joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1402496f0
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x870
call fcn.1404a54e0
sub rsp, rax
mov rax, qword [0x140648080]
xor rax, rsp
mov qword [rsp + 0x860], rax
mov r13, qword [rsp + 0x8c8]
mov r14, rcx
mov dword [rsp + 0x24], r8d
xor ebp, ebp
mov dword [rsp + 0x28], edx
mov r8d, 0x400
mov qword [rsp + 0x38], rcx
xor edx, edx
lea rcx, [rsp + 0x41]
mov byte [rsp + 0x40], bpl
mov r12d, ebp
mov word [rsp + 0x20], r9w
call fcn.1404dd800
xor edx, edx
mov byte [rsp + 0x450], bpl
mov r8d, 0x400
lea rcx, [rsp + 0x451]
call fcn.1404dd800
lea rbx, [rsp + 0x40]
mov r9d, 0x400
mov r8, r14
mov qword [rsp + 0x30], rbx
mov edx, 0x401
lea rcx, [rsp + 0x40]
lea rdi, [rsp + 0x450]
call fcn.1404bf00c
mov r15, 0xffffffffffffffff
mov rcx, r14
mov qword [r13], rbp
mov rsi, r13
mov byte [rdi], bpl
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov r14, rax
test rax, rax
je 0x1402498fe
cmp word [rax + 0x10], 2
jne 0x140249827
cmp word [rax + 0x12], 4
jne 0x140249827
mov rbx, qword [rax + 0x18]
mov rax, qword [rbx]
test rax, rax
je 0x140249822
nop dword [rax]
mov r9d, dword [rax]
movzx r8d, word [rsp + 0x20]
mov edx, dword [rsp + 0x24]
mov ecx, dword [rsp + 0x28]
call fcn.140249960
mov qword [rsi], rax
test rax, rax
je 0x1402498f7
add rbx, 8
lea rsi, [rax + 0x28]
mov rax, qword [rbx]
test rax, rax
jne 0x1402497f0
mov rbx, qword [rsp + 0x30]
mov r8, qword [r14]
mov r9d, 0x400
mov edx, 0x401
mov rcx, rdi
call fcn.1404bf00c
cmp qword [r13], rbp
jne 0x1402498a1
mov rax, r15
inc rax
cmp byte [rdi + rax], bpl
jne 0x140249846
test rax, rax
je 0x140249918
mov r8, rdi
mov rax, rbx
sub r8, rbx
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140249874
inc rax
test ecx, ecx
jne 0x140249861
test edx, edx
je 0x140249918
inc r12d
cmp r12d, 0x10
je 0x140249918
mov r14, qword [rsp + 0x38]
mov rax, rbx
mov rbx, rdi
mov rdi, rax
mov qword [rsp + 0x30], rbx
jmp 0x1402497b0
cmp dword [rsp + 0x8c0], ebp
je 0x14024992b
nop
cmp byte [rdi + r15 + 1], bpl
lea r15, [r15 + 1]
jne 0x1402498b0
lea rdx, [r15 + 1]
mov ecx, 1
call fcn.1404ba994
mov rbx, rax
test rax, rax
jne 0x1402498d6
mov rbx, rbp
jmp 0x1402498e5
mov r8, rdi
lea rdx, [r15 + 1]
mov rcx, rax
call fcn.1404bd23c
mov rax, qword [r13]
mov qword [rax + 0x18], rbx
mov rax, qword [r13]
cmp qword [rax + 0x18], rbp
jne 0x14024992b
mov ebp, 8
jmp 0x14024992b
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
sub ecx, 0x2af9
je 0x140249926
sub ecx, 1
je 0x14024991f
sub ecx, 1
jne 0x140249926
mov ebp, 0x2afb
jmp 0x14024992b
mov ebp, 0x2afa
jmp 0x14024992b
mov ebp, 0x2af9
mov eax, ebp
mov rcx, qword [rsp + 0x860]
xor rcx, rsp
call fcn.1404a4900
lea r11, [rsp + 0x870]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1402568f0
Capabilities:
Encode data using add xor sub operations

Disassembly:
xor eax, eax
mov r10, rcx
test rcx, rcx
je 0x14025695c
movzx ecx, byte [rcx]
test cl, cl
je 0x14025695c
mov r11d, 0x100
nop word [rax + rax]
movsx r9d, cl
lea r10, [r10 + 1]
or r9d, r11d
mov r8d, eax
mov edx, r9d
mov ecx, 0x20
shr edx, 2
add r11d, 0x100
xor edx, r9d
imul r9d, r9d
and edx, 0xf
sub ecx, edx
shr r8, cl
mov ecx, edx
mov edx, eax
mov eax, r8d
shl edx, cl
movzx ecx, byte [r10]
or eax, edx
xor eax, r9d
test cl, cl
jne 0x140256910
mov ecx, eax
shr ecx, 0x10
xor eax, ecx
ret

Function at 0x140256a20
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xor eax, eax
mov r10, rcx
test rcx, rcx
je 0x140256a90
movzx ecx, byte [rcx]
test cl, cl
je 0x140256a90
mov r11d, 0x100
nop word [rax + rax]
movsx r9d, cl
lea r10, [r10 + 1]
mov r8d, eax
and r9d, 0xffffffdf
or r9d, r11d
mov ecx, 0x20
mov edx, r9d
add r11d, 0x100
shr edx, 2
xor edx, r9d
imul r9d, r9d
and edx, 0xf
sub ecx, edx
shr r8, cl
mov ecx, edx
mov edx, eax
mov eax, r8d
shl edx, cl
movzx ecx, byte [r10]
or eax, edx
xor eax, r9d
test cl, cl
jne 0x140256a40
mov ecx, eax
shr ecx, 0x10
xor eax, ecx
ret

Function at 0x140257bf0
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x28
call fcn.1404a54e0
sub rsp, rax
cmp dword [0x140650600], 0
jne 0x140257d71
mov qword [rsp + 0x30], rbx
lea rcx, [0x140512390]
mov qword [rsp + 0x40], rsi
lea rbx, [0x1406505a0]
mov qword [rsp + 0x38], rbp
mov rdx, rbx
mov qword [rsp + 0x48], rdi
mov r8d, gethostbyaddr
mov qword [rsp + 0x20], r14
mov dword [0x140650600], 1
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0x2e
ja 0x140257d33
movzx edi, word [rbx]
xor ebp, ebp
cmp di, 0x7e
mov ecx, ebp
mov r14d, 2
cmove ecx, r14d
add rcx, rbx
call fcn.140257d80
mov rsi, rax
cmp di, 0x7e
jne 0x140257caf
lea rcx, [0x140654c90]
mov rdi, rax
call fcn.140001030
not rsi
movabs rcx, 0xedfff7fdffffffff
and rax, rsi
and edi, 0x1000000
mov rsi, rax
and rsi, rcx
test rdi, rdi
cmove rsi, rax
jmp 0x140257cc4
cmp word [rbx], 0x3a
jne 0x140257cc4
lea rcx, [0x140654c90]
call fcn.140001030
mov rsi, rax
movzx eax, word [rbx]
test ax, ax
je 0x140257ce1
nop dword [rax]
cmp ax, 0x3a
je 0x140257cea
add rbx, r14
movzx eax, word [rbx]
test ax, ax
jne 0x140257cd0
mov qword [0x140654c98], rbp
jmp 0x140257d42
test rbx, rbx
je 0x140257ce1
add rbx, r14
movzx edi, word [rbx]
cmp di, 0x7e
cmove rbp, r14
lea rcx, [rbx + rbp]
call fcn.140257d80
mov rcx, rax
shr rcx, 0x20
cmp di, 0x7e
jne 0x140257d25
not eax
not ecx
and dword [0x140654c98], eax
and dword [0x140654c9c], ecx
jmp 0x140257d42
mov dword [0x140654c98], eax
mov dword [0x140654c9c], ecx
jmp 0x140257d42
lea rcx, [0x140654c90]
call fcn.140001030
mov rsi, rax
mov r14, qword [rsp + 0x20]
mov eax, esi
mov rdi, qword [rsp + 0x48]
bts eax, 0xa
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
shr rsi, 0x20
mov dword [0x140654c94], esi
mov rsi, qword [rsp + 0x40]
mov dword [0x140654c90], eax
add rsp, 0x28
ret
Function at 0x14025ca30
Capabilities:
Get thread local storage value

Disassembly:
mov eax, 0x28
call fcn.1404a54e0
sub rsp, rax
lea rcx, [0x1406507b8]
add rsp, 0x28
jmp fcn.1402146f0

Function at 0x140269100
Capabilities:
Encode data using xor

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r14
mov eax, 0x48
call fcn.1404a54e0
sub rsp, rax
mov ebp, dword [rsp + 0xa0]
mov r12, rcx
mov ecx, ebp
movsxd r14, edx
mov ebx, 1
mov edx, r14d
shl ebx, cl
mov esi, r9d
mov rcx, r12
mov rdi, r8
call fcn.140217760
test rax, rax
jne 0x140269157
add rsp, 0x48
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov qword [rsp + 0x98], r13
mov r13, r14
cmp ebp, 3
jg 0x1402691d5
test r14d, r14d
jle 0x14026935c
xor r10d, r10d
movsxd r11, ebx
shl r11, 3
nop word [rax + rax]
xor r9d, r9d
xor eax, eax
test ebx, ebx
jle 0x1402691bd
mov r8, rdi
nop dword [rax]
mov ecx, eax
lea r8, [r8 + 8]
xor ecx, esi
inc eax
lea edx, [rcx - 1]
not ecx
shr edx, 0x1f
shr ecx, 0x1f
and edx, ecx
mov rcx, qword [r8 - 8]
neg edx
and edx, 1
neg rdx
and rdx, rcx
or r9, rdx
cmp eax, ebx
jl 0x140269190
mov rax, qword [r12]
add rdi, r11
mov qword [rax + r10*8], r9
inc r10
cmp r10, r13
jl 0x140269180
jmp 0x14026935c
lea ecx, [rbp - 2]
mov edx, esi
sar edx, cl
mov r8d, 1
shl r8d, cl
movsxd rbp, r8d
lea ecx, [rdx - 1]
shr ecx, 0x1f
lea eax, [r8 - 1]
and esi, eax
mov eax, edx
not eax
shr eax, 0x1f
and eax, ecx
mov ecx, edx
neg eax
xor ecx, 1
and eax, 1
neg rax
mov qword [rsp + 0x30], rax
lea eax, [rcx - 1]
not ecx
shr eax, 0x1f
shr ecx, 0x1f
and eax, ecx
mov ecx, edx
neg eax
xor ecx, 2
and eax, 1
xor edx, 3
neg rax
mov qword [rsp + 0x28], rax
lea eax, [rcx - 1]
not ecx
shr eax, 0x1f
shr ecx, 0x1f
and eax, ecx
neg eax
and eax, 1
neg rax
mov qword [rsp + 0x20], rax
lea eax, [rdx - 1]
shr eax, 0x1f
not edx
shr edx, 0x1f
and eax, edx
neg eax
and eax, 1
neg rax
mov qword [rsp + 0x90], rax
test r14d, r14d
jle 0x14026935c
xor r14d, r14d
movsxd rax, ebx
shl rax, 3
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], r15
nop word [rax + rax]
xor r11d, r11d
xor r9d, r9d
test rbp, rbp
jle 0x140269338
mov r12, qword [rsp + 0x90]
mov rax, rbp
neg rax
mov r8, rbp
shl r8, 4
mov r10, rbp
add r8, rdi
neg r10
add r10, r10
mov rbx, rbp
lea r15, [rax*8]
nop dword [rax + rax]
mov eax, r9d
lea r8, [r8 + 8]
xor eax, esi
inc r9d
lea edx, [rax - 1]
not eax
shr eax, 0x1f
shr edx, 0x1f
and edx, eax
mov rax, qword [r8 + rbp*8 - 8]
mov rcx, qword [r8 - 8]
and rax, r12
and rcx, qword [rsp + 0x20]
neg edx
or rcx, rax
and edx, 1
mov rax, qword [r15 + r8 - 8]
neg rdx
and rax, qword [rsp + 0x28]
or rax, rcx
mov rcx, qword [r8 + r10*8 - 8]
and rcx, qword [rsp + 0x30]
or rcx, rax
and rcx, rdx
or r11, rcx
sub rbx, 1
jne 0x1402692d0
mov r12, qword [rsp + 0x80]
mov rax, qword [rsp + 0x38]
mov rcx, qword [r12]
add rdi, rax
mov qword [rcx + r14*8], r11
inc r14
cmp r14, r13
jl 0x140269290
mov r15, qword [rsp + 0x40]
mov r14d, dword [rsp + 0x88]
mov r13, qword [rsp + 0x98]
mov eax, 1
mov dword [r12 + 8], r14d
add rsp, 0x48
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14026ece0
Capabilities:
Check for software breakpoints

Disassembly:
mov eax, 0x28
call fcn.1404a54e0
sub rsp, rax
mov r11, rcx
cmp dword [rsp + 0x50], r9d
jne 0x14026edd9
movzx r10d, byte [r8]
lea eax, [r10 - 0x6a]
cmp al, 1
ja 0x14026edd9
mov qword [rsp + 0x20], rbx
lea rdx, [r8 + 1]
cmp r10b, 0x6b
jne 0x14026ed91
lea ebx, [r9 - 3]
xor eax, eax
test ebx, ebx
jle 0x14026ed3a
movzx ecx, byte [rdx]
inc rdx
cmp cl, 0xba
je 0x14026ed3a
cmp cl, 0xbb
jne 0x14026ed7e
inc eax
cmp eax, ebx
jl 0x14026ed24
sub ebx, eax
test eax, eax
jne 0x14026ed95
call fcn.14021d2b0
lea r8, str.RSA_padding_check_X931
mov edx, 0x56
lea rcx, str.crypto_rsa_rsa_x931.c
call fcn.14021d3d0
mov edx, 0x8a
xor r8d, r8d
mov ecx, 4
call fcn.14021d530
mov rbx, qword [rsp + 0x20]
mov eax, 0xffffffff
add rsp, 0x28
ret
call fcn.14021d2b0
lea r8, str.RSA_padding_check_X931
mov edx, 0x4e
jmp 0x14026ed51
lea ebx, [r9 - 2]
movsxd rax, ebx
cmp byte [rax + rdx], 0xcc
je 0x14026edc2
call fcn.14021d2b0
lea r8, str.RSA_padding_check_X931
mov edx, 0x5f
lea rcx, str.crypto_rsa_rsa_x931.c
call fcn.14021d3d0
mov edx, 0x8b
jmp 0x14026ed62
mov r8d, ebx
mov rcx, r11
call fcn.1404dd160
mov eax, ebx
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
call fcn.14021d2b0
lea r8, str.RSA_padding_check_X931
mov edx, 0x43
lea rcx, str.crypto_rsa_rsa_x931.c
call fcn.14021d3d0
xor r8d, r8d
mov edx, 0x89
mov ecx, 4
call fcn.14021d530
mov eax, 0xffffffff
add rsp, 0x28
ret
Function at 0x140283fe0
Capabilities:
Encrypt data using curve25519

Disassembly:
push rbx
push rsi
push rdi
mov eax, 0x1a0
call fcn.1404a54e0
sub rsp, rax
mov rax, qword [0x140648080]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov rbx, r8
mov rsi, rdx
mov r8, r9
lea rdx, str.SHA512
call fcn.14020f210
mov rdi, rax
test rax, rax
je 0x140284066
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x150]
xor r9d, r9d
mov qword [rsp + 0x20], rax
mov edx, 0x20
mov rcx, rbx
call fcn.14020dfa0
mov rcx, rdi
mov ebx, eax
call fcn.14020f260
test ebx, ebx
jne 0x14028406d
mov edx, 0x40
lea rcx, [rsp + 0x150]
call fcn.140001240
xor eax, eax
jmp 0x140284121
movzx eax, byte [rsp + 0x16f]
lea rdx, [rsp + 0x150]
and byte [rsp + 0x150], 0xf8
lea rcx, [rsp + 0xb0]
and al, 0x3f
or al, 0x40
mov byte [rsp + 0x16f], al
call fcn.140283220
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0x30]
call fcn.14027fbe0
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x80]
call fcn.14027fe60
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x58]
call fcn.14027fe60
lea rdx, [rsp + 0x58]
mov rcx, rsi
call fcn.140281500
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x80]
call fcn.140281500
movzx eax, byte [rsp + 0x30]
lea rcx, [rsp + 0x150]
shl al, 7
mov edx, 0x40
xor byte [rsi + 0x1f], al
call fcn.140001240
mov eax, 1
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1404a4900
add rsp, 0x1a0
pop rdi
pop rsi
pop rbx
ret
Function at 0x140284140
Capabilities:
Encrypt data using curve25519

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1d0
call fcn.1404a54e0
sub rsp, rax
mov rax, qword [0x140648080]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov rax, qword [rsp + 0x230]
mov r13, rdx
mov r15, qword [rsp + 0x250]
lea rdx, str.SHA512
mov qword [rsp + 0x38], r8
mov r14, rcx
mov rcx, qword [rsp + 0x260]
mov r8, qword [rsp + 0x268]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x50], r9
call fcn.14020f210
mov rdi, rax
call fcn.14020f150
xor r12d, r12d
mov rbx, rax
test r15, r15
mov esi, r12d
cmovne rsi, qword [rsp + 0x258]
cmp byte [rsp + 0x248], r12b
je 0x1402841e1
test rsi, rsi
je 0x1402843dd
cmp byte [rsp + 0x238], r12b
jne 0x1402841f4
test rsi, rsi
jne 0x1402843dd
test rdi, rdi
je 0x1402843dd
test rbx, rbx
je 0x1402843dd
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call fcn.14020e750
test eax, eax
je 0x1402843dd
mov rdx, qword [rsp + 0x40]
mov r8d, 0x20
mov rcx, rbx
call fcn.14020e790
test eax, eax
je 0x1402843dd
lea r8, [rsp + 0x30]
mov rcx, rbx
lea rdx, [rsp + 0x100]
call fcn.14020e490
test eax, eax
je 0x1402843dd
movzx eax, byte [rsp + 0x11f]
mov rdx, rdi
movzx r8d, byte [rsp + 0x238]
and al, 0x3f
and byte [rsp + 0x100], 0xf8
or al, 0x40
mov qword [rsp + 0x28], rsi
mov rcx, rbx
mov qword [rsp + 0x20], r15
movzx r15d, byte [rsp + 0x240]
movzx r9d, r15b
mov byte [rsp + 0x11f], al
call fcn.140283ee0
test eax, eax
je 0x1402843dd
mov r8d, 0x20
lea rdx, [rsp + 0x120]
mov rcx, rbx
call fcn.14020e790
test eax, eax
je 0x1402843dd
mov r8, qword [rsp + 0x38]
mov rdx, r13
mov rcx, rbx
call fcn.14020e790
test eax, eax
je 0x1402843dd
lea r8, [rsp + 0x30]
mov rcx, rbx
lea rdx, [rsp + 0x140]
call fcn.14020e490
test eax, eax
je 0x1402843dd
lea rcx, [rsp + 0x140]
call fcn.1402869a0
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x60]
call fcn.140283220
lea rdx, [rsp + 0x60]
mov rcx, r14
call fcn.140283190
mov rax, qword [rsp + 0x48]
movzx r9d, r15b
movzx r8d, byte [rsp + 0x238]
mov rdx, rdi
mov qword [rsp + 0x28], rsi
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.140283ee0
test eax, eax
je 0x1402843dd
mov r8d, 0x20
mov rdx, r14
mov rcx, rbx
call fcn.14020e790
test eax, eax
je 0x1402843dd
mov rdx, qword [rsp + 0x50]
mov r8d, 0x20
mov rcx, rbx
call fcn.14020e790
test eax, eax
je 0x1402843dd
mov r8, qword [rsp + 0x38]
mov rdx, r13
mov rcx, rbx
call fcn.14020e790
test eax, eax
je 0x1402843dd
lea r8, [rsp + 0x30]
mov rcx, rbx
lea rdx, [rsp + 0x180]
call fcn.14020e490
test eax, eax
je 0x1402843dd
lea rcx, [rsp + 0x180]
call fcn.1402869a0
lea rcx, [r14 + 0x20]
lea r9, [rsp + 0x140]
lea r8, [rsp + 0x100]
lea rdx, [rsp + 0x180]
call fcn.140284950
mov r12d, 1
mov edx, 0x40
lea rcx, [rsp + 0x140]
call fcn.140001240
mov edx, 0x40
lea rcx, [rsp + 0x100]
call fcn.140001240
mov rcx, rdi
call fcn.14020f260
mov rcx, rbx
call fcn.14020f0a0
mov eax, r12d
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1404a4900
add rsp, 0x1d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x1402847d0
Capabilities:
Encrypt data using curve25519

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
lea rbp, [rsp - 0x70]
mov eax, 0x170
call fcn.1404a54e0
sub rsp, rax
mov rax, qword [0x140648080]
xor rax, rsp
mov qword [rbp + 0x60], rax
movups xmm0, xmmword [rdx]
mov rbx, rcx
lea rcx, [rsp + 0x50]
movups xmm1, xmmword [rdx + 0x10]
movd eax, xmm0
movups xmmword [rbp + 0x40], xmm0
and al, 0xf8
mov byte [rbp + 0x40], al
mov rax, qword [rdx + 0x18]
lea rdx, [rbp + 0x40]
shr rax, 0x38
and al, 0x3f
or al, 0x40
movups xmmword [rbp + 0x50], xmm1
mov byte [rbp + 0x5f], al
call fcn.140283220
mov ecx, dword [rsp + 0x78]
mov edx, dword [rbp - 0x60]
mov r8, qword [rbp - 0x3c]
lea eax, [rcx + rdx]
sub edx, ecx
mov rcx, qword [rsp + 0x7c]
mov dword [rbp + 0x18], edx
mov rdx, qword [rbp - 0x5c]
mov dword [rbp - 0x10], eax
lea eax, [rcx + rdx]
sub edx, ecx
mov rcx, qword [rbp - 0x80]
mov dword [rbp + 0x1c], edx
mov rdx, qword [rbp - 0x58]
mov dword [rbp - 0xc], eax
lea eax, [rcx + rdx]
sub edx, ecx
mov rcx, qword [rbp - 0x7c]
mov dword [rbp + 0x20], edx
mov rdx, qword [rbp - 0x54]
mov dword [rbp - 8], eax
lea eax, [rcx + rdx]
sub edx, ecx
mov rcx, qword [rbp - 0x78]
mov dword [rbp + 0x24], edx
mov rdx, qword [rbp - 0x50]
mov dword [rbp - 4], eax
lea eax, [rcx + rdx]
sub edx, ecx
mov rcx, qword [rbp - 0x74]
mov dword [rbp + 0x28], edx
mov rdx, qword [rbp - 0x4c]
mov dword [rbp], eax
lea eax, [rcx + rdx]
sub edx, ecx
mov rcx, qword [rbp - 0x70]
mov dword [rbp + 0x2c], edx
mov rdx, qword [rbp - 0x48]
mov dword [rbp + 4], eax
lea eax, [rcx + rdx]
sub edx, ecx
mov rcx, qword [rbp - 0x6c]
mov dword [rbp + 0x30], edx
mov rdx, qword [rbp - 0x44]
mov dword [rbp + 8], eax
lea eax, [rcx + rdx]
sub edx, ecx
mov rcx, qword [rbp - 0x68]
mov dword [rbp + 0x34], edx
mov rdx, qword [rbp - 0x40]
mov dword [rbp + 0xc], eax
lea eax, [rcx + rdx]
sub edx, ecx
mov dword [rbp + 0x38], edx
lea rcx, [rsp + 0x20]
mov rdx, qword [rbp - 0x64]
mov dword [rbp + 0x10], eax
lea eax, [rdx + r8]
sub r8d, edx
lea rdx, [rbp + 0x18]
mov dword [rbp + 0x3c], r8d
mov dword [rbp + 0x14], eax
call fcn.14027fbe0
lea r8, [rsp + 0x20]
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x10]
call fcn.14027fe60
lea rdx, [rbp - 0x10]
mov rcx, rbx
call fcn.140281500
lea rcx, [rbp + 0x40]
mov edx, 0x20
call fcn.140001240
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.1404a4900
mov rbx, qword [rsp + 0x190]
add rsp, 0x170
pop rbp
ret
Function at 0x140289310
Capabilities:
Encode data using xor

Disassembly:
mov r9, rcx
movd xmm4, r8d
mov r10d, r8d
pshufd xmm4, xmm4, 0
lea rcx, [rdx + 0x3c]
lea rax, [r9 + 0x3c]
cmp rdx, rax
ja 0x140289361
cmp rcx, r9
jb 0x140289361
sub r9, rdx
mov r8d, reloc.WS2_32.dll_recv
nop dword [rax + rax]
mov ecx, dword [r9 + rdx]
lea rdx, [rdx + 4]
mov eax, ecx
xor eax, dword [rdx - 4]
and eax, r10d
xor ecx, eax
mov dword [r9 + rdx - 4], ecx
xor dword [rdx - 4], eax
sub r8, 1
jne 0x140289340
ret
sub r9, rdx
mov eax, 4
nop dword [rax]
movdqu xmm1, xmmword [r9 + rdx]
movdqu xmm2, xmmword [rdx]
lea rdx, [rdx + 0x10]
movdqa xmm3, xmm1
xorps xmm3, xmm2
andps xmm3, xmm4
movdqa xmm0, xmm3
xorps xmm3, xmm2
xorps xmm0, xmm1
movdqu xmmword [r9 + rdx - 0x10], xmm0
movdqu xmmword [rdx - 0x10], xmm3
sub rax, 1
jne 0x140289370
ret
Function at 0x14029a8d0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push rbx
mov eax, 0x20
call fcn.1404a54e0
sub rsp, rax
mov rbx, rcx
test r9, r9
jne 0x14029a91e
call fcn.14021d2b0
lea r8, str.c2i_ibuf
mov edx, 0xa0
lea rcx, str.crypto_asn1_a_int.c
call fcn.14021d3d0
xor r8d, r8d
mov edx, 0xde
mov ecx, reloc.WS2_32.dll_listen
call fcn.14021d530
xor eax, eax
add rsp, 0x20
pop rbx
ret
movzx r10d, byte [r8]
and r10d, 0x80
test rdx, rdx
je 0x14029a931
mov dword [rdx], r10d
cmp r9, 1
jne 0x14029a954
test rbx, rbx
je 0x14029a949
movzx eax, byte [r8]
test r10d, r10d
je 0x14029a947
neg al
mov byte [rcx], al
mov eax, 1
add rsp, 0x20
pop rbx
ret
movzx ecx, byte [r8]
test cl, cl
jne 0x14029a966
mov eax, 1
jmp 0x14029aa1a
xor eax, eax
cmp cl, 0xff
jne 0x14029aa61
xor edx, edx
lea rcx, [r9 - 1]
mov eax, 1
cmp r9, rax
jbe 0x14029aa0f
cmp rcx, 8
jb 0x14029aa00
and ecx, 7
mov rdx, r9
sub rdx, rcx
xorps xmm3, xmm3
xorps xmm2, xmm2
nop word [rax + rax]
movd xmm1, dword [r8 + rax]
xorps xmm0, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
orps xmm3, xmm1
movd xmm1, dword [r8 + rax + 4]
punpcklbw xmm1, xmm0
add rax, 8
punpcklwd xmm1, xmm0
orps xmm2, xmm1
cmp rax, rdx
jb 0x14029a9a0
orps xmm2, xmm3
movdqa xmm0, xmm2
psrldq xmm0, 8
orps xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
orps xmm2, xmm0
movd edx, xmm2
cmp rax, r9
jae 0x14029aa0f
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r8 + rax]
inc rax
or edx, ecx
cmp rax, r9
jb 0x14029aa00
xor eax, eax
test edx, edx
setne al
test edx, edx
je 0x14029aa61
movzx ecx, byte [r8 + 1]
and ecx, 0x80
cmp r10d, ecx
jne 0x14029aa61
call fcn.14021d2b0
lea r8, str.c2i_ibuf
mov edx, 0xc1
lea rcx, str.crypto_asn1_a_int.c
call fcn.14021d3d0
xor r8d, r8d
mov edx, 0xdd
mov ecx, reloc.WS2_32.dll_listen
call fcn.14021d530
xor eax, eax
add rsp, 0x20
pop rbx
ret
sub r9, rax
test rbx, rbx
je 0x14029aaae
add rax, r8
mov rdx, r9
neg r10d
sbb r11d, r11d
movzx r11d, r11b
mov ecx, r11d
and ecx, 1
test r9, r9
je 0x14029aaae
mov r10, r9
lea r8, [rax + r9]
sub r10, r9
add r10, rbx
movzx eax, byte [r8 - 1]
lea r8, [r8 - 1]
dec rdx
xor eax, r11d
add ecx, eax
mov byte [r10 + rdx], cl
shr ecx, 8
test rdx, rdx
jne 0x14029aa91
mov rax, r9
add rsp, 0x20
pop rbx
ret
Function at 0x14029aac0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
mov r10, rdx
xor r11b, r11b
xor edx, edx
mov rdi, r9
mov rbx, rcx
test rcx, rcx
je 0x14029abc1
test r10, r10
je 0x14029abc1
movzx eax, byte [rcx]
test r8d, r8d
jne 0x14029ab09
cmp al, 0x7f
jbe 0x14029abba
mov edx, 1
mov eax, edx
add rax, r10
jmp 0x14029abc9
mov r11b, 0xff
cmp al, 0x80
jbe 0x14029ab1f
mov edx, 1
mov eax, edx
add rax, r10
jmp 0x14029abc9
jne 0x14029abba
mov eax, 1
lea rcx, [r10 - 1]
cmp r10, rax
jbe 0x14029abaf
cmp rcx, 8
jb 0x14029aba1
and ecx, 7
mov rdx, r10
sub rdx, rcx
xorps xmm3, xmm3
xorps xmm2, xmm2
nop dword [rax]
movd xmm1, dword [rbx + rax]
xorps xmm0, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
orps xmm3, xmm1
movd xmm1, dword [rbx + rax + 4]
punpcklbw xmm1, xmm0
add rax, 8
punpcklwd xmm1, xmm0
orps xmm2, xmm1
cmp rax, rdx
jb 0x14029ab50
orps xmm2, xmm3
movdqa xmm0, xmm2
psrldq xmm0, 8
orps xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
orps xmm2, xmm0
movd edx, xmm2
cmp rax, r10
jae 0x14029abaf
movzx ecx, byte [rbx + rax]
inc rax
or edx, ecx
cmp rax, r10
jb 0x14029aba1
neg edx
sbb r11b, r11b
mov edx, r11d
and edx, 1
mov eax, edx
add rax, r10
jmp 0x14029abc9
mov eax, 1
mov r10, rdx
test rdi, rdi
je 0x14029ac25
mov rcx, qword [r9]
test rcx, rcx
je 0x14029ac25
mov edx, edx
mov r8d, r11d
add rdx, rcx
mov byte [rcx], r11b
and r8d, 1
test r10, r10
je 0x14029ac22
lea r9, [r10 + rbx]
mov rbx, r10
sub rbx, r10
add rbx, rdx
nop word [rax + rax]
movzx edx, byte [r9 - 1]
lea r9, [r9 - 1]
dec r10
movzx ecx, r11b
xor edx, ecx
add r8d, edx
mov byte [rbx + r10], r8b
shr r8d, 8
test r10, r10
jne 0x14029ac00
add qword [rdi], rax
mov rbx, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret

Function at 0x14029ae30
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x28
call fcn.1404a54e0
sub rsp, rax
mov r8d, dword [rcx + 4]
mov r9, rdx
movsxd rdx, dword [rcx]
and r8d, 0x100
mov rcx, qword [rcx + 8]
add rsp, 0x28
jmp fcn.14029aac0