joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140059650
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x80
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x1400f2120]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov ebx, r8d
mov rbp, rdx
mov rdi, rcx
mov r14d, 1
test rdx, rdx
jne 0x14005973b
mov qword [rsp + 0x48], SafeArrayLock
mov qword [rsp + 0x40], rdx
mov byte [rsp + 0x30], dl
lea r8d, [rdx + 0x2f]
lea rdx, str._Connector::DoSend__Input_parameters_incorrect_n
lea rcx, [rsp + 0x30]
call fcn.140006800
nop
mov dword [rdi], 0xfffffffd
lea rcx, [rdi + 8]
lea rax, [rsp + 0x30]
cmp rcx, rax
je 0x1400596dc
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x30]
call fcn.140006930
nop
mov rax, qword [rsp + 0x48]
cmp rax, 0x10
jb 0x140059734
inc rax
mov rcx, qword [rsp + 0x30]
cmp rax, 0x1000
jb 0x14005972f
test cl, 0x1f
je 0x140059702
call fcn.140078f8c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140059711
call fcn.140078f8c
int3
sub rcx, rax
cmp rcx, 8
jae 0x140059720
call fcn.140078f8c
int3
cmp rcx, 0x27
jbe 0x14005972c
call fcn.140078f8c
int3
mov rcx, rax
call fcn.14002a780
xor eax, eax
jmp 0x1400598a1
xor esi, esi
xor r9d, r9d
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.WS2_32.dll_send]
mov dword [rsp + 0x20], eax
test eax, eax
jle 0x140059779
sub ebx, eax
je 0x14005989e
add esi, eax
mov edx, esi
add rdx, rbp
xor r9d, r9d
mov r8d, ebx
mov rcx, qword [rdi + 0x30]
call qword [sym.imp.WS2_32.dll_send]
mov dword [rsp + 0x20], eax
test eax, eax
jg 0x140059752
cmp eax, 0xffffffff
jne 0x140059788
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rsp + 0x20], eax
mov rcx, rdi
call fcn.140059020
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x50]
call fcn.140058840
nop
mov r8, rax
lea rdx, str._Connector::DoSend__Send_buffer_failed_:_wsaerror
lea rcx, [rsp + 0x30]
call fcn.14000cee0
nop
mov dword [rdi], 0xfffffffd
lea rcx, [rdi + 8]
cmp rcx, rax
je 0x1400597d4
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
call fcn.140006930
nop
mov rax, qword [rsp + 0x48]
cmp rax, 0x10
jb 0x14005982c
inc rax
mov rcx, qword [rsp + 0x30]
cmp rax, 0x1000
jb 0x140059827
test cl, 0x1f
je 0x1400597fa
call fcn.140078f8c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140059809
call fcn.140078f8c
int3
sub rcx, rax
cmp rcx, 8
jae 0x140059818
call fcn.140078f8c
int3
cmp rcx, 0x27
jbe 0x140059824
call fcn.140078f8c
int3
mov rcx, rax
call fcn.14002a780
mov qword [rsp + 0x48], SafeArrayLock
mov qword [rsp + 0x40], 0
mov byte [rsp + 0x30], 0
mov rax, qword [rsp + 0x68]
cmp rax, 0x10
jb 0x14005989b
inc rax
mov rcx, qword [rsp + 0x50]
cmp rax, 0x1000
jb 0x140059896
test cl, 0x1f
je 0x140059869
call fcn.140078f8c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140059878
call fcn.140078f8c
int3
sub rcx, rax
cmp rcx, 8
jae 0x140059887
call fcn.140078f8c
int3
cmp rcx, 0x27
jbe 0x140059893
call fcn.140078f8c
int3
mov rcx, rax
call fcn.14002a780
xor r14d, r14d
mov eax, r14d
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140057d50
add rsp, 0x80
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14005ba20
Capabilities:
Encode data using xor

Disassembly:
xor r9b, r9b
test r8, r8
je 0x14005ba43
sub rdx, rcx
nop dword [rax + rax]
movzx eax, byte [rdx + rcx]
xor al, byte [rcx]
lea rcx, [rcx + 1]
or r9b, al
sub r8, 1
jne 0x14005ba30
movzx ecx, r9b
mov eax, 0x100
sub eax, ecx
sar eax, 8
ret
Function at 0x140063420
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x30
lea rbp, [rsp + 0x20]
mov qword [rbp + 0x40], rbx
mov qword [rbp + 0x48], rsi
mov qword [rbp + 0x50], rdi
mov rax, qword [0x1400f2120]
xor rax, rbp
mov qword [rbp], rax
movzx edi, word [rcx + 0xe]
mov r12, r9
movzx r13d, word [rcx + 0xc]
mov r14, r8
mov r15, rdx
mov rbx, rcx
lea rax, [rdi + 0xf]
cmp rax, rdi
ja 0x140063475
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.140057e10
sub rsp, rax
lea rsi, [rsp + 0x20]
cmp r14, rdi
ja 0x14006349f
mov rcx, rsi
call fcn.140075800
mov r8, rdi
lea rcx, [rsi + r14]
sub r8, r14
jmp 0x1400634c1
call qword [rcx + reloc.WS2_32.dll_recv]
mov r8, r14
mov rdx, r15
mov rcx, rbx
call qword [rbx + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov rdx, rsi
mov rcx, rbx
call qword [rbx + 0x20]
mov r8, rdi
lea rcx, [rsi + r13]
sub r8, r13
xor edx, edx
call fcn.1400773b0
mov rcx, rdi
mov rax, rsi
test rdi, rdi
je 0x1400634e0
xor byte [rax], 0x36
lea rax, [rax + 1]
sub rcx, 1
jne 0x1400634d3
mov rcx, rbx
call qword [rbx + reloc.WS2_32.dll_recv]
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call qword [rbx + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov r8, qword [rbp + 0x60]
mov rdx, r12
mov rcx, rbx
call qword [rbx + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov rdx, qword [rbp + 0x68]
test rdx, rdx
je 0x140063512
mov r8, qword [rbp + 0x70]
mov rcx, rbx
call qword [rbx + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov r14, qword [rbp + 0x78]
mov rcx, rbx
mov rdx, r14
call qword [rbx + 0x20]
mov rcx, rdi
mov rax, rsi
test rdi, rdi
je 0x14006353d
nop word [rax + rax]
xor byte [rax], 0x6a
lea rax, [rax + 1]
sub rcx, 1
jne 0x140063530
mov rcx, rbx
call qword [rbx + reloc.WS2_32.dll_recv]
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call qword [rbx + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov r8, r13
mov rdx, r14
mov rcx, rbx
call qword [rbx + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov rdx, r14
mov rcx, rbx
call qword [rbx + 0x20]
movzx edx, word [rbx + 0xe]
mov rcx, rsi
call fcn.14005b9d0
mov rcx, qword [rbp]
xor rcx, rbp
call fcn.140057d50
mov rbx, qword [rbp + 0x40]
mov rsi, qword [rbp + 0x48]
mov rdi, qword [rbp + 0x50]
lea rsp, [rbp + 0x10]
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140063620
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
push rbp
push rsi
push r12
push r15
sub rsp, 0x108
mov rax, qword [0x1400f2120]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov r12, qword [rsp + 0x160]
mov r15, r8
mov qword [rsp + 0x48], r9
mov rbp, rdx
mov rsi, rcx
test rcx, rcx
je 0x1400638a5
test rdx, rdx
je 0x1400638a5
test r9, r9
je 0x1400638a5
test r12, r12
je 0x1400638a5
mov qword [r11 - 0x28], rbx
movzx ebx, word [rcx + 0xc]
mov ecx, 0xffffffff
mov eax, ebx
mov qword [r11 - 0x40], r14
mov r14, qword [rsp + 0x168]
imul rax, rcx
cmp r14, rax
jbe 0x1400636d3
mov eax, 0x450a
mov rbx, qword [rsp + 0x100]
mov r14, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.140057d50
add rsp, 0x108
pop r15
pop r12
pop rsi
pop rbp
ret
mov qword [rsp + 0xf0], r13
mov r13d, 1
test r14, r14
je 0x140063875
mov qword [rsp + 0xf8], rdi
nop dword [rax]
nop word [rax + rax]
mov rax, r13
mov byte [rsp + 0x43], r13b
shr rax, 0x18
mov r8, r15
mov byte [rsp + 0x40], al
mov rdx, rbp
mov rax, r13
mov rcx, rsi
shr rax, 0x10
mov byte [rsp + 0x41], al
mov rax, r13
shr rax, 8
inc r13
mov byte [rsp + 0x42], al
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], 4
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x150]
mov qword [rsp + 0x20], rax
call fcn.140063420
mov r8, rbx
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x90]
call fcn.140075800
mov rax, qword [rsp + 0x158]
cmp rax, 1
jbe 0x14006383e
lea rdi, [rax - 1]
xor edx, edx
nop
lea rax, [rsp + 0x90]
mov r8, r15
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x90]
mov qword [rsp + 0x30], rdx
mov rcx, rsi
mov qword [rsp + 0x28], rdx
mov rdx, rbp
mov qword [rsp + 0x20], rbx
call fcn.140063420
xor edx, edx
mov eax, edx
test rbx, rbx
je 0x140063834
cmp rbx, 0x20
jb 0x14006381b
mov rcx, rbx
and rcx, 0xffffffffffffffe0
nop dword [rax + rax]
movdqu xmm0, xmmword [rsp + rax + 0x50]
movdqu xmm1, xmmword [rsp + rax + 0x90]
pxor xmm1, xmm0
movdqu xmmword [rsp + rax + 0x50], xmm1
movdqu xmm0, xmmword [rsp + rax + 0x60]
movdqu xmm1, xmmword [rsp + rax + 0xa0]
pxor xmm1, xmm0
movdqu xmmword [rsp + rax + 0x60], xmm1
add rax, 0x20
cmp rax, rcx
jb 0x1400637e0
cmp rax, rbx
jae 0x140063834
movzx ecx, byte [rsp + rax + 0x90]
xor byte [rsp + rax + 0x50], cl
inc rax
cmp rax, rbx
jb 0x140063820
sub rdi, 1
jne 0x140063790
lea rdx, [rsp + 0x50]
mov rcx, r12
cmp r14, rbx
jb 0x140063865
mov r8, rbx
call fcn.140075800
add r12, rbx
sub r14, rbx
je 0x14006386d
mov r9, qword [rsp + 0x48]
jmp 0x140063700
mov r8, r14
call fcn.140075800
mov rdi, qword [rsp + 0xf8]
mov edx, 0x40
lea rcx, [rsp + 0x50]
call fcn.14005b9d0
mov edx, 0x40
lea rcx, [rsp + 0x90]
call fcn.14005b9d0
mov r13, qword [rsp + 0xf0]
xor eax, eax
jmp 0x1400636a5
mov eax, 0x450b
jmp 0x1400636b5
Function at 0x140066a50
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1400f2120]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
test r8, r8
je 0x140066b1b
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], r14
movzx ecx, byte [rsi + 0x166]
lea r9, [rsp + 0x20]
movzx eax, byte [rsi + 0x167]
lea r8, [rsi + 0x158]
shl cx, 8
mov edx, recv
or cx, ax
inc cx
mov byte [rsi + 0x167], cl
shr cx, 8
mov byte [rsi + 0x166], cl
lea rcx, [rsi + 0x40]
call fcn.140071b10
mov r9b, reloc.WS2_32.dll_recv
cmp rbx, 0x10
jae 0x140066ad6
movzx r9d, bl
test bl, bl
je 0x140066b01
lea r8, [rsp + 0x20]
movzx edx, r9b
sub r8, rdi
mov rax, rdi
nop word [rax + rax]
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x140066af0
movzx eax, r9b
add rdi, rax
sub rbx, rax
jne 0x140066a83
mov r14, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x70]
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
call fcn.14005b9d0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140057d50
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x140066b40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword [0x1400f2120]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbp, rcx
lea rbx, [r8*8]
add rcx, 0x130
mov rdi, r9
mov r14, rdx
call fcn.1400728d0
lea rdx, [rdi*8]
mov byte [rsp + 0x27], bl
mov rax, rbx
mov byte [rsp + 0x2f], dl
shr rax, 0x38
lea rcx, [rbp + 0x130]
mov byte [rsp + 0x20], al
mov rax, rbx
shr rax, 0x30
mov byte [rsp + 0x21], al
mov rax, rbx
shr rax, 0x28
mov byte [rsp + 0x22], al
mov rax, rbx
shr rax, 0x20
mov byte [rsp + 0x23], al
mov rax, rbx
shr rax, 0x18
mov byte [rsp + 0x24], al
mov rax, rbx
shr rax, 0x10
mov byte [rsp + 0x25], al
mov rax, rbx
shr rax, 8
mov ebx, reloc.WS2_32.dll_recv
mov byte [rsp + 0x26], al
mov r8d, ebx
mov rax, rdx
shr rax, 0x38
mov byte [rsp + 0x28], al
mov rax, rdx
shr rax, 0x30
mov byte [rsp + 0x29], al
mov rax, rdx
shr rax, 0x28
mov byte [rsp + 0x2a], al
mov rax, rdx
shr rax, 0x20
mov byte [rsp + 0x2b], al
mov rax, rdx
shr rax, 0x18
mov byte [rsp + 0x2c], al
mov rax, rdx
shr rax, 0x10
mov byte [rsp + 0x2d], al
mov rax, rdx
shr rax, 8
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x2e], al
call fcn.140072930
lea rax, [rbp + 0x140]
sub rbp, rax
sub r14, rax
nop
movzx ecx, byte [rax + rbp + 0x168]
xor cl, byte [rax]
mov byte [r14 + rax], cl
lea rax, [rax + 1]
sub rbx, 1
jne 0x140066c50
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140057d50
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x140066e20
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rdx
mov qword [rsp + 0x50], 0
mov r8, rdx
mov rdi, rcx
xor edx, edx
call fcn.1400773b0
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000040
xor r8d, r8d
lea rcx, [rsp + 0x50]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x140066e8d
mov rcx, qword [rsp + 0x50]
mov r8, rdi
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rcx, qword [rsp + 0x50]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov ecx, 2
call fcn.1400795a4
mov rcx, rax
lea rdx, [0x1400aac88]
call fcn.1400651c0
mov ecx, 1
call fcn.14008b048
int3
Function at 0x14006db40
Capabilities:
Encrypt data using curve25519

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0xf0]
sub rsp, 0x1f0
mov rax, qword [0x1400f2120]
xor rax, rsp
mov qword [rbp + 0xe0], rax
movups xmm2, xmmword [rdx]
mov rbx, rcx
lea rcx, [rsp + 0x20]
movups xmm0, xmmword [rdx + 0x10]
mov rdx, r8
movd eax, xmm2
movups xmmword [rbp + 0xd0], xmm0
and al, 0xf8
psrldq xmm0, 0xf
movups xmmword [rbp + 0xc0], xmm2
mov byte [rbp + 0xc0], al
movd eax, xmm0
and al, 0x3f
or al, 0x40
mov byte [rbp + 0xdf], al
call fcn.14006e120
lea r9, [rsp + 0x20]
lea r8, [rbp + 0xc0]
lea rcx, [rsp + 0x70]
lea rdx, [rbp + 0x60]
call fcn.14006c0f0
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.14006c3e0
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x40]
call fcn.14006ed20
imul rax, qword [rbp + 0x48], 0x13
imul r8, qword [rbp + 0x50], 0x13
add qword [rbp - 8], rax
mov r9d, 5
imul rax, qword [rbp + 0x40], 0x13
add qword [rbp], r8
add qword [rbp - 0x10], rax
imul rax, qword [rbp + 0x38], 0x13
add qword [rbp - 0x18], rax
imul rax, qword [rbp + 0x30], 0x13
add qword [rbp - 0x20], rax
imul rax, qword [rbp + 0x28], 0x13
add qword [rbp - 0x28], rax
imul rax, qword [rbp + 0x20], 0x13
add qword [rbp - 0x30], rax
imul rax, qword [rbp + 0x18], 0x13
add qword [rbp - 0x38], rax
imul rax, qword [rbp + 0x10], 0x13
mov qword [rbp + 0x10], 0
add qword [rbp - 0x40], rax
lea rax, [rbp - 0x30]
nop dword [rax + rax]
mov r8, qword [rax - 0x10]
lea rax, [rax + 0x10]
mov rdx, r8
shr rdx, 0x20
sar edx, 0x1f
shr rdx, 6
add rdx, r8
sar rdx, 0x1a
mov rcx, rdx
shl rcx, 0x1a
sub r8, rcx
mov qword [rax - 0x20], r8
mov r8, qword [rax - 0x18]
add r8, rdx
mov rdx, r8
shr rdx, 0x20
sar edx, 0x1f
shr rdx, 7
add rdx, r8
sar rdx, 0x19
add qword [rax - 0x10], rdx
mov rcx, rdx
shl rcx, 0x19
sub r8, rcx
mov qword [rax - 0x18], r8
sub r9, 1
jne 0x14006dc50
imul rcx, qword [rbp + 0x10], 0x13
movaps xmm1, xmmword [rbp - 0x30]
movaps xmmword [rbp + 0x70], xmm1
movaps xmm1, xmmword [rbp - 0x10]
movaps xmmword [rbp + 0x90], xmm1
add rcx, qword [rbp - 0x40]
mov rdx, rcx
shr rdx, 0x20
sar edx, 0x1f
shr rdx, 6
add rdx, rcx
sar rdx, 0x1a
add qword [rbp - 0x38], rdx
mov rax, rdx
shl rax, 0x1a
lea rdx, [rbp + 0x60]
sub rcx, rax
mov qword [rbp - 0x40], rcx
mov rcx, rbx
movaps xmm0, xmmword [rbp - 0x40]
movaps xmmword [rbp + 0x60], xmm0
movaps xmm0, xmmword [rbp - 0x20]
movaps xmmword [rbp + 0x80], xmm0
movaps xmm0, xmmword [rbp]
movaps xmmword [rbp + 0xa0], xmm0
call fcn.14006dd40
xor eax, eax
mov rcx, qword [rbp + 0xe0]
xor rcx, rsp
call fcn.140057d50
mov rbx, qword [rsp + 0x208]
add rsp, 0x1f0
pop rbp
ret
Function at 0x140071270
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x1400f2120]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, qword [rsp + 0xa0]
mov rbp, rdx
mov edx, r8d
mov r14d, r8d
mov rdi, r9
mov r13, rcx
call fcn.1400711c0
mov ecx, r14d
call fcn.140099e34
mov ecx, dword [r13 + 4]
mov rsi, rax
inc ecx
shl ecx, 4
call fcn.140099e34
mov r8, rax
mov rdx, rdi
mov rcx, r13
mov r15, rax
call fcn.140071790
movups xmm0, xmmword [rbx]
xor edi, edi
movups xmmword [rsp + 0x30], xmm0
test r14d, r14d
je 0x14007139e
mov rbx, rbp
sub rbx, rsi
nop dword [rax]
nop dword [rax + rax]
mov r9, r15
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
mov rcx, r13
call fcn.1400713d0
mov edx, edi
lea r8, [rsp + 0x20]
neg rdx
mov r11d, edi
mov rcx, rdx
lea rax, [rsi + 1]
sub rcx, rsi
lea r9, [rsp + 0x21]
add r8, rcx
lea r10, [rsp + 0x22]
mov rcx, rdx
add rax, r11
sub rcx, rsi
sub rdx, rsi
add r9, rcx
add r10, rdx
mov edx, 4
movzx ecx, byte [rbx + rax - 1]
xor cl, byte [r8 + rax - 1]
mov byte [rax - 1], cl
movzx ecx, byte [rbx + rax]
xor cl, byte [r8 + rax]
mov byte [rax], cl
movzx ecx, byte [rbx + rax + 1]
xor cl, byte [r9 + rax]
mov byte [rax + 1], cl
movzx ecx, byte [rbx + rax + 2]
xor cl, byte [r10 + rax]
mov byte [rax + 2], cl
lea rax, [rax + 4]
sub rdx, 1
jne 0x140071350
movups xmm0, xmmword [rdi + rbp]
add edi, 0x10
movups xmmword [rsp + 0x30], xmm0
cmp edi, r14d
jb 0x140071300
mov rcx, r15
call fcn.1400579d4
mov rax, rsi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140057d50
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
Function at 0x140071790
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
sub rsp, 0x18
mov eax, dword [rcx]
mov r10, r8
shl eax, 2
xor r8d, r8d
mov r11, rcx
test eax, eax
je 0x1400717c6
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [r8 + r10], al
inc r8d
mov eax, dword [rcx]
shl eax, 2
cmp r8d, eax
jb 0x1400717b0
mov eax, dword [rcx + 4]
mov r9d, dword [rcx]
inc eax
shl eax, 4
shl r9d, 2
cmp r9d, eax
jae 0x1400719dc
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x30], rsi
lea esi, [r9 + 2]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x10], r12
lea r12, str.cw
mov qword [rsp + 8], r14
mov qword [rsp], r15
nop dword [rax + rax]
mov edi, dword [r11]
lea eax, [r9 - 4]
movzx ebx, byte [rax + r10]
xor edx, edx
lea eax, [r9 - 3]
movzx ebp, byte [rax + r10]
lea eax, [r9 - 2]
movzx r14d, byte [rax + r10]
lea eax, [r9 - 1]
movzx r15d, byte [rax + r10]
mov eax, r9d
shr eax, 2
div edi
test edx, edx
jne 0x1400718da
movzx eax, bpl
lea r8d, [rdi*4]
mov ecx, eax
movzx edx, bl
and rcx, 0xfffffffffffffff0
and eax, 0xf
add rcx, rax
movzx eax, r14b
movzx ebx, byte [rcx + r12]
mov ecx, eax
and rcx, 0xfffffffffffffff0
and eax, 0xf
add rcx, rax
movzx eax, r15b
movzx ebp, byte [rcx + r12]
mov ecx, eax
and rcx, 0xfffffffffffffff0
and eax, 0xf
add rcx, rax
mov eax, edx
and eax, 0xf
movzx r14d, byte [rcx + r12]
mov ecx, edx
and rcx, 0xfffffffffffffff0
xor edx, edx
add rcx, rax
mov eax, r9d
div r8d
movzx r15d, byte [rcx + r12]
mov cl, 1
sub eax, 1
je 0x1400718d6
mov r8d, eax
nop dword [rax + rax]
movzx eax, cl
add cl, cl
shr al, 7
movzx eax, al
imul edx, eax, 0x1b
xor cl, dl
sub r8, 1
jne 0x1400718c0
xor bl, cl
jmp 0x140071937
cmp edi, 6
jbe 0x140071937
cmp edx, 4
jne 0x140071937
movzx eax, bl
mov ecx, eax
and eax, 0xf
and rcx, 0xfffffffffffffff0
add rcx, rax
movzx eax, bpl
movzx ebx, byte [rcx + r12]
mov ecx, eax
and rcx, 0xfffffffffffffff0
and eax, 0xf
add rcx, rax
movzx eax, r14b
movzx ebp, byte [rcx + r12]
mov ecx, eax
and rcx, 0xfffffffffffffff0
and eax, 0xf
add rcx, rax
movzx eax, r15b
movzx r14d, byte [rcx + r12]
mov ecx, eax
and rcx, 0xfffffffffffffff0
and eax, 0xf
add rcx, rax
movzx r15d, byte [rcx + r12]
mov ecx, r9d
lea eax, [rdi*4]
sub ecx, eax
movzx ecx, byte [rcx + r10]
xor cl, bl
mov byte [r9 + r10], cl
mov ecx, r9d
mov eax, dword [r11]
shl eax, 2
sub ecx, eax
lea eax, [rsi - 1]
inc ecx
movzx edx, byte [rcx + r10]
mov ecx, r9d
xor dl, bpl
mov byte [rax + r10], dl
mov eax, dword [r11]
shl eax, 2
sub ecx, eax
add ecx, 2
movzx ecx, byte [rcx + r10]
xor cl, r14b
mov byte [rsi + r10], cl
mov ecx, r9d
mov eax, dword [r11]
add r9d, 4
shl eax, 2
sub ecx, eax
lea eax, [rsi + 1]
add ecx, 3
add esi, 4
movzx edx, byte [rcx + r10]
xor dl, r15b
mov byte [rax + r10], dl
mov eax, dword [r11 + 4]
inc eax
shl eax, 4
cmp r9d, eax
jb 0x140071810
mov r15, qword [rsp]
mov r14, qword [rsp + 8]
mov r12, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
add rsp, 0x18
ret
Function at 0x140072600
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
push r15
mov rax, qword [rdx]
xor ebx, ebx
mov r9, qword [rdx + 8]
mov r14, rcx
mov edi, ebx
mov rsi, rcx
movabs r15, 0xe100000000000000
lea ebp, [rbx + 0x10]
nop word [rax + rax]
movzx r10d, byte [rsi]
mov r11d, 8
nop word [rax + rax]
mov r8, r9
movzx edx, r10b
shr rdx, 7
and r8d, 1
not rdx
not r8
inc rdx
inc r8
mov rcx, rdx
and r8, r15
and rdx, r9
and rcx, rax
xor rdi, rdx
xor rbx, rcx
mov rdx, rax
mov rcx, r9
shl rdx, 0x3f
add r10b, r10b
shr rcx, 1
mov r9, rdx
shr rax, 1
or r9, rcx
xor rax, r8
sub r11, 1
jne 0x140072650
inc rsi
sub rbp, 1
jne 0x140072640
mov rbp, qword [rsp + 0x20]
mov rcx, rbx
mov rsi, qword [rsp + 0x28]
and ecx, 0xff00
mov rdx, rbx
mov rax, rbx
shr rax, 0x10
movabs r11, 0xff000000000000
and rdx, r11
movabs r10, 0xff0000000000
or rdx, rax
movabs r9, 0xff00000000
shr rdx, 0x10
mov rax, rbx
and rax, r10
mov r8d, 0xff000000
or rdx, rax
mov rax, rbx
and rax, r9
shr rdx, 0x10
or rdx, rax
mov rax, rbx
shl rax, 0x10
or rcx, rax
shr rdx, 8
shl rcx, 0x10
mov rax, rbx
and eax, 0xff0000
and rbx, r8
or rcx, rax
mov rax, rdi
shl rcx, 0x10
or rcx, rbx
shr rax, 0x10
mov rbx, qword [rsp + 0x18]
shl rcx, 8
or rdx, rcx
mov rcx, rdi
mov qword [r14], rdx
and ecx, 0xff00
mov rdx, rdi
and rdx, r11
or rdx, rax
mov rax, rdi
and rax, r10
shr rdx, 0x10
or rdx, rax
mov rax, rdi
and rax, r9
shr rdx, 0x10
or rdx, rax
mov rax, rdi
shl rax, 0x10
or rcx, rax
shr rdx, 8
shl rcx, 0x10
mov rax, rdi
and rdi, r8
and eax, 0xff0000
or rcx, rax
shl rcx, 0x10
or rcx, rdi
mov rdi, qword [rsp + 0x30]
shl rcx, 8
or rdx, rcx
mov qword [r14 + 8], rdx
pop r15
pop r14
ret
Function at 0x140072930
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x140072b84
push r12
push r14
push r15
sub rsp, 0x10
mov qword [rsp + 0x30], rbx
mov r15, r8
mov qword [rsp + 0x38], rbp
mov r12, rdx
mov qword [rsp + 0x40], rsi
mov r14, rcx
mov qword [rsp + 8], rdi
mov qword [rsp], r13
nop dword [rax]
nop dword [rax + rax]
mov eax, reloc.WS2_32.dll_recv
sub al, byte [r14 + 0x20]
movzx ecx, al
cmp rcx, r15
movzx r9d, al
movzx eax, r15b
lea rcx, [r14 + 0x10]
cmova r9d, eax
movzx eax, byte [r14 + 0x20]
add rcx, rax
test r9b, r9b
je 0x1400729c1
mov r8, r12
movzx edx, r9b
sub r8, rcx
nop word [rax + rax]
movzx eax, byte [r8 + rcx]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x1400729b0
add byte [r14 + 0x20], r9b
movzx eax, r9b
sub r15, rax
add r12, rax
cmp byte [r14 + 0x20], 0x10
jne 0x140072b59
mov rax, qword [r14]
lea rsi, [r14 + 0x10]
mov r9, qword [r14 + 8]
xor ebx, ebx
xor edi, edi
movabs r13, 0xe100000000000000
lea ebp, [rbx + 0x10]
nop word [rax + rax]
movzx r10d, byte [rsi]
mov r11d, 8
nop word [rax + rax]
mov r8, r9
movzx edx, r10b
shr rdx, 7
and r8d, 1
not rdx
not r8
inc rdx
inc r8
mov rcx, rdx
and r8, r13
and rdx, r9
and rcx, rax
xor rdi, rdx
xor rbx, rcx
mov rdx, rax
mov rcx, r9
shl rdx, 0x3f
add r10b, r10b
shr rcx, 1
mov r9, rdx
shr rax, 1
or r9, rcx
xor rax, r8
sub r11, 1
jne 0x140072a10
inc rsi
sub rbp, 1
jne 0x140072a00
mov rcx, rbx
mov rdx, rbx
and ecx, 0xff00
movabs r8, 0xff000000000000
and rdx, r8
mov rax, rbx
shr rax, 0x10
movabs r10, 0xff0000000000
or rdx, rax
movabs r11, 0xff00000000
shr rdx, 0x10
mov rax, rbx
and rax, r10
mov esi, 0xff000000
or rdx, rax
mov rax, rbx
and rax, r11
shr rdx, 0x10
or rdx, rax
mov rax, rbx
shl rax, 0x10
or rcx, rax
shr rdx, 8
shl rcx, 0x10
mov rax, rbx
and eax, 0xff0000
and rbx, rsi
or rcx, rax
mov rax, rdi
shl rcx, 0x10
or rcx, rbx
shr rax, 0x10
shl rcx, 8
or rdx, rcx
mov rcx, rdi
mov qword [r14 + 0x10], rdx
and ecx, 0xff00
mov rdx, rdi
and rdx, r8
or rdx, rax
mov rax, rdi
and rax, r10
shr rdx, 0x10
or rdx, rax
mov rax, rdi
and rax, r11
shr rdx, 0x10
or rdx, rax
mov rax, rdi
shl rax, 0x10
or rcx, rax
shr rdx, 8
shl rcx, 0x10
mov rax, rdi
and eax, 0xff0000
and rdi, rsi
or rcx, rax
shl rcx, 0x10
or rcx, rdi
shl rcx, 8
or rdx, rcx
mov qword [r14 + 0x18], rdx
mov byte [r14 + 0x20], bpl
test r15, r15
jne 0x140072970
mov r13, qword [rsp]
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x10
pop r15
pop r14
pop r12
ret