joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401ded80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
mov eax, 0x50
call fcn.1402563a0
sub rsp, rax
mov rax, qword [0x1403bb2d8]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x60]
mov r15, qword [rbp + 0x68]
mov r12d, r8d
movzx r10d, byte [rax]
movzx r8d, byte [rax + 4]
mov ebx, dword [r15]
lea rdi, [rax + 1]
mov qword [rbp - 0x18], rax
shl r10d, 0x18
movzx eax, byte [rdi]
mov rsi, rcx
movzx ecx, byte [rdi + 5]
shl eax, 0x10
shl r8d, 0x18
shl ecx, 8
or r10d, eax
movzx eax, byte [rdi + 1]
mov r14, rdx
shl eax, 8
lea rdx, [rdi + 5]
xor r13d, r13d
or r10d, eax
movzx eax, byte [rdi + 2]
mov qword [rbp - 0x28], r9
or r10d, eax
movzx eax, byte [rdi + 4]
mov qword [rbp - 0x20], r15
shl eax, 0x10
mov dword [rbp - 0x30], r10d
mov byte [rbp - 0xd], r10b
or r8d, eax
movzx eax, byte [rdx + 1]
or ecx, eax
mov eax, r10d
shr eax, 0x18
or r8d, ecx
mov byte [rbp - 0x10], al
mov eax, r10d
mov dword [rbp - 0x2c], r8d
shr eax, 0x10
mov byte [rbp - 9], r8b
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r8d
shr eax, 8
mov byte [rbp - 0xa], al
test r12d, r12d
je 0x1401def46
mov r15, qword [rbp - 0x28]
sub r14, rsi
movzx edx, r8b
movzx r9d, r10b
nop dword [rax]
dec r12d
test ebx, ebx
jne 0x1401deee3
lea rcx, [rbp - 0x30]
mov rdx, r15
call fcn.1401ddb90
mov r10d, dword [rbp - 0x30]
mov r8d, dword [rbp - 0x2c]
mov eax, r10d
movzx edx, r8b
movzx r9d, r10b
shr eax, 0x18
mov byte [rbp - 0xd], r10b
mov byte [rbp - 9], dl
mov byte [rbp - 0x10], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r8d
shr eax, 8
inc r13d
mov byte [rbp - 0xa], al
movsxd rax, ebx
inc rsi
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [rsi - 1]
inc ebx
mov byte [r14 + rsi - 1], cl
and ebx, 7
test r12d, r12d
jne 0x1401dee80
mov r15, qword [rbp - 0x20]
test r13d, r13d
je 0x1401def46
mov rcx, qword [rbp - 0x18]
mov eax, r10d
shr eax, 0x18
mov byte [rcx], al
mov eax, r10d
shr r10d, 8
shr eax, 0x10
mov byte [rdi], al
mov byte [rdi + 1], r10b
mov byte [rdi + 2], r9b
mov eax, r8d
shr eax, 0x18
mov byte [rdi + 3], al
mov eax, r8d
shr eax, 0x10
shr r8d, 8
mov byte [rdi + 4], al
mov byte [rdi + 5], r8b
mov byte [rdi + 6], dl
mov dword [r15], ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140254f60
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401def70
Capabilities:
Encode data using xor
Encrypt data using blowfish
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x20
call fcn.1402563a0
sub rsp, rax
mov ebx, edx
mov rsi, r8
lea rdx, [0x14035ecc0]
mov r8d, 0x1048
mov rdi, rcx
call fcn.1402550b0
mov eax, 0x48
mov rdx, rsi
cmp ebx, eax
cmovg ebx, eax
movsxd r8, ebx
add r8, rsi
xor ebx, ebx
mov r9d, ebx
nop word [rax + rax]
movzx ecx, byte [rdx]
inc rdx
cmp rdx, r8
cmovae rdx, rsi
shl ecx, 8
movzx eax, byte [rdx]
inc rdx
or ecx, eax
cmp rdx, r8
cmovae rdx, rsi
shl ecx, 8
movzx eax, byte [rdx]
inc rdx
or ecx, eax
cmp rdx, r8
cmovae rdx, rsi
shl ecx, 8
movzx eax, byte [rdx]
inc rdx
or ecx, eax
cmp rdx, r8
cmovae rdx, rsi
xor dword [rdi + r9*4], ecx
inc r9
cmp r9, 0x12
jl 0x1401defc0
mov qword [rsp + 0x30], rbx
mov rsi, rbx
nop dword [rax + rax]
lea rcx, [rsp + 0x30]
mov rdx, rdi
call fcn.1401ddb90
mov eax, dword [rsp + 0x30]
add rsi, 2
mov dword [rdi + rsi*4 - 8], eax
mov eax, dword [rsp + 0x34]
mov dword [rdi + rsi*4 - 4], eax
cmp rsi, 0x12
jl 0x1401df020
nop word [rax + rax]
lea rcx, [rsp + 0x30]
mov rdx, rdi
call fcn.1401ddb90
mov eax, dword [rsp + 0x30]
add rbx, 2
mov dword [rdi + rbx*4 + 0x40], eax
mov eax, dword [rsp + 0x34]
mov dword [rdi + rbx*4 + 0x44], eax
cmp rbx, 0x400
jl 0x1401df050
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1401dfbe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
mov eax, 0x50
call fcn.1402563a0
sub rsp, rax
mov rax, qword [0x1403bb2d8]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x60]
mov r15, qword [rbp + 0x68]
mov rsi, rcx
movzx r10d, byte [rax]
mov ebx, dword [r15]
lea rdi, [rax + 1]
movzx ecx, byte [rdi + 6]
mov qword [rbp - 0x18], rax
movzx eax, byte [rdi]
shl eax, 8
mov r14, rdx
movzx edx, byte [rdi + 3]
or r10d, eax
movzx eax, byte [rdi + 1]
shl ecx, 8
shl eax, 0x10
mov r12d, r8d
lea r8, [rdi + 5]
or r10d, eax
movzx eax, byte [rdi + 2]
xor r13d, r13d
shl eax, 0x18
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], r15
or r10d, eax
movzx eax, byte [rdi + 4]
shl eax, 8
mov dword [rbp - 0x30], r10d
mov byte [rbp - 0x10], r10b
or edx, eax
movzx eax, byte [r8]
or ecx, eax
mov eax, r10d
shr eax, 8
shl ecx, 0x10
mov byte [rbp - 0xf], al
or edx, ecx
mov eax, r10d
shr eax, 0x10
mov dword [rbp - 0x2c], edx
mov byte [rbp - 0xc], dl
mov byte [rbp - 0xe], al
mov eax, r10d
shr eax, 0x18
mov byte [rbp - 0xd], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0xb], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0xa], al
mov eax, edx
shr eax, 0x18
mov byte [rbp - 9], al
test r12d, r12d
je 0x1401dfd94
mov r15, qword [rbp - 0x28]
sub r14, rsi
movzx r8d, dl
movzx r9d, r10b
dec r12d
test ebx, ebx
jne 0x1401dfd34
lea rcx, [rbp - 0x30]
mov rdx, r15
call fcn.1401df090
mov r10d, dword [rbp - 0x30]
mov edx, dword [rbp - 0x2c]
movzx r9d, byte [rbp - 0x30]
movzx r8d, byte [rbp - 0x2c]
mov eax, r10d
shr eax, 8
mov byte [rbp - 0x10], r9b
mov byte [rbp - 0xc], r8b
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0xe], al
mov eax, r10d
shr eax, 0x18
mov byte [rbp - 0xd], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0xb], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0xa], al
mov eax, edx
shr eax, 0x18
inc r13d
mov byte [rbp - 9], al
movsxd rax, ebx
inc rsi
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [rsi - 1]
inc ebx
mov byte [r14 + rsi - 1], cl
and ebx, 7
test r12d, r12d
jne 0x1401dfcd2
mov r15, qword [rbp - 0x20]
test r13d, r13d
je 0x1401dfd94
mov rax, qword [rbp - 0x18]
mov byte [rax], r9b
mov eax, r10d
shr eax, 8
mov byte [rdi], al
mov eax, r10d
shr r10d, 0x18
shr eax, 0x10
mov byte [rdi + 1], al
mov byte [rdi + 2], r10b
mov byte [rdi + 3], r8b
mov eax, edx
shr eax, 8
mov byte [rdi + 4], al
mov eax, edx
shr eax, 0x10
shr edx, 0x18
mov byte [rdi + 5], al
mov byte [rdi + 6], dl
mov dword [r15], ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140254f60
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401dfdc0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov edi, 0x80
mov r10, rcx
mov byte [rcx], 0
cmp edx, edi
mov ebx, 0x400
cmovg edx, edi
test r9d, r9d
jle 0x1401dfdf3
cmp r9d, ebx
cmovg r9d, ebx
mov ebx, r9d
movsxd r9, edx
test edx, edx
jle 0x1401dfe10
sub r8, r10
mov rdx, r9
movzx eax, byte [r8 + rcx]
inc rcx
dec rdx
mov byte [rcx - 1], al
jne 0x1401dfe00
movzx ecx, byte [r9 + r10 - 1]
lea rdx, [r9 + r10]
lea rsi, [0x14035fd10]
cmp r9, rdi
jge 0x1401dfe59
mov r11, r9
mov r8, rdi
neg r11
sub r8, r9
nop word [rax + rax]
movzx eax, byte [rdx + r11]
inc rdx
add eax, ecx
dec r8
movzx ecx, al
movzx ecx, byte [rcx + rsi]
mov byte [rdx - 1], cl
jne 0x1401dfe40
lea edx, [rbx + 7]
neg ebx
mov eax, 0xff
sar edx, 3
and ebx, 7
sub edi, edx
movzx ecx, bl
movsxd r11, edx
sar eax, cl
movsxd r9, edi
mov ecx, eax
lea r8, [r9 + r10]
movzx eax, byte [r8]
and rcx, rax
movzx eax, byte [rcx + rsi]
mov byte [r8], al
test edi, edi
je 0x1401dfea8
nop
movzx ecx, byte [r8 + r11 - 1]
dec r8
xor rcx, rax
dec r9
movzx eax, byte [rcx + rsi]
mov byte [r8], al
jne 0x1401dfe90
lea r8, [r10 + 0xfc]
lea rdx, [r10 + 0x7e]
mov r9d, 0x40
nop dword [rax]
movzx eax, byte [rdx]
movzx ecx, byte [rdx + 1]
sub r8, 4
shl ecx, 8
sub rdx, 2
or ecx, eax
dec r9
movzx eax, cx
mov dword [r8 + 4], eax
jne 0x1401dfec0
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
Function at 0x1401e53e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push rbx
push rsi
push r12
push r13
push r14
push r15
mov rbp, rsp
mov eax, 0x50
call fcn.1402563a0
sub rsp, rax
mov rax, qword [0x1403bb2d8]
xor rax, rsp
mov qword [rbp - 8], rax
mov r15, qword [rbp + 0x68]
mov rax, qword [rbp + 0x60]
xor r13d, r13d
mov ebx, dword [r15]
mov qword [rbp - 0x28], r9
mov r12d, r8d
mov r14, rdx
mov rsi, rcx
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x20], r15
test ebx, ebx
jns 0x1401e543d
mov dword [r15], 0xffffffff
jmp 0x1401e55c1
movzx r8d, byte [rax]
movzx r9d, byte [rax + 4]
mov qword [rsp + 0x90], rdi
lea rdi, [rax + 1]
shl r8d, 0x18
shl r9d, 0x18
movzx eax, byte [rdi]
movzx ecx, byte [rdi + 5]
lea rdx, [rdi + 5]
shl eax, 0x10
shl ecx, 8
or r8d, eax
movzx eax, byte [rdi + 1]
shl eax, 8
or r8d, eax
movzx eax, byte [rdi + 2]
or r8d, eax
movzx eax, byte [rdi + 4]
shl eax, 0x10
mov dword [rbp - 0x30], r8d
mov byte [rbp - 0xd], r8b
or r9d, eax
movzx eax, byte [rdx + 1]
or ecx, eax
mov eax, r8d
shr eax, 0x18
or r9d, ecx
mov byte [rbp - 0x10], al
mov eax, r8d
mov dword [rbp - 0x2c], r9d
shr eax, 0x10
mov byte [rbp - 9], r9b
mov byte [rbp - 0xf], al
mov eax, r8d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r9d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r9d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r9d
shr eax, 8
mov byte [rbp - 0xa], al
test r12d, r12d
je 0x1401e55b6
mov r15, qword [rbp - 0x28]
sub r14, rsi
movzx edx, r9b
movzx r10d, r8b
dec r12d
test ebx, ebx
jne 0x1401e5553
lea rcx, [rbp - 0x30]
mov rdx, r15
call fcn.1401e4650
mov r8d, dword [rbp - 0x30]
mov r9d, dword [rbp - 0x2c]
mov eax, r8d
movzx edx, r9b
movzx r10d, r8b
shr eax, 0x18
mov byte [rbp - 0xd], r8b
mov byte [rbp - 9], dl
mov byte [rbp - 0x10], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0xf], al
mov eax, r8d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r9d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r9d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r9d
shr eax, 8
inc r13d
mov byte [rbp - 0xa], al
movsxd rax, ebx
inc rsi
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [rsi - 1]
inc ebx
mov byte [r14 + rsi - 1], cl
and ebx, 7
test r12d, r12d
jne 0x1401e54f0
mov r15, qword [rbp - 0x20]
test r13d, r13d
je 0x1401e55b6
mov rcx, qword [rbp - 0x18]
mov eax, r8d
shr eax, 0x18
mov byte [rcx], al
mov eax, r8d
shr r8d, 8
shr eax, 0x10
mov byte [rdi], al
mov byte [rdi + 1], r8b
mov byte [rdi + 2], r10b
mov eax, r9d
shr eax, 0x18
mov byte [rdi + 3], al
mov eax, r9d
shr eax, 0x10
shr r9d, 8
mov byte [rdi + 4], al
mov byte [rdi + 5], r9b
mov byte [rdi + 6], dl
mov rdi, qword [rsp + 0x90]
mov dword [r15], ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140254f60
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rbx
pop rbp
ret
Function at 0x1401ea030
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
mov eax, 0x50
call fcn.1402563a0
sub rsp, rax
mov rax, qword [0x1403bb2d8]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x60]
mov r15, qword [rbp + 0x68]
mov rsi, rcx
movzx r10d, byte [rax]
mov ebx, dword [r15]
lea rdi, [rax + 1]
movzx ecx, byte [rdi + 6]
mov qword [rbp - 0x18], rax
movzx eax, byte [rdi]
shl eax, 8
mov r14, rdx
movzx edx, byte [rdi + 3]
or r10d, eax
movzx eax, byte [rdi + 1]
shl ecx, 8
shl eax, 0x10
mov r12d, r8d
lea r8, [rdi + 5]
or r10d, eax
movzx eax, byte [rdi + 2]
xor r13d, r13d
shl eax, 0x18
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], r15
or r10d, eax
movzx eax, byte [rdi + 4]
shl eax, 8
mov dword [rbp - 0x30], r10d
mov byte [rbp - 0x10], r10b
or edx, eax
movzx eax, byte [r8]
or ecx, eax
mov eax, r10d
shr eax, 8
shl ecx, 0x10
mov byte [rbp - 0xf], al
or edx, ecx
mov eax, r10d
shr eax, 0x10
mov dword [rbp - 0x2c], edx
mov byte [rbp - 0xc], dl
mov byte [rbp - 0xe], al
mov eax, r10d
shr eax, 0x18
mov byte [rbp - 0xd], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0xb], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0xa], al
mov eax, edx
shr eax, 0x18
mov byte [rbp - 9], al
test r12d, r12d
je 0x1401ea1ec
mov r15, qword [rbp - 0x28]
sub r14, rsi
movzx r8d, dl
movzx r9d, r10b
dec r12d
test ebx, ebx
jne 0x1401ea188
lea r8d, [rbx + 1]
lea rcx, [rbp - 0x30]
mov rdx, r15
call fcn.1401e5e00
mov r10d, dword [rbp - 0x30]
mov edx, dword [rbp - 0x2c]
movzx r9d, byte [rbp - 0x30]
movzx r8d, byte [rbp - 0x2c]
mov eax, r10d
shr eax, 8
mov byte [rbp - 0x10], r9b
mov byte [rbp - 0xc], r8b
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0xe], al
mov eax, r10d
shr eax, 0x18
mov byte [rbp - 0xd], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0xb], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0xa], al
mov eax, edx
shr eax, 0x18
inc r13d
mov byte [rbp - 9], al
movsxd rax, ebx
inc rsi
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [rsi - 1]
inc ebx
mov byte [r14 + rsi - 1], cl
and ebx, 7
test r12d, r12d
jne 0x1401ea122
mov r15, qword [rbp - 0x20]
test r13d, r13d
je 0x1401ea1ec
mov rax, qword [rbp - 0x18]
mov byte [rax], r9b
mov eax, r10d
shr eax, 8
mov byte [rdi], al
mov eax, r10d
shr r10d, 0x18
shr eax, 0x10
mov byte [rdi + 1], al
mov byte [rdi + 2], r10b
mov byte [rdi + 3], r8b
mov eax, edx
shr eax, 8
mov byte [rdi + 4], al
mov eax, edx
shr eax, 0x10
shr edx, 0x18
mov byte [rdi + 5], al
mov byte [rdi + 6], dl
mov dword [r15], ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140254f60
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401eb6d0
Capabilities:
Encode data using xor
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x20
call fcn.1402563a0
sub rsp, rax
mov rdi, rdx
lea r8d, [rax + 0x60]
xor edx, edx
mov rbx, rcx
call fcn.1402547c0
mov dword [rbx], 0x6a09e667
mov dword [rbx + 4], 0xbb67ae85
mov dword [rbx + 8], 0x3c6ef372
mov dword [rbx + 0xc], 0xa54ff53a
mov dword [rbx + 0x10], 0x510e527f
mov dword [rbx + 0x14], 0x9b05688c
mov dword [rbx + 0x18], 0x1f83d9ab
mov dword [rbx + 0x1c], 0x5be0cd19
movzx eax, byte [rdi]
mov ecx, 8
mov qword [rbx + 0x78], rax
sub rdi, rbx
nop word [rax + rax]
mov eax, dword [rdi + rbx]
add rbx, 4
xor dword [rbx - 4], eax
dec rcx
jne 0x1401eb740
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1401ed750
Capabilities:
Encode data using xor
Hash data using sha512

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x20
call fcn.1402563a0
sub rsp, rax
mov rdi, rdx
mov r8d, 0xf0
xor edx, edx
mov rbx, rcx
call fcn.1402547c0
movabs rax, 0xbb67ae8584caa73b
mov qword [rbx + 8], rax
movabs rax, 0x3c6ef372fe94f82b
movabs r11, 0x6a09e667f3bcc908
mov qword [rbx + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rbx], r11
mov qword [rbx + 0x18], rax
movabs rax, 0x510e527fade682d1
mov ecx, 8
mov qword [rbx + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rbx + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rbx + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rbx + 0x38], rax
movzx eax, byte [rdi]
sub rdi, rbx
mov qword [rbx + 0xe8], rax
nop word [rax + rax]
mov rax, qword [rdi + rbx]
add rbx, 8
xor qword [rbx - 8], rax
dec rcx
jne 0x1401ed800
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1401f5009
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x1401f5207
push rbp
mov eax, 0xe0
call fcn.1402563a0
sub rsp, rax
mov rax, qword [0x1403bb2d8]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0x100], rbx
mov qword [rsp + 0xd8], rsi
mov qword [rsp + 0xd0], rdi
mov qword [rsp + 0xc8], r12
lea rsi, [r8 - 1]
mov qword [rsp + 0xc0], r13
shr rsi, 3
mov rbp, rdx
lea r12, [rcx + 0xc]
inc rsi
lea r13, [rcx + 0x14]
nop word [rax + rax]
movzx eax, byte [rbp + 1]
movzx ebx, byte [rbp]
movzx edi, byte [rbp + 4]
shl eax, 8
mov rcx, r12
add rbp, 8
or ebx, eax
movzx eax, byte [rbp - 6]
shl eax, 0x10
or ebx, eax
movzx eax, byte [rbp - 5]
shl eax, 0x18
or ebx, eax
movzx eax, byte [rbp - 3]
shl eax, 8
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
or edi, eax
movzx eax, byte [rbp - 2]
shl eax, 0x10
or edi, eax
movzx eax, byte [rbp - 1]
and byte [r12], 0xdf
and byte [r13], 0xbf
or byte [r12], 0x40
or byte [r13], 0x20
shl eax, 0x18
or edi, eax
mov dword [rsp + 0x2c], edi
mov dword [rsp + 0x24], edi
call fcn.1401e9bb0
lea rdx, [rsp + 0x30]
mov rcx, r12
call fcn.1401e9c10
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
mov r8d, 1
call fcn.1401e5e00
mov rcx, r13
call fcn.1401e9bb0
lea rdx, [rsp + 0x30]
mov rcx, r13
call fcn.1401e9c10
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x28]
mov r8d, 1
call fcn.1401e5e00
mov r11d, dword [rsp + 0x28]
mov edx, dword [rsp + 0x2c]
xor r11d, ebx
xor ebx, dword [rsp + 0x20]
xor edx, edi
xor edi, dword [rsp + 0x24]
mov byte [r12], bl
mov eax, ebx
shr eax, 8
mov byte [r12 + 1], al
mov eax, ebx
shr ebx, 0x18
shr eax, 0x10
mov byte [r12 + 2], al
mov byte [r12 + 3], bl
mov byte [r12 + 4], dl
mov eax, edx
shr eax, 8
mov byte [r12 + 5], al
mov eax, edx
shr edx, 0x18
shr eax, 0x10
mov byte [r12 + 6], al
mov byte [r12 + 7], dl
mov byte [r13], r11b
mov eax, r11d
shr eax, 8
mov byte [r13 + 1], al
mov eax, r11d
shr eax, 0x10
shr r11d, 0x18
mov byte [r13 + 2], al
mov byte [r13 + 3], r11b
mov byte [r13 + 4], dil
mov eax, edi
shr eax, 8
mov byte [r13 + 5], al
mov eax, edi
shr edi, 0x18
shr eax, 0x10
dec rsi
mov byte [r13 + 6], al
mov byte [r13 + 7], dil
jne 0x1401f5070
mov r13, qword [rsp + 0xc0]
mov r12, qword [rsp + 0xc8]
mov rdi, qword [rsp + 0xd0]
mov rsi, qword [rsp + 0xd8]
mov rbx, qword [rsp + 0x100]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140254f60
add rsp, 0xe0
pop rbp
repz ret

Function at 0x1401f5350
Capabilities:
Hash data using sha1

Disassembly:
push rbx
mov eax, 0x20
call fcn.1402563a0
sub rsp, rax
mov rbx, rcx
call fcn.1401affa0
test eax, eax
jne 0x1401f5371
add rsp, 0x20
pop rbx
ret
lea rcx, [rbx + 0x5c]
add rsp, 0x20
pop rbx
jmp fcn.140181e90
Function at 0x1401fc370
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x20
call fcn.1402563a0
sub rsp, rax
mov eax, dword [r8 + 8]
mov rsi, rdx
mov rdi, rcx
cmp dword [rdx + 8], eax
jge 0x1401fc39c
mov rbx, r8
jmp 0x1401fc3a2
mov rbx, rdx
mov rsi, r8
mov edx, dword [rbx + 8]
call fcn.14011b520
test rax, rax
jne 0x1401fc3bf
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor r8d, r8d
cmp dword [rsi + 8], r8d
jle 0x1401fc3f4
mov r9d, r8d
nop dword [rax + rax]
mov rax, qword [rsi]
mov rcx, qword [rbx]
inc r8d
mov rdx, qword [rcx + r9]
add r9, 8
xor rdx, qword [rax + r9 - 8]
mov rax, qword [rdi]
mov qword [r9 + rax - 8], rdx
cmp r8d, dword [rsi + 8]
jl 0x1401fc3d0
movsxd rdx, r8d
cmp r8d, dword [rbx + 8]
jge 0x1401fc41d
shl rdx, 3
mov rax, qword [rbx]
mov rcx, qword [rdi]
inc r8d
mov rax, qword [rdx + rax]
add rdx, 8
mov qword [rdx + rcx - 8], rax
cmp r8d, dword [rbx + 8]
jl 0x1401fc401
mov eax, dword [rbx + 8]
mov rcx, rdi
mov dword [rdi + 8], eax
call fcn.14011ad40
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov eax, 1
add rsp, 0x20
pop rdi
ret
Function at 0x140224420
Capabilities:
Encode data using xor

Disassembly:
mov r11, rdx
mov r9, rcx
test rdx, rdx
je 0x140224499
test r8, r8
je 0x140224499
mov r10, qword [rcx + 0x28]
cmp r8, r10
cmovb r10, r8
test r10, r10
je 0x140224460
add rcx, 0x34
sub rdx, r9
nop word [rax + rax]
movzx eax, byte [rdx + rcx - 0x34]
inc rcx
xor byte [rcx - 1], al
dec r10
jne 0x140224450
mov rax, qword [r9 + 0x28]
cmp r8, rax
jbe 0x140224499
sub r8, rax
mov eax, reloc.WS2_32.dll_recv
cmp r8, rax
cmova r8, rax
xor ecx, ecx
test r8, r8
je 0x140224499
nop
mov rax, qword [r9 + 0x28]
add rax, rcx
inc rcx
movzx eax, byte [rax + r11]
xor byte [r9 + rcx + 0x53], al
cmp rcx, r8
jb 0x140224480
repz ret

Function at 0x1402244a0
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov eax, reloc.WS2_32.dll_WSASetLastError
call fcn.1402563a0
sub rsp, rax
mov rax, qword [0x1403bb2d8]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rax, qword [rdx]
mov r11, rcx
mov cl, 2
cmp qword [r11 + 0x28], 0x10
mov qword [rsp + 0x38], rax
mov rax, qword [rdx + 8]
mov qword [rsp + 0x40], rax
mov rax, qword [rdx]
mov qword [rsp + 0x48], rax
mov rax, qword [rdx + 8]
mov qword [rsp + 0x50], rax
je 0x1402244ff
mov rax, qword [rdx]
mov cl, 3
mov qword [rsp + 0x58], rax
mov rax, qword [rdx + 8]
mov qword [rsp + 0x60], rax
movzx ebx, cl
lea rdx, [r11 + 0x80]
mov dword [rsp + 0x30], reloc.WS2_32.dll_recv
shl ebx, 4
movsxd r9, ebx
test ebx, ebx
jle 0x140224541
lea r10, [rsp + 0x38]
mov r8, rdx
sub r10, rdx
nop word [rax + rax]
movzx eax, byte [r10 + r8]
inc r8
xor byte [r8 - 1], al
dec r9
jne 0x140224530
mov rcx, qword [r11 + 0x10]
lea r8, [rsp + 0x30]
mov r9, rdx
mov dword [rsp + 0x20], ebx
call fcn.1400db810
test eax, eax
je 0x140224578
cmp dword [rsp + 0x30], ebx
jne 0x140224578
mov eax, 1
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140254f60
add rsp, 0x70
pop rbx
ret
xor eax, eax
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140254f60
add rsp, 0x70
pop rbx
ret
Function at 0x140224590
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov eax, reloc.WS2_32.dll_WSASetLastError
call fcn.1402563a0
sub rsp, rax
mov rax, qword [0x1403bb2d8]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor eax, eax
lea rdx, [rcx + 0x80]
xor ebx, ebx
mov qword [rdx], rax
mov qword [rdx + 8], rax
mov qword [rdx + 0x10], rax
mov qword [rdx + 0x18], rax
mov qword [rdx + 0x20], rax
mov qword [rdx + 0x28], rax
cmp qword [rcx + 0x28], 0x10
mov qword [rsp + 0x49], rax
mov qword [rsp + 0x59], rax
setne bl
mov byte [rsp + 0x38], 0
mov qword [rsp + 0x39], rax
add ebx, 2
mov qword [rsp + 0x41], rax
mov qword [rsp + 0x51], rax
shl ebx, 4
mov dword [rsp + 0x61], eax
mov word [rsp + 0x65], ax
mov byte [rsp + 0x67], al
mov byte [rsp + 0x4b], 1
mov byte [rsp + 0x5b], 2
mov dword [rsp + 0x30], reloc.WS2_32.dll_recv
movsxd r9, ebx
test ebx, ebx
jle 0x140224641
lea r10, [rsp + 0x38]
mov r8, rdx
sub r10, rdx
nop dword [rax]
movzx eax, byte [r10 + r8]
inc r8
xor byte [r8 - 1], al
dec r9
jne 0x140224630
mov rcx, qword [rcx + 0x10]
lea r8, [rsp + 0x30]
mov r9, rdx
mov dword [rsp + 0x20], ebx
call fcn.1400db810
test eax, eax
je 0x140224678
cmp dword [rsp + 0x30], ebx
jne 0x140224678
mov eax, 1
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140254f60
add rsp, 0x70
pop rbx
ret
xor eax, eax
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140254f60
add rsp, 0x70
pop rbx
ret