8d
mov r8, rdx
mov rdx, rcx
xor ecx, ecx
add rsp, 0x28
jmp fcn.14009b4a0
Function at 0x1400a4720
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov eax, 0x20
call fcn.140103e70
sub rsp, rax
mov rbx, r8
call fcn.1400a4100
test eax, eax
js 0x1400a495e
mov eax, dword [rbx + 0xf0]
xor r10d, r10d
shl eax, 2
movsxd r9, eax
test eax, eax
jle 0x1400a47a9
lea rdx, [rbx + r9*4 + 8]
lea r8, [rbx + 8]
nop dword [rax + rax]
mov eax, dword [rdx - 8]
mov ecx, dword [r8 - 8]
add r10, 4
mov dword [r8 - 8], eax
mov eax, dword [rdx - 4]
mov dword [rdx - 8], ecx
mov ecx, dword [r8 - 4]
mov dword [r8 - 4], eax
mov eax, dword [rdx]
mov dword [rdx - 4], ecx
mov ecx, dword [r8]
mov dword [r8], eax
mov eax, dword [rdx + 4]
mov dword [rdx], ecx
mov ecx, dword [r8 + 4]
mov dword [r8 + 4], eax
sub r9, 4
mov dword [rdx + 4], ecx
sub rdx, 0x10
add r8, 0x10
cmp r10, r9
jl 0x1400a4760
mov r11d, 1
cmp dword [rbx + 0xf0], r11d
jle 0x1400a495c
mov qword [rsp + 0x30], rdi
lea r10, [rbx + 2]
lea rdi, [0x140000000]
nop dword [rax]
mov r8d, dword [r10 + 0xe]
add r10, 0x10
inc r11d
mov rax, r8
shr rax, 0x18
movzx edx, byte [rdi + rax*4 + 0x13c4c0]
movzx eax, byte [r10 - 1]
movzx ecx, byte [rdi + rax*4 + 0x13c4c0]
mov r9d, dword [rdi + rdx*4 + 0x13d0c0]
movzx eax, r8b
xor r9d, dword [rdi + rcx*4 + 0x13d8c0]
movzx ecx, byte [rdi + rax*4 + 0x13c4c0]
movzx eax, byte [r10]
xor r9d, dword [rdi + rcx*4 + 0x13dcc0]
movzx ecx, byte [rdi + rax*4 + 0x13c4c0]
xor r9d, dword [rdi + rcx*4 + 0x13d4c0]
mov dword [r10 - 2], r9d
mov r9d, dword [r10 + 2]
mov rax, r9
shr rax, 0x18
movzx edx, byte [rdi + rax*4 + 0x13c4c0]
movzx eax, byte [r10 + 3]
movzx ecx, byte [rdi + rax*4 + 0x13c4c0]
mov r8d, dword [rdi + rdx*4 + 0x13d0c0]
movzx eax, byte [r10 + 4]
xor r8d, dword [rdi + rcx*4 + 0x13d8c0]
movzx ecx, byte [rdi + rax*4 + 0x13c4c0]
movzx eax, r9b
xor r8d, dword [rdi + rcx*4 + 0x13d4c0]
movzx ecx, byte [rdi + rax*4 + 0x13c4c0]
mov r9d, dword [r10 + 6]
xor r8d, dword [rdi + rcx*4 + 0x13dcc0]
mov rax, r9
mov dword [r10 + 2], r8d
shr rax, 0x18
movzx edx, byte [rdi + rax*4 + 0x13c4c0]
movzx eax, byte [r10 + 7]
movzx ecx, byte [rdi + rax*4 + 0x13c4c0]
mov r8d, dword [rdi + rdx*4 + 0x13d0c0]
movzx eax, byte [r10 + 8]
xor r8d, dword [rdi + rcx*4 + 0x13d8c0]
movzx ecx, byte [rdi + rax*4 + 0x13c4c0]
movzx eax, r9b
xor r8d, dword [rdi + rcx*4 + 0x13d4c0]
movzx ecx, byte [rdi + rax*4 + 0x13c4c0]
movzx eax, byte [r10 + 0xb]
xor r8d, dword [rdi + rcx*4 + 0x13dcc0]
mov r9d, dword [r10 + 0xa]
mov dword [r10 + 6], r8d
movzx edx, byte [rdi + rax*4 + 0x13c4c0]
movzx eax, byte [r10 + 0xc]
movzx ecx, byte [rdi + rax*4 + 0x13c4c0]
mov r8d, dword [rdi + rdx*4 + 0x13d8c0]
mov rax, r9
xor r8d, dword [rdi + rcx*4 + 0x13d4c0]
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0x13c4c0]
movzx eax, r9b
xor r8d, dword [rdi + rcx*4 + 0x13d0c0]
movzx ecx, byte [rdi + rax*4 + 0x13c4c0]
xor r8d, dword [rdi + rcx*4 + 0x13dcc0]
mov dword [r10 + 0xa], r8d
cmp r11d, dword [rbx + 0xf0]
jl 0x1400a47d0
mov rdi, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x1400a98b0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Encrypt data using salsa20 or chacha

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
mov eax, 0xb0
call fcn.140103e70
sub rsp, rax
mov rax, qword [0x140172b58]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov r10, qword [rsp + 0xf0]
mov eax, dword [r9]
mov rdi, r8
mov esi, dword [r10]
mov dword [rsp + 0x30], eax
mov eax, dword [r9 + 4]
mov dword [rsp + 0x34], eax
mov eax, dword [r9 + 8]
mov rbp, rdx
mov dword [rsp + 0x38], eax
mov eax, dword [r9 + 0xc]
mov r12, rcx
mov dword [rsp + 0x3c], eax
mov eax, dword [r9 + 0x10]
mov dword [rsp + 0x20], 0x61707865
mov dword [rsp + 0x40], eax
mov eax, dword [r9 + 0x14]
mov dword [rsp + 0x24], 0x3320646e
mov dword [rsp + 0x44], eax
mov eax, dword [r9 + 0x18]
mov dword [rsp + 0x28], 0x79622d32
mov dword [rsp + 0x48], eax
mov eax, dword [r9 + 0x1c]
mov dword [rsp + 0x2c], 0x6b206574
mov dword [rsp + 0x4c], eax
mov eax, dword [r10 + 4]
mov dword [rsp + 0x50], esi
mov dword [rsp + 0x54], eax
mov eax, dword [r10 + 8]
mov dword [rsp + 0x58], eax
mov eax, dword [r10 + 0xc]
mov dword [rsp + 0x5c], eax
test r8, r8
je 0x1400a99f0
mov qword [rsp + 0xd8], rbx
nop dword [rax + rax]
mov ebx, 0x40
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x60]
cmp rdi, rbx
cmovb rbx, rdi
call fcn.1400a95c0
xor r11d, r11d
test rbx, rbx
je 0x1400a99d7
lea rax, [rsp + 0x60]
mov rdx, rbp
mov r8, r12
sub rdx, rax
lea rax, [rsp + 0x60]
sub r8, rax
nop dword [rax]
lea rcx, [rsp + r11 + 0x60]
inc r11
movzx eax, byte [rdx + rcx]
xor al, byte [rcx]
mov byte [r8 + rcx], al
cmp r11, rbx
jb 0x1400a99c0
inc esi
add r12, rbx
add rbp, rbx
sub rdi, rbx
mov dword [rsp + 0x50], esi
jne 0x1400a9980
mov rbx, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140103060
mov rbp, qword [rsp + 0xe0]
add rsp, 0xb0
pop r12
pop rdi
pop rsi
ret
Function at 0x1400aa320
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x1400aa49e
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
push r13
push r14
mov eax, 0x20
call fcn.140103e70
sub rsp, rax
mov r14, qword [rsp + 0x60]
mov qword [rsp + 0x48], r12
mov r12, qword [rsp + 0x68]
mov r10, r14
mov r13, r9
mov rdi, r8
mov rbx, rdx
mov rbp, rcx
cmp r8, 0x10
jb 0x1400aa3d9
mov qword [rsp + 0x40], rsi
mov rsi, r8
shr rsi, 4
mov rax, rsi
imul rax, rax, 0xfffffffffffffff0
add rdi, rax
nop
mov r8, rbx
sub r10, rbp
mov rcx, rbp
sub r8, rbp
mov edx, 2
nop word [rax + rax]
mov rax, qword [r10 + rcx]
add rcx, 8
xor rax, qword [rcx - 8]
sub rdx, 1
mov qword [r8 + rcx - 8], rax
jne 0x1400aa3a0
mov r8, r13
mov rdx, rbx
mov rcx, rbx
call r12
mov r10, rbx
add rbx, 0x10
add rbp, 0x10
sub rsi, 1
jne 0x1400aa380
mov rsi, qword [rsp + 0x40]
test rdi, rdi
je 0x1400aa478
nop word [rax + rax]
mov rdx, r10
mov r9, rbx
xor r8d, r8d
sub rdx, rbp
sub r9, rbp
mov rcx, rbp
cmp r8, rdi
jae 0x1400aa421
movzx eax, byte [rcx + rdx]
inc r8
inc rcx
xor al, byte [rcx - 1]
mov byte [rcx + r9 - 1], al
cmp r8, 0x10
jb 0x1400aa402
jmp 0x1400aa451
cmp r8, 0x10
jae 0x1400aa451
mov edx, reloc.WS2_32.dll_recv
sub r10, rbx
lea rcx, [r8 + rbx]
sub rdx, r8
nop word [rax + rax]
movzx eax, byte [r10 + rcx]
inc rcx
sub rdx, 1
mov byte [rcx - 1], al
jne 0x1400aa440
mov r8, r13
mov rdx, rbx
mov rcx, rbx
call r12
mov r10, rbx
cmp rdi, 0x10
jbe 0x1400aa478
add rbp, 0x10
add rbx, 0x10
sub rdi, 0x10
jne 0x1400aa3f0
mov rax, qword [r10]
mov r12, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov qword [r14], rax
mov rax, qword [r10 + 8]
mov qword [r14 + 8], rax
add rsp, 0x20
pop r14
pop r13
pop rdi
repz ret
Function at 0x1400aa4a9
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x1400aa6a7
push rbx
push rsi
push rdi
push r13
push r14
push r15
mov eax, 0x48
call fcn.140103e70
sub rsp, rax
mov rax, qword [0x140172b58]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov r13, qword [rsp + 0xa0]
mov r15, qword [rsp + 0xa8]
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0x40], r12
mov r14, r9
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
cmp rcx, rdx
je 0x1400aa561
mov r12, r13
cmp rbx, 0x10
jb 0x1400aa54e
mov rbp, rbx
shr rbp, 4
mov rax, rbp
imul rax, rax, 0xfffffffffffffff0
add rbx, rax
nop word [rax + rax]
mov r8, r14
mov rdx, rsi
mov rcx, rdi
call r15
mov r11, qword [r12]
add rsi, 0x10
xor qword [rsi - 0x10], r11
mov rax, qword [r12 + 8]
mov r12, rdi
xor qword [rsi - 8], rax
add rdi, 0x10
sub rbp, 1
jne 0x1400aa520
mov rax, qword [r12]
mov qword [r13], rax
mov rax, qword [r12 + 8]
mov qword [r13 + 8], rax
jmp 0x1400aa5c5
cmp rbx, 0x10
jb 0x1400aa5c5
mov rbp, rbx
shr rbp, 4
mov rax, rbp
imul rax, rax, 0xfffffffffffffff0
add rbx, rax
nop dword [rax + rax]
lea rdx, [rsp + 0x20]
mov r8, r14
mov rcx, rdi
call r15
mov r11, qword [rdi]
mov rax, qword [r13]
xor rax, qword [rsp + 0x20]
add rsi, 0x10
add rdi, 0x10
mov qword [rsi - 0x10], rax
mov rax, qword [r13 + 8]
mov qword [r13], r11
mov rcx, qword [rdi - 8]
xor rax, qword [rsp + 0x28]
sub rbp, 1
mov qword [rsi - 8], rax
mov qword [r13 + 8], rcx
jne 0x1400aa580
test rbx, rbx
je 0x1400aa680
lea rax, [rsp + 0x20]
mov r12, r13
mov rbp, rdi
sub r12, rax
lea rax, [rsp + 0x20]
sub rsi, rax
lea rax, [rsp + 0x20]
sub rbp, rax
nop dword [rax]
lea rdx, [rsp + 0x20]
mov r8, r14
mov rcx, rdi
call r15
xor r11d, r11d
cmp r11, rbx
jae 0x1400aa634
movzx ecx, byte [rsp + r11 + 0x20]
lea rax, [r11 + rbp]
lea rdx, [r12 + r11]
movzx r8d, byte [rsp + rax + 0x20]
xor cl, byte [rsp + rdx + 0x20]
lea rax, [rsi + r11]
inc r11
mov byte [rsp + rax + 0x20], cl
mov byte [rsp + rdx + 0x20], r8b
cmp r11, 0x10
jb 0x1400aa601
cmp rbx, 0x10
jbe 0x1400aa64e
add rdi, 0x10
add rbp, 0x10
add rsi, 0x10
sub rbx, 0x10
jne 0x1400aa5f0
jmp 0x1400aa680
cmp r11, 0x10
jae 0x1400aa680
mov edx, reloc.WS2_32.dll_recv
sub rdi, r13
lea rcx, [r13 + r11]
sub rdx, r11
nop word [rax + rax]
movzx eax, byte [rdi + rcx]
inc rcx
sub rdx, 1
mov byte [rcx - 1], al
jne 0x1400aa670
mov rbp, qword [rsp + 0x90]
mov r12, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140103060
add rsp, 0x48
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
repz ret
Function at 0x1400aa6b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rsi
push rdi
push r12
push r13
push r14
mov eax, 0x38
call fcn.140103e70
sub rsp, rax
mov rsi, qword [rsp + 0x98]
mov r14, qword [rsp + 0x90]
mov qword [rsp + 0x28], r15
mov ebx, dword [rsi]
mov r10, r9
mov rdi, r8
mov r12, rdx
mov r13, rcx
test ebx, ebx
je 0x1400aa717
test rdi, rdi
je 0x1400aa717
mov eax, ebx
inc r12
inc r13
movzx ecx, byte [rax + r14]
dec rdi
xor cl, byte [r13 - 1]
inc ebx
and ebx, 0xf
mov byte [r12 - 1], cl
jne 0x1400aa6f2
mov r9, qword [rsp + 0xa0]
movsxd r15, ebx
cmp rdi, 0x10
jb 0x1400aa7f1
mov rsi, r12
mov rcx, rdi
mov qword [rsp + 0x30], rbp
shr rcx, 4
mov rbp, r13
sub rsi, r14
mov rax, rcx
sub rbp, r14
imul rax, rax, 0xfffffffffffffff0
add rdi, rax
mov rax, rcx
shl rax, 4
add r12, rax
add r13, rax
mov qword [rsp + 0x70], r13
mov r13, qword [rsp + 0x88]
mov qword [rsp + 0x78], r12
mov r12, rcx
mov r8, r13
mov rdx, r14
mov rcx, r14
call r9
cmp ebx, 0x10
jae 0x1400aa7b7
mov edx, recv
lea rcx, [r15 + r14]
sub edx, ebx
shr edx, 3
inc edx
nop word [rax + rax]
mov rax, qword [rcx + rbp]
add rcx, 8
xor rax, qword [rcx - 8]
sub rdx, 1
mov qword [rsi + rcx - 8], rax
jne 0x1400aa7a0
mov r9, qword [rsp + 0xa0]
add rsi, 0x10
add rbp, 0x10
xor ebx, ebx
xor r15d, r15d
sub r12, 1
jne 0x1400aa770
mov r12, qword [rsp + 0x78]
mov r13, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x98]
mov r10, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x30]
mov r15, qword [rsp + 0x28]
test rdi, rdi
je 0x1400aa836
mov r8, r10
mov rdx, r14
mov rcx, r14
call r9
movsxd rcx, ebx
sub r13, r14
add rcx, r14
sub r12, r14
add ebx, edi
nop word [rax + rax]
movzx eax, byte [rcx + r13]
inc rcx
xor al, byte [rcx - 1]
sub rdi, 1
mov byte [rcx + r12 - 1], al
jne 0x1400aa820
mov dword [rsi], ebx
add rsp, 0x38
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400aab50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
mov eax, 0x50
call fcn.140103e70
sub rsp, rax
mov rax, qword [0x140172b58]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rsi, qword [rsp + 0x90]
mov r10, qword [rsp + 0xa0]
lea eax, [r8 - 1]
mov ebp, r8d
mov rdi, rdx
mov rbx, rcx
cmp eax, 0x7f
ja 0x1400aad10
mov rax, qword [rsi]
lea rcx, [rsp + 0x20]
mov r8, r9
mov qword [rcx], rax
mov rax, qword [rsi + 8]
mov rdx, rsi
mov qword [rcx + 8], rax
mov rcx, rsi
call r10
lea eax, [rbp + 7]
cdq
and edx, 7
add eax, edx
sar eax, 3
cmp dword [rsp + 0x98], 0
movsxd r9, eax
je 0x1400aac0a
test eax, eax
jle 0x1400aac4d
lea rdx, [rsp + 0x30]
mov rcx, rsi
sub rdx, rbx
sub rcx, rbx
sub rdi, rbx
nop word [rax + rax]
movzx eax, byte [rcx + rbx]
inc rbx
xor al, byte [rbx - 1]
sub r9, 1
mov byte [rdx + rbx - 1], al
mov byte [rdi + rbx - 1], al
jne 0x1400aabf0
jmp 0x1400aac4d
xor r8d, r8d
test eax, eax
jle 0x1400aac4d
lea rax, [rsp + 0x30]
mov r10, rsi
sub rbx, rax
lea rax, [rsp + 0x30]
sub r10, rax
lea rax, [rsp + 0x30]
sub rdi, rax
nop dword [rax]
lea rdx, [rsp + r8 + 0x30]
inc r8
movzx ecx, byte [rbx + rdx]
movzx eax, byte [r10 + rdx]
xor al, cl
cmp r8, r9
mov byte [rdx], cl
mov byte [rdi + rdx], al
jl 0x1400aac30
mov eax, ebp
cdq
and edx, 7
add eax, edx
mov ecx, eax
and eax, 7
sub eax, edx
sar ecx, 3
mov r11d, eax
test eax, eax
jne 0x1400aac7f
movsxd rcx, ecx
mov rax, qword [rsp + rcx + 0x20]
mov qword [rsi], rax
mov rax, qword [rsp + rcx + 0x28]
mov qword [rsi + 8], rax
jmp 0x1400aad10
movsxd rax, ecx
mov r10d, 8
mov edi, 4
sub r10b, r11b
inc rsi
lea rbx, [rsp + rax + 0x21]
nop dword [rax + rax]
movzx r8d, byte [rbx]
movzx r9d, byte [rbx + 1]
movzx edx, byte [rbx - 1]
mov ecx, r11d
movzx eax, r8b
add rsi, 4
shl dl, cl
movzx ecx, r10b
add rbx, 4
shr al, cl
mov ecx, r11d
or dl, al
shl r8b, cl
movzx eax, r9b
mov byte [rsi - 5], dl
movzx edx, byte [rbx - 2]
movzx ecx, r10b
shr al, cl
mov ecx, r11d
or r8b, al
shl r9b, cl
movzx ecx, r10b
movzx eax, dl
mov byte [rsi - 4], r8b
shr al, cl
or r9b, al
movzx eax, byte [rbx - 1]
shr al, cl
mov ecx, r11d
mov byte [rsi - 3], r9b
shl dl, cl
or al, dl
sub rdi, 1
mov byte [rsi - 2], al
jne 0x1400aaca0
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140103060
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400aaef0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
mov eax, 0x50
call fcn.140103e70
sub rsp, rax
mov rbp, rdx
mov rdx, qword [rsp + 0xc0]
mov r10, r9
mov edi, dword [rdx]
mov rbx, r8
mov r12, rcx
test edi, edi
je 0x1400aaf56
mov r14, qword [rsp + 0xb8]
nop
test rbx, rbx
je 0x1400aaf5e
mov eax, edi
inc rbp
inc r12
movzx ecx, byte [rax + r14]
dec rbx
xor cl, byte [r12 - 1]
inc edi
and edi, 0xf
mov byte [rbp - 1], cl
jne 0x1400aaf30
jmp 0x1400aaf5e
mov r14, qword [rsp + 0xb8]
mov r9, qword [rsp + 0xc8]
mov r13d, reloc.WS2_32.dll_recv
mov qword [rsp + 0x48], r15
mov esi, 1
cmp rbx, r13
jb 0x1400ab08e
mov rax, qword [rsp + 0xb0]
mov rcx, rbx
xor edi, edi
add rax, r13
shr rcx, 4
mov r14, rbp
mov qword [rsp + 0x30], rax
mov r15, r12
mov rax, rcx
mov dword [rsp + 0x20], edi
mov rdi, qword [rsp + 0xb8]
imul rax, rax, 0xfffffffffffffff0
add rbx, rax
mov rax, rcx
sub r14, rdi
shl rax, 4
sub r15, rdi
mov qword [rsp + 0xa0], rbx
mov rbx, qword [rsp + 0x30]
add rbp, rax
add r12, rax
mov qword [rsp + 0x90], r12
mov r12, qword [rsp + 0xb0]
mov qword [rsp + 0x98], rbp
mov rbp, rcx
nop
mov r8, r10
mov rdx, rdi
mov rcx, r12
call r9
mov r11d, r13d
mov ecx, esi
mov rdx, rbx
nop word [rax + rax]
movzx eax, byte [rdx - 1]
dec rdx
add ecx, eax
mov byte [rdx], cl
shr ecx, 8
add r11d, 0xffffffff
jne 0x1400ab010
mov rcx, rdi
lea edx, [r11 + 2]
nop dword [rax + rax]
mov rax, qword [r15 + rcx]
add rcx, 8
xor rax, qword [rcx - 8]
sub rdx, rsi
mov qword [r14 + rcx - 8], rax
jne 0x1400ab030
mov r9, qword [rsp + 0xc8]
mov r10, qword [rsp + 0xa8]
add r14, r13
add r15, r13
sub rbp, 1
jne 0x1400aaff0
mov rbx, qword [rsp + 0xa0]
mov edi, dword [rsp + 0x20]
mov rbp, qword [rsp + 0x98]
mov r12, qword [rsp + 0x90]
mov r14, qword [rsp + 0xb8]
mov rdx, qword [rsp + 0xc0]
test rbx, rbx
je 0x1400ab101
mov r15, qword [rsp + 0xb0]
mov r8, r10
mov rdx, r14
mov rcx, r15
call r9
lea rcx, [r15 + 0x10]
nop dword [rax + rax]
movzx eax, byte [rcx - 1]
dec rcx
add esi, eax
mov byte [rcx], sil
shr esi, 8
add r13d, 0xffffffff
jne 0x1400ab0b0
movsxd rcx, edi
sub r12, r14
sub rbp, r14
add rcx, r14
add edi, ebx
nop word [rax + rax]
movzx eax, byte [rcx + r12]
inc rcx
xor al, byte [rcx - 1]
sub rbx, 1
mov byte [rcx + rbp - 1], al
jne 0x1400ab0e0
mov rax, qword [rsp + 0xc0]
mov dword [rax], edi
jmp 0x1400ab103
mov dword [rdx], edi
mov r15, qword [rsp + 0x48]
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400ab120
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
mov eax, 0x40
call fcn.140103e70
sub rsp, rax
mov rbx, r8
mov r8, qword [rsp + 0xb0]
mov rsi, rdx
mov edi, dword [r8]
mov rbp, rcx
mov dword [rsp + 0x30], edi
test edi, edi
je 0x1400ab185
mov rdx, qword [rsp + 0xa8]
test rbx, rbx
je 0x1400ab181
mov eax, edi
inc rsi
inc rbp
movzx ecx, byte [rax + rdx]
dec rbx
xor cl, byte [rbp - 1]
inc edi
and edi, 0xf
mov byte [rsi - 1], cl
jne 0x1400ab160
mov dword [rsp + 0x30], edi
mov rdx, qword [rsp + 0xa0]
mov r10, qword [rsp + 0xb8]
mov r15d, recv
movzx eax, byte [rdx + 0xd]
movzx ecx, byte [rdx + 0xc]
lea r14, [rdx + 0xc]
shl ecx, 8
mov qword [rsp + 0x80], r13
lea r12d, [r15 - 0xb]
or ecx, eax
movzx eax, byte [rdx + 0xe]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0xf]
shl ecx, 8
or ecx, eax
mov dword [rsp + 0x90], ecx
cmp rbx, 0x10
jb 0x1400ab2bb
mov eax, 0x10000000
mov rdi, rdx
nop word [rax + rax]
mov r13, rbx
shr r13, 4
cmp r13, rax
cmova r13, rax
add ecx, r13d
mov eax, ecx
mov dword [rsp + 0x90], ecx
cmp rax, r13
jae 0x1400ab21b
sub r13, rax
xor ecx, ecx
mov dword [rsp + 0x90], ecx
mov r8, r13
mov rdx, rsi
mov rcx, rbp
mov qword [rsp + 0x20], rdi
call r10
mov ecx, dword [rsp + 0x90]
mov eax, ecx
mov r11d, ecx
mov byte [rdi + 0xf], cl
shr eax, 0x10
shr r11d, 0x18
mov byte [rdi + 0xd], al
mov eax, ecx
mov byte [r14], r11b
shr eax, 8
mov byte [rdi + 0xe], al
test ecx, ecx
jne 0x1400ab27b
mov r8d, r15d
mov ecx, r12d
mov rdx, r14
nop dword [rax]
movzx eax, byte [rdx - 1]
dec rdx
add ecx, eax
mov byte [rdx], cl
shr ecx, 8
add r8d, 0xffffffff
jne 0x1400ab260
mov ecx, dword [rsp + 0x90]
mov r9, qword [rsp + 0x98]
mov r10, qword [rsp + 0xb8]
shl r13, 4
sub rbx, r13
add rsi, r13
add rbp, r13
mov eax, 0x10000000
cmp rbx, 0x10
jae 0x1400ab1f0
mov edi, dword [rsp + 0x30]
mov r8, qword [rsp + 0xb0]
mov rdx, qword [rsp + 0xa0]
test rbx, rbx
je 0x1400ab370
mov r13, qword [rsp + 0xa8]
xor eax, eax
mov qword [rsp + 0x20], rdx
mov qword [r13], rax
mov rdx, r13
mov rcx, r13
mov r8, r12
mov qword [r13 + 8], rax
call r10
mov rdx, qword [rsp + 0xa0]
mov ecx, dword [rsp + 0x90]
inc ecx
mov eax, ecx
mov byte [rdx + 0xf], cl
shr eax, 0x18
mov byte [r14], al
mov eax, ecx
shr eax, 0x10
mov byte [rdx + 0xd], al
mov eax, ecx
shr eax, 8
mov byte [rdx + 0xe], al
test ecx, ecx
jne 0x1400ab338
nop word [rax + rax]
movzx eax, byte [r14 - 1]
dec r14
add r12d, eax
mov byte [r14], r12b
shr r12d, 8
add r15d, 0xffffffff
jne 0x1400ab320
movsxd rcx, edi
sub rbp, r13
sub rsi, r13
add rcx, r13
add edi, ebx
nop word [rax + rax]
movzx eax, byte [rcx + rbp]
inc rcx
xor al, byte [rcx - 1]
sub rbx, 1
mov byte [rsi + rcx - 1], al
jne 0x1400ab350
mov rax, qword [rsp + 0xb0]
mov dword [rax], edi
jmp 0x1400ab373
mov dword [r8], edi
mov r13, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret