joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14010c0d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
mov eax, 0xa8
call fcn.140189b00
sub rsp, rax
mov esi, ecx
xor ebp, ebp
lea r8, [rsp + 0x88]
lea rdx, [rsp + 0x80]
xor ecx, ecx
mov edi, ebp
mov ebx, ebp
call fcn.1400a98e0
test eax, eax
je 0x14010c35b
nop
nop
nop
mov eax, dword [rsp + 0x80]
shl eax, 0xa
test esi, eax
je 0x14010c131
add edi, 1
add ebx, 1
lea r8, [rsp + 0x88]
lea rdx, [rsp + 0x80]
mov ecx, ebx
call fcn.1400a98e0
test eax, eax
jne 0x14010c120
test edi, edi
je 0x14010c35b
mov ecx, dword [rsp + 0x130]
mov rbx, qword [rsp + 0x128]
mov qword [rsp + 0xd0], r12
mov eax, ecx
mov qword [rsp + 0xa0], r13
mov qword [rsp + 0x98], r14
mov r14, qword [rsp + 0x138]
cdq
mov qword [rsp + 0x90], r15
idiv edi
cmp edi, 1
movsxd rdi, dword [rsp + 0x148]
cmove ecx, ebp
mov r8, rdi
xor edx, edx
mov dword [rsp + 0x130], ecx
mov rcx, r14
movsxd r13, eax
call fcn.140041940
lea r8, [rsp + 0x88]
lea rdx, [rsp + 0x80]
xor ecx, ecx
call fcn.1400a98e0
test eax, eax
je 0x14010c304
mov r12, qword [rsp + 0x140]
mov r15d, dword [rsp + 0x120]
nop
nop
nop
mov eax, dword [rsp + 0x80]
shl eax, 0xa
test esi, eax
je 0x14010c2e2
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x14010c335
mov eax, dword [rsp + 0x148]
mov r8d, dword [rsp + 0x130]
mov r9, qword [rsp + 0xd8]
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x118]
mov qword [rsp + 0x68], r12
mov dword [rsp + 0x60], r15d
mov qword [rsp + 0x58], rax
mov eax, dword [rsp + 0x110]
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x108]
and r8d, 1
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x100]
add r8d, r13d
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0xf8]
mov rdx, rbx
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0xf0]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0xe0]
mov dword [rsp + 0x20], eax
call fcn.14010bcb0
test eax, eax
je 0x14010c357
add rbx, r13
test rdi, rdi
jle 0x14010c2e2
mov r8, r12
mov rcx, r14
mov rdx, rdi
sub r8, r14
nop
nop
nop
nop
movzx eax, byte [r8 + rcx]
add rcx, 1
xor byte [rcx - 1], al
sub rdx, 1
jne 0x14010c2d0
add ebp, 1
lea r8, [rsp + 0x88]
lea rdx, [rsp + 0x80]
mov ecx, ebp
call fcn.1400a98e0
test eax, eax
jne 0x14010c1f0
mov eax, 1
mov r14, qword [rsp + 0x98]
mov r13, qword [rsp + 0xa0]
mov r12, qword [rsp + 0xd0]
mov r15, qword [rsp + 0x90]
add rsp, 0xa8
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov edx, 0x11c
lea r9, [0x140218cb0]
mov ecx, reloc.WS2_32.dll_sendto
lea r8d, [rdx + 0x2a]
mov dword [rsp + 0x20], 0x114
call fcn.1400a5900
xor eax, eax
jmp 0x14010c309
mov ecx, reloc.WS2_32.dll_sendto
lea r9, [0x140218ca0]
mov edx, 0x11c
lea r8d, [rcx + 0x30]
mov dword [rsp + 0x20], 0x109
call fcn.1400a5900
mov eax, ebp
add rsp, 0xa8
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14010e190
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push r13
push r14
push r15
mov eax, reloc.WS2_32.dll_getservbyport
call fcn.140189b00
sub rsp, rax
cmp r8d, 3
mov rbx, r9
mov r14d, r8d
mov r13, rdx
mov r15, rcx
jge 0x14010e1f2
mov edx, 0x136
lea r9, [0x140218fc8]
lea ecx, [rax - 0x24]
lea r8d, [rdx + 0x2b]
mov dword [rsp + 0x20], 0x125
call fcn.1400a5900
mov dword [rbx], reloc.WLDAP32.dll_Ordinal_50
mov eax, 1
add rsp, 0x38
pop r15
pop r14
pop r13
pop rbx
ret
movzx eax, byte [rdx + 1]
mov qword [rsp + 0x60], rbp
movzx ebp, byte [rdx]
shl ebp, 8
add r13, 2
sub r14d, 2
or ebp, eax
mov eax, ebp
cdq
and eax, 1
xor eax, edx
cmp eax, edx
je 0x14010e239
mov edx, 0x136
mov dword [rsp + 0x20], 0x131
lea r9, [0x140218fd8]
lea r8d, [rdx + 0x2b]
mov ecx, reloc.WS2_32.dll_sendto
jmp 0x14010e343
lea eax, [rbp + 1]
cmp r14d, eax
jge 0x14010e263
mov edx, 0x136
mov dword [rsp + 0x20], 0x139
lea r9, [0x140218fe8]
lea r8d, [rdx + 0x2b]
mov ecx, reloc.WS2_32.dll_sendto
jmp 0x14010e343
test rcx, rcx
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x30], r12
je 0x14010e296
mov r12, qword [rcx + 0x270]
test r12, r12
jne 0x14010e299
mov rax, qword [rcx + 0x170]
test rax, rax
je 0x14010e296
mov r12, qword [rax + 0x2c0]
test r12, r12
jne 0x14010e299
xor r12d, r12d
mov qword [rcx + 0x278], 0
mov rcx, r12
call fcn.1400af830
test ebp, ebp
mov edi, eax
je 0x14010e30f
mov qword [rsp + 0x68], rsi
nop
nop
nop
movzx esi, byte [r13]
movzx ecx, byte [r13 + 1]
add r13, 2
shl esi, 8
sub ebp, 2
sub r14d, 2
or esi, ecx
xor ebx, ebx
test edi, edi
jle 0x14010e301
mov edx, ebx
mov rcx, r12
call fcn.1400af840
cmp dword [rax + 8], esi
je 0x14010e2f8
add ebx, 1
cmp ebx, edi
jl 0x14010e2e0
jmp 0x14010e301
mov qword [r15 + 0x278], rax
mov edi, ebx
test ebp, ebp
jne 0x14010e2c0
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x68]
movzx eax, byte [r13]
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x70]
lea ecx, [r14 - 1]
cmp eax, ecx
je 0x14010e364
mov edx, 0x136
mov dword [rsp + 0x20], 0x161
lea r9, [0x140218ff8]
lea r8d, [rdx + 0x2a]
mov ecx, reloc.WS2_32.dll_sendto
call fcn.1400a5900
mov rbp, qword [rsp + 0x60]
mov dword [rbx], reloc.WLDAP32.dll_Ordinal_50
mov eax, 1
add rsp, 0x38
pop r15
pop r14
pop r13
pop rbx
ret
xor eax, eax
mov rbp, qword [rsp + 0x60]
add rsp, 0x38
pop r15
pop r14
pop r13
pop rbx
ret
Function at 0x14010eac0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push r13
push r15
mov eax, Ordinal_211
call fcn.140189b00
sub rsp, rax
mov rax, qword [0x1401f3660]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov r15, qword [rsp + 0x120]
xor eax, eax
test r9, r9
mov rbp, r9
movsxd rsi, r8d
mov r13, rdx
mov rdi, rcx
je 0x14010eb23
cmp r9, qword [rcx]
je 0x14010eb19
test rdx, rdx
je 0x14010ed22
test r8d, r8d
js 0x14010ed22
mov eax, 1
mov qword [rcx], r9
jmp 0x14010eb2f
mov rbp, qword [rcx]
test rbp, rbp
je 0x14010ed22
test rdx, rdx
mov qword [rsp + 0xc8], rbx
mov qword [rsp + 0xc0], r12
mov qword [rsp + 0xb8], r14
je 0x14010ec14
mov rcx, rbp
call fcn.1400dce20
mov ebx, 0x80
cmp eax, ebx
mov r12d, eax
jle 0x14010eb7a
lea r8, str.j____int_sizeof_ctx__key_
lea edx, [rbx - 0xc]
lea rcx, str..cryptohmachmac.c
call fcn.1400c9330
cmp r12d, esi
jge 0x14010ebd1
lea rcx, [rdi + 8]
mov r8, r15
mov rdx, rbp
call fcn.1400da3d0
test eax, eax
je 0x14010ed01
lea rcx, [rdi + 8]
mov r8, rsi
mov rdx, r13
call fcn.1400da630
test eax, eax
je 0x14010ed01
lea r12, [rdi + 0x98]
lea rdx, [rdi + 0x9c]
lea rcx, [rdi + 8]
mov r8, r12
call fcn.1400da650
test eax, eax
je 0x14010ed01
jmp 0x14010ebf6
cmp esi, ebx
ja 0x14010ed01
lea rcx, [rdi + 0x9c]
mov r8, rsi
mov rdx, r13
call fcn.140042d30
lea r12, [rdi + 0x98]
mov dword [r12], esi
mov eax, dword [r12]
cmp eax, ebx
je 0x14010ec1c
sub ebx, eax
lea rcx, [rax + rdi + 0x9c]
xor edx, edx
mov r8d, ebx
call fcn.140041940
jmp 0x14010ec1c
test eax, eax
je 0x14010ecf0
lea rbx, [rdi + 0x9d]
mov esi, 0x40
lea rcx, [rsp + 0x21]
mov rdx, rbx
mov r8, rsi
nop
nop
nop
nop
movzx eax, byte [rdx - 1]
add rcx, 2
add rdx, 2
xor al, 0x36
mov byte [rcx - 3], al
movzx eax, byte [rdx - 2]
xor al, 0x36
sub r8, 1
mov byte [rcx - 2], al
jne 0x14010ec40
lea rcx, [rdi + 0x38]
mov r8, r15
mov rdx, rbp
call fcn.1400da3d0
test eax, eax
je 0x14010ed01
mov rcx, rbp
call fcn.1400dce20
lea rdx, [rsp + 0x20]
lea rcx, [rdi + 0x38]
movsxd r8, eax
call fcn.1400da630
test eax, eax
je 0x14010ed01
lea rdx, [rsp + 0x21]
nop
nop
movzx eax, byte [rbx - 1]
add rdx, 2
add rbx, 2
xor al, 0x5c
mov byte [rdx - 3], al
movzx eax, byte [rbx - 2]
xor al, 0x5c
sub rsi, 1
mov byte [rdx - 2], al
jne 0x14010eca0
lea rcx, [rdi + 0x68]
mov r8, r15
mov rdx, rbp
call fcn.1400da3d0
test eax, eax
je 0x14010ed01
mov rcx, rbp
call fcn.1400dce20
lea rdx, [rsp + 0x20]
lea rcx, [rdi + 0x68]
movsxd r8, eax
call fcn.1400da630
test eax, eax
je 0x14010ed01
lea rdx, [rdi + 0x38]
lea rcx, [rdi + 8]
call fcn.1400da930
test eax, eax
jne 0x14010ed05
xor eax, eax
jmp 0x14010ed0a
mov eax, 1
mov r12, qword [rsp + 0xc0]
mov rbx, qword [rsp + 0xc8]
mov r14, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140041910
add rsp, 0xd0
pop r15
pop r13
pop rdi
pop rsi
pop rbp
ret
Function at 0x14010f040
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r12
mov eax, reloc.WLDAP32.dll_Ordinal_32
call fcn.140189b00
sub rsp, rax
mov rax, qword [rcx + 8]
lea r12d, [r9 + 1]
mov rbx, rdx
mov r9, qword [rax + 0xc8]
mov rsi, rcx
test byte [r9 + 0x70], 1
je 0x14010f0a6
mov ecx, dword [rdx + 4]
lea eax, [r12 + r8]
cmp eax, ecx
jbe 0x14010f093
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
mov eax, r8d
add qword [rdx + 0x10], rax
add qword [rdx + 0x18], rax
sub ecx, r8d
mov dword [rdx + 4], ecx
jmp 0x14010f0ac
cmp r12d, dword [rdx + 4]
ja 0x14010f080
mov ecx, dword [rdx + 4]
mov rax, qword [rdx + 0x10]
mov qword [rsp + 0x30], rbp
add ecx, 0xffffffff
or ebp, 0xffffffff
bt dword [rsi + 0x19c], 9
mov qword [rsp + 0x38], rdi
movzx edi, byte [rcx + rax]
jae 0x14010f11e
cmp qword [rsi + 0xe0], 0
jne 0x14010f11e
mov rcx, qword [rsi + 0x80]
lea rdx, [0x140241860]
mov r8d, 8
add rcx, 8
call fcn.1400c9370
test eax, eax
jne 0x14010f10c
test dil, 1
jne 0x14010f10c
mov rax, qword [rsi + 0x80]
or dword [rax], 8
mov rax, qword [rsi + 0x80]
test byte [rax], 8
je 0x14010f11e
test edi, edi
je 0x14010f11e
add edi, ebp
mov rcx, qword [rsi + 0xd0]
mov rcx, qword [rcx]
call fcn.1400dcdd0
bt eax, 0x15
jae 0x14010f142
sub ebp, edi
mov eax, 1
add dword [rbx + 4], ebp
jmp 0x14010f200
mov r10d, dword [rbx + 4]
lea ecx, [rdi + r12]
mov ebp, 0xff
mov r9d, r10d
mov eax, r10d
sub r9d, ecx
xor eax, ecx
xor r9d, ecx
or r9d, eax
lea eax, [r10 - 1]
xor r9d, r10d
shr r9d, 0x1f
sub r9d, 1
cmp eax, ebp
cmovb ebp, eax
xor r11d, r11d
test ebp, ebp
je 0x14010f1d0
mov rsi, qword [rbx + 0x10]
mov r8d, edi
shr r8d, 0x1f
nop
nop
nop
movzx eax, r8b
mov ecx, r11d
mov edx, edi
sub edx, r11d
shr ecx, 0x1f
shr edx, 0x1f
xor al, cl
xor dl, cl
or dl, al
mov eax, r10d
xor dl, r8b
sub eax, r11d
add r11d, 1
sub dl, 1
sub eax, 1
movzx ecx, byte [rax + rsi]
movzx edx, dl
xor ecx, edi
and edx, ecx
not edx
and r9d, edx
cmp r11d, ebp
jb 0x14010f190
not r9d
movzx eax, r9b
lea ecx, [rax - 1]
not eax
shr eax, 0x1f
shr ecx, 0x1f
and ecx, eax
lea eax, [rdi + 1]
neg ecx
and eax, ecx
sub r10d, eax
shl eax, 8
or dword [rbx], eax
mov eax, ecx
not ecx
and eax, 1
mov dword [rbx + 4], r10d
or eax, ecx
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x14011c230
Capabilities:
Hash data using sha1

Disassembly:
push rbx
mov eax, reloc.WLDAP32.dll_Ordinal_32
call fcn.140189b00
sub rsp, rax
lea r8d, [rax + 0x40]
xor edx, edx
mov rbx, rcx
call fcn.140041940
mov dword [rbx], 0x67452301
mov dword [rbx + 4], 0xefcdab89
mov dword [rbx + 8], 0x98badcfe
mov dword [rbx + 0xc], 0x10325476
mov dword [rbx + 0x10], 0xc3d2e1f0
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x140125b40
Capabilities:
Encode data using base64

Disassembly:
mov eax, 8
call fcn.140189b00
sub rsp, rax
xor r11d, r11d
test r8d, r8d
mov r10, rdx
mov r9, rcx
jle 0x140125c56
mov qword [rsp], rbx
lea rbx, [0x1401bb090]
nop
nop
cmp r8d, 3
jl 0x140125bd3
movzx eax, byte [r10 + 1]
movzx ecx, byte [r10]
shl ecx, 8
or ecx, eax
movzx eax, byte [r10 + 2]
shl ecx, 8
or ecx, eax
mov eax, ecx
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rax + rbx]
mov byte [r9], al
mov eax, ecx
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rax + rbx]
mov byte [r9 + 1], al
mov eax, ecx
shr rax, 6
and eax, 0x3f
movzx eax, byte [rax + rbx]
mov byte [r9 + 2], al
mov al, cl
and eax, 0x3f
add r9, 4
movzx eax, byte [rax + rbx]
mov byte [r9 - 1], al
jmp 0x140125c31
movzx ecx, byte [r10]
shl ecx, 0x10
cmp r8d, 2
jne 0x140125bea
movzx eax, byte [r10 + 1]
shl eax, 8
or ecx, eax
mov rax, rcx
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rax + rbx]
mov byte [r9], al
mov rax, rcx
shr rax, 0xc
and eax, 0x3f
cmp r8d, 1
movzx eax, byte [rax + rbx]
mov byte [r9 + 1], al
jne 0x140125c19
lea eax, [r8 + 0x3c]
jmp 0x140125c24
shr rcx, 6
and ecx, 0x3f
movzx eax, byte [rcx + rbx]
mov byte [r9 + 2], al
mov byte [r9 + 3], 0x3d
add r9, 4
sub r8d, 3
add r11d, 4
add r10, 3
test r8d, r8d
jg 0x140125b70
mov rbx, qword [rsp]
mov byte [r9], 0
mov eax, r11d
add rsp, 8
ret
mov byte [rcx], r11b
mov eax, r11d
add rsp, 8
ret

Function at 0x140129da0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
mov eax, reloc.WLDAP32.dll_Ordinal_32
call fcn.140189b00
sub rsp, rax
cmp r8, 0x10
mov r14, qword [rsp + 0x60]
mov r13, qword [rsp + 0x68]
mov r12, r9
mov rdi, r8
mov rbx, rdx
mov r10, r14
mov rbp, rcx
jb 0x140129e59
mov qword [rsp + 0x40], rsi
mov rsi, r8
shr rsi, 4
mov rax, rsi
imul rax, rax, 0xfffffffffffffff0
add rdi, rax
nop
nop
nop
mov r8, rbx
sub r10, rbp
mov rcx, rbp
sub r8, rbp
mov edx, 2
nop
nop
nop
nop
mov rax, qword [r10 + rcx]
add rcx, 8
xor rax, qword [rcx - 8]
sub rdx, 1
mov qword [r8 + rcx - 8], rax
jne 0x140129e20
mov r8, r12
mov rdx, rbx
mov rcx, rbx
call r13
mov r10, rbx
add rbx, 0x10
add rbp, 0x10
sub rsi, 1
jne 0x140129e00
mov rsi, qword [rsp + 0x40]
test rdi, rdi
je 0x140129ef9
nop
nop
nop
nop
mov rdx, r10
mov r9, rbx
xor r8d, r8d
sub rdx, rbp
sub r9, rbp
mov rcx, rbp
cmp r8, rdi
jae 0x140129ea3
movzx eax, byte [rcx + rdx]
add r8, 1
add rcx, 1
xor al, byte [rcx - 1]
cmp r8, 0x10
mov byte [rcx + r9 - 1], al
jb 0x140129e82
jmp 0x140129ed2
cmp r8, 0x10
jae 0x140129ed2
mov edx, reloc.WS2_32.dll_recv
sub r10, rbx
lea rcx, [r8 + rbx]
sub rdx, r8
nop
nop
movzx eax, byte [r10 + rcx]
add rcx, 1
sub rdx, 1
mov byte [rcx - 1], al
jne 0x140129ec0
mov r8, r12
mov rdx, rbx
mov rcx, rbx
call r13
cmp rdi, 0x10
mov r10, rbx
jbe 0x140129ef9
add rbp, 0x10
add rbx, 0x10
sub rdi, 0x10
jne 0x140129e70
mov rax, qword [r10]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov qword [r14], rax
mov rax, qword [r10 + 8]
mov qword [r14 + 8], rax
add rsp, 0x20
pop r14
pop r13
pop r12
ret
Function at 0x140129f30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x40
call fcn.140189b00
sub rsp, rax
mov rax, qword [0x1401f3660]
xor rax, rsp
mov qword [rsp + 0x30], rax
cmp rcx, rdx
mov r13, qword [rsp + 0xa0]
mov r15, qword [rsp + 0xa8]
mov r14, r9
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
je 0x140129fe1
cmp rbx, 0x10
mov r12, r13
jb 0x140129fce
mov rbp, rbx
shr rbp, 4
mov rax, rbp
imul rax, rax, 0xfffffffffffffff0
add rbx, rax
nop
nop
nop
mov r8, r14
mov rdx, rsi
mov rcx, rdi
call r15
mov r11, qword [r12]
add rsi, 0x10
xor qword [rsi - 0x10], r11
mov rax, qword [r12 + 8]
mov r12, rdi
xor qword [rsi - 8], rax
add rdi, 0x10
sub rbp, 1
jne 0x140129fa0
mov rax, qword [r12]
mov qword [r13], rax
mov rax, qword [r12 + 8]
mov qword [r13 + 8], rax
jmp 0x14012a045
cmp rbx, 0x10
jb 0x14012a045
mov rbp, rbx
shr rbp, 4
mov rax, rbp
imul rax, rax, 0xfffffffffffffff0
add rbx, rax
nop
nop
lea rdx, [rsp + 0x20]
mov r8, r14
mov rcx, rdi
call r15
mov r11, qword [rdi]
mov rax, qword [r13]
xor rax, qword [rsp + 0x20]
add rsi, 0x10
add rdi, 0x10
mov qword [rsi - 0x10], rax
mov rax, qword [r13 + 8]
mov qword [r13], r11
mov rcx, qword [rdi - 8]
xor rax, qword [rsp + 0x28]
sub rbp, 1
mov qword [rsi - 8], rax
mov qword [r13 + 8], rcx
jne 0x14012a000
test rbx, rbx
je 0x14012a101
lea rax, [rsp + 0x20]
mov r12, r13
mov rbp, rdi
sub r12, rax
lea rax, [rsp + 0x20]
sub rsi, rax
lea rax, [rsp + 0x20]
sub rbp, rax
nop
lea rdx, [rsp + 0x20]
mov r8, r14
mov rcx, rdi
call r15
xor r11d, r11d
cmp r11, rbx
jae 0x14012a0b5
movzx ecx, byte [rsp + r11 + 0x20]
lea rax, [r11 + rbp]
lea rdx, [r12 + r11]
movzx r8d, byte [rsp + rax + 0x20]
xor cl, byte [rsp + rdx + 0x20]
lea rax, [rsi + r11]
add r11, 1
mov byte [rsp + rax + 0x20], cl
mov byte [rsp + rdx + 0x20], r8b
cmp r11, 0x10
jb 0x14012a081
cmp rbx, 0x10
jbe 0x14012a0cf
add rdi, 0x10
add rbp, 0x10
add rsi, 0x10
sub rbx, 0x10
jne 0x14012a070
jmp 0x14012a101
cmp r11, 0x10
jae 0x14012a101
mov edx, reloc.WS2_32.dll_recv
sub rdi, r13
lea rcx, [r13 + r11]
sub rdx, r11
nop
nop
nop
movzx eax, byte [rdi + rcx]
add rcx, 1
sub rdx, 1
mov byte [rcx - 1], al
jne 0x14012a0f0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140041910
mov rbx, qword [rsp + 0x90]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14012a130
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rsi
push rdi
push r12
push r13
push r14
mov eax, reloc.WS2_32.dll_getservbyport
call fcn.140189b00
sub rsp, rax
mov rsi, qword [rsp + 0x98]
mov r14, qword [rsp + 0x90]
mov qword [rsp + 0x28], r15
mov ebx, dword [rsi]
mov r10, r9
mov rdi, r8
test ebx, ebx
mov r12, rdx
mov r13, rcx
je 0x14012a19b
test rdi, rdi
je 0x14012a19b
mov eax, ebx
add ebx, 1
add r12, 1
movzx ecx, byte [rax + r14]
add r13, 1
sub rdi, 1
xor cl, byte [r13 - 1]
and ebx, 0xf
mov byte [r12 - 1], cl
jne 0x14012a172
cmp rdi, 0x10
mov r9, qword [rsp + 0xa0]
movsxd r15, ebx
jb 0x14012a271
mov rsi, r12
mov rcx, rdi
mov qword [rsp + 0x30], rbp
shr rcx, 4
mov rbp, r13
sub rsi, r14
mov rax, rcx
sub rbp, r14
imul rax, rax, 0xfffffffffffffff0
add rdi, rax
mov rax, rcx
shl rax, 4
add r12, rax
add r13, rax
mov qword [rsp + 0x70], r13
mov r13, qword [rsp + 0x88]
mov qword [rsp + 0x78], r12
mov r12, rcx
mov r8, r13
mov rdx, r14
mov rcx, r14
call r9
cmp ebx, 0x10
jae 0x14012a237
mov edx, reloc.WS2_32.dll_ntohs
lea rcx, [r15 + r14]
sub edx, ebx
shr edx, 3
add edx, 1
nop
nop
nop
mov rax, qword [rcx + rbp]
add rcx, 8
xor rax, qword [rcx - 8]
sub rdx, 1
mov qword [rsi + rcx - 8], rax
jne 0x14012a220
mov r9, qword [rsp + 0xa0]
add rsi, 0x10
add rbp, 0x10
xor ebx, ebx
xor r15d, r15d
sub r12, 1
jne 0x14012a1f4
mov r12, qword [rsp + 0x78]
mov r13, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x98]
mov r10, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x30]
test rdi, rdi
mov r15, qword [rsp + 0x28]
je 0x14012a2b7
mov r8, r10
mov rdx, r14
mov rcx, r14
call r9
movsxd rcx, ebx
sub r13, r14
add rcx, r14
sub r12, r14
add ebx, edi
nop
nop
nop
movzx eax, byte [rcx + r13]
add rcx, 1
xor al, byte [rcx - 1]
sub rdi, 1
mov byte [rcx + r12 - 1], al
jne 0x14012a2a0
mov dword [rsi], ebx
add rsp, 0x38
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x14012a5e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
mov eax, 0x50
call fcn.140189b00
sub rsp, rax
mov rax, qword [0x1401f3660]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rsi, qword [rsp + 0x90]
mov r10, qword [rsp + 0xa0]
lea eax, [r8 - 1]
cmp eax, 0x7f
mov ebp, r8d
mov rdi, rdx
mov rbx, rcx
ja 0x14012a7a0
mov rax, qword [rsi]
lea rcx, [rsp + 0x20]
mov r8, r9
mov qword [rcx], rax
mov rax, qword [rsi + 8]
mov rdx, rsi
mov qword [rcx + 8], rax
mov rcx, rsi
call r10
lea eax, [rbp + 7]
cdq
and edx, 7
add eax, edx
sar eax, 3
cmp dword [rsp + 0x98], 0
movsxd r9, eax
je 0x14012a69b
test eax, eax
jle 0x14012a6de
lea rdx, [rsp + 0x30]
mov rcx, rsi
sub rdx, rbx
sub rcx, rbx
sub rdi, rbx
nop
nop
nop
movzx eax, byte [rcx + rbx]
add rbx, 1
xor al, byte [rbx - 1]
sub r9, 1
mov byte [rdx + rbx - 1], al
mov byte [rdi + rbx - 1], al
jne 0x14012a680
jmp 0x14012a6de
xor r8d, r8d
test eax, eax
jle 0x14012a6de
lea rax, [rsp + 0x30]
mov r10, rsi
sub rbx, rax
lea rax, [rsp + 0x30]
sub r10, rax
lea rax, [rsp + 0x30]
sub rdi, rax
nop
lea rdx, [rsp + r8 + 0x30]
add r8, 1
movzx ecx, byte [rbx + rdx]
movzx eax, byte [r10 + rdx]
xor al, cl
cmp r8, r9
mov byte [rdx], cl
mov byte [rdi + rdx], al
jl 0x14012a6c0
mov eax, ebp
cdq
and edx, 7
add eax, edx
mov ecx, eax
and eax, 7
sub eax, edx
sar ecx, 3
test eax, eax
mov r11d, eax
jne 0x14012a710
movsxd rcx, ecx
mov rax, qword [rsp + rcx + 0x20]
mov qword [rsi], rax
mov rax, qword [rsp + rcx + 0x28]
mov qword [rsi + 8], rax
jmp 0x14012a7a0
movsxd rax, ecx
mov r10d, 8
mov edi, 4
sub r10b, r11b
add rsi, 1
lea rbx, [rsp + rax + 0x21]
nop
nop
movzx r8d, byte [rbx]
movzx r9d, byte [rbx + 1]
movzx edx, byte [rbx - 1]
mov ecx, r11d
movzx eax, r8b
add rsi, 4
shl dl, cl
movzx ecx, r10b
add rbx, 4
shr al, cl
mov ecx, r11d
or dl, al
shl r8b, cl
movzx eax, r9b
mov byte [rsi - 5], dl
movzx edx, byte [rbx - 2]
movzx ecx, r10b
shr al, cl
mov ecx, r11d
or r8b, al
shl r9b, cl
movzx ecx, r10b
movzx eax, dl
mov byte [rsi - 4], r8b
shr al, cl
or r9b, al
movzx eax, byte [rbx - 1]
shr al, cl
mov ecx, r11d
mov byte [rsi - 3], r9b
shl dl, cl
or al, dl
sub rdi, 1
mov byte [rsi - 2], al
jne 0x14012a730
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140041910
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret

Function at 0x14012bdd0
Capabilities:
Encode data using xor

Disassembly:
mov eax, Ordinal_41
call fcn.140189b00
sub rsp, rax
add rsp, 0x28
jmp fcn.14012a9f0
Function at 0x14012bdf0
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov eax, reloc.WLDAP32.dll_Ordinal_32
call fcn.140189b00
sub rsp, rax
mov rbx, r8
call fcn.14012a9f0
test eax, eax
js 0x14012b23f
mov eax, dword [rbx + 0xf0]
xor r10d, r10d
shl eax, 2
test eax, eax
movsxd r9, eax
jle 0x14012b089
lea rdx, [rbx + r9*4 + 8]
lea r8, [rbx + 8]
nop
nop
mov eax, dword [rdx - 8]
mov ecx, dword [r8 - 8]
add r10, 4
mov dword [r8 - 8], eax
mov eax, dword [rdx - 4]
mov dword [rdx - 8], ecx
mov ecx, dword [r8 - 4]
mov dword [r8 - 4], eax
mov eax, dword [rdx]
mov dword [rdx - 4], ecx
mov ecx, dword [r8]
mov dword [r8], eax
mov eax, dword [rdx + 4]
mov dword [rdx], ecx
mov ecx, dword [r8 + 4]
mov dword [r8 + 4], eax
sub r9, 4
mov dword [rdx + 4], ecx
sub rdx, 0x10
add r8, 0x10
cmp r10, r9
jl 0x14012b040
mov r11d, 1
cmp dword [rbx + 0xf0], r11d
jle 0x14012b23d
mov qword [rsp + 0x30], rdi
lea r10, [rbx + 2]
lea rdi, [0x140000000]
nop
mov r8d, dword [r10 + 0xe]
add r10, 0x10
add r11d, 1
mov rax, r8
shr rax, 0x18
movzx edx, byte [rdi + rax*4 + 0x1bcb90]
movzx eax, byte [r10 - 1]
movzx ecx, byte [rdi + rax*4 + 0x1bcb90]
mov r9d, dword [rdi + rdx*4 + 0x1bd790]
movzx eax, r8b
movzx eax, byte [rdi + rax*4 + 0x1bcb90]
xor r9d, dword [rdi + rcx*4 + 0x1bdf90]
xor r9d, dword [rdi + rax*4 + 0x1be390]
movzx eax, byte [r10]
movzx ecx, byte [rdi + rax*4 + 0x1bcb90]
xor r9d, dword [rdi + rcx*4 + 0x1bdb90]
mov dword [r10 - 2], r9d
mov r9d, dword [r10 + 2]
mov rax, r9
shr rax, 0x18
movzx edx, byte [rdi + rax*4 + 0x1bcb90]
movzx eax, byte [r10 + 3]
movzx ecx, byte [rdi + rax*4 + 0x1bcb90]
mov r8d, dword [rdi + rdx*4 + 0x1bd790]
movzx eax, byte [r10 + 4]
xor r8d, dword [rdi + rcx*4 + 0x1bdf90]
movzx ecx, byte [rdi + rax*4 + 0x1bcb90]
movzx eax, r9b
xor r8d, dword [rdi + rcx*4 + 0x1bdb90]
movzx eax, byte [rdi + rax*4 + 0x1bcb90]
mov r9d, dword [r10 + 6]
xor r8d, dword [rdi + rax*4 + 0x1be390]
mov rax, r9
mov dword [r10 + 2], r8d
shr rax, 0x18
movzx edx, byte [rdi + rax*4 + 0x1bcb90]
movzx eax, byte [r10 + 7]
movzx ecx, byte [rdi + rax*4 + 0x1bcb90]
mov r8d, dword [rdi + rdx*4 + 0x1bd790]
movzx eax, byte [r10 + 8]
xor r8d, dword [rdi + rcx*4 + 0x1bdf90]
movzx ecx, byte [rdi + rax*4 + 0x1bcb90]
movzx eax, r9b
xor r8d, dword [rdi + rcx*4 + 0x1bdb90]
movzx eax, byte [rdi + rax*4 + 0x1bcb90]
mov r9d, dword [r10 + 0xa]
xor r8d, dword [rdi + rax*4 + 0x1be390]
movzx eax, byte [r10 + 0xb]
mov dword [r10 + 6], r8d
movzx edx, byte [rdi + rax*4 + 0x1bcb90]
movzx eax, byte [r10 + 0xc]
movzx ecx, byte [rdi + rax*4 + 0x1bcb90]
mov r8d, dword [rdi + rdx*4 + 0x1bdf90]
mov rax, r9
xor r8d, dword [rdi + rcx*4 + 0x1bdb90]
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0x1bcb90]
movzx eax, r9b
xor r8d, dword [rdi + rcx*4 + 0x1bd790]
movzx eax, byte [rdi + rax*4 + 0x1bcb90]
xor r8d, dword [rdi + rax*4 + 0x1be390]
mov dword [r10 + 0xa], r8d
cmp r11d, dword [rbx + 0xf0]
jl 0x14012b0b0
mov rdi, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov eax, Ordinal_41
call fcn.140189b00
sub rsp, rax
add rsp, 0x28
jmp 0x14012b000