joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400394c0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r13
push r14
push r15
sub rsp, 0x20
mov edi, 4
xor esi, esi
mov ebx, edi
mov r14d, esi
mov r15, rdx
mov r13, rcx
mov rcx, qword [r13 + 8]
xor r9d, r9d
movsxd rdx, r14d
mov r8d, ebx
add rdx, r15
call qword [sym.imp.WS2_32.dll_send]
mov ebp, eax
test eax, eax
jg 0x14003953d
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x140039542
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r13
ret
add r14d, ebp
sub ebx, ebp
test ebx, ebx
jne 0x1400394f0
test ebp, ebp
jle 0x140039519
mov ebp, esi
nop dword [rax]
mov rcx, qword [r13 + 8]
xor r9d, r9d
movsxd rdx, ebp
mov r8d, edi
add rdx, 4
add rdx, r15
call qword [sym.imp.WS2_32.dll_send]
mov ebx, eax
test eax, eax
jg 0x14003957f
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x140039519
jmp 0x140039583
add ebp, ebx
sub edi, ebx
test edi, edi
jne 0x140039550
test ebx, ebx
jle 0x140039519
mov ebx, dword [r15 + 0x10]
mov edi, esi
mov rbp, qword [r15 + 8]
sub ebx, dword [r15 + 8]
je 0x1400395d7
nop dword [rax + rax]
mov rcx, qword [r13 + 8]
xor r9d, r9d
movsxd rdx, edi
mov r8d, ebx
add rdx, rbp
call qword [sym.imp.WS2_32.dll_send]
mov esi, eax
test eax, eax
jg 0x1400395cf
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x140039519
jmp 0x1400395d3
add edi, eax
sub ebx, eax
test ebx, ebx
jne 0x1400395a0
test esi, esi
jle 0x140039519
mov eax, dword [r15]
jmp 0x14003951e
Function at 0x1400395f0
Capabilities:
Connect socket
Resolve dns
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x1401fd600]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rdi, rcx
mov edx, 1
lea r8d, [rdx + 5]
mov ebx, 2
mov ecx, ebx
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rdi + 8], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
mov dword [rsp + 0x54], ebx
mov dword [rsp + 0x58], 1
mov word [rsp + 0x30], bx
mov dword [rsp + 0x34], 0xf24be1b9
movdqa xmm0, xmmword [0x1401dce60]
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov edx, 0x448
mov eax, dword [rdx + rcx]
mov ebx, 0x508
add rbx, rcx
test al, 1
jne 0x1400396b6
or eax, 1
mov dword [rdx + rcx], eax
mov byte [rbx + 0x10], 1
lea rax, [rbx + 0xf]
lea rcx, [rsp + 0x4f]
cmp rbx, rcx
ja 0x1400396a6
lea rcx, [rsp + 0x40]
cmp rax, rcx
jb 0x1400396a6
movups xmmword [rbx], xmm0
jmp 0x1400396a9
movups xmmword [rbx], xmm0
lea rcx, [0x14018deb0]
call fcn.14015b9c0
nop
cmp byte [rbx + 0x10], 0
je 0x1400396ff
xor byte [rbx], 0xa3
xor byte [rbx + 1], 0x5b
xor byte [rbx + 2], 0x8f
xor byte [rbx + 3], 5
xor byte [rbx + 4], 0xc9
xor byte [rbx + 5], 0x8b
xor byte [rbx + 6], 0x7d
xor byte [rbx + 7], 0xcb
xor byte [rbx + 8], 0xa3
xor byte [rbx + 9], 0x5b
xor byte [rbx + 0xa], 0x8f
xor byte [rbx + 0xb], 5
xor byte [rbx + 0xc], 0xc9
xor byte [rbx + 0xd], 0x8b
xor byte [rbx + 0xe], 0x7d
xor byte [rbx + 0xf], 0xcb
mov byte [rbx + 0x10], 0
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x50]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x140039748
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x140039748
mov rax, rcx
test byte [rax + 4], 2
jne 0x140039736
mov rax, qword [rax + 0x28]
test rax, rax
jne 0x140039725
jmp 0x140039742
mov rax, qword [rcx + 0x20]
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov eax, 0x7a53
mov word [rsp + 0x32], ax
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x30]
mov rcx, qword [rdi + 8]
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
jns 0x14003976f
xor al, al
jmp 0x14003978d
mov dword [rsp + 0x28], 1
lea r8, [rsp + 0x28]
mov edx, 0x8004667e
mov rcx, qword [rdi + 8]
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov al, 1
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14015b500
mov rbx, qword [rsp + 0xa8]
add rsp, 0x90
pop rdi
ret
Function at 0x14003f660
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
cmp byte [rcx + 0x4c], 0
mov rbp, rcx
je 0x14003f862
mov qword [rsp + 0x58], rbx
lea rax, [rcx + 2]
mov qword [rsp + 0x28], rsi
mov rdx, 0xfffffffffffffffb
mov qword [rsp + 0x20], rdi
sub rdx, rcx
mov qword [rsp + 0x18], r12
mov r8, 0xfffffffffffffffc
mov qword [rsp + 0x10], r13
sub r8, rcx
mov qword [rsp + 8], r14
mov r13, 0xfffffffffffffffa
sub r13, rcx
mov qword [rsp], r15
mov r15, rcx
mov qword [rsp + 0x48], rdx
mov r12d, 1
mov qword [rsp + 0x50], r8
sub r12, rcx
mov r14, 0xfffffffffffffffe
mov rcx, 0xfffffffffffffffd
not r15
sub rcx, rbp
movabs r9, 0xdff77dcf6f49fdeb
mov qword [rsp + 0x40], rcx
sub r14, rbp
nop dword [rax]
nop word [rax + rax]
lea ecx, [r14 + rax]
mov rsi, r9
and cl, 7
mov rdi, r9
shl cl, 3
mov rbx, r9
shr rsi, cl
mov r11, r9
xor byte [rax - 2], sil
lea ecx, [rax + r15]
xor byte [rax + 6], sil
and cl, 7
xor byte [rax + 0xe], sil
mov r10, r9
xor byte [rax + 0x16], sil
xor byte [rax + 0x1e], sil
shl cl, 3
shr rdi, cl
movzx ecx, al
xor byte [rax - 1], dil
sub cl, bpl
xor byte [rax + 7], dil
and cl, 7
xor byte [rax + 0xf], dil
xor byte [rax + 0x17], dil
xor byte [rax + 0x1f], dil
shl cl, 3
shr rbx, cl
lea ecx, [r12 + rax]
xor byte [rax], bl
and cl, 7
xor byte [rax + 8], bl
xor byte [rax + 0x10], bl
xor byte [rax + 0x18], bl
xor byte [rax + 0x20], bl
shl cl, 3
shr r11, cl
lea ecx, [rax + r13]
xor byte [rax + 1], r11b
and cl, 7
xor byte [rax + 9], r11b
xor byte [rax + 0x11], r11b
xor byte [rax + 0x19], r11b
xor byte [rax + 0x21], r11b
shl cl, 3
shr r10, cl
lea ecx, [rdx + rax]
xor byte [rax + 2], r10b
and cl, 7
xor byte [rax + 0xa], r10b
movabs rdx, 0xdff77dcf6f49fdeb
xor byte [rax + 0x12], r10b
xor byte [rax + 0x1a], r10b
xor byte [rax + 0x22], r10b
shl cl, 3
shr r9, cl
lea ecx, [r8 + rax]
xor byte [rax + 3], r9b
and cl, 7
xor byte [rax + 0xb], r9b
mov r8, rdx
xor byte [rax + 0x13], r9b
xor byte [rax + 0x1b], r9b
xor byte [rax + 0x23], r9b
shl cl, 3
shr r8, cl
movzx ecx, al
add cl, byte [rsp + 0x40]
xor byte [rax + 4], r8b
and cl, 7
xor byte [rax + 0xc], r8b
xor byte [rax + 0x14], r8b
xor byte [rax + 0x1c], r8b
shl cl, 3
shr rdx, cl
xor byte [rax + 5], dl
xor byte [rax + 0xd], dl
xor byte [rax + 0x15], dl
xor byte [rax + 0x1d], dl
add rax, 0x26
lea rcx, [rax + r14]
mov rdx, qword [rsp + 0x48]
movabs r9, 0xdff77dcf6f49fdeb
mov r8, qword [rsp + 0x50]
cmp rcx, 0x4c
jb 0x14003f700
mov r15, qword [rsp]
mov r14, qword [rsp + 8]
mov r13, qword [rsp + 0x10]
mov r12, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x58]
mov byte [rbp + 0x4c], 0
add rsp, 0x30
pop rbp
ret
Function at 0x14005dbd0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
cmp byte [rcx + 0x46], 0
mov rbp, rcx
je 0x14005ddc6
mov qword [rsp + 0x58], rbx
lea rax, [rcx + 2]
mov qword [rsp + 0x28], rsi
mov rdx, 0xfffffffffffffffb
mov qword [rsp + 0x20], rdi
sub rdx, rcx
mov qword [rsp + 0x18], r12
mov r8, 0xfffffffffffffffc
mov qword [rsp + 0x10], r13
sub r8, rcx
mov qword [rsp + 8], r14
mov r13, 0xfffffffffffffffa
sub r13, rcx
mov qword [rsp], r15
mov r15, rcx
mov qword [rsp + 0x48], rdx
mov r12d, 1
mov qword [rsp + 0x50], r8
sub r12, rcx
mov r14, 0xfffffffffffffffe
mov rcx, 0xfffffffffffffffd
not r15
sub rcx, rbp
movabs r9, 0x4fb7d5f3ab95cfbf
mov qword [rsp + 0x40], rcx
sub r14, rbp
nop dword [rax]
nop word [rax + rax]
lea ecx, [rax + r14]
mov rsi, r9
and cl, 7
mov rdi, r9
shl cl, 3
mov rbx, r9
shr rsi, cl
mov r11, r9
xor byte [rax - 2], sil
lea ecx, [rax + r15]
xor byte [rax + 6], sil
and cl, 7
xor byte [rax + 0xe], sil
mov r10, r9
xor byte [rax + 0x16], sil
xor byte [rax + 0x1e], sil
shl cl, 3
shr rdi, cl
movzx ecx, al
xor byte [rax - 1], dil
sub cl, bpl
xor byte [rax + 7], dil
and cl, 7
xor byte [rax + 0xf], dil
xor byte [rax + 0x17], dil
xor byte [rax + 0x1f], dil
shl cl, 3
shr rbx, cl
lea ecx, [rax + r12]
xor byte [rax], bl
and cl, 7
xor byte [rax + 8], bl
xor byte [rax + 0x10], bl
xor byte [rax + 0x18], bl
xor byte [rax + 0x20], bl
shl cl, 3
shr r11, cl
lea ecx, [rax + r13]
xor byte [rax + 1], r11b
and cl, 7
xor byte [rax + 9], r11b
xor byte [rax + 0x11], r11b
xor byte [rax + 0x19], r11b
shl cl, 3
shr r10, cl
lea ecx, [rax + rdx]
xor byte [rax + 2], r10b
and cl, 7
xor byte [rax + 0xa], r10b
movabs rdx, 0x4fb7d5f3ab95cfbf
xor byte [rax + 0x12], r10b
xor byte [rax + 0x1a], r10b
shl cl, 3
shr r9, cl
lea ecx, [rax + r8]
xor byte [rax + 3], r9b
and cl, 7
xor byte [rax + 0xb], r9b
mov r8, rdx
xor byte [rax + 0x13], r9b
xor byte [rax + 0x1b], r9b
shl cl, 3
shr r8, cl
xor byte [rax + 4], r8b
xor byte [rax + 0xc], r8b
xor byte [rax + 0x14], r8b
xor byte [rax + 0x1c], r8b
movzx ecx, byte [rsp + 0x40]
mov r8, qword [rsp + 0x50]
add cl, al
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [rax + 5], dl
xor byte [rax + 0xd], dl
xor byte [rax + 0x15], dl
xor byte [rax + 0x1d], dl
add rax, 0x23
mov rdx, qword [rsp + 0x48]
lea rcx, [r14 + rax]
cmp rcx, 0x46
movabs r9, 0x4fb7d5f3ab95cfbf
jb 0x14005dc70
mov r15, qword [rsp]
mov r14, qword [rsp + 8]
mov r13, qword [rsp + 0x10]
mov r12, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x58]
mov byte [rbp + 0x46], 0
add rsp, 0x30
pop rbp
ret
Function at 0x14006ba60
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
cmp byte [rcx + 0x4c], 0
mov rbp, rcx
je 0x14006bc62
mov qword [rsp + 0x58], rbx
lea rax, [rcx + 2]
mov qword [rsp + 0x28], rsi
mov rdx, 0xfffffffffffffffb
mov qword [rsp + 0x20], rdi
sub rdx, rcx
mov qword [rsp + 0x18], r12
mov r8, 0xfffffffffffffffc
mov qword [rsp + 0x10], r13
sub r8, rcx
mov qword [rsp + 8], r14
mov r13, 0xfffffffffffffffa
sub r13, rcx
mov qword [rsp], r15
mov r15, rcx
mov qword [rsp + 0x48], rdx
mov r12d, 1
mov qword [rsp + 0x50], r8
sub r12, rcx
mov r14, 0xfffffffffffffffe
mov rcx, 0xfffffffffffffffd
not r15
sub rcx, rbp
movabs r9, 0x3e385e97fd57d6d
mov qword [rsp + 0x40], rcx
sub r14, rbp
nop dword [rax]
nop word [rax + rax]
lea ecx, [r14 + rax]
mov rsi, r9
and cl, 7
mov rdi, r9
shl cl, 3
mov rbx, r9
shr rsi, cl
mov r11, r9
xor byte [rax - 2], sil
lea ecx, [rax + r15]
xor byte [rax + 6], sil
and cl, 7
xor byte [rax + 0xe], sil
mov r10, r9
xor byte [rax + 0x16], sil
xor byte [rax + 0x1e], sil
shl cl, 3
shr rdi, cl
movzx ecx, al
xor byte [rax - 1], dil
sub cl, bpl
xor byte [rax + 7], dil
and cl, 7
xor byte [rax + 0xf], dil
xor byte [rax + 0x17], dil
xor byte [rax + 0x1f], dil
shl cl, 3
shr rbx, cl
lea ecx, [r12 + rax]
xor byte [rax], bl
and cl, 7
xor byte [rax + 8], bl
xor byte [rax + 0x10], bl
xor byte [rax + 0x18], bl
xor byte [rax + 0x20], bl
shl cl, 3
shr r11, cl
lea ecx, [rax + r13]
xor byte [rax + 1], r11b
and cl, 7
xor byte [rax + 9], r11b
xor byte [rax + 0x11], r11b
xor byte [rax + 0x19], r11b
xor byte [rax + 0x21], r11b
shl cl, 3
shr r10, cl
lea ecx, [rdx + rax]
xor byte [rax + 2], r10b
and cl, 7
xor byte [rax + 0xa], r10b
movabs rdx, 0x3e385e97fd57d6d
xor byte [rax + 0x12], r10b
xor byte [rax + 0x1a], r10b
xor byte [rax + 0x22], r10b
shl cl, 3
shr r9, cl
lea ecx, [r8 + rax]
xor byte [rax + 3], r9b
and cl, 7
xor byte [rax + 0xb], r9b
mov r8, rdx
xor byte [rax + 0x13], r9b
xor byte [rax + 0x1b], r9b
xor byte [rax + 0x23], r9b
shl cl, 3
shr r8, cl
movzx ecx, al
add cl, byte [rsp + 0x40]
xor byte [rax + 4], r8b
and cl, 7
xor byte [rax + 0xc], r8b
xor byte [rax + 0x14], r8b
xor byte [rax + 0x1c], r8b
shl cl, 3
shr rdx, cl
xor byte [rax + 5], dl
xor byte [rax + 0xd], dl
xor byte [rax + 0x15], dl
xor byte [rax + 0x1d], dl
add rax, 0x26
lea rcx, [rax + r14]
mov rdx, qword [rsp + 0x48]
movabs r9, 0x3e385e97fd57d6d
mov r8, qword [rsp + 0x50]
cmp rcx, 0x4c
jb 0x14006bb00
mov r15, qword [rsp]
mov r14, qword [rsp + 8]
mov r13, qword [rsp + 0x10]
mov r12, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x58]
mov byte [rbp + 0x4c], 0
add rsp, 0x30
pop rbp
ret
Function at 0x14006bd50
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
cmp byte [rcx + 0x5d], 0
mov rbp, rcx
je 0x14006bf38
mov qword [rsp + 0x58], rbx
lea rax, [rcx + 2]
mov qword [rsp + 0x28], rsi
mov rdx, 0xfffffffffffffffb
mov qword [rsp + 0x20], rdi
sub rdx, rcx
mov qword [rsp + 0x18], r12
mov r8, 0xfffffffffffffffc
mov qword [rsp + 0x10], r13
sub r8, rcx
mov qword [rsp + 8], r14
mov r13, 0xfffffffffffffffa
sub r13, rcx
mov qword [rsp], r15
mov r15, rcx
mov qword [rsp + 0x48], rdx
mov r12d, 1
mov qword [rsp + 0x50], r8
sub r12, rcx
mov r14, 0xfffffffffffffffe
mov rcx, 0xfffffffffffffffd
not r15
sub rcx, rbp
movabs r9, 0xc13963014d37c5d1
mov qword [rsp + 0x40], rcx
sub r14, rbp
nop dword [rax]
nop word [rax + rax]
lea ecx, [r14 + rax]
mov rsi, r9
and cl, 7
mov rdi, r9
shl cl, 3
mov rbx, r9
shr rsi, cl
mov r11, r9
xor byte [rax - 2], sil
lea ecx, [rax + r15]
xor byte [rax + 6], sil
and cl, 7
xor byte [rax + 0xe], sil
mov r10, r9
xor byte [rax + 0x16], sil
shl cl, 3
shr rdi, cl
movzx ecx, al
xor byte [rax - 1], dil
sub cl, bpl
xor byte [rax + 7], dil
and cl, 7
xor byte [rax + 0xf], dil
xor byte [rax + 0x17], dil
shl cl, 3
shr rbx, cl
lea ecx, [r12 + rax]
xor byte [rax], bl
and cl, 7
xor byte [rax + 8], bl
xor byte [rax + 0x10], bl
xor byte [rax + 0x18], bl
shl cl, 3
shr r11, cl
lea ecx, [rax + r13]
xor byte [rax + 1], r11b
and cl, 7
xor byte [rax + 9], r11b
xor byte [rax + 0x11], r11b
xor byte [rax + 0x19], r11b
shl cl, 3
shr r10, cl
lea ecx, [rdx + rax]
xor byte [rax + 2], r10b
and cl, 7
xor byte [rax + 0xa], r10b
movabs rdx, 0xc13963014d37c5d1
xor byte [rax + 0x12], r10b
xor byte [rax + 0x1a], r10b
shl cl, 3
shr r9, cl
lea ecx, [r8 + rax]
xor byte [rax + 3], r9b
and cl, 7
xor byte [rax + 0xb], r9b
mov r8, rdx
xor byte [rax + 0x13], r9b
xor byte [rax + 0x1b], r9b
movabs r9, 0xc13963014d37c5d1
shl cl, 3
shr r8, cl
movzx ecx, al
add cl, byte [rsp + 0x40]
xor byte [rax + 4], r8b
and cl, 7
xor byte [rax + 0xc], r8b
xor byte [rax + 0x14], r8b
xor byte [rax + 0x1c], r8b
mov r8, qword [rsp + 0x50]
shl cl, 3
shr rdx, cl
xor byte [rax + 5], dl
xor byte [rax + 0xd], dl
xor byte [rax + 0x15], dl
add rax, 0x1f
mov rdx, qword [rsp + 0x48]
lea rcx, [rax + r14]
cmp rcx, 0x5d
jb 0x14006bdf0
mov r15, qword [rsp]
mov r14, qword [rsp + 8]
mov r13, qword [rsp + 0x10]
mov r12, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x58]
mov byte [rbp + 0x5d], 0
add rsp, 0x30
pop rbp
ret
Function at 0x14006c030
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
cmp byte [rcx + 0x45], 0
mov rbp, rcx
je 0x14006c1fa
mov qword [rsp + 0x58], rbx
lea rax, [rcx + 2]
mov qword [rsp + 0x28], rsi
mov rdx, 0xfffffffffffffffb
mov qword [rsp + 0x20], rdi
sub rdx, rcx
mov qword [rsp + 0x18], r12
mov r8, 0xfffffffffffffffc
mov qword [rsp + 0x10], r13
sub r8, rcx
mov qword [rsp + 8], r14
mov r13, 0xfffffffffffffffa
sub r13, rcx
mov qword [rsp], r15
mov r15, rcx
mov qword [rsp + 0x48], rdx
mov r12d, 1
mov qword [rsp + 0x50], r8
sub r12, rcx
mov r14, 0xfffffffffffffffe
mov rcx, 0xfffffffffffffffd
not r15
sub rcx, rbp
movabs r9, 0x1dc3834d7537e95d
mov qword [rsp + 0x40], rcx
sub r14, rbp
nop dword [rax]
nop word [rax + rax]
lea ecx, [r14 + rax]
mov rsi, r9
and cl, 7
mov rdi, r9
shl cl, 3
mov rbx, r9
shr rsi, cl
mov r11, r9
xor byte [rax - 2], sil
lea ecx, [r15 + rax]
xor byte [rax + 6], sil
and cl, 7
xor byte [rax + 0xe], sil
mov r10, r9
shl cl, 3
shr rdi, cl
movzx ecx, al
xor byte [rax - 1], dil
sub cl, bpl
xor byte [rax + 7], dil
and cl, 7
xor byte [rax + 0xf], dil
shl cl, 3
shr rbx, cl
lea ecx, [r12 + rax]
xor byte [rax], bl
and cl, 7
xor byte [rax + 8], bl
xor byte [rax + 0x10], bl
shl cl, 3
shr r11, cl
lea ecx, [rax + r13]
xor byte [rax + 1], r11b
and cl, 7
xor byte [rax + 9], r11b
xor byte [rax + 0x11], r11b
shl cl, 3
shr r10, cl
lea ecx, [rdx + rax]
xor byte [rax + 2], r10b
and cl, 7
xor byte [rax + 0xa], r10b
movabs rdx, 0x1dc3834d7537e95d
xor byte [rax + 0x12], r10b
shl cl, 3
shr r9, cl
lea ecx, [r8 + rax]
xor byte [rax + 3], r9b
and cl, 7
xor byte [rax + 0xb], r9b
mov r8, rdx
xor byte [rax + 0x13], r9b
movabs r9, 0x1dc3834d7537e95d
shl cl, 3
shr r8, cl
movzx ecx, al
add cl, byte [rsp + 0x40]
xor byte [rax + 4], r8b
and cl, 7
xor byte [rax + 0xc], r8b
xor byte [rax + 0x14], r8b
mov r8, qword [rsp + 0x50]
shl cl, 3
shr rdx, cl
xor byte [rax + 5], dl
xor byte [rax + 0xd], dl
add rax, 0x17
mov rdx, qword [rsp + 0x48]
lea rcx, [rax + r14]
cmp rcx, 0x45
jb 0x14006c0d0
mov r15, qword [rsp]
mov r14, qword [rsp + 8]
mov r13, qword [rsp + 0x10]
mov r12, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x58]
mov byte [rbp + 0x45], 0
add rsp, 0x30
pop rbp
ret
Function at 0x14006d5c0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1401fd600]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, r9
mov rdi, r8
mov rsi, rcx
xor ebp, ebp
lea ecx, [rbp + 0x38]
call fcn.14015b520
mov r9, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rbp
movups xmm0, xmmword [rbx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rax + 0x10], xmm1
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], send
mov byte [rbx], bpl
mov rax, qword [rbx + 0x20]
mov qword [r9 + 0x20], rax
mov rax, qword [rdi]
mov qword [r9 + 0x28], rax
lea rax, [0x140074440]
mov qword [r9 + 0x30], rax
mov qword [rsp + 0x30], r9
lea rbx, [rsi + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebp
lea r8, [0x140072770]
xor edx, edx
xor ecx, ecx
call fcn.14016a540
mov qword [rsi], rax
test rax, rax
je 0x14006d67d
mov rax, rsi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14015b500
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
mov dword [rbx], ebp
mov ecx, 6
call fcn.14015a9b8
int3
Function at 0x140077b20
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push r13
push r14
sub rsp, 0x28
cmp qword [rcx + 0x38], 0
mov rdi, r8
mov r8, qword [rcx + 0x160]
mov r14, rdx
mov r13, qword [rcx + 0x168]
mov rsi, rcx
jne 0x140077c37
mov rcx, qword [rcx + 0x30]
movabs rax, 0x2000000000000000
add rcx, rdi
cmp rcx, rax
ja 0x140077c37
cmp rcx, rdi
jb 0x140077c37
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsi + 0x30], rcx
mov ebp, dword [rsi + 0x184]
mov qword [rsp + 0x60], r12
test ebp, ebp
je 0x140077bbf
nop dword [rax]
test rdi, rdi
je 0x140077c12
movzx eax, byte [r14]
dec rdi
mov ecx, ebp
inc r14
xor byte [rcx + rsi + 0x40], al
inc ebp
and ebp, 0xf
jne 0x140077b90
lea r12, [rsi + 0x60]
lea rbx, [rsi + 0x40]
mov rdx, r12
mov rcx, rbx
call r8
jmp 0x140077bc7
lea r12, [rsi + 0x60]
lea rbx, [rsi + 0x40]
mov qword [rsp + 0x20], r15
mov r15, rdi
and r15, 0xfffffffffffffff0
je 0x140077bea
mov r9, r15
mov r8, r14
mov rdx, r12
mov rcx, rbx
call r13
add r14, r15
sub rdi, r15
mov r15, qword [rsp + 0x20]
test rdi, rdi
je 0x140077c12
mov ebp, edi
sub r14, rsi
nop dword [rax]
movzx eax, byte [r14 + rbx - 0x40]
xor byte [rbx], al
lea rbx, [rbx + 1]
sub rdi, 1
jne 0x140077c00
mov rbx, qword [rsp + 0x50]
mov eax, 1
mov r12, qword [rsp + 0x60]
mov dword [rsi + 0x184], ebp
mov rbp, qword [rsp + 0x58]
add rsp, 0x28
pop r14
pop r13
pop rdi
pop rsi
ret
xor eax, eax
add rsp, 0x28
pop r14
pop r13
pop rdi
pop rsi
ret
Function at 0x140077f70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x48
mov rax, qword [rcx + 0x168]
mov rsi, rcx
mov r13, qword [rcx + 0x160]
mov r15, r9
mov rcx, qword [rcx + 0x38]
mov r14, r8
mov rbx, qword [rsp + 0xa0]
mov rdi, rdx
mov qword [rsp + 0x30], rax
add rcx, rbx
movabs rax, 0xfffffffe0
cmp rcx, rax
ja 0x1400781f1
cmp rcx, rbx
jb 0x1400781f1
mov qword [rsp + 0x90], rbp
lea r8, [rsi + 0x60]
mov qword [rsi + 0x38], rcx
cmp dword [rsi + 0x184], 0
mov qword [rsp + 0x40], r12
lea r12, [rsi + 0x40]
je 0x140078005
mov rdx, r8
mov rcx, r12
call r13
lea r8, [rsi + 0x60]
mov dword [rsi + 0x184], 0
mov ebp, dword [rsi + 0x180]
mov dword [rsp + 0x80], ebp
test ebp, ebp
je 0x140078053
test rbx, rbx
je 0x1400781cb
movzx edx, byte [r14]
dec rbx
mov ecx, ebp
inc r14
movzx eax, dl
xor al, byte [rcx + rsi + 0x10]
mov byte [r15], al
inc r15
xor byte [rcx + rsi + 0x40], dl
inc ebp
and ebp, 0xf
jne 0x140078016
mov rdx, r8
mov rcx, r12
call r13
mov dword [rsp + 0x80], ebp
test byte [rsi + 0x178], 1
je 0x140078085
test rbx, rbx
je 0x140078085
mov qword [rsp + 0x28], r12
mov r9, rdi
mov r8, rbx
mov qword [rsp + 0x20], rsi
mov rdx, r15
mov rcx, r14
call fcn.140006e00
add r14, rax
add r15, rax
sub rbx, rax
mov r13d, dword [rsi + 0xc]
bswap r13d
cmp rbx, 0xc00
jb 0x140078131
movabs rax, 0xaaaaaaaaaaaaaaab
mul rbx
mov rdi, rdx
shr rdi, 0xb
imul rax, rdi, 0xfffffffffffff400
add rbx, rax
mov qword [rsp + 0xa0], rbx
mov rbx, qword [rsp + 0x88]
nop word [rax + rax]
mov r9d, 0xc00
lea rdx, [rsi + 0x60]
mov r8, r14
mov rcx, r12
call qword [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x20], rsi
mov r8d, 0xc0
mov rdx, r15
mov rcx, r14
call qword [rsp + 0xa8]
add r13d, 0xc0
add r15, 0xc00
mov eax, r13d
add r14, 0xc00
bswap eax
mov dword [rsi + 0xc], eax
sub rdi, 1
jne 0x1400780d0
mov rbx, qword [rsp + 0xa0]
mov ebp, dword [rsp + 0x80]
mov r12, rbx
and r12, 0xfffffffffffffff0
je 0x140078184
mov rdi, r12
lea rdx, [rsi + 0x60]
mov r9, r12
shr rdi, 4
mov r8, r14
lea rcx, [rsi + 0x40]
call qword [rsp + 0x30]
mov r9, qword [rsp + 0x88]
mov r8, rdi
mov rdx, r15
mov qword [rsp + 0x20], rsi
mov rcx, r14
call qword [rsp + 0xa8]
add r13d, edi
add r15, r12
mov eax, r13d
add r14, r12
bswap eax
mov dword [rsi + 0xc], eax
sub rbx, r12
test rbx, rbx
je 0x1400781cb
mov r8, qword [rsp + 0x88]
lea rdx, [rsi + 0x10]
mov rcx, rsi
call qword [rsi + 0x170]
lea eax, [r13 + 1]
bswap eax
mov dword [rsi + 0xc], eax
nop word [rax + rax]
mov ecx, ebp
inc ebp
movzx eax, byte [rcx + r14]
xor byte [rcx + rsi + 0x40], al
xor al, byte [rcx + rsi + 0x10]
mov byte [rcx + r15], al
sub rbx, 1
jne 0x1400781b0
mov r12, qword [rsp + 0x40]
mov eax, 1
mov dword [rsi + 0x180], ebp
mov rbp, qword [rsp + 0x90]
add rsp, 0x48
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
ret
xor eax, eax
add rsp, 0x48
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
ret