joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180030844
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.180027f4c
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.180027f4c
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x180030991
cmp rax, 0xffffffffffffffff
je 0x180030991
xor edi, edi
test rbp, rbp
jle 0x18003093f
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.180024720
mov rbx, rax
test rax, rax
jne 0x1800308cc
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x180030935
mov edx, 0x8000
mov ecx, r14d
call fcn.1800306c8
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.18002529c
cmp eax, 0xffffffff
je 0x180030915
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1800308dc
mov edx, r15d
mov ecx, r14d
call fcn.1800306c8
jmp 0x180030935
cmp byte [rsi + 0x38], dil
je 0x18003092c
cmp dword [rsi + 0x34], 5
jne 0x18003092c
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x180030935
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1800255d0
jmp 0x1800309a3
jns 0x1800309a3
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.180027f4c
cmp rax, 0xffffffffffffffff
jne 0x18003095d
cmp byte [rsi + 0x30], dil
je 0x1800309a3
jmp 0x180030999
mov ecx, r14d
call fcn.18002bb04
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1800309a3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x1800309a3
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x18003099e
mov edi, dword [rsi + 0x2c]
jmp 0x1800309a3
mov edi, 0x16
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.180027f4c
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x180030c00
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x180030c28
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x180030c28
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x140001a08
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001a52
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001a52
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001a52
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001a52
cmp dword [rcx + 0x84], 0xe
jbe 0x140001a52
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001a54
xor al, al
add rsp, 0x28
ret
Function at 0x1400027b0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x38
xorps xmm0, xmm0
lea rcx, str.bcrypt_alt_prov
xorps xmm1, xmm1
movdqa xmmword [0x14001d100], xmm0
xor r8d, r8d
movdqa xmmword [0x14001d110], xmm1
xor edx, edx
movdqa xmmword [0x14001d120], xmm0
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x1400027f5
lea rcx, str.bcrypt_alt.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor r9d, r9d
lea rdx, [0x140013760]
xor r8d, r8d
lea rcx, [0x14001d0d0]
call qword [sym.imp.bcrypt.dll_BCryptOpenAlgorithmProvider]
mov rcx, qword [0x14001d0d0]
lea r8, str.ChainingModeCBC
and dword [rsp + 0x20], 0
lea rdx, str.ChainingMode
mov r9d, 0x20
call qword [sym.imp.bcrypt.dll_BCryptSetProperty]
xor r9d, r9d
lea rdx, [0x140013760]
xor r8d, r8d
lea rcx, [0x14001d0d8]
call qword [sym.imp.bcrypt.dll_BCryptOpenAlgorithmProvider]
mov rcx, qword [0x14001d0d8]
lea r8, str.ChainingModeECB
and dword [rsp + 0x20], 0
lea rdx, str.ChainingMode
mov r9d, 0x20
call qword [sym.imp.bcrypt.dll_BCryptSetProperty]
mov rax, qword [0x14001d0d8]
lea rdx, [0x1400137c8]
and qword [0x14001d0f0], 0
lea rcx, [0x14001d100]
xorps xmm0, xmm0
mov qword [0x14001d0f8], rax
xor r9d, r9d
movdqa xmmword [0x14001d0e0], xmm0
xor r8d, r8d
call qword [sym.imp.bcrypt.dll_BCryptOpenAlgorithmProvider]
xor r9d, r9d
lea rdx, [0x1400137d0]
xor r8d, r8d
lea rcx, [0x14001d108]
call qword [sym.imp.bcrypt.dll_BCryptOpenAlgorithmProvider]
xor r9d, r9d
lea rdx, str.ECDH
xor r8d, r8d
lea rcx, [0x14001d110]
call qword [sym.imp.bcrypt.dll_BCryptOpenAlgorithmProvider]
mov rcx, qword [0x14001d110]
lea r8, str.curve25519
and dword [rsp + 0x20], 0
lea rdx, str.ECCCurveName
mov r9d, socket
call qword [sym.imp.bcrypt.dll_BCryptSetProperty]
xor r9d, r9d
lea rdx, [0x140013820]
xor r8d, r8d
lea rcx, [0x14001d118]
call qword [sym.imp.bcrypt.dll_BCryptOpenAlgorithmProvider]
xor r9d, r9d
lea rdx, str.SHA1
xor r8d, r8d
lea rcx, [0x14001d120]
call qword [sym.imp.bcrypt.dll_BCryptOpenAlgorithmProvider]
mov r9d, 8
lea rdx, str.SHA256
xor r8d, r8d
lea rcx, [0x14001d128]
call qword [sym.imp.bcrypt.dll_BCryptOpenAlgorithmProvider]
lea rax, [0x14001d0d0]
add rsp, 0x38
ret

Function at 0x140002968
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rbx, rdx
and dword [rsp + 0x20], 0
mov edx, 0x80
mov rcx, rbx
call fcn.1400025c4
mov dword [rsp + 0x20], 1
mov rdx, qword [rbx + 8]
mov r8, qword [rbx + 0x10]
sub r8d, edx
xor r9d, r9d
mov rcx, qword [0x14001d118]
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140004160
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
lea rax, [0x1400138c8]
mov qword [rcx], rax
lea rax, [0x140013bb0]
mov qword [rcx], rax
lea rax, [rcx + 8]
mov qword [rsp + 0x48], rax
xor ecx, ecx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rcx
mov dword [rbx + 0x28], ecx
or qword [rbx + 0x30], 0xffffffffffffffff
mov word [rbx + 0x38], cx
cmp word [0x14001d2c0], cx
jne 0x1400041d6
mov ecx, 0x202
lea rdx, [0x14001d2c0]
call qword [sym.imp.WS2_32.dll_WSAStartup]
lea rcx, [0x140004144]
call qword [sym.imp.msvcrt.dll_atexit]
nop
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140004288
Capabilities:
Connect socket
Resolve dns
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rbx, rcx
movzx esi, r8w
mov rcx, qword [rdx]
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov rdi, rax
test rax, rax
je 0x1400043d3
mov ebp, 2
movzx ecx, si
mov word [rsp + 0x30], bp
call qword [sym.imp.WS2_32.dll_htons]
mov word [rsp + 0x32], ax
lea rcx, [rsp + 0x34]
mov rdx, qword [rdi + 0x18]
movsx r8, word [rdi + 0x12]
mov rdx, qword [rdx]
call sub.msvcrt.dll_memcpy
mov eax, dword [rsp + 0x34]
lea edx, [rbp - 1]
lea r8d, [rbp + 4]
mov dword [rbx + 0x28], eax
mov ecx, ebp
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rbx + 0x30], rax
cmp rax, 0xffffffffffffffff
je 0x1400043d3
mov ebp, 0x7530
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x58]
mov dword [rsp + 0x58], ebp
mov edx, 0xffff
mov r8d, 0x1006
mov rcx, rax
call qword [sym.imp.WS2_32.dll_setsockopt]
mov edi, 3
lea rsi, [0x14001d010]
test eax, eax
je 0x140004358
mov r9d, eax
lea r8, str.tcp_socket::connect_setsockopt_SO_RCVTIMEO_error:__i_n
mov edx, edi
mov rcx, rsi
call fcn.140001720
mov rcx, qword [rbx + 0x30]
lea r9, [rsp + 0x58]
mov edx, 0xffff
mov dword [rsp + 0x58], ebp
mov r8d, 0x1005
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x140004396
mov r9d, eax
lea r8, str.tcp_socket::connect_setsockopt_SO_SNDTIMEO_error:__i_n
mov edx, edi
mov rcx, rsi
call fcn.140001720
mov rcx, qword [rbx + 0x30]
lea rdx, [rsp + 0x30]
mov r8d, reloc.WS2_32.dll_recv
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x1400043ea
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r8, str.tcp_socket::connect_connect_error:__i_n
mov edx, edi
mov r9d, eax
mov rcx, rsi
call fcn.140001720
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + htons]
xor al, al
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
mov al, 1
jmp 0x1400043d5
Function at 0x140004518
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
lea rax, [0x140013c28]
mov qword [rcx], rax
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x14000455e
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
nop
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
and qword [rbx + 8], 0
and dword [rbx + 0x10], 0
mov byte [rbx + 0x14], 1
add rsp, 0x30
pop rbx
ret
Function at 0x14000659c
Capabilities:
Hash data via wincrypt

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xd0
mov qword [rbp + 7], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov r14, rdx
mov rsi, rcx
mov rdi, qword [rcx + 0x40]
mov r15, qword [rcx + 0x48]
cmp rdi, r15
je 0x1400066fd
xor r12d, r12d
mov rax, qword [rdi]
mov r13, qword [rax + 0x10]
lea rcx, [r13 + 0x68]
mov rdx, qword [r14 + 0x18]
mov rax, qword [r14 + 0x10]
mov qword [rbp - 0x49], rax
mov qword [rbp - 0x41], rdx
movaps xmm0, xmmword [rbp - 0x49]
movdqa xmmword [rbp - 0x79], xmm0
lea r8, [rbp - 0x79]
lea rdx, [rbp - 0x19]
call fcn.140007f80
nop
mov rax, qword [rbp - 0x11]
mov qword [rbp - 0x39], rax
mov rax, qword [rbp - 9]
mov qword [rbp - 0x31], rax
movaps xmm0, xmmword [rbp - 0x39]
movdqa xmmword [rbp - 0x79], xmm0
lea rdx, [rbp - 0x79]
mov rcx, r14
call fcn.1400046e0
mov rcx, qword [r14 + 0x10]
cmp word [rcx + 1], r12w
jne 0x1400066e6
mov rax, qword [r14 + 0x18]
mov qword [rbp - 0x29], rcx
mov qword [rbp - 0x21], rax
movaps xmm0, xmmword [rbp - 0x29]
movdqa xmmword [rbp - 0x79], xmm0
lea rdx, [rbp - 0x79]
lea rcx, [rbp - 0x69]
call fcn.1400048e8
nop
mov rax, qword [rbp - 0x61]
xor ecx, ecx
mov dword [rax + 5], ecx
mov rax, qword [r14 + 0x10]
mov ebx, dword [rax + 5]
lea rdx, [rbp + 0x67]
lea rcx, [r13 + 0xd8]
call fcn.140007d70
nop
mov r8d, dword [rbp - 0x59]
mov rdx, qword [rbp - 0x61]
sub r8d, edx
xor r9d, r9d
mov rcx, qword [rbp + 0x67]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
lea rdx, [rbp + 0xf]
lea rcx, [rbp + 0x67]
call fcn.140007264
nop
mov rax, qword [rbp + 0x17]
cmp dword [rax], ebx
je 0x14000673e
mov rcx, qword [rbp + 0x17]
call qword [sym.imp.msvcrt.dll_free]
nop
mov rcx, qword [rbp + 0x67]
test rcx, rcx
je 0x1400066db
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov qword [rbp + 0x67], r12
mov rcx, qword [rbp - 0x61]
call qword [sym.imp.msvcrt.dll_free]
nop
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.msvcrt.dll_free]
add rdi, 8
cmp rdi, r15
jne 0x1400065e1
lea r8, str.circuit::handle_cell___cannot_decrypt_relay_cell__destroying_circuit_n
mov edx, 3
lea rcx, [0x14001d010]
call fcn.140001720
mov rcx, rsi
call fcn.140005114
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov r8d, dword [rbp - 0x59]
mov rdx, qword [rbp - 0x61]
sub r8d, edx
xor r9d, r9d
mov rcx, qword [r13 + 0xd8]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
nop
mov rcx, qword [rbp + 0x17]
call qword [sym.imp.msvcrt.dll_free]
nop
mov rcx, qword [rbp + 0x67]
test rcx, rcx
je 0x140006778
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov qword [rbp + 0x67], r12
mov rcx, qword [rbp - 0x61]
call qword [sym.imp.msvcrt.dll_free]
nop
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.msvcrt.dll_free]
mov r8, r14
mov rdx, qword [rdi]
mov rcx, rsi
call fcn.1400067a0
jmp 0x14000671d
Function at 0x14000e5bc
Capabilities:
Generate random numbers via winapi

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov qword [rbp - 0x39], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rsi
mov rsi, r8
mov r12, rdx
mov rdi, rcx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x29], xmm0
and qword [rbp - 0x19], 0
mov rdx, r8
lea rcx, [rbp - 0x11]
call fcn.140008b9c
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x17], xmm0
and qword [rbp + 0x27], 0
mov rdx, qword [rdi + 0x60]
sub rdx, qword [rdi + 0x50]
sar rdx, 3
lea rcx, [rbp + 0xf]
call fcn.140008d98
mov r14, qword [rdi + 0x58]
mov rbx, qword [rdi + 0x50]
jmp 0x14000e645
mov rdx, rbx
lea rcx, [rbp + 0xf]
call fcn.140008ac0
add rbx, 8
cmp rbx, r14
jne 0x14000e635
movzx eax, word [r12]
mov word [rbp + 0x2f], ax
lea r8, [rbp - 0x31]
lea rdx, [rbp - 0x59]
lea rcx, [0x14001d020]
call fcn.1400084b0
nop
mov rcx, qword [rbp + 0x17]
call qword [sym.imp.msvcrt.dll_free]
nop
mov rcx, qword [rbp - 9]
call qword [sym.imp.msvcrt.dll_free]
nop
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.msvcrt.dll_free]
mov rbx, qword [rbp - 0x49]
sub rbx, qword [rbp - 0x51]
sar rbx, 3
test rbx, rbx
je 0x14000e6e8
lea rcx, [rbp + 0x67]
lea rdx, [rbp + 0x6f]
sub edx, ecx
lea r8, [rbp + 0x67]
mov rcx, qword [0x14001d0c0]
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
xor edx, edx
mov rax, qword [rbp + 0x67]
div rbx
mov rax, qword [rbp - 0x51]
mov rbx, qword [rax + rdx*8]
mov qword [rbp + 0x67], rbx
test rbx, rbx
je 0x14000e701
lea rdx, [rbp + 0x67]
lea rcx, [rdi + 0x48]
call fcn.140008ac0
mov rdx, rbx
mov rcx, rdi
call fcn.14000e734
jmp 0x14000e701
lea r8, str.No_available_routers_n
mov edx, 2
lea rcx, [0x14001d010]
call fcn.140001720
nop
mov rcx, qword [rbp - 0x51]
call qword [sym.imp.msvcrt.dll_free]
nop
mov rcx, qword [rsi + 8]
call qword [sym.imp.msvcrt.dll_free]
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x14000c980
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14000c9cc
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14000c9c4
cmp dword [rcx + 0x3c], edx
jl 0x14000c9c4
cmp dword [rcx + 0x3c], 0x10000000
jae 0x14000c9c4
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x14000c9cc
mov rax, rdx
add rsp, 0x18
ret

Function at 0x1408b4058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1408b41df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1408b4089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1408b406f
add dl, dl
jne 0x1408b4096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1408b40f6
xor eax, eax
add dl, dl
jne 0x1408b40a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1408b41ad
add dl, dl
jne 0x1408b40b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408b40c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408b40d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408b40dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1408b40ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1408b407e
mov eax, 1
add dl, dl
jne 0x1408b4106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408b4113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1408b40fb
sub eax, ebx
mov ebx, 1
jne 0x1408b414c
mov ecx, 1
add dl, dl
jne 0x1408b412e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1408b413b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1408b4123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1408b407e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1408b4168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1408b4175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1408b415d
cmp eax, 0x7d00
jae 0x1408b419b
cmp eax, 0x500
jb 0x1408b4196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1408b407e
cmp eax, 0x7f
ja 0x1408b419e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1408b407e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1408b41d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1408b407e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140144b90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r12
push r14
mov eax, 0x28
call fcn.1402b9730
sub rsp, rax
mov r14, qword [rsp + 0x90]
mov r10, r9
mov r12, qword [rsp + 0x88]
mov rdi, r8
mov rsi, rdx
mov rbp, rcx
mov ebx, dword [r14]
test ebx, ebx
je 0x140144bf1
nop dword [rax]
test rdi, rdi
je 0x140144bf1
mov eax, ebx
dec rdi
movzx ecx, byte [rax + r12]
xor cl, byte [rbp]
inc rbp
mov byte [rsi], cl
inc rsi
inc ebx
and ebx, 0xf
jne 0x140144bd0
mov r9, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x80]
cmp rdi, 0x10
jb 0x140144cbe
mov qword [rsp + 0x60], r13
xor ebx, ebx
mov r13, rdi
mov qword [rsp + 0x20], r15
shr r13, 4
mov r14, rsi
imul rax, r13, 0xfffffffffffffff0
mov r15, rbp
mov dword [rsp + 0x70], ebx
mov rbx, qword [rsp + 0x78]
add rdi, rax
mov rax, r13
sub r14, r12
shl rax, 4
sub r15, r12
add rsi, rax
add rbp, rax
mov r8, rbx
mov rdx, r12
call r9
mov rcx, qword [rsp + 0x80]
call fcn.140144f20
mov edx, 2
mov rcx, r12
nop word [rax + rax]
mov rax, qword [r15 + rcx]
xor rax, qword [rcx]
mov qword [r14 + rcx], rax
lea rcx, [rcx + 8]
sub rdx, 1
jne 0x140144c70
mov rcx, qword [rsp + 0x80]
add r14, 0x10
mov r9, qword [rsp + 0x98]
add r15, 0x10
sub r13, 1
jne 0x140144c47
mov r15, qword [rsp + 0x20]
mov r13, qword [rsp + 0x60]
mov ebx, dword [rsp + 0x70]
mov r14, qword [rsp + 0x90]
mov r10, qword [rsp + 0x78]
test rdi, rdi
je 0x140144cf5
mov r8, r10
mov rdx, r12
call r9
mov rcx, qword [rsp + 0x80]
call fcn.140144f20
nop dword [rax]
mov ecx, ebx
inc ebx
movzx eax, byte [r12 + rcx]
xor al, byte [rcx + rbp]
mov byte [rsi + rcx], al
sub rdi, 1
jne 0x140144ce0
mov dword [r14], ebx
add rsp, 0x28
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140144d10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r13
push r14
push r15
mov eax, 0x40
call fcn.1402b9730
sub rsp, rax
mov rbx, r8
mov r14, rdx
mov r8, qword [rsp + 0xb0]
mov rbp, rcx
mov edi, dword [r8]
mov dword [rsp + 0x30], edi
test edi, edi
je 0x140144d75
mov rdx, qword [rsp + 0xa8]
test rbx, rbx
je 0x140144d71
mov eax, edi
dec rbx
movzx ecx, byte [rax + rdx]
xor cl, byte [rbp]
inc rbp
mov byte [r14], cl
inc r14
inc edi
and edi, 0xf
jne 0x140144d50
mov dword [rsp + 0x30], edi
mov rax, qword [rsp + 0xa0]
mov esi, 1
mov ecx, dword [rax + 0xc]
lea r15, [rax + 0xc]
mov r10, qword [rsp + 0xb8]
mov r13d, reloc.WS2_32.dll_inet_ntoa
mov qword [rsp + 0x80], r12
bswap ecx
mov dword [rsp + 0x90], ecx
cmp rbx, 0x10
jb 0x140144e83
mov rdi, qword [rsp + 0xa0]
mov eax, 0x10000000
nop
mov rdx, rbx
mov qword [rsp + 0x20], rdi
shr rdx, 4
cmp rdx, rax
cmova rdx, rax
add ecx, edx
mov r12, rdx
mov eax, ecx
sub r12, rax
cmp rax, rdx
cmovae r12, rdx
xor r8d, r8d
cmp rax, rdx
mov rdx, r14
cmovae r8d, ecx
mov rcx, rbp
mov dword [rsp + 0x90], r8d
mov r8, r12
call r10
mov ecx, dword [rsp + 0x90]
mov eax, ecx
bswap eax
mov dword [r15], eax
test ecx, ecx
jne 0x140144e3c
mov r8d, r13d
mov eax, esi
mov rdx, r15
nop dword [rax]
movzx ecx, byte [rdx - 1]
lea rdx, [rdx - 1]
add eax, ecx
mov byte [rdx], al
shr eax, 8
add r8d, 0xffffffff
jne 0x140144e20
mov ecx, dword [rsp + 0x90]
mov r10, qword [rsp + 0xb8]
mov eax, 0x10000000
mov r9, qword [rsp + 0x98]
shl r12, 4
sub rbx, r12
add r14, r12
add rbp, r12
cmp rbx, 0x10
jae 0x140144dc0
mov edi, dword [rsp + 0x30]
mov r8, qword [rsp + 0xb0]
mov rax, qword [rsp + 0xa0]
mov dword [rsp + 0x90], ecx
test rbx, rbx
je 0x140144f02
mov r12, qword [rsp + 0xa8]
xorps xmm0, xmm0
mov r8, rsi
mov qword [rsp + 0x20], rax
mov rdx, r12
mov rcx, r12
movups xmmword [r12], xmm0
call r10
mov r8d, dword [rsp + 0x90]
add r8d, esi
bswap r8d
mov dword [r15], r8d
jne 0x140144ee0
nop dword [rax]
movzx eax, byte [r15 - 1]
lea r15, [r15 - 1]
add esi, eax
mov byte [r15], sil
shr esi, 8
add r13d, 0xffffffff
jne 0x140144ec0
nop word [rax + rax]
mov ecx, edi
inc edi
movzx eax, byte [r12 + rcx]
xor al, byte [rcx + rbp]
mov byte [r14 + rcx], al
sub rbx, 1
jne 0x140144ee0
mov rax, qword [rsp + 0xb0]
mov dword [rax], edi
jmp 0x140144f05
mov dword [r8], edi
mov r12, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140144fe0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r12
push r15
mov eax, 0x28
call fcn.1402b9730
sub rsp, rax
mov rsi, qword [rsp + 0x88]
mov r10, r9
mov r15, qword [rsp + 0x80]
mov rdi, r8
mov rbp, rdx
mov r12, rcx
mov ebx, dword [rsi]
test ebx, ebx
jns 0x14014502f
mov dword [rsi], 0xffffffff
add rsp, 0x28
pop r15
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
je 0x140145054
test rdi, rdi
je 0x140145054
mov eax, ebx
dec rdi
movzx ecx, byte [rax + r15]
xor cl, byte [r12]
inc r12
mov byte [rbp], cl
inc rbp
inc ebx
and ebx, 0xf
jne 0x140145031
mov r9, qword [rsp + 0x90]
cmp rdi, 0x10
jb 0x140145119
mov qword [rsp + 0x60], r13
mov rsi, rbp
mov r13, rdi
mov qword [rsp + 0x20], r14
shr r13, 4
mov r14, r12
imul rax, r13, 0xfffffffffffffff0
sub rsi, r15
sub r14, r15
add rdi, rax
mov rax, r13
shl rax, 4
add rbp, rax
mov qword [rsp + 0x68], rbp
add r12, rax
mov rbp, qword [rsp + 0x78]
mov r8, rbp
mov rdx, r15
mov rcx, r15
call r9
cmp ebx, 0x10
jae 0x1401450e5
mov edx, reloc.WS2_32.dll_ntohs
mov ecx, ebx
sub edx, ebx
add rcx, r15
shr edx, 3
inc edx
nop dword [rax]
nop word [rax + rax]
mov rax, qword [r14 + rcx]
xor rax, qword [rcx]
mov qword [rsi + rcx], rax
lea rcx, [rcx + 8]
sub rdx, 1
jne 0x1401450d0
mov r9, qword [rsp + 0x90]
add rsi, 0x10
add r14, 0x10
xor ebx, ebx
sub r13, 1
jne 0x1401450a1
mov r14, qword [rsp + 0x20]
mov r13, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x88]
mov r10, qword [rsp + 0x78]
test rdi, rdi
je 0x140145146
mov r8, r10
mov rdx, r15
mov rcx, r15
call r9
nop word [rax + rax]
mov ecx, ebx
inc ebx
movzx eax, byte [r15 + rcx]
xor al, byte [rcx + r12]
mov byte [rcx + rbp], al
sub rdi, 1
jne 0x140145130
mov dword [rsi], ebx
add rsp, 0x28
pop r15
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140145b40
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push r14
mov eax, 0x20
call fcn.1402b9730
sub rsp, rax
cmp qword [rcx + 0x38], 0
mov rbx, r8
mov r14, rdx
mov rbp, rcx
je 0x140145b70
mov eax, 0xfffffffe
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret
mov rcx, qword [rcx + 0x30]
movabs rax, 0x2000000000000000
add rcx, rbx
cmp rcx, rax
ja 0x140145c62
cmp rcx, rbx
jb 0x140145c62
mov qword [rsp + 0x40], rsi
mov esi, dword [rbp + 0x17c]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], r12
mov qword [rbp + 0x30], rcx
test esi, esi
je 0x140145be6
test rbx, rbx
je 0x140145c42
movzx eax, byte [r14]
dec rbx
mov ecx, esi
inc r14
xor byte [rcx + rbp + 0x40], al
inc esi
and esi, 0xf
jne 0x140145bb0
lea r12, [rbp + 0x60]
lea rdi, [rbp + 0x40]
mov rdx, r12
mov rcx, rdi
call qword [rbp + 0x170]
jmp 0x140145bee
lea r12, [rbp + 0x60]
lea rdi, [rbp + 0x40]
mov qword [rsp + 0x58], r15
mov r15, rbx
and r15, 0xfffffffffffffff0
je 0x140145c14
mov r9, r15
mov r8, r14
mov rdx, r12
mov rcx, rdi
call qword [rbp + 0x168]
add r14, r15
sub rbx, r15
mov r15, qword [rsp + 0x58]
test rbx, rbx
je 0x140145c42
mov esi, ebx
sub r14, rbp
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdi + r14 - 0x40]
xor byte [rdi], al
lea rdi, [rdi + 1]
sub rbx, 1
jne 0x140145c30
mov rdi, qword [rsp + 0x48]
xor eax, eax
mov r12, qword [rsp + 0x50]
mov dword [rbp + 0x17c], esi
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret
mov eax, 0xffffffff
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret