joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f0fe0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f121b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x60], rbx
nop
call sym.crypto_internal_boring_sig.StandardCrypto.abi0
xorps xmm15, xmm15
mov r14, qword [0x006cca80]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
add qword [rcx + 0x68], rax
mov rdx, qword [rcx + 0x60]
test rdx, rdx
jle 0x4f112a
nop dword [rax]
cmp rdx, 0x40
ja 0x4f120d
lea rsi, [rdx - 0x40]
mov rdi, rsi
neg rsi
sar rdi, 0x3f
and rdi, rdx
lea rdx, [rcx + rdi]
lea rdx, [rdx + 0x20]
cmp rax, rsi
cmovl rsi, rax
mov qword [rsp + 0x28], rsi
mov rbx, qword [rsp + 0x60]
cmp rbx, rdx
je 0x4f1099
mov rax, rdx
mov rcx, rsi
nop
call sym.runtime.memmove
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x60]
add rdx, rsi
mov qword [rcx + 0x60], rdx
cmp rdx, 0x40
jne 0x4f1101
mov qword [rsp], rcx
lea rax, [rcx + 0x20]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call sym.crypto_sha256.block.abi0
xorps xmm15, xmm15
mov r14, qword [0x006cca80]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x60], 0
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
cmp rax, rsi
jb 0x4f1202
mov rdi, qword [rsp + 0x70]
sub rdi, rsi
mov rdx, rdi
neg rdx
sar rdx, 0x3f
and rdx, rsi
mov r8, rax
sub r8, rsi
add rbx, rdx
jmp 0x4f1137
mov r8, rax
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
cmp r8, 0x40
jl 0x4f11b5
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rdi
mov qword [rsp], rcx
mov qword [rsp + 8], rbx
and r8, 0xffffffffffffffc0
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], rdi
call sym.crypto_sha256.block.abi0
xorps xmm15, xmm15
mov r14, qword [0x006cca80]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov r8, qword [rsp + 0x38]
and rax, r8
and rax, 0xffffffffffffffc0
mov rcx, qword [rsp + 0x40]
lea rbx, [rcx + rax]
sub r8, rdx
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
test r8, r8
je 0x4f11f8
lea rdx, [rcx + 0x20]
cmp r8, 0x40
mov esi, 0x40
cmovl rsi, r8
cmp rbx, rdx
je 0x4f11f4
mov qword [rsp + 0x38], rsi
mov rax, rdx
mov rcx, rsi
nop dword [rax + rax]
call sym.runtime.memmove
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x38]
mov qword [rcx + 0x60], rsi
xor ebx, ebx
xor ecx, ecx
add rsp, 0x48
pop rbp
ret
mov rcx, rax
mov rax, rsi
call sym.runtime.panicSliceB
mov rax, rdx
mov ecx, 0x40
call sym.runtime.panicSliceB
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp sym.crypto_sha256._digest_.Write
Function at 0x4f5400
Capabilities:
Hash data using sha384
Hash data using sha512

Disassembly:
mov rcx, qword [rax + 0xd0]
cmp rcx, 6
jne 0x4f5485
movabs rcx, 0xcbbb9d5dc1059ed8
mov qword [rax], rcx
movabs rcx, 0x629a292a367cd507
mov qword [rax + 8], rcx
movabs rcx, 0x9159015a3070dd17
mov qword [rax + 0x10], rcx
movabs rcx, 0x152fecd8f70e5939
mov qword [rax + 0x18], rcx
movabs rcx, 0x67332667ffc00b31
mov qword [rax + 0x20], rcx
movabs rcx, 0x8eb44a8768581511
mov qword [rax + 0x28], rcx
movabs rcx, 0xdb0c2e0d64f98fa7
mov qword [rax + 0x30], rcx
movabs rcx, 0x47b5481dbefa4fa4
mov qword [rax + 0x38], rcx
nop dword [rax]
jmp 0x4f55e6
cmp rcx, 0xe
jne 0x4f5500
movabs rcx, 0x8c3d37c819544da2
mov qword [rax], rcx
movabs rcx, 0x73e1996689dcd4d6
mov qword [rax + 8], rcx
movabs rcx, 0x1dfab7ae32ff9c82
mov qword [rax + 0x10], rcx
movabs rcx, 0x679dd514582f9fcf
mov qword [rax + 0x18], rcx
movabs rcx, 0xf6d2b697bd44da8
mov qword [rax + 0x20], rcx
movabs rcx, 0x77e36f7304c48942
mov qword [rax + 0x28], rcx
movabs rcx, 0x3f9d85a86a1d36c8
mov qword [rax + 0x30], rcx
movabs rcx, 0x1112e6ad91d692a1
mov qword [rax + 0x38], rcx
jmp 0x4f55e6
cmp rcx, 0xf
jne 0x4f5577
movabs rcx, 0x22312194fc2bf72c
mov qword [rax], rcx
movabs rcx, 0x9f555fa3c84c64c2
mov qword [rax + 8], rcx
movabs rcx, 0x2393b86b6f53b151
mov qword [rax + 0x10], rcx
movabs rcx, 0x963877195940eabd
mov qword [rax + 0x18], rcx
movabs rcx, 0x96283ee2a88effe3
mov qword [rax + 0x20], rcx
movabs rcx, 0xbe5e1e2553863992
mov qword [rax + 0x28], rcx
movabs rcx, 0x2b0199fc2c85b8aa
mov qword [rax + 0x30], rcx
movabs rcx, 0xeb72ddc81c52ca2
mov qword [rax + 0x38], rcx
jmp 0x4f55e6
movabs rcx, 0x6a09e667f3bcc908
mov qword [rax], rcx
movabs rcx, 0xbb67ae8584caa73b
mov qword [rax + 8], rcx
movabs rcx, 0x3c6ef372fe94f82b
mov qword [rax + 0x10], rcx
movabs rcx, 0xa54ff53a5f1d36f1
mov qword [rax + 0x18], rcx
movabs rcx, 0x510e527fade682d1
mov qword [rax + 0x20], rcx
movabs rcx, 0x9b05688c2b3e6c1f
mov qword [rax + 0x28], rcx
movabs rcx, 0x1f83d9abfb41bd6b
mov qword [rax + 0x30], rcx
movabs rcx, 0x5be0cd19137e2179
mov qword [rax + 0x38], rcx
movups xmmword [rax + 0xc0], xmm15
ret
Function at 0x140001000
Capabilities:
Create thread

Disassembly:
push rsi
sub rsp, 0x160
mov r11, r9
mov qword [rsp + 0x68], r11
mov qword [rsp + 0x30], r8
mov rax, rdx
mov rdx, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, rcx
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x1b8]
mov qword [rsp + 0x58], rax
mov r8, qword [rsp + 0x1b0]
mov qword [rsp + 0x50], r8
mov r9d, dword [rsp + 0x1a8]
mov dword [rsp + 0x84], r9d
mov r9, qword [rsp + 0x1a0]
mov qword [rsp + 0x48], r9
mov r10, qword [rsp + 0x198]
mov qword [rsp + 0x40], r10
mov rsi, qword [rsp + 0x190]
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0xb0], rcx
mov qword [rsp + 0xb8], rdx
mov qword [rsp + 0xc0], r11
mov qword [rsp + 0xc8], r10
mov qword [rsp + 0xd0], r9
mov qword [rsp + 0xd8], r8
mov qword [rsp + 0xe0], rax
mov qword [rsp + 0x130], 0
mov rax, qword [rsp + 0x130]
mov qword [rsp + 0x138], rax
mov qword [rsp + 0x128], rax
mov rax, qword [rsp + 0x128]
mov qword [rsp + 0x120], rax
mov r8, qword [rsp + 0x120]
call fcn.1401fcd80
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 0xe8], rax
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x110], 0
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x118], rax
mov qword [rsp + 0x108], rax
mov rax, qword [rsp + 0x108]
mov qword [rsp + 0x100], rax
mov r8, qword [rsp + 0x100]
call fcn.1401fce40
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x150], 0
mov rax, qword [rsp + 0x150]
mov qword [rsp + 0x158], rax
mov qword [rsp + 0x148], rax
mov rax, qword [rsp + 0x148]
mov qword [rsp + 0x140], rax
mov r8, qword [rsp + 0x140]
call fcn.1401fcde0
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x68]
mov r8, qword [rsp + 0x70]
mov r9, qword [rsp + 0x78]
mov r10d, dword [rsp + 0x84]
mov qword [rsp + 0xf8], rax
mov rax, qword [rsp + 0xf8]
mov dword [rsp + 0x20], r10d
mov qword [rsp + 0x28], rax
call qword [sym.imp.kernel32.dll_CreateThread]
mov qword [rsp + 0xa0], rax
lea rcx, [rsp + 0xa0]
call fcn.1402086a0
mov cl, al
xor cl, 0xff
lea rax, [rsp + 0xa0]
mov qword [rsp + 0xa8], rax
mov rdx, qword [rsp + 0xa8]
and cl, 1
call fcn.1401fdbc0
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x90], rax
mov r8, rdx
mov rdx, qword [rsp + 0x90]
call fcn.1401fcd00
mov rax, qword [rsp + 0x98]
add rsp, 0x160
pop rsi
ret
Function at 0x140212c00
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 0
mov qword [rbp + 0x3d0], 2
mov qword [rbp + 0x3d8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor r12d, r12d
xor r13d, r13d
xor edi, edi
cmp r8, 0x201
jae 0x140212ca0
jmp 0x140212c8f
jae 0x140212d5e
cmp r8, 0x201
jae 0x140212ca0
lea rbx, [rbp - 0x58]
mov r14d, 0x200
mov rsi, r8
jmp 0x140212cf7
sub r8, rdi
sub r13, rdi
cmp r13, r8
jae 0x140212ccf
lea rcx, [rbp + 0x3c8]
mov rdx, rdi
call fcn.1403430a0
mov r12, qword [rbp + 0x3c8]
mov rax, qword [rbp + 0x3d0]
mov qword [rbp + 0x3e8], rax
mov eax, 0xffffffff
cmp r12, rax
mov edi, 0xffffffff
cmovb rdi, r12
mov qword [rbp + 0x3d8], rdi
mov r13, r12
mov rbx, qword [rbp + 0x3e8]
mov r14, rdi
mov rsi, rdi
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov ecx, esi
mov rdx, rbx
call qword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov r15d, eax
test eax, eax
jne 0x140212d1f
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x140212dc6
mov r8d, r15d
cmp rsi, r8
jne 0x140212c80
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140212de9
add rsi, rsi
mov eax, 0xffffffff
cmp rsi, rax
cmovae rsi, rax
mov r8, rsi
cmp r8, 0x201
jb 0x140212c8f
jmp 0x140212ca0
cmp r14, r8
jb 0x140212e03
lea rcx, [rbp + 0x3a8]
mov rdx, rbx
call fcn.1402144c0
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test r12, r12
je 0x140212daf
add r12, r12
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, r12
call fcn.1401fff60
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi], rax
mov byte [rsi + 0x18], 2
test r12, r12
jne 0x140212d97
jmp 0x140212daf
lea rcx, [0x1403bb52b]
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.140343b20
jmp 0x140212e18
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.140343f10
ud2
Function at 0x140214db0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
movzx ebx, byte [rdx + 0x38]
xor r15d, r15d
cmp bl, 1
setne dl
mov eax, 0
sbb eax, eax
mov r14, rcx
or al, dl
movzx ecx, al
cmp cl, 0xff
je 0x140214de3
test ecx, ecx
jne 0x140214e32
movzx r15d, byte [rdi + 0x3a]
cmp al, 0xff
je 0x140214df0
test ecx, ecx
jne 0x140214e32
mov rcx, rdi
call fcn.140214c90
movzx r10d, al
test bl, bl
jne 0x140214e39
lea rax, [rdi + 0x10]
xor esi, esi
cmp byte [rdi + 0x10], 6
cmove rax, rsi
je case.0x140214e26.2
movzx ecx, byte [rax]
mov esi, 6
lea rdx, [0x140214fac]
movsxd rcx, dword [rdx + rcx*4]
add rcx, rdx
jmp rcx
mov rsi, qword [rax + 0x10]
add rsi, 4
jmp case.0x140214e26.2
xor r10d, r10d
test bl, bl
je 0x140214e00
xor esi, esi
movzx eax, r15b
lea rcx, [r10 + rax]
add rcx, rsi
mov rdx, qword [rdi + 8]
cmp rdx, rcx
jb 0x140214f8e
mov r11, qword [rdi]
lea r9, [r11 + rcx]
movzx r8d, byte [rdi + 0x10]
cmp rdx, rcx
jne 0x140214e6b
xor edi, edi
jmp 0x140214ee8
add rsi, r10
add rsi, rax
sub rsi, rdx
inc rsi
lea rax, [rdx + r11]
dec rax
xor edi, edi
cmp r8b, 3
jae 0x140214eb0
nop word cs:[rax + rax]
cmp byte [rax], 0x5c
je 0x140214ecb
inc rsi
dec rax
cmp rsi, 1
jne 0x140214e90
jmp 0x140214ee8
movzx ebx, byte [rax]
cmp ebx, 0x2f
je 0x140214ecb
cmp ebx, 0x5c
je 0x140214ecb
inc rsi
dec rax
cmp rsi, 1
jne 0x140214eb0
jmp 0x140214ee8
neg rsi
add rcx, rsi
inc rcx
cmp rdx, rcx
jb 0x140214f9c
add r11, rcx
mov edi, 1
mov r9, r11
sub rdx, rcx
je 0x140214f12
mov al, 9
cmp rdx, 2
je 0x140214f16
cmp rdx, 1
jne 0x140214f26
cmp byte [r9], 0x2e
jne 0x140214f26
xor eax, eax
cmp r8b, 3
setae al
lea eax, [rax + rax*2]
add eax, 7
jmp 0x140214f26
mov al, 0xa
jmp 0x140214f26
cmp byte [r9], 0x2e
jne 0x140214f26
cmp byte [r9 + 1], 0x2e
sete al
xor al, 9
add rdi, rdx
mov qword [r14], rdi
mov qword [r14 + 8], r9
mov qword [r14 + 0x10], rdx
mov byte [r14 + 0x18], al
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rcx, qword [rax + 0x10]
mov rax, qword [rax + 0x20]
lea rdx, [rax + 1]
test rax, rax
cmove rdx, rax
lea rsi, [rcx + rdx]
add rsi, 8
jmp case.0x140214e26.2
mov rcx, qword [rax + 0x10]
mov rax, qword [rax + 0x20]
lea rdx, [rax + 1]
test rax, rax
cmove rdx, rax
lea rsi, [rcx + rdx]
add rsi, 2
jmp case.0x140214e26.2
mov esi, 2
jmp case.0x140214e26.2
lea r8, str.library_std_srcpath.rs
call fcn.140343f00
ud2
lea r8, str.library_std_srcpath.rs
call fcn.140343f00
ud2
Function at 0x1402276f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
test r8, r8
je 0x14022776a
mov r11, rdx
mov rdx, qword [rsp + 0x70]
mov ebp, ecx
shr ebp, 8
lea r8, [r11 + r8*2]
xor eax, eax
mov rbx, r11
movzx edi, byte [r11 + 1]
add r11, 2
lea r10, [rax + rdi]
cmp byte [rbx], bpl
jne 0x140227760
cmp r10, rax
jb 0x1402277fd
cmp r10, rdx
ja 0x140227811
add rax, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x140227762
lea rsi, [rbx + 1]
cmp byte [rax + rbx], cl
mov rbx, rsi
jne 0x140227740
jmp 0x1402277d2
ja 0x14022776a
mov rax, r10
cmp r11, r8
jne 0x140227710
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x1402277d6
mov rsi, qword [rsp + 0x78]
add rdx, rsi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea rbx, [rsi + 1]
movzx edi, byte [rsi]
test dil, dil
js 0x1402277b0
mov rsi, rbx
sub ecx, edi
jns 0x1402277c9
jmp 0x1402277d8
cmp rbx, rdx
je 0x1402277e3
movzx ebp, byte [rsi + 1]
add rsi, 2
and edi, 0x7f
shl edi, 8
or edi, ebp
sub ecx, edi
js 0x1402277d8
xor al, 1
cmp rsi, rdx
jne 0x140227790
jmp 0x1402277d8
xor eax, eax
jmp 0x1402277d8
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
lea rcx, str.called__Option::unwrap____on_a__None__valuefrom_str_radix_int:_must_lie_in_the_range___2__36_____found
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.140343b20
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, rax
mov rdx, r10
call fcn.140343f20
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.140343f10
ud2
Function at 0x140230370
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push r13
push r14
mov eax, 0x40
call fcn.140342130
sub rsp, rax
mov rsi, qword [rcx + 0x70]
mov rbx, r8
mov r8d, dword [rsi + 0x70]
lea r13, [rsi + 0x70]
mov qword [rsp + 0x38], r13
mov rbp, r9
mov r14, rdx
test r8d, r8d
je 0x1402303f6
test r9, r9
je 0x1402303d2
nop dword [rax]
cmp r8d, 0x40
jae 0x1402303d2
mov eax, r8d
inc r8d
movzx ecx, byte [rax + rsi + 0x30]
xor cl, byte [rbx]
inc rbx
mov byte [r14], cl
inc r14
sub rbp, 1
jne 0x1402303b0
mov dword [r13], r8d
test rbp, rbp
je 0x140230529
cmp r8d, 0x40
jne 0x1402303f6
mov dword [r13], 0
add dword [rsi + 0x20], 1
jne 0x1402303f6
inc dword [rsi + 0x24]
mov ecx, dword [rsi + 0x20]
lea rax, [rsi + 0x20]
mov qword [rsp + 0x80], r12
mov r12d, ebp
and r12d, 0x3f
mov qword [rsp + 0x88], r15
mov r15d, r12d
sub rbp, r15
mov dword [rsp + 0x30], r12d
cmp rbp, 0x40
jb 0x1402304b6
mov qword [rsp + 0x78], rdi
lea r13, [rsi + 0x20]
mov r12d, 0x10000000
mov r15d, ecx
nop dword [rax + rax]
mov rdx, rbp
mov qword [rsp + 0x20], r13
shr rdx, 6
mov r9, rsi
cmp rdx, r12
cmova rdx, r12
mov rdi, rdx
lea eax, [rdx + r15]
xor r15d, r15d
mov ecx, eax
cmp rcx, rdx
cmovae r15d, eax
sub rdi, rcx
cmp rcx, rdx
mov rcx, r14
cmovae rdi, rdx
mov rdx, rbx
shl rdi, 6
mov r8, rdi
call fcn.1402836b0
sub rbp, rdi
mov dword [r13], r15d
add rbx, rdi
add r14, rdi
test r15d, r15d
jne 0x14023049a
inc dword [rsi + 0x24]
cmp rbp, 0x40
jae 0x140230440
mov r12d, dword [rsp + 0x30]
lea rax, [rsi + 0x20]
mov r13, qword [rsp + 0x38]
mov r15d, r12d
mov rdi, qword [rsp + 0x78]
test r12d, r12d
je 0x140230519
lea rcx, [rsi + 0x30]
mov qword [rsp + 0x20], rax
xorps xmm0, xmm0
mov r9, rsi
movups xmmword [rcx], xmm0
mov r8d, 0x40
mov rdx, rcx
movups xmmword [rcx + 0x10], xmm0
movups xmmword [rcx + 0x20], xmm0
movups xmmword [rcx + 0x30], xmm0
call fcn.1402836b0
test r12d, r12d
je 0x140230515
sub rsi, rbx
sub r14, rbx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rsi + rbx + 0x30]
xor al, byte [rbx]
mov byte [r14 + rbx], al
lea rbx, [rbx + 1]
sub r15, 1
jne 0x140230500
mov dword [r13], r12d
mov r12, qword [rsp + 0x80]
mov r15, qword [rsp + 0x88]
mov eax, 1
add rsp, 0x40
pop r14
pop r13
pop rsi
pop rbp
pop rbx
ret
Function at 0x140233410
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r14
mov eax, 0x38
call fcn.140342130
sub rsp, rax
mov rdi, qword [rsp + 0x88]
mov rsi, rdx
mov qword [rsp + 0x68], rbp
mov r14, r9
mov rbp, qword [rsp + 0x80]
mov rbx, rcx
mov qword [rsp + 0x30], r12
mov r10, rcx
shl rsi, 5
mov r12, rdx
mov qword [rsp + 0x28], r13
mov r13, r8
test rsi, rsi
je 0x1402334a8
mov r8, rsi
nop dword [rax]
movzx eax, byte [r10]
lea r10, [r10 + 4]
mov dword [rdi], eax
movzx ecx, byte [r10 - 3]
shl ecx, 8
or ecx, eax
mov dword [rdi], ecx
movzx edx, byte [r10 - 2]
shl edx, 0x10
or edx, ecx
mov dword [rdi], edx
movzx eax, byte [r10 - 1]
shl eax, 0x18
or eax, edx
mov dword [rdi], eax
add rdi, 4
sub r8, 1
jne 0x140233470
mov qword [rsp + 0x20], r15
mov r15, r12
shl r15, 7
cmp r13, 1
jbe 0x1402334df
dec r13
nop dword [rax]
mov rdx, rdi
mov r8, r12
sub rdx, r15
mov rcx, rdi
call fcn.140232f70
add rdi, r15
sub r13, 1
jne 0x1402334c0
mov r13, qword [rsp + 0x70]
mov rdx, r13
mov r8, r12
shl rdx, 7
mov rcx, r14
add rdx, 0xffffffffffffff80
imul rdx, r12
add rdx, qword [rsp + 0x88]
call fcn.140232f70
xor edi, edi
test r13, r13
je 0x140233626
lea rbx, [r15 + r14]
mov r15, r13
mov eax, dword [rbx - 0x40]
xor edx, edx
div r13
mov r8, rdi
mov eax, edx
imul rax, r12
shl rax, 7
add rax, qword [rsp + 0x88]
test rsi, rsi
je 0x140233609
cmp rsi, 0x10
jb 0x1402335e2
lea rcx, [rsi - 1]
lea rcx, [rax + rcx*4]
lea rdx, [rbp - 4]
lea rdx, [rdx + rsi*4]
cmp rbp, rcx
ja 0x140233561
cmp rdx, rax
jae 0x1402335e2
lea rcx, [r14 - 4]
lea rcx, [rcx + rsi*4]
cmp rbp, rcx
ja 0x140233573
cmp rdx, r14
jae 0x1402335e2
mov rcx, r14
lea rdx, [rbp + 0x10]
sub rcx, rbp
nop dword [rax]
movdqu xmm0, xmmword [rax]
add r8, 0x10
lea rax, [rax + 0x40]
movdqu xmm1, xmmword [rcx + rdx - 0x10]
lea rdx, [rdx + 0x40]
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x30]
movdqu xmmword [rdx - 0x50], xmm1
movdqu xmm1, xmmword [rdx + rcx - 0x40]
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmmword [rdx - 0x40], xmm1
movdqu xmm1, xmmword [rcx + rdx - 0x30]
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x10]
movdqu xmmword [rdx - 0x30], xmm1
movdqu xmm1, xmmword [rcx + rdx - 0x20]
pxor xmm1, xmm0
movdqu xmmword [rdx - 0x20], xmm1
cmp r8, rsi
jb 0x140233580
jmp 0x140233609
mov r9, r14
mov rdx, rbp
sub r9, rbp
nop dword [rax + rax]
mov ecx, dword [r9 + rdx]
lea rdx, [rdx + 4]
xor ecx, dword [rax]
lea rax, [rax + 4]
inc r8
mov dword [rdx - 4], ecx
cmp r8, rsi
jb 0x1402335f0
mov r8, r12
mov rdx, rbp
mov rcx, r14
call fcn.140232f70
sub r15, 1
jne 0x140233513
mov rbx, qword [rsp + 0x60]
mov r15, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x68]
test rsi, rsi
je 0x140233668
nop
mov ecx, dword [r14 + rdi*4]
mov eax, ecx
mov byte [rbx], cl
lea rbx, [rbx + 4]
shr eax, 8
inc rdi
mov byte [rbx - 3], al
mov eax, ecx
shr eax, 0x10
shr ecx, 0x18
mov byte [rbx - 2], al
mov byte [rbx - 1], cl
cmp rdi, rsi
jb 0x140233640
add rsp, 0x38
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x140234370
Capabilities:
Encode data using base64

Disassembly:
mov eax, 0x28
call fcn.140342130
sub rsp, rax
mov r9d, r8d
mov r8, rdx
mov rdx, rcx
xor ecx, ecx
add rsp, 0x28
jmp fcn.140234730

Function at 0x140235f90
Capabilities:
Encode data using xor

Disassembly:
xor r9b, r9b
mov r10, rdx
test r8, r8
je 0x140235fb7
sub r10, rcx
nop
movzx edx, byte [r10 + rcx]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
xor dl, al
or r9b, dl
sub r8, 1
jne 0x140235fa0
movzx eax, r9b
ret
Function at 0x14023c320
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x38
call fcn.140342130
sub rsp, rax
mov r10, rcx
test r9, r9
jne 0x14023c35c
mov edx, 0xe2
mov dword [rsp + 0x20], 0x9a
lea r9, str.crypto_asn1_a_int.c
lea ecx, [rax - 0x2b]
lea r8d, [rdx - 4]
call fcn.140253150
xor eax, eax
add rsp, 0x38
ret
movzx r11d, byte [r8]
and r11d, 0x80
test rdx, rdx
je 0x14023c36f
mov dword [rdx], r11d
cmp r9, 1
jne 0x14023c391
test r10, r10
je 0x14023c387
movzx eax, byte [r8]
test r11d, r11d
je 0x14023c385
neg al
mov byte [rcx], al
mov eax, 1
add rsp, 0x38
ret
movzx ecx, byte [r8]
test cl, cl
jne 0x14023c3a3
mov eax, 1
jmp 0x14023c45a
xor eax, eax
cmp cl, 0xff
jne 0x14023c493
xor edx, edx
lea rcx, [r9 - 1]
mov eax, 1
cmp r9, rax
jbe 0x14023c44f
cmp rcx, 8
jb 0x14023c440
and ecx, 7
mov rdx, r9
sub rdx, rcx
xorps xmm3, xmm3
xorps xmm2, xmm2
nop word [rax + rax]
movd xmm1, dword [rax + r8]
xorps xmm0, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
por xmm3, xmm1
movd xmm1, dword [rax + r8 + 4]
punpcklbw xmm1, xmm0
add rax, 8
punpcklwd xmm1, xmm0
por xmm2, xmm1
cmp rax, rdx
jb 0x14023c3e0
por xmm2, xmm3
movdqa xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd edx, xmm2
cmp rax, r9
jae 0x14023c44f
nop dword [rax + rax]
movzx ecx, byte [rax + r8]
inc rax
or edx, ecx
cmp rax, r9
jb 0x14023c440
xor eax, eax
test edx, edx
setne al
test edx, edx
je 0x14023c493
movzx ecx, byte [r8 + 1]
and ecx, 0x80
cmp r11d, ecx
jne 0x14023c493
mov edx, 0xe2
mov dword [rsp + 0x20], 0xbb
lea r9, str.crypto_asn1_a_int.c
mov ecx, recv
lea r8d, [rdx - 5]
call fcn.140253150
xor eax, eax
add rsp, 0x38
ret
mov qword [rsp + 0x30], rbx
mov rbx, r9
sub rbx, rax
test r10, r10
je 0x14023c4dd
neg r11d
sbb r11d, r11d
add r9, r8
movzx r11d, r11b
mov edx, r11d
and edx, 1
test rbx, rbx
je 0x14023c4dd
mov r8, rbx
nop
movzx ecx, byte [r9 - 1]
lea r9, [r9 - 1]
dec r8
xor ecx, r11d
add edx, ecx
mov byte [r8 + r10], dl
shr edx, 8
test r8, r8
jne 0x14023c4c0
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
ret
Function at 0x14023c5f0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
mov r10, rdx
xor r11b, r11b
xor edx, edx
mov rsi, r9
mov rbx, rcx
test rcx, rcx
je 0x14023c704
test r10, r10
je 0x14023c704
movzx eax, byte [rcx]
test r8d, r8d
jne 0x14023c635
cmp al, 0x7f
jbe 0x14023c6fd
mov edx, 1
mov eax, edx
add rax, r10
jmp 0x14023c70c
mov r11b, 0xff
cmp al, 0x80
jbe 0x14023c64b
mov edx, 1
mov eax, edx
add rax, r10
jmp 0x14023c70c
jne 0x14023c6fd
mov eax, 1
lea rcx, [r10 - 1]
cmp r10, rax
jbe 0x14023c6ee
cmp rcx, 8
jb 0x14023c6e0
and ecx, 7
mov rdx, r10
sub rdx, rcx
xorps xmm3, xmm3
xorps xmm2, xmm2
nop dword [rax + rax]
movd xmm1, dword [rax + rbx]
xorps xmm0, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
por xmm3, xmm1
movd xmm1, dword [rax + rbx + 4]
punpcklbw xmm1, xmm0
add rax, 8
punpcklwd xmm1, xmm0
por xmm2, xmm1
cmp rax, rdx
jb 0x14023c680
por xmm2, xmm3
movdqa xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd edx, xmm2
cmp rax, r10
jae 0x14023c6ee
nop word [rax + rax]
movzx ecx, byte [rax + rbx]
inc rax
or edx, ecx
cmp rax, r10
jb 0x14023c6e0
neg edx
sbb r11b, r11b
movzx r11d, r11b
mov edx, r11d
and edx, 1
mov eax, edx
add rax, r10
jmp 0x14023c70c
mov eax, 1
mov r10, rdx
mov qword [rsp + 0x18], rdi
test rsi, rsi
je 0x14023c765
mov rdi, qword [r9]
test rdi, rdi
je 0x14023c765
movzx r8d, r11b
lea r9, [rbx + r10]
and r8d, 1
mov byte [rdi], r11b
test r10, r10
je 0x14023c762
mov ebx, edx
add rbx, rdi
nop word [rax + rax]
movzx edx, byte [r9 - 1]
lea r9, [r9 - 1]
dec r10
movzx ecx, r11b
xor edx, ecx
add r8d, edx
mov byte [rbx + r10], r8b
shr r8d, 8
test r10, r10
jne 0x14023c740
add qword [rsi], rax
mov rdi, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
pop rsi
ret