joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003c5d0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x78
call fcn.1400035e0
sub rsp, rax
mov rax, qword [0x1401ad1c0]
mov qword [rsp + 0x30], rax
test rcx, rcx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x60], rsi
mov rsi, qword [rsp + 0xa0]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x40], r14
mov rdi, r8
mov r14d, r9d
mov rbp, rdx
mov r8, rcx
je 0x14003c81f
test rdx, rdx
je 0x14003c81f
cmp byte [rdx], 1
je 0x14003c81f
test rdi, rdi
je 0x14003c818
test r9d, r9d
jle 0x14003c818
mov eax, r9d
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x50], r12
cdq
mov qword [rsp + 0x48], r13
and edx, 0xf
lea r12d, [rdx + rax]
movzx eax, byte [rcx + 0x14]
sar r12d, 4
dec eax
je 0x14003c798
dec eax
je 0x14003c6a3
mov eax, 0xfffffffb
mov r12, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x70]
mov r13, qword [rsp + 0x48]
mov r14, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x30]
call fcn.14006b6a0
add rsp, 0x78
ret
test r12d, r12d
mov ebx, r12d
jle 0x14003c700
nop
nop
mov eax, dword [rdi]
mov r9d, dword [rbp + 0x4c]
lea rcx, [rsp + 0x20]
xor eax, dword [r8]
mov rdx, rsi
mov dword [rsp + 0x20], eax
mov eax, dword [rdi + 4]
xor eax, dword [r8 + 4]
mov dword [rsp + 0x24], eax
mov eax, dword [rdi + 8]
xor eax, dword [r8 + 8]
mov dword [rsp + 0x28], eax
mov eax, dword [rdi + 0xc]
xor eax, dword [r8 + 0xc]
lea r8, [rbp + 0x54]
mov dword [rsp + 0x2c], eax
call fcn.140055af0
dec ebx
mov r8, rsi
add rdi, 0x10
add rsi, 0x10
test ebx, ebx
jg 0x14003c6b0
shl r12d, 4
mov r11d, reloc.WSOCK32.dll_recv
mov r9d, r12d
sub r9d, r14d
add r9d, 0x10
sub r11d, r9d
test r11d, r11d
jle 0x14003c744
lea r10, [rsp + 0x20]
sub rdi, r8
mov rcx, r8
sub r10, r8
mov edx, r11d
nop
movzx eax, byte [rdi + rcx]
inc rcx
xor al, byte [rcx - 1]
dec rdx
mov byte [r10 + rcx - 1], al
jne 0x14003c730
movsxd rdx, r11d
cmp rdx, 0x10
jge 0x14003c779
lea rax, [rsp + 0x20]
sub r8, rax
nop
nop
nop
lea rax, [r8 + rdx]
inc rdx
movzx ecx, byte [rsp + rax + 0x20]
xor cl, r9b
cmp rdx, 0x10
mov byte [rsp + rdx + 0x1f], cl
jl 0x14003c760
mov r9d, dword [rbp + 0x4c]
lea r8, [rbp + 0x54]
lea rcx, [rsp + 0x20]
mov rdx, rsi
call fcn.140055af0
lea eax, [r12 + 0x10]
jmp 0x14003c671
test r12d, r12d
mov ebx, r12d
jle 0x14003c7c1
mov r9d, dword [rbp + 0x4c]
lea r8, [rbp + 0x54]
mov rdx, rsi
mov rcx, rdi
call fcn.140055af0
dec ebx
add rdi, 0x10
add rsi, 0x10
test ebx, ebx
jg 0x14003c7a0
mov r11d, reloc.WSOCK32.dll_recv
shl r12d, 4
lea rcx, [rsp + 0x20]
mov ebx, r12d
mov rdx, rdi
sub ebx, r14d
add ebx, 0x10
sub r11d, ebx
movsxd r8, r11d
call sub.MSVCR110.dll_memcpy
movsxd r8, ebx
lea rcx, [rsp + 0x30]
sub rcx, r8
mov edx, ebx
call sub.MSVCR110.dll_memset
mov r9d, dword [rbp + 0x4c]
lea r8, [rbp + 0x54]
lea rcx, [rsp + 0x20]
mov rdx, rsi
call fcn.140055af0
lea eax, [r12 + 0x10]
jmp 0x14003c671
xor eax, eax
jmp 0x14003c680
mov eax, 0xfffffffb
jmp 0x14003c680
Function at 0x14003cf40
Capabilities:
Hash data using sha1

Disassembly:
push rbx
mov eax, 0x20
call fcn.1400035e0
sub rsp, rax
lea r8d, [rax + 0x3c]
xor edx, edx
mov rbx, rcx
call fcn.140056410
xor eax, eax
mov dword [rbx], 0x67452301
mov dword [rbx + 0x18], eax
mov dword [rbx + 0x14], eax
mov dword [rbx + 4], 0xefcdab89
mov dword [rbx + 8], 0x98badcfe
mov dword [rbx + 0xc], 0x10325476
mov dword [rbx + 0x10], 0xc3d2e1f0
add rsp, 0x20
pop rbx
ret
Function at 0x14003f460
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x28
call fcn.1400035e0
sub rsp, rax
mov eax, dword [rcx + 0x14]
mov qword [rsp + 0x30], rbx
mov rbx, rdx
mov qword [rsp + 0x48], rdi
mov edx, eax
mov rdi, rcx
shr edx, 3
lea ecx, [rax + r8*8]
mov qword [rsp + 0x20], r12
and edx, 0x3f
cmp ecx, eax
mov r12d, r8d
jae 0x14003f49b
inc dword [rdi + 0x18]
mov eax, r8d
mov qword [rsp + 0x40], rsi
mov dword [rdi + 0x14], ecx
shr eax, 0x1d
add dword [rdi + 0x18], eax
test edx, edx
je 0x14003f52e
mov esi, 0x40
movsxd rax, edx
sub esi, edx
lea rcx, [rax + rdi + 0x1c]
cmp r8d, esi
jl 0x14003f5ca
mov r8d, esi
mov rdx, rbx
call fcn.140056430
movzx eax, word [0x1401c3908]
and ax, 0xff00
cmp ax, 0x5000
je 0x14003f51d
xor r8d, r8d
nop
nop
nop
mov edx, dword [rdi + r8*4 + 0x1c]
inc r8
rol edx, 0x10
mov ecx, edx
mov eax, edx
shl edx, 8
shr ecx, 8
shl eax, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, edx
cmp r8, 0x10
mov dword [rdi + r8*4 + 0x18], ecx
jl 0x14003f4f0
mov rcx, rdi
call fcn.14003d0c0
movsxd r11, esi
add rbx, r11
sub r12d, esi
cmp r12d, 0x40
jl 0x14003f5c3
mov esi, r12d
mov qword [rsp + 0x38], rbp
shr rsi, 6
mov eax, esi
neg eax
shl eax, 6
add r12d, eax
nop
lea rcx, [rdi + 0x1c]
mov r8d, 0x40
mov rdx, rbx
call fcn.140056430
movzx r11d, word [0x1401c3908]
and r11w, 0xff00
cmp r11w, 0x5000
je 0x14003f5ad
xor r8d, r8d
nop
nop
mov edx, dword [rdi + r8*4 + 0x1c]
inc r8
rol edx, 0x10
mov ecx, edx
mov eax, edx
shl edx, 8
shr ecx, 8
shl eax, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, edx
cmp r8, 0x10
mov dword [rdi + r8*4 + 0x18], ecx
jl 0x14003f580
mov rcx, rdi
call fcn.14003d0c0
add rbx, 0x40
dec rsi
jne 0x14003f550
mov rbp, qword [rsp + 0x38]
lea rcx, [rdi + 0x1c]
mov r8d, r12d
mov rdx, rbx
mov r12, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x28
jmp fcn.140056430
Function at 0x14003f5f0
Capabilities:
Encode data using xor

Disassembly:
mov eax, reloc.WSOCK32.dll_getservbyport
call fcn.1400035e0
sub rsp, rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov ebp, dword [rdx + 0x14]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x30], r12
mov r12d, dword [rdx + 0x18]
mov r9d, ebp
mov qword [rsp + 0x28], r13
mov r13, rcx
shr r9d, 3
mov r8d, 0x3f
xor edi, edi
and r9d, 0x3f
mov rbx, rdx
movsxd rax, r9d
sub r8d, r9d
lea rcx, [rax + rdx + 0x1c]
inc rcx
cmp r8d, 8
mov byte [rcx - 1], 0x80
jge 0x14003f6c0
xor edx, edx
mov qword [rsp + 0x50], rsi
call fcn.140056410
movzx eax, word [0x1401c3908]
and ax, 0xff00
cmp ax, 0x5000
je 0x14003f6a2
mov r9, rdi
nop
mov r8d, dword [rbx + r9*4 + 0x1c]
inc r9
rol r8d, 0x10
mov edx, r8d
mov eax, r8d
shl r8d, 8
shr edx, 8
shl eax, 8
xor edx, eax
and edx, 0xff00ff
xor edx, r8d
cmp r9, 0x10
mov dword [rbx + r9*4 + 0x18], edx
jl 0x14003f670
mov rcx, rbx
call fcn.14003d0c0
xor edx, edx
lea rcx, [rbx + 0x1c]
lea r8d, [rdx + 0x38]
call fcn.140056410
mov rsi, qword [rsp + 0x50]
jmp 0x14003f6cb
add r8d, 0xfffffff8
xor edx, edx
call fcn.140056410
movzx eax, word [0x1401c3908]
and ax, 0xff00
cmp ax, 0x5000
je 0x14003f70d
mov r8, rdi
nop
mov edx, dword [rbx + r8*4 + 0x1c]
inc r8
rol edx, 0x10
mov ecx, edx
mov eax, edx
shl edx, 8
shr ecx, 8
shl eax, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, edx
cmp r8, 0x10
mov dword [rbx + r8*4 + 0x18], ecx
jl 0x14003f6e0
mov rcx, rbx
mov dword [rbx + 0x58], r12d
mov dword [rbx + 0x54], ebp
call fcn.14003d0c0
movzx eax, word [0x1401c3908]
mov r12, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x48]
and ax, 0xff00
cmp ax, 0x5000
je 0x14003f76b
nop
nop
nop
mov edx, dword [rbx + rdi*4 + 0x1c]
inc rdi
rol edx, 0x10
mov ecx, edx
mov eax, edx
shl edx, 8
shr ecx, 8
shl eax, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, edx
cmp rdi, 0x10
mov dword [rbx + rdi*4 + 0x18], ecx
jl 0x14003f740
mov rdi, qword [rsp + 0x58]
lea rcx, [r13 + 1]
mov r13, qword [rsp + 0x28]
lea rdx, [rbx + 2]
mov r8d, 5
nop
nop
nop
nop
movzx eax, byte [rdx - 2]
add rcx, 4
add rdx, 4
dec r8
mov byte [rcx - 5], al
movzx eax, byte [rdx - 5]
mov byte [rcx - 4], al
movzx eax, byte [rdx - 4]
mov byte [rcx - 3], al
movzx eax, byte [rdx - 3]
mov byte [rcx - 2], al
jne 0x14003f790
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 0x5c]
mov rbx, qword [rsp + 0x40]
add rsp, 0x38
jmp fcn.140056410
Function at 0x140041c40
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, 8
call fcn.1400035e0
sub rsp, rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], rdi
mov qword [rsp], r12
xor bpl, bpl
xor r12b, r12b
xor di, di
test edx, edx
mov rbx, r8
mov r11d, edx
mov rsi, rcx
jle 0x140041cf5
nop
nop
movzx ecx, r12b
movzx eax, bpl
movsx r9, di
inc eax
inc di
cdq
movzx edx, dl
add eax, edx
movzx eax, al
sub eax, edx
movzx r10d, al
mov ebp, eax
movzx eax, byte [r10 + rbx]
add eax, ecx
cdq
movzx edx, dl
add eax, edx
movzx eax, al
sub eax, edx
movzx edx, byte [r10 + rbx]
movzx r8d, al
mov r12d, eax
movzx eax, dl
movzx ecx, byte [r8 + rbx]
mov byte [r10 + rbx], cl
mov byte [r8 + rbx], dl
movzx ecx, byte [r10 + rbx]
add eax, ecx
cdq
movzx edx, dl
add eax, edx
movzx eax, al
sub eax, edx
movzx ecx, al
movzx eax, byte [rcx + rbx]
xor byte [r9 + rsi], al
movsx eax, di
cmp eax, r11d
jl 0x140041c80
mov r12, qword [rsp]
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x10]
add rsp, 8
ret

Function at 0x140041d20
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rdi
mov r10, r8
mov rdi, rcx
mov ebx, edx
xor ax, ax
mov r9, r8
nop
nop
mov byte [r9], al
inc ax
inc r9
cmp ax, 0x100
jl 0x140041d40
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
xor bpl, bpl
xor sil, sil
mov r9, r8
mov r11d, 0x100
nop
nop
movzx ecx, byte [r9]
movzx eax, bpl
inc r9
movzx eax, byte [rax + rdi]
sub eax, ecx
movzx ecx, sil
add eax, ecx
cdq
movzx edx, dl
add eax, edx
movzx eax, al
sub eax, edx
movzx edx, byte [r9 - 1]
movzx r8d, al
mov esi, eax
movzx eax, bpl
movzx ecx, byte [r8 + r10]
inc eax
mov byte [r9 - 1], cl
mov byte [r8 + r10], dl
cdq
idiv ebx
dec r11
mov ebp, edx
jne 0x140041d70
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x10]
mov rbx, qword [rsp + 8]
ret

Function at 0x140042830
Capabilities:
Encode data using xor

Disassembly:
push rbx
xor r9w, r9w
test edx, edx
mov r10, rcx
je 0x140042894
mov r11d, edx
lea rbx, [0x1401c3970]
nop
nop
nop
movzx r8d, byte [r10]
mov dl, r9b
shr r9w, 4
mov al, r8b
and edx, 0xf
shr r8, 4
movzx ecx, word [rbx + rdx*4]
and eax, 0xf
inc r10
xor cx, word [rbx + rax*4]
xor cx, r9w
mov al, cl
shr cx, 4
and eax, 0xf
movzx r9d, word [rbx + rax*4]
xor r9w, word [rbx + r8*4]
xor r9w, cx
dec r11
jne 0x140042850
mov ax, r9w
pop rbx
ret
Function at 0x140045da0
Capabilities:
Encode data using base64

Disassembly:
mov eax, 0x28
call fcn.1400035e0
sub rsp, rax
cmp r9d, 1
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x18], r13
mov r13, rcx
mov r11d, r9d
mov rdi, rdx
jae 0x140045ddd
xor r10d, r10d
xor eax, eax
mov dword [rdx], r10d
mov r13, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x48]
add rsp, 0x28
ret
xor r10d, r10d
test r9d, r9d
mov dword [rdx], r10d
je 0x140045f28
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x10], r14
mov qword [rsp + 8], r15
mov qword [rsp + 0x30], rbx
lea ecx, [r11 - 1]
mov eax, 0xaaaaaaab
mov qword [rsp + 0x40], rsi
lea r9, [r8 + 1]
lea r15d, [r10 + 3]
mul ecx
shr edx, 1
lea r14, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov qword [rsp + 0x20], r12
lea ebp, [rdx + 1]
nop
nop
mov eax, 0xaaaaaaab
mov ebx, r11d
mul r10d
movzx eax, byte [r9 - 1]
shr edx, 1
mov r12d, eax
mov r8d, edx
add r8, r13
cmp r11d, r15d
cmovae ebx, r15d
shr r12d, 2
cmp ebx, 1
jle 0x140045e6c
movzx edx, byte [r9]
and eax, r15d
shr edx, 4
shl eax, 4
or edx, eax
jmp 0x140045e74
mov edx, eax
and edx, r15d
shl edx, 4
cmp ebx, 2
jle 0x140045e8e
mov cl, byte [r9]
movzx eax, byte [r9 + 1]
and ecx, 0xf
shr eax, 6
shl ecx, 2
or ecx, eax
jmp 0x140045e97
mov cl, byte [r9]
and ecx, 0xf
shl ecx, 2
mov sil, byte [r9 + 1]
mov eax, r12d
and eax, 0x3f
and esi, 0x3f
movzx eax, byte [rax + r14]
mov byte [r8], al
mov eax, edx
and eax, 0x3f
cmp ebx, 1
movzx eax, byte [rax + r14]
mov byte [r8 + 1], al
jne 0x140045ecb
mov byte [r8 + 2], 0x3d
mov byte [r8 + 3], 0x3d
jmp 0x140045ef3
mov eax, ecx
and eax, 0x3f
cmp ebx, 2
movzx eax, byte [rax + r14]
mov byte [r8 + 2], al
jne 0x140045ee5
mov byte [r8 + 3], 0x3d
jmp 0x140045ef3
mov eax, esi
and eax, 0x3f
movzx eax, byte [rax + r14]
mov byte [r8 + 3], al
add dword [rdi], 4
add r11d, 0xfffffffd
add r10d, 0xc
add r9, r15
dec rbp
jne 0x140045e30
mov r15, qword [rsp + 8]
mov r14, qword [rsp + 0x10]
mov r12, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r13, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x48]
xor eax, eax
add rsp, 0x28
ret
Function at 0x1400477a0
Capabilities:
Encode data using xor

Disassembly:
rol dx, 1
mov r8d, socket
mov word [rsp + 0x10], dx
xor byte [rsp + 0x11], dl
movzx eax, dl
movzx eax, word [rsp + 0x10]
lea rdx, [rcx + 4]
ror ax, 1
ror ax, 1
mov word [rsp + 0x10], ax
nop
nop
movzx eax, byte [rsp + 0x11]
movzx ecx, byte [rsp + 0x10]
add rdx, 8
rol cl, 1
ror al, 1
xor al, cl
mov byte [rsp + 0x10], cl
mov byte [rsp + 0x11], al
movzx eax, word [rsp + 0x10]
not ax
xor word [rdx - 0xc], ax
add ax, 0x55
mov word [rsp + 0x10], ax
movzx ecx, al
movzx eax, byte [rsp + 0x11]
rol cl, 1
ror al, 1
xor al, cl
mov byte [rsp + 0x10], cl
mov byte [rsp + 0x11], al
movzx eax, word [rsp + 0x10]
not ax
xor word [rdx - 0xa], ax
add ax, 0x55
mov word [rsp + 0x10], ax
movzx ecx, al
movzx eax, byte [rsp + 0x11]
rol cl, 1
ror al, 1
xor al, cl
mov byte [rsp + 0x10], cl
mov byte [rsp + 0x11], al
movzx eax, word [rsp + 0x10]
not ax
xor word [rdx - 8], ax
add ax, 0x55
mov word [rsp + 0x10], ax
movzx ecx, al
movzx eax, byte [rsp + 0x11]
rol cl, 1
ror al, 1
xor al, cl
mov byte [rsp + 0x10], cl
mov byte [rsp + 0x11], al
movzx eax, word [rsp + 0x10]
not ax
xor word [rdx - 6], ax
add ax, 0x55
dec r8
mov word [rsp + 0x10], ax
jne 0x1400477d0
ret
Function at 0x14004a270
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov eax, 0x440
call fcn.1400035e0
sub rsp, rax
mov rax, qword [0x1401ad1c0]
mov qword [rsp + 0x430], rax
mov rbx, rcx
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, Ordinal_1026
call sub.MSVCR110.dll_memset
lea rdx, [0x1401f33f0]
lea rcx, [rsp + 0x30]
mov r8d, 0xa5
call sub.MSVCR110.dll_memcpy
movzx r11d, byte [0x1401f33f0]
movzx eax, r11b
and al, 0xf
movzx r10d, al
nop
xor dl, dl
mov r9w, 0xa4
lea r8, [rsp + 0xd4]
nop
movzx ecx, byte [r8]
movzx eax, dl
dec r8
movzx edx, cl
add cl, cl
or cl, al
shr dl, 7
add r9w, 0xffff
mov byte [r8 + 1], cl
jne 0x14004a2e0
test dl, dl
je 0x14004a30c
or byte [rsp + 0xd4], 1
movzx eax, r10w
add r10w, 0xffff
test ax, ax
jne 0x14004a2d0
xor cx, cx
nop
movzx eax, cx
inc cx
xor byte [rsp + rax + 0x31], r11b
cmp cx, 0xa4
jb 0x14004a320
inc dword [0x1401f3e94]
xor eax, eax
lea rcx, [rbx + 1]
lea r8, [0x1401f3634]
mov qword [0x1401f3630], rax
mov qword [0x1401f3638], rax
mov word [0x1401f3630], 2
lea edx, [rax + 4]
sub r8, rcx
nop
nop
nop
nop
movzx eax, byte [rcx]
inc rcx
dec rdx
mov byte [r8 + rcx - 1], al
jne 0x14004a370
movzx ecx, word [0x1401c69c8]
mov eax, 0x1db
test cx, cx
cmove cx, ax
mov word [0x1401c69c8], cx
call qword [0x1401f34e8]
mov rcx, qword [0x1401f34b8]
mov word [0x1401f3632], ax
lea rax, [0x1401f3630]
lea rdx, [rsp + 0x30]
xor r9d, r9d
mov r8d, 0xa5
mov dword [rsp + 0x28], reloc.WSOCK32.dll_recv
mov qword [rsp + 0x20], rax
call qword [0x1401f2f20]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x430]
call fcn.14006b6a0
add rsp, 0x440
pop rbx
ret
Function at 0x14004a400
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x458
call fcn.1400035e0
sub rsp, rax
mov rax, qword [0x1401ad1c0]
mov qword [rsp + 0x430], rax
inc dword [0x1401f3e94]
xor eax, eax
mov qword [rsp + 0x470], rbx
mov qword [rsp + 0x478], rbp
movzx ebp, word [rdx + 6]
lea r8, [0x1401f3634]
add ebp, 8
mov qword [rsp + 0x448], rdi
inc rcx
mov edi, 4
mov rbx, rdx
mov qword [0x1401f3630], rax
sub r8, rcx
mov qword [0x1401f3638], rax
mov word [0x1401f3630], 2
mov rdx, rdi
nop
nop
nop
nop
movzx eax, byte [rcx]
inc rcx
dec rdx
mov byte [r8 + rcx - 1], al
jne 0x14004a480
movzx ecx, word [0x1401c69c8]
mov eax, 0x1db
mov qword [rsp + Ordinal_1111], rsi
test cx, cx
cmove cx, ax
mov word [0x1401c69c8], cx
call qword [0x1401f34e8]
test ebp, ebp
mov word [0x1401f3632], ax
movsxd rsi, ebp
je 0x14004a4d6
lea rcx, [rsp + 0x30]
mov r8, rsi
mov rdx, rbx
call sub.MSVCR110.dll_memcpy
cmp word [rsp + 0x34], 0x135
jne 0x14004a575
movzx eax, word [rsp + 0x32]
lea r11, [rsp + 0x38]
mov ebx, getservbyname
add eax, 0x22030000
nop
nop
nop
mov r9d, dword [r11 + 4]
mov r8d, dword [r11]
mov r10d, reloc.WSOCK32.dll_recv
nop
mov dl, al
mov ecx, r9d
and dx, 0xf
jbe 0x14004a536
nop
nop
bt ecx, 0x1f
jae 0x14004a52d
add ecx, ecx
or ecx, 1
jmp 0x14004a52f
add ecx, ecx
add dx, 0xffff
jne 0x14004a520
xor r8d, ecx
mov cx, 2
xor r8d, eax
mov edx, r8d
test al, 1
je 0x14004a54f
shr eax, 1
bts eax, 0x1f
jmp 0x14004a551
shr eax, 1
add cx, 0xffff
jne 0x14004a543
dec r10
mov r8d, r9d
mov r9d, edx
jne 0x14004a510
mov dword [r11 + 4], edx
mov dword [r11], r8d
add r11, 8
inc eax
dec rbx
jne 0x14004a500
cmp rdi, rsi
movzx eax, byte [rsp + 0x32]
mov rbx, qword [rsp + 0x470]
lea r8, str._.C
movzx edx, byte [rax + r8]
jge 0x14004a5a9
movzx ecx, dl
inc rdi
inc edx
movzx eax, byte [rcx + r8]
xor byte [rsp + rdi + 0x2f], al
cmp rdi, rsi
jl 0x14004a593
mov rcx, qword [0x1401f34b8]
lea rax, [0x1401f3630]
lea rdx, [rsp + 0x30]
xor r9d, r9d
mov r8d, ebp
mov dword [rsp + 0x28], reloc.WSOCK32.dll_recv
mov qword [rsp + 0x20], rax
call qword [0x1401f2f20]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rdi, qword [rsp + 0x448]
mov rsi, qword [rsp + 0x450]
mov rbp, qword [rsp + 0x478]
mov rcx, qword [rsp + 0x430]
call fcn.14006b6a0
add rsp, 0x458
ret
Function at 0x14004a6b0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x28
call fcn.1400035e0
sub rsp, rax
test edx, edx
mov rax, qword [rcx]
mov qword [rsp + 0x40], rbx
mov qword [0x1401f3ec0], rax
mov eax, dword [rcx + 8]
mov qword [rsp + 0x48], rdi
mov dword [0x1401f3ec8], eax
movzx eax, byte [rcx + 0xc]
mov ebx, edx
mov byte [0x1401f3ecc], al
mov rdi, rcx
je 0x14004a6f4
inc word [0x1401c699c]
cmp byte [rcx], 8
je 0x14004a717
mov dword [0x1401f3edc], 0xa
mov eax, 0xfffffef1
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x28
ret
movzx ecx, word [0x1401f3e90]
call qword [0x1401f34e8]
test ebx, ebx
mov word [0x1401f342f], ax
je 0x14004a734
call fcn.140049f60
movzx eax, byte [0x1401f33f1]
cmp al, 0x31
je 0x14004a83c
cmp al, 0x62
je 0x14004a83c
cmp al, 0x60
je 0x14004a83c
lea rcx, [0x1401f3320]
xor edx, edx
mov r8d, 0xad
call sub.MSVCR110.dll_memset
movzx eax, word [0x1401c699c]
lea rdx, [0x1401f33f0]
lea rcx, [0x1401f3328]
mov r8d, 0xa5
mov word [0x1401f3322], ax
mov word [0x1401f3320], 0x2309
mov word [0x1401f3324], reloc.mfc110.dll_Ordinal_300
mov word [0x1401f3326], 0xa5
call sub.MSVCR110.dll_memcpy
movzx r11d, byte [0x1401f33f0]
lea rbx, [0x1401f33cc]
movzx eax, r11b
and al, 0xf
movzx r10d, al
xor dl, dl
mov r9w, 0xa4
mov r8, rbx
nop
movzx ecx, byte [r8]
movzx eax, dl
dec r8
movzx edx, cl
add cl, cl
or cl, al
shr dl, 7
add r9w, 0xffff
mov byte [r8 + 1], cl
jne 0x14004a7d0
test dl, dl
je 0x14004a7fb
or byte [0x1401f33cc], 1
movzx eax, r10w
add r10w, 0xffff
test ax, ax
jne 0x14004a7c2
lea rax, [0x1401f3329]
mov ecx, 0xa4
nop
nop
nop
xor byte [rax], r11b
inc rax
dec rcx
jne 0x14004a820
lea rdx, [0x1401f3320]
mov rcx, rdi
call fcn.14004a400
jmp 0x14004a844
mov rcx, rdi
call fcn.14004a270
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov dword [0x1401f3edc], 0
xor eax, eax
add rsp, 0x28
ret
Function at 0x140055610
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, 0x78
call fcn.1400035e0
sub rsp, rax
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x58], rdi
mov rdi, r8
xor ebx, ebx
mov qword [rsp + 0x50], r12
lea r8, [rsp + 0x30]
mov qword [rsp + 0x48], r13
mov r12d, r9d
mov r13, rcx
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], ebx
call fcn.1400553c0
test rax, rax
mov rsi, rax
jne 0x140055666
mov eax, 0xf1
jmp 0x14005576e
lea rax, [rsp + 0x38]
lea r9, [0x140055600]
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x20], rax
call fcn.1400554e0
cmp eax, 0xffffffff
je 0x14005575a
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14005575a
mov rax, qword [rcx + 8]
mov r10d, dword [rsp + 0xa0]
test r10d, r10d
movzx edi, byte [rax + 4]
mov ebp, dword [rax]
jne 0x1400556c8
cmp dil, 1
je 0x1400556c8
mov ebx, 0xf3
jmp 0x14005575f
mov byte [rax + 4], 1
mov rax, qword [rsp + 0x38]
mov r8d, 0xffffffff
mov rcx, qword [rax + 8]
mov r9, rbx
mov dword [rcx], r12d
mov r11d, dword [rsp + 0x30]
test r11, r11
je 0x140055712
lea r12, [0x1401c7270]
movzx ecx, byte [r9 + r13]
mov eax, r8d
inc r9
xor cl, r8b
shr eax, 8
movzx edx, cl
mov r8d, dword [r12 + rdx*4]
xor r8d, eax
cmp r9, r11
jb 0x1400556f2
test r10d, r10d
not r8d
je 0x140055735
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 8]
mov byte [rcx + 4], 1
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 8]
mov dword [rcx], r8d
jmp 0x14005575f
mov eax, 0xf0
cmp ebp, r8d
cmovne ebx, eax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 8]
mov byte [rcx + 4], dil
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 8]
mov dword [rcx], ebp
jmp 0x14005575f
mov ebx, 0xf2
mov rcx, rsi
call fcn.140055350
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov r13, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x70]
add rsp, 0x78
ret
Function at 0x140055790
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov eax, 0x58
call fcn.1400035e0
sub rsp, rax
mov rax, qword [0x1401ad1c0]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x38], r12
lea r12d, [r8 - 6]
mov rbx, rdx
mov ebp, r8d
lea eax, [r12 - 1]
mov rdx, rcx
test eax, eax
movsxd r9, eax
js 0x1400557f1
lea rax, [rsp]
sub rdx, rax
nop
nop
lea rax, [rdx + r9*4]
dec r9
mov ecx, dword [rsp + rax]
mov dword [rsp + r9*4 + 4], ecx
jns 0x1400557e0
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rdi
xor r10d, r10d
xor edi, edi
xor r8d, r8d
xor edx, edx
test r12d, r12d
movsxd r9, r12d
jle 0x140055854
lea esi, [rbp + 1]
xor r11d, r11d
cmp edi, esi
jge 0x140055854
cmp r8, r9
jge 0x14005583f
nop
cmp rdx, 4
jge 0x14005583f
mov eax, dword [rsp + r8*4]
lea rcx, [r11 + rdx]
inc r8
inc r10d
inc rdx
cmp r8, r9
mov dword [rbx + rcx*4], eax
jl 0x140055820
cmp rdx, 4
jne 0x14005584f
inc edi
add r11, rdx
xor r10d, r10d
xor edx, edx
cmp r8, r9
jl 0x140055813
inc ebp
movsxd r11, edi
movsxd r8, r10d
cmp edi, ebp
jge 0x140055996
lea r10, [0x1401ca870]
lea rsi, [0x1401c7670]
movzx ecx, byte [rsp + r9*4 - 3]
movzx eax, byte [rsp]
add r10, 4
xor al, byte [rcx + rsi]
mov byte [rsp], al
movzx eax, byte [rsp + r9*4 - 2]
movzx eax, byte [rax + rsi]
xor byte [rsp + 1], al
movzx eax, byte [rsp + r9*4 - 1]
movzx eax, byte [rax + rsi]
xor byte [rsp + 2], al
movzx eax, byte [rsp + r9*4 - 4]
movzx eax, byte [rax + rsi]
xor byte [rsp + 3], al
movzx eax, byte [r10 - 4]
xor byte [rsp], al
cmp r12d, 8
je 0x1400558e2
mov ecx, 1
cmp rcx, r9
jge 0x140055950
nop
mov eax, dword [rsp + rcx*4 - 4]
inc rcx
xor dword [rsp + rcx*4 - 4], eax
cmp rcx, r9
jl 0x1400558d0
jmp 0x140055950
lea rcx, [rsp + 4]
mov edx, 3
nop
mov eax, dword [rcx - 4]
add rcx, 4
xor dword [rcx - 4], eax
dec rdx
jne 0x1400558f0
movzx eax, byte [rsp + 0xc]
mov ecx, 5
movzx eax, byte [rax + rsi]
xor byte [rsp + 0x10], al
movzx eax, byte [rsp + 0xd]
movzx eax, byte [rax + rsi]
xor byte [rsp + 0x11], al
movzx eax, byte [rsp + 0xe]
movzx eax, byte [rax + rsi]
xor byte [rsp + 0x12], al
movzx eax, byte [rsp + 0xf]
movzx eax, byte [rax + rsi]
xor byte [rsp + 0x13], al
cmp rcx, r9
jge 0x140055950
nop
mov eax, dword [rsp + rcx*4 - 4]
inc rcx
xor dword [rsp + rcx*4 - 4], eax
cmp rcx, r9
jl 0x140055940
xor edx, edx
test r12d, r12d
jle 0x14005598e
cmp edi, ebp
jge 0x14005598e
cmp rdx, r9
jge 0x14005597b
cmp r8, 4
jge 0x14005597b
mov eax, dword [rsp + rdx*4]
lea rcx, [r8 + r11*4]
inc rdx
inc r8
cmp rdx, r9
mov dword [rbx + rcx*4], eax
jl 0x140055960
cmp r8, 4
jne 0x140055989
inc edi
inc r11
xor r8d, r8d
cmp rdx, r9
jl 0x140055957
cmp edi, ebp
jl 0x140055872
mov r12, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x78]
xor eax, eax
mov rcx, qword [rsp + 0x20]
call fcn.14006b6a0
add rsp, 0x58
ret