joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401d67d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r13
mov eax, 0x20
call fcn.1402563a0
sub rsp, rax
xor r13d, r13d
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
mov qword [rcx + 0x30], r13
mov qword [rcx + 0x38], r13
mov qword [rcx + 0x170], r13
cmp r8, 0xc
jne 0x1401d6821
mov rax, qword [rdx]
lea ebx, [r8 - 0xb]
mov qword [rcx], rax
mov eax, dword [rdx + 8]
mov dword [rcx + 0xc], 0x1000000
mov dword [rcx + 8], eax
jmp 0x1401d6980
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x60], r15
mov qword [rcx + 0x40], r13
mov r15, r8
mov qword [rcx + 0x48], r13
cmp r8, 0x10
jb 0x1401d68c4
mov r13, r8
mov rbx, rdx
mov qword [rsp + 0x58], r14
shr r13, 4
sub rbx, rcx
mov rax, r13
sub rbx, 0x3f
imul rax, rax, 0xfffffffffffffff0
add rsi, rax
mov rax, r13
shl rax, 4
add rbp, rax
nop word [rax + rax]
lea rcx, [rdi + 0x40]
mov edx, 4
nop dword [rax]
movzx eax, byte [rbx + rcx - 1]
add rcx, 4
xor byte [rcx - 4], al
movzx eax, byte [rbx + rcx - 4]
xor byte [rcx - 3], al
movzx eax, byte [rbx + rcx - 3]
xor byte [rcx - 2], al
movzx eax, byte [rbx + rcx - 2]
xor byte [rcx - 1], al
dec rdx
jne 0x1401d6880
lea rdx, [rdi + 0x60]
lea rcx, [rdi + 0x40]
call fcn.1401d63d0
add rbx, 0x10
dec r13
jne 0x1401d6870
mov r14, qword [rsp + 0x58]
test rsi, rsi
je 0x1401d68ed
lea rcx, [rdi + 0x40]
sub rbp, rdi
movzx eax, byte [rcx + rbp - 0x40]
inc rcx
xor byte [rcx - 1], al
dec rsi
jne 0x1401d68d0
lea rdx, [rdi + 0x60]
lea rcx, [rdi + 0x40]
call fcn.1401d63d0
shl r15, 3
lea rdx, [rdi + 0x60]
lea rcx, [rdi + 0x40]
xor byte [rdi + 0x4f], r15b
mov rax, r15
shr rax, 0x38
xor byte [rdi + 0x48], al
mov rax, r15
shr rax, 0x30
xor byte [rdi + 0x49], al
mov rax, r15
shr rax, 0x28
xor byte [rdi + 0x4a], al
mov rax, r15
shr rax, 0x20
xor byte [rdi + 0x4b], al
mov rax, r15
shr rax, 0x18
xor byte [rdi + 0x4c], al
mov rax, r15
shr rax, 0x10
xor byte [rdi + 0x4d], al
mov rax, r15
shr rax, 8
xor byte [rdi + 0x4e], al
call fcn.1401d63d0
movzx eax, byte [rdi + 0x4d]
movzx ebx, byte [rdi + 0x4c]
mov r15, qword [rsp + 0x60]
mov r12, qword [rsp + 0x50]
shl ebx, 8
or ebx, eax
movzx eax, byte [rdi + 0x4e]
shl ebx, 8
or ebx, eax
movzx eax, byte [rdi + 0x4f]
shl ebx, 8
or ebx, eax
mov rax, qword [rdi + 0x40]
mov qword [rdi], rax
mov rax, qword [rdi + 0x48]
mov qword [rdi + 8], rax
mov r8, qword [rdi + 0x180]
lea rdx, [rdi + 0x20]
mov rcx, rdi
mov qword [rdi + 0x40], r13
mov qword [rdi + 0x48], r13
call qword [rdi + 0x178]
inc ebx
mov eax, ebx
mov byte [rdi + 0xf], bl
shr eax, 0x18
mov byte [rdi + 0xc], al
mov eax, ebx
shr eax, 0x10
mov byte [rdi + 0xd], al
mov eax, ebx
shr eax, 8
mov byte [rdi + 0xe], al
add rsp, 0x20
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1401d69d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
mov eax, 0x20
call fcn.1402563a0
sub rsp, rax
cmp qword [rcx + 0x38], 0
mov rbx, r8
mov rbp, rdx
mov rdi, rcx
je 0x1401d6a0d
mov eax, 0xfffffffe
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rcx + 0x30]
lea rcx, [r8 + rax]
movabs rax, 0x2000000000000000
cmp rcx, rax
ja 0x1401d6add
cmp rcx, rbx
jb 0x1401d6add
mov qword [rsp + 0x30], rsi
mov esi, dword [rdi + 0x174]
mov qword [rdi + 0x30], rcx
test esi, esi
je 0x1401d6a73
test rbx, rbx
je 0x1401d6a62
movzx eax, byte [rbp]
mov ecx, esi
inc rbp
xor byte [rcx + rdi + 0x40], al
dec rbx
inc esi
and esi, 0xf
jne 0x1401d6a44
jmp 0x1401d6a66
test esi, esi
jne 0x1401d6ac0
lea rdx, [rdi + 0x60]
lea rcx, [rdi + 0x40]
call fcn.1401d63d0
mov qword [rsp + 0x38], r12
mov r12, rbx
and r12, 0xfffffffffffffff0
je 0x1401d6a9a
lea rdx, [rdi + 0x60]
lea rcx, [rdi + 0x40]
mov r9, r12
mov r8, rbp
call fcn.1401d6510
add rbp, r12
sub rbx, r12
mov r12, qword [rsp + 0x38]
test rbx, rbx
je 0x1401d6ac0
mov esi, ebx
lea rcx, [rdi + 0x40]
sub rbp, rdi
nop dword [rax]
movzx eax, byte [rcx + rbp - 0x40]
inc rcx
xor byte [rcx - 1], al
dec rbx
jne 0x1401d6ab0
mov dword [rdi + 0x174], esi
mov rsi, qword [rsp + 0x30]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
or eax, 0xffffffff
add rsp, 0x20
pop rdi
ret
Function at 0x1401d8370
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x68
call fcn.1402563a0
sub rsp, rax
mov rax, qword [0x1403bb2d8]
xor rax, rsp
mov qword [rsp + 0x58], rax
movzx edi, byte [rcx]
mov rax, qword [rcx + 0x28]
mov r12, qword [rsp + 0xd0]
mov rsi, r9
mov r9, qword [rcx + 0x30]
mov r15, r8
mov r13, rdx
mov rbx, rcx
mov byte [rsp + 0x30], dil
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], rax
test dil, 0x40
jne 0x1401d83df
lea rdx, [rcx + 0x10]
mov r8, r9
call rax
inc qword [rbx + 0x20]
mov r9, qword [rsp + 0x38]
movzx eax, dil
mov r8d, reloc.WS2_32.dll_ntohs
xor ebp, ebp
and eax, 7
mov r14d, r8d
mov ecx, ebp
sub r14d, eax
mov byte [rbx], al
movsxd rax, r14d
cmp r14d, r8d
jae 0x1401d8425
lea rdx, [rax + rbx]
sub r8d, r14d
nop word [rax + rax]
movzx eax, byte [rdx]
mov byte [rdx], bpl
inc rdx
or rcx, rax
shl rcx, 8
dec r8
jne 0x1401d8410
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0xf], 1
or rcx, rax
cmp rcx, rsi
je 0x1401d843d
or eax, 0xffffffff
jmp 0x1401d85dc
lea rax, [rsi + 0xf]
or rax, 8
shr rax, 3
add qword [rbx + 0x20], rax
movabs rax, 0x2000000000000000
cmp qword [rbx + 0x20], rax
jbe 0x1401d8467
mov eax, 0xfffffffe
jmp 0x1401d85dc
mov rdi, rsi
shr rdi, 4
test rdi, rdi
je 0x1401d84f0
lea rax, [rbx + 0x10]
mov r8, rdi
mov rdx, r15
mov qword [rsp + 0x28], rax
mov rcx, r13
mov qword [rsp + 0x20], rbx
call r12
shl rdi, 4
add r13, rdi
add r15, rdi
sub rsi, rdi
je 0x1401d858c
lea r9, [rbx + 8]
shr rdi, 4
mov rdx, rbp
lea r8, [r9 + 8]
neg r9
nop word [rax + rax]
movzx eax, byte [r8 - 1]
dec r8
movzx ecx, dil
add rdx, rax
lea rax, [r9 + r8]
shr rdi, 8
add rdx, rcx
mov byte [r8], dl
shr rdx, 8
test rax, rax
je 0x1401d84f0
test rdi, rdi
jne 0x1401d84c0
test rdx, rdx
jne 0x1401d84c0
test rsi, rsi
je 0x1401d858c
mov r8, r13
mov edx, ebp
lea rcx, [rbx + 0x10]
sub r8, rbx
nop word [rax + rax]
movzx eax, byte [r8 + rcx - 0x10]
inc edx
inc rcx
xor byte [rcx - 1], al
mov eax, edx
cmp rax, rsi
jb 0x1401d8510
mov rdi, qword [rsp + 0x38]
mov r12, qword [rsp + 0x40]
lea rcx, [rbx + 0x10]
mov r8, rdi
mov rdx, rcx
call r12
lea rdx, [rsp + 0x48]
mov r8, rdi
mov rcx, rbx
call r12
test rsi, rsi
je 0x1401d8596
lea rax, [rsp + 0x48]
lea rcx, [rsp + 0x48]
sub r13, rax
lea rax, [rsp + 0x48]
sub r15, rax
nop word [rax + rax]
movzx eax, byte [r13 + rcx]
inc ebp
inc rcx
xor al, byte [rcx - 1]
mov byte [r15 + rcx - 1], al
mov eax, ebp
cmp rax, rsi
jb 0x1401d8570
jmp 0x1401d8596
mov r12, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x38]
movsxd rax, r14d
cmp r14d, 0x10
jae 0x1401d85b3
mov r8d, reloc.WS2_32.dll_recv
lea rcx, [rax + rbx]
xor edx, edx
sub r8d, r14d
call fcn.1402547c0
lea rdx, [rsp + 0x48]
mov r8, rdi
mov rcx, rbx
call r12
mov rax, qword [rsp + 0x48]
xor qword [rbx + 0x10], rax
mov rax, qword [rsp + 0x50]
xor qword [rbx + 0x18], rax
movzx eax, byte [rsp + 0x30]
mov byte [rbx], al
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140254f60
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1401d8600
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x68
call fcn.1402563a0
sub rsp, rax
mov rax, qword [0x1403bb2d8]
xor rax, rsp
mov qword [rsp + 0x58], rax
movzx ebx, byte [rcx]
mov rax, qword [rcx + 0x28]
mov r13, qword [rsp + 0xd0]
mov r14, qword [rcx + 0x30]
mov rsi, r9
mov r10, r8
mov qword [rsp + 0x38], r8
mov r15, rdx
mov rdi, rcx
mov byte [rsp + 0x30], bl
mov qword [rsp + 0x40], rax
test bl, 0x40
jne 0x1401d8669
lea rdx, [rcx + 0x10]
mov r8, r14
call rax
mov r10, qword [rsp + 0x38]
movzx eax, bl
mov r8d, reloc.WS2_32.dll_ntohs
xor ebp, ebp
and eax, 7
mov r12d, r8d
mov ecx, ebp
sub r12d, eax
mov byte [rdi], al
movsxd rax, r12d
cmp r12d, r8d
jae 0x1401d86a5
lea rdx, [rax + rdi]
sub r8d, r12d
movzx eax, byte [rdx]
mov byte [rdx], bpl
inc rdx
or rcx, rax
shl rcx, 8
dec r8
jne 0x1401d8690
movzx eax, byte [rdi + 0xf]
mov byte [rdi + 0xf], 1
or rcx, rax
cmp rcx, rsi
je 0x1401d86bd
or eax, 0xffffffff
jmp 0x1401d87fa
mov rbx, rsi
shr rbx, 4
test rbx, rbx
je 0x1401d8741
lea rax, [rdi + 0x10]
mov r9, r14
mov r8, rbx
mov qword [rsp + 0x28], rax
mov rdx, r10
mov rcx, r15
mov qword [rsp + 0x20], rdi
call r13
mov r13, qword [rsp + 0x38]
shl rbx, 4
add r13, rbx
add r15, rbx
sub rsi, rbx
je 0x1401d87b0
lea r9, [rdi + 8]
shr rbx, 4
mov rdx, rbp
lea r8, [r9 + 8]
neg r9
movzx eax, byte [r8 - 1]
dec r8
movzx ecx, bl
add rdx, rax
lea rax, [r9 + r8]
shr rbx, 8
add rdx, rcx
mov byte [r8], dl
shr rdx, 8
test rax, rax
je 0x1401d8746
test rbx, rbx
jne 0x1401d8710
test rdx, rdx
jne 0x1401d8710
jmp 0x1401d8746
mov r13, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
test rsi, rsi
je 0x1401d87b5
lea rdx, [rsp + 0x48]
mov r8, r14
mov rcx, rdi
call rbx
test rsi, rsi
je 0x1401d87a2
lea rax, [rsp + 0x48]
mov r8, rdi
lea rdx, [rsp + 0x48]
sub r15, rax
lea rax, [rsp + 0x48]
sub r13, rax
lea rax, [rsp + 0x48]
sub r8, rax
movzx ecx, byte [r15 + rdx]
movzx eax, byte [rdx]
inc ebp
xor ecx, eax
mov eax, ebp
inc rdx
mov byte [r13 + rdx - 1], cl
xor byte [r8 + rdx + 0xf], cl
cmp rax, rsi
jb 0x1401d8782
lea rcx, [rdi + 0x10]
mov r8, r14
mov rdx, rcx
call rbx
jmp 0x1401d87b5
mov rbx, qword [rsp + 0x40]
movsxd rax, r12d
cmp r12d, 0x10
jae 0x1401d87d2
mov r8d, reloc.WS2_32.dll_recv
lea rcx, [rax + rdi]
xor edx, edx
sub r8d, r12d
call fcn.1402547c0
lea rdx, [rsp + 0x48]
mov r8, r14
mov rcx, rdi
call rbx
mov rax, qword [rsp + 0x48]
xor qword [rdi + 0x10], rax
mov rax, qword [rsp + 0x50]
xor qword [rdi + 0x18], rax
movzx eax, byte [rsp + 0x30]
mov byte [rdi], al
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140254f60
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1401d8ec0
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov eax, 0x20
call fcn.1402563a0
sub rsp, rax
mov rbx, r8
call fcn.1401d88d0
test eax, eax
js 0x1401d90fe
mov eax, dword [rbx + 0xf0]
xor r10d, r10d
shl eax, 2
movsxd r9, eax
test eax, eax
jle 0x1401d8f49
lea rdx, [rbx + r9*4 + 8]
lea r8, [rbx + 8]
nop dword [rax + rax]
mov eax, dword [rdx - 8]
mov ecx, dword [r8 - 8]
add r10, 4
mov dword [r8 - 8], eax
mov eax, dword [rdx - 4]
mov dword [rdx - 8], ecx
mov ecx, dword [r8 - 4]
mov dword [r8 - 4], eax
mov eax, dword [rdx]
mov dword [rdx - 4], ecx
mov ecx, dword [r8]
mov dword [r8], eax
mov eax, dword [rdx + 4]
mov dword [rdx], ecx
mov ecx, dword [r8 + 4]
mov dword [r8 + 4], eax
sub r9, 4
mov dword [rdx + 4], ecx
sub rdx, 0x10
add r8, 0x10
cmp r10, r9
jl 0x1401d8f00
mov r11d, 1
cmp dword [rbx + 0xf0], r11d
jle 0x1401d90fc
mov qword [rsp + 0x30], rdi
lea r10, [rbx + 2]
lea rdi, [0x140000000]
nop dword [rax]
mov r8d, dword [r10 + 0xe]
add r10, 0x10
inc r11d
mov eax, r8d
shr rax, 0x18
movzx edx, byte [rdi + rax*4 + 0x35af40]
movzx eax, byte [r10 - 1]
movzx ecx, byte [rdi + rax*4 + 0x35af40]
mov r9d, dword [rdi + rdx*4 + 0x35bb40]
movzx eax, r8b
xor r9d, dword [rdi + rcx*4 + 0x35c340]
movzx ecx, byte [rdi + rax*4 + 0x35af40]
movzx eax, byte [r10]
xor r9d, dword [rdi + rcx*4 + 0x35c740]
movzx ecx, byte [rdi + rax*4 + 0x35af40]
xor r9d, dword [rdi + rcx*4 + 0x35bf40]
mov dword [r10 - 2], r9d
mov r9d, dword [r10 + 2]
mov eax, r9d
shr rax, 0x18
movzx edx, byte [rdi + rax*4 + 0x35af40]
movzx eax, byte [r10 + 3]
movzx ecx, byte [rdi + rax*4 + 0x35af40]
mov r8d, dword [rdi + rdx*4 + 0x35bb40]
movzx eax, byte [r10 + 4]
xor r8d, dword [rdi + rcx*4 + 0x35c340]
movzx ecx, byte [rdi + rax*4 + 0x35af40]
movzx eax, r9b
xor r8d, dword [rdi + rcx*4 + 0x35bf40]
movzx ecx, byte [rdi + rax*4 + 0x35af40]
mov r9d, dword [r10 + 6]
xor r8d, dword [rdi + rcx*4 + 0x35c740]
mov eax, r9d
mov dword [r10 + 2], r8d
shr rax, 0x18
movzx edx, byte [rdi + rax*4 + 0x35af40]
movzx eax, byte [r10 + 7]
movzx ecx, byte [rdi + rax*4 + 0x35af40]
mov r8d, dword [rdi + rdx*4 + 0x35bb40]
movzx eax, byte [r10 + 8]
xor r8d, dword [rdi + rcx*4 + 0x35c340]
movzx ecx, byte [rdi + rax*4 + 0x35af40]
movzx eax, r9b
xor r8d, dword [rdi + rcx*4 + 0x35bf40]
movzx ecx, byte [rdi + rax*4 + 0x35af40]
movzx eax, byte [r10 + 0xb]
xor r8d, dword [rdi + rcx*4 + 0x35c740]
mov r9d, dword [r10 + 0xa]
mov dword [r10 + 6], r8d
movzx edx, byte [rdi + rax*4 + 0x35af40]
movzx eax, byte [r10 + 0xc]
movzx ecx, byte [rdi + rax*4 + 0x35af40]
mov r8d, dword [rdi + rdx*4 + 0x35c340]
mov eax, r9d
xor r8d, dword [rdi + rcx*4 + 0x35bf40]
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0x35af40]
movzx eax, r9b
xor r8d, dword [rdi + rcx*4 + 0x35bb40]
movzx ecx, byte [rdi + rax*4 + 0x35af40]
xor r8d, dword [rdi + rcx*4 + 0x35c740]
mov dword [r10 + 0xa], r8d
cmp r11d, dword [rbx + 0xf0]
jl 0x1401d8f70
mov rdi, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x1401da610
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push r12
mov eax, 0x20
call fcn.1402563a0
sub rsp, rax
mov r12, qword [rcx + 0x28]
mov rsi, rdx
mov rbp, rcx
cmp rdx, r12
ja 0x1401da645
shl rsi, 4
add rsi, qword [rcx + 0x58]
mov rax, rsi
add rsp, 0x20
pop r12
pop rsi
pop rbp
ret
mov rcx, qword [rcx + 0x30]
cmp rdx, rcx
jb 0x1401da68c
sub rdx, rcx
lea r8, str.cryptomodesocb128.c
mov r9d, WSAStartup
add rdx, 4
and rdx, 0xfffffffffffffffc
add rdx, rcx
mov rcx, qword [rbp + 0x58]
mov qword [rbp + 0x30], rdx
shl rdx, 4
call fcn.1400b46a0
test rax, rax
jne 0x1401da688
add rsp, 0x20
pop r12
pop rsi
pop rbp
ret
mov qword [rbp + 0x58], rax
cmp r12, rsi
jae 0x1401da706
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r14
mov r14, r12
mov r13, rsi
sub r13, r12
shl r14, 4
add r12, r13
nop word [rax + rax]
mov rax, qword [rbp + 0x58]
mov edx, 1
movzx ebx, byte [r14 + rax]
lea rcx, [r14 + rax]
lea rdi, [rcx + 0x10]
shr bl, 7
neg bl
mov r8, rdi
and bl, 0x87
call fcn.1401da560
xor byte [rdi + 0xf], bl
add r14, 0x10
dec r13
jne 0x1401da6c0
mov r14, qword [rsp + 0x58]
mov r13, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
shl rsi, 4
mov qword [rbp + 0x28], r12
add rsi, qword [rbp + 0x58]
mov rax, rsi
add rsp, 0x20
pop r12
pop rsi
pop rbp
ret
Function at 0x1401dacf0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
mov eax, 0x60
call fcn.1402563a0
sub rsp, rax
mov rax, qword [0x1403bb2d8]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rax, qword [rcx + 0x68]
mov rsi, r9
xor edi, edi
shr rsi, 4
mov rbp, r9
mov r12, r8
mov r14, rdx
mov rbx, rcx
lea r13, [rax + rsi]
test rsi, rsi
je 0x1401dadab
cmp qword [rcx + 0x20], rdi
je 0x1401dadab
mov rax, r13
mov edx, edi
shr rax, 1
je 0x1401dad58
nop dword [rax]
inc rdx
shr rax, 1
jne 0x1401dad50
call fcn.1401da610
test rax, rax
jne 0x1401dad69
xor eax, eax
jmp 0x1401daf2a
mov rdx, qword [rbx + 0x68]
mov r9, qword [rbx + 0x10]
lea rax, [rbx + 0xa0]
mov qword [rsp + 0x38], rax
mov rax, qword [rbx + 0x58]
inc rdx
mov qword [rsp + 0x30], rax
lea rcx, [rbx + 0x90]
mov r8, rsi
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rdx
mov rdx, r12
mov rcx, r14
call qword [rbx + 0x20]
jmp 0x1401dae7e
lea rsi, [rax + 1]
cmp rsi, r13
ja 0x1401dae7e
nop dword [rax + rax]
mov rax, rsi
mov ecx, edi
test sil, 1
jne 0x1401dadd9
nop dword [rax + rax]
shr rax, 1
inc ecx
test al, 1
je 0x1401dadd0
mov edx, ecx
mov rcx, rbx
call fcn.1401da610
test rax, rax
je 0x1401dad62
mov rcx, qword [rax]
mov r8, qword [rbx + 0x10]
lea rdx, [rsp + 0x40]
xor qword [rbx + 0x90], rcx
mov rax, qword [rax + 8]
add r14, 0x10
xor qword [rbx + 0x98], rax
mov rcx, qword [r14 - 8]
mov rax, qword [r14 - 0x10]
xor qword [rbx + 0xa8], rcx
xor rcx, qword [rbx + 0x98]
xor qword [rbx + 0xa0], rax
xor rax, qword [rbx + 0x90]
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
call qword [rbx]
mov r11, qword [rsp + 0x40]
xor r11, qword [rbx + 0x90]
mov rax, qword [rsp + 0x48]
inc rsi
xor rax, qword [rbx + 0x98]
mov qword [r12], r11
add r12, 0x10
mov qword [r12 - 8], rax
mov qword [rsp + 0x40], r11
mov qword [rsp + 0x48], rax
cmp rsi, r13
jbe 0x1401dadc0
and ebp, 0xf
jbe 0x1401daf21
mov rax, qword [rbx + 0x38]
mov r8, qword [rbx + 0x10]
lea rcx, [rbx + 0x90]
xor qword [rcx], rax
mov rax, qword [rbx + 0x40]
lea rdx, [rsp + 0x40]
xor qword [rbx + 0x98], rax
call qword [rbx]
test rbp, rbp
je 0x1401daee8
lea rax, [rsp + 0x40]
mov r8, r14
sub r8, rax
lea rax, [rsp + 0x40]
sub r12, rax
nop word [rax + rax]
lea rcx, [rsp + rdi + 0x40]
inc rdi
movzx eax, byte [r8 + rcx]
xor al, byte [rcx]
mov byte [r12 + rcx], al
cmp rdi, rbp
jb 0x1401daed0
xor eax, eax
lea rcx, [rsp + 0x40]
mov r8, rbp
mov rdx, r14
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
call fcn.1402550b0
mov byte [rsp + rbp + 0x40], 0x80
mov rax, qword [rsp + 0x40]
xor qword [rbx + 0xa0], rax
mov rax, qword [rsp + 0x48]
xor qword [rbx + 0xa8], rax
mov qword [rbx + 0x68], r13
mov eax, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140254f60
add rsp, 0x60
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1401daf50
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
mov eax, 0x60
call fcn.1402563a0
sub rsp, rax
mov rax, qword [0x1403bb2d8]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rax, qword [rcx + 0x68]
mov rsi, r9
xor edi, edi
shr rsi, 4
mov rbp, r9
mov r14, r8
mov r12, rdx
mov rbx, rcx
lea r13, [rax + rsi]
test rsi, rsi
je 0x1401db00b
cmp qword [rcx + 0x20], rdi
je 0x1401db00b
mov rax, r13
mov edx, edi
shr rax, 1
je 0x1401dafb8
nop dword [rax]
inc rdx
shr rax, 1
jne 0x1401dafb0
call fcn.1401da610
test rax, rax
jne 0x1401dafc9
xor eax, eax
jmp 0x1401db18a
mov rdx, qword [rbx + 0x68]
mov r9, qword [rbx + 0x18]
lea rax, [rbx + 0xa0]
mov qword [rsp + 0x38], rax
mov rax, qword [rbx + 0x58]
inc rdx
mov qword [rsp + 0x30], rax
lea rcx, [rbx + 0x90]
mov r8, rsi
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov rcx, r12
call qword [rbx + 0x20]
jmp 0x1401db0df
lea rsi, [rax + 1]
cmp rsi, r13
ja 0x1401db0df
nop dword [rax + rax]
mov rax, rsi
mov ecx, edi
test sil, 1
jne 0x1401db039
nop dword [rax + rax]
shr rax, 1
inc ecx
test al, 1
je 0x1401db030
mov edx, ecx
mov rcx, rbx
call fcn.1401da610
test rax, rax
je 0x1401dafc2
mov rcx, qword [rax]
mov r8, qword [rbx + 0x18]
lea rdx, [rsp + 0x40]
xor qword [rbx + 0x90], rcx
mov rax, qword [rax + 8]
add r12, 0x10
xor qword [rbx + 0x98], rax
mov rcx, qword [r12 - 8]
mov rax, qword [r12 - 0x10]
xor rcx, qword [rbx + 0x98]
xor rax, qword [rbx + 0x90]
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r11, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
xor r11, qword [rbx + 0x90]
xor rax, qword [rbx + 0x98]
inc rsi
xor qword [rbx + 0xa0], r11
xor qword [rbx + 0xa8], rax
mov qword [r14], r11
mov qword [r14 + 8], rax
add r14, 0x10
mov qword [rsp + 0x40], r11
mov qword [rsp + 0x48], rax
cmp rsi, r13
jbe 0x1401db020
and ebp, 0xf
jbe 0x1401db181
mov rax, qword [rbx + 0x38]
mov r8, qword [rbx + 0x10]
lea rcx, [rbx + 0x90]
xor qword [rcx], rax
mov rax, qword [rbx + 0x40]
lea rdx, [rsp + 0x40]
xor qword [rbx + 0x98], rax
call qword [rbx]
test rbp, rbp
je 0x1401db148
lea rax, [rsp + 0x40]
mov r8, r14
sub r12, rax
lea rax, [rsp + 0x40]
sub r8, rax
nop word [rax + rax]
lea rcx, [rsp + rdi + 0x40]
inc rdi
movzx eax, byte [r12 + rcx]
xor al, byte [rcx]
mov byte [r8 + rcx], al
cmp rdi, rbp
jb 0x1401db130
xor eax, eax
lea rcx, [rsp + 0x40]
mov r8, rbp
mov rdx, r14
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
call fcn.1402550b0
mov byte [rsp + rbp + 0x40], 0x80
mov rax, qword [rsp + 0x40]
xor qword [rbx + 0xa0], rax
mov rax, qword [rsp + 0x48]
xor qword [rbx + 0xa8], rax
mov qword [rbx + 0x68], r13
mov eax, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140254f60
add rsp, 0x60
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1401dc620
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
mov eax, 0x50
call fcn.1402563a0
sub rsp, rax
mov rax, qword [0x1403bb2d8]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x60]
mov r15, qword [rbp + 0x68]
mov r12d, r8d
movzx r10d, byte [rax]
movzx r8d, byte [rax + 4]
mov ebx, dword [r15]
lea rdi, [rax + 1]
mov qword [rbp - 0x18], rax
shl r10d, 0x18
movzx eax, byte [rdi]
mov rsi, rcx
movzx ecx, byte [rdi + 5]
shl eax, 0x10
shl r8d, 0x18
shl ecx, 8
or r10d, eax
movzx eax, byte [rdi + 1]
mov r14, rdx
shl eax, 8
lea rdx, [rdi + 5]
xor r13d, r13d
or r10d, eax
movzx eax, byte [rdi + 2]
mov qword [rbp - 0x28], r9
or r10d, eax
movzx eax, byte [rdi + 4]
mov qword [rbp - 0x20], r15
shl eax, 0x10
mov dword [rbp - 0x30], r10d
mov byte [rbp - 0xd], r10b
or r8d, eax
movzx eax, byte [rdx + 1]
or ecx, eax
mov eax, r10d
shr eax, 0x18
or r8d, ecx
mov byte [rbp - 0x10], al
mov eax, r10d
mov dword [rbp - 0x2c], r8d
shr eax, 0x10
mov byte [rbp - 9], r8b
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r8d
shr eax, 8
mov byte [rbp - 0xa], al
test r12d, r12d
je 0x1401dc7e6
mov r15, qword [rbp - 0x28]
sub r14, rsi
movzx edx, r8b
movzx r9d, r10b
nop dword [rax]
dec r12d
test ebx, ebx
jne 0x1401dc783
lea rcx, [rbp - 0x30]
mov rdx, r15
call fcn.1401db3c0
mov r10d, dword [rbp - 0x30]
mov r8d, dword [rbp - 0x2c]
mov eax, r10d
movzx edx, r8b
movzx r9d, r10b
shr eax, 0x18
mov byte [rbp - 0xd], r10b
mov byte [rbp - 9], dl
mov byte [rbp - 0x10], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r8d
shr eax, 8
inc r13d
mov byte [rbp - 0xa], al
movsxd rax, ebx
inc rsi
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [rsi - 1]
inc ebx
mov byte [r14 + rsi - 1], cl
and ebx, 7
test r12d, r12d
jne 0x1401dc720
mov r15, qword [rbp - 0x20]
test r13d, r13d
je 0x1401dc7e6
mov rcx, qword [rbp - 0x18]
mov eax, r10d
shr eax, 0x18
mov byte [rcx], al
mov eax, r10d
shr r10d, 8
shr eax, 0x10
mov byte [rdi], al
mov byte [rdi + 1], r10b
mov byte [rdi + 2], r9b
mov eax, r8d
shr eax, 0x18
mov byte [rdi + 3], al
mov eax, r8d
shr eax, 0x10
shr r8d, 8
mov byte [rdi + 4], al
mov byte [rdi + 5], r8b
mov byte [rdi + 6], dl
mov dword [r15], ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140254f60
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret