joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14013ee70
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov eax, 0x20
call fcn.14009cc40
sub rsp, rax
mov rbx, r8
call fcn.14013f0d0
test eax, eax
js 0x14013f0c4
mov eax, dword [rbx + 0xf0]
shl eax, 2
movsxd r9, eax
test eax, eax
jle 0x14013eefd
lea r8, [rbx + 8]
xor r10d, r10d
lea r8, [r8 + r9*4]
lea rax, [rbx + 8]
nop
mov edx, dword [rax - 8]
add r10, 4
mov ecx, dword [r8 - 8]
lea r8, [r8 - 0x10]
mov dword [rax - 8], ecx
lea rax, [rax + 0x10]
mov ecx, dword [r8 + 0xc]
sub r9, 4
mov dword [r8 + 8], edx
mov edx, dword [rax - 0x14]
mov dword [rax - 0x14], ecx
mov ecx, dword [r8 + 0x10]
mov dword [r8 + 0xc], edx
mov edx, dword [rax - 0x10]
mov dword [rax - 0x10], ecx
mov ecx, dword [r8 + 0x14]
mov dword [r8 + 0x10], edx
mov edx, dword [rax - 0xc]
mov dword [rax - 0xc], ecx
mov dword [r8 + 0x14], edx
cmp r10, r9
jl 0x14013eeb0
mov r11d, 1
cmp dword [rbx + 0xf0], r11d
jle 0x14013f0c2
mov qword [rsp + 0x30], rdi
lea r10, [rbx + 4]
lea rdi, [0x140000000]
mov r9d, dword [r10 + 0x10]
lea r10, [r10 + 0x10]
mov edx, dword [r10 - 4]
inc r11d
movzx eax, byte [r10 - 3]
movzx ecx, byte [rdi + rax*4 + 0x22a000]
mov eax, edx
shr rax, 0x18
mov r8d, dword [rdi + rcx*4 + 0x22b400]
movzx eax, byte [rdi + rax*4 + 0x22a000]
xor r8d, dword [rdi + rax*4 + 0x22ac00]
movzx eax, dl
movzx ecx, byte [rdi + rax*4 + 0x22a000]
movzx eax, byte [r10 - 2]
xor r8d, dword [rdi + rcx*4 + 0x22b800]
movzx ecx, byte [rdi + rax*4 + 0x22a000]
mov eax, r9d
shr eax, 0x10
xor r8d, dword [rdi + rcx*4 + 0x22b000]
movzx ecx, al
mov eax, r9d
shr eax, 8
mov dword [r10 - 4], r8d
movzx edx, byte [rdi + rcx*4 + 0x22a000]
movzx ecx, al
mov r8d, dword [rdi + rdx*4 + 0x22b000]
movzx eax, byte [rdi + rcx*4 + 0x22a000]
xor r8d, dword [rdi + rax*4 + 0x22b400]
mov eax, r9d
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0x22a000]
movzx eax, r9b
mov r9d, dword [r10 + 4]
xor r8d, dword [rdi + rcx*4 + 0x22ac00]
movzx ecx, byte [rdi + rax*4 + 0x22a000]
mov eax, r9d
shr eax, 0x10
xor r8d, dword [rdi + rcx*4 + 0x22b800]
movzx ecx, al
mov eax, r9d
shr eax, 8
mov dword [r10], r8d
movzx edx, byte [rdi + rcx*4 + 0x22a000]
movzx ecx, al
mov r8d, dword [rdi + rdx*4 + 0x22b000]
movzx eax, byte [rdi + rcx*4 + 0x22a000]
xor r8d, dword [rdi + rax*4 + 0x22b400]
mov eax, r9d
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0x22a000]
movzx eax, r9b
mov r9d, dword [r10 + 8]
xor r8d, dword [rdi + rcx*4 + 0x22ac00]
movzx ecx, byte [rdi + rax*4 + 0x22a000]
mov eax, r9d
shr eax, 0x10
xor r8d, dword [rdi + rcx*4 + 0x22b800]
movzx ecx, al
mov eax, r9d
shr eax, 8
mov dword [r10 + 4], r8d
movzx edx, byte [rdi + rcx*4 + 0x22a000]
movzx ecx, al
mov r8d, dword [rdi + rdx*4 + 0x22b000]
movzx eax, byte [rdi + rcx*4 + 0x22a000]
xor r8d, dword [rdi + rax*4 + 0x22b400]
mov eax, r9d
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0x22a000]
movzx eax, r9b
xor r8d, dword [rdi + rcx*4 + 0x22ac00]
movzx ecx, byte [rdi + rax*4 + 0x22a000]
xor r8d, dword [rdi + rcx*4 + 0x22b800]
mov dword [r10 + 8], r8d
cmp r11d, dword [rbx + 0xf0]
jl 0x14013ef20
mov rdi, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x140140660
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r13
push r14
push r15
mov eax, 0x40
call fcn.14009cc40
sub rsp, rax
mov rbx, r8
mov r14, rdx
mov r8, qword [rsp + 0xb0]
mov rbp, rcx
mov edi, dword [r8]
mov dword [rsp + 0x30], edi
test edi, edi
je 0x1401406c5
mov rdx, qword [rsp + 0xa8]
test rbx, rbx
je 0x1401406c1
mov eax, edi
dec rbx
movzx ecx, byte [rax + rdx]
xor cl, byte [rbp]
inc rbp
mov byte [r14], cl
inc r14
inc edi
and edi, 0xf
jne 0x1401406a0
mov dword [rsp + 0x30], edi
mov rax, qword [rsp + 0xa0]
mov esi, 1
mov ecx, dword [rax + 0xc]
lea r15, [rax + 0xc]
mov r10, qword [rsp + 0xb8]
mov qword [rsp + 0x80], r12
lea r13d, [rsi + 0xb]
bswap ecx
mov dword [rsp + 0x90], ecx
cmp rbx, 0x10
jb 0x1401407d3
mov rdi, qword [rsp + 0xa0]
mov eax, 0x10000000
nop dword [rax]
mov rdx, rbx
mov qword [rsp + 0x20], rdi
shr rdx, 4
cmp rdx, rax
cmova rdx, rax
add ecx, edx
mov r12, rdx
mov eax, ecx
sub r12, rax
cmp rax, rdx
cmovae r12, rdx
xor r8d, r8d
cmp rax, rdx
mov rdx, r14
cmovae r8d, ecx
mov rcx, rbp
mov dword [rsp + 0x90], r8d
mov r8, r12
call r10
mov ecx, dword [rsp + 0x90]
mov eax, ecx
bswap eax
mov dword [r15], eax
test ecx, ecx
jne 0x14014078c
mov r8d, r13d
mov eax, esi
mov rdx, r15
nop dword [rax]
movzx ecx, byte [rdx - 1]
lea rdx, [rdx - 1]
add eax, ecx
mov byte [rdx], al
shr eax, 8
add r8d, 0xffffffff
jne 0x140140770
mov ecx, dword [rsp + 0x90]
mov r10, qword [rsp + 0xb8]
mov eax, 0x10000000
mov r9, qword [rsp + 0x98]
shl r12, 4
sub rbx, r12
add r14, r12
add rbp, r12
cmp rbx, 0x10
jae 0x140140710
mov edi, dword [rsp + 0x30]
mov r8, qword [rsp + 0xb0]
mov rax, qword [rsp + 0xa0]
mov dword [rsp + 0x90], ecx
test rbx, rbx
je 0x140140852
mov r12, qword [rsp + 0xa8]
xorps xmm0, xmm0
mov r8, rsi
mov qword [rsp + 0x20], rax
mov rdx, r12
mov rcx, r12
movups xmmword [r12], xmm0
call r10
mov r8d, dword [rsp + 0x90]
add r8d, esi
bswap r8d
mov dword [r15], r8d
jne 0x140140830
nop dword [rax]
movzx eax, byte [r15 - 1]
lea r15, [r15 - 1]
add esi, eax
mov byte [r15], sil
shr esi, 8
add r13d, 0xffffffff
jne 0x140140810
nop word [rax + rax]
mov ecx, edi
inc edi
movzx eax, byte [rcx + rbp]
xor al, byte [rcx + r12]
mov byte [rcx + r14], al
sub rbx, 1
jne 0x140140830
mov rax, qword [rsp + 0xb0]
mov dword [rax], edi
jmp 0x140140855
mov dword [r8], edi
mov r12, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140142430
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r12
push r13
push r14
mov eax, 0x20
call fcn.14009cc40
sub rsp, rax
mov r13, qword [rcx + 0x160]
lea r14, [rcx + 0x40]
xor r12d, r12d
mov rdi, r8
mov qword [rcx + 0x30], r12
mov rsi, rdx
mov qword [rcx + 0x38], r12
mov rbx, rcx
mov qword [rcx + 0x170], r12
cmp r8, 0xc
jne 0x140142494
movsd xmm0, qword [rdx]
lea edi, [r8 - 0xb]
movsd qword [rcx], xmm0
mov eax, dword [rdx + 8]
mov dword [rcx + 8], eax
mov dword [rcx + 0xc], 0x1000000
jmp 0x1401425ac
mov qword [rsp + 0x50], rbp
mov rbp, rdi
mov qword [rsp + 0x58], r15
lea r15, [rcx + 0x60]
mov qword [r14], r12
mov qword [rcx + 0x48], r12
cmp rdi, 0x10
jb 0x140142556
mov r12, rdi
shr r12, 4
imul rax, r12, 0xfffffffffffffff0
add rdi, rax
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rsi]
mov rdx, r15
xor byte [r14], al
mov rcx, r14
movzx eax, byte [rsi + 1]
xor byte [rbx + 0x41], al
movzx eax, byte [rsi + 2]
xor byte [rbx + 0x42], al
movzx eax, byte [rsi + 3]
xor byte [rbx + 0x43], al
movzx eax, byte [rsi + 4]
xor byte [rbx + 0x44], al
movzx eax, byte [rsi + 5]
xor byte [rbx + 0x45], al
movzx eax, byte [rsi + 6]
xor byte [rbx + 0x46], al
movzx eax, byte [rsi + 7]
xor byte [rbx + 0x47], al
movzx eax, byte [rsi + 8]
xor byte [rbx + 0x48], al
movzx eax, byte [rsi + 9]
xor byte [rbx + 0x49], al
movzx eax, byte [rsi + 0xa]
xor byte [rbx + 0x4a], al
movzx eax, byte [rsi + 0xb]
xor byte [rbx + 0x4b], al
movzx eax, byte [rsi + 0xc]
xor byte [rbx + 0x4c], al
movzx eax, byte [rsi + 0xd]
xor byte [rbx + 0x4d], al
movzx eax, byte [rsi + 0xe]
xor byte [rbx + 0x4e], al
movzx eax, byte [rsi + 0xf]
xor byte [rbx + 0x4f], al
call r13
add rsi, 0x10
sub r12, 1
jne 0x1401424d0
test rdi, rdi
je 0x14014257b
mov rcx, r14
sub rsi, rbx
movzx eax, byte [rsi + rcx - 0x40]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub rdi, 1
jne 0x140142561
mov rdx, r15
mov rcx, r14
call r13
shl rbp, 3
mov rdx, r15
bswap rbp
xor qword [rbx + 0x48], rbp
mov rcx, r14
call r13
mov rax, qword [r14]
mov edi, dword [rbx + 0x4c]
mov r15, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
mov qword [rbx], rax
mov rax, qword [rbx + 0x48]
mov qword [rbx + 8], rax
bswap edi
mov qword [r14], r12
lea rdx, [rbx + 0x20]
mov qword [rbx + 0x48], r12
mov rcx, rbx
mov r8, qword [rbx + 0x180]
call qword [rbx + 0x178]
inc edi
bswap edi
mov dword [rbx + 0xc], edi
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140142c90
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x78
call fcn.14009cc40
sub rsp, rax
mov rax, qword [0x1402a61f0]
xor rax, rsp
mov qword [rsp + 0x68], rax
movzx ebx, byte [rcx]
lea r12, [rcx + 0x10]
mov r11, qword [rsp + 0xe0]
mov rbp, r9
mov rax, qword [rcx + 0x28]
mov r15, r8
mov r10, qword [rcx + 0x30]
mov r14, rdx
mov qword [rsp + 0x50], r11
mov rdi, rcx
mov byte [rsp + 0x30], bl
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r10
test bl, 0x40
jne 0x140142d09
mov r8, r10
mov rdx, r12
call rax
mov r10, qword [rsp + 0x38]
mov r9, rbp
mov r11, qword [rsp + 0x50]
xor esi, esi
mov r8d, ebx
and r8d, 7
mov r13d, recv
sub r13d, r8d
mov byte [rdi], r8b
mov ecx, esi
cmp r13d, 0xf
jae 0x140142d47
mov edx, r13d
add rdx, rdi
nop dword [rax]
movzx eax, byte [rdx]
mov byte [rdx], sil
lea rdx, [rdx + 1]
or rcx, rax
shl rcx, 8
sub r8, 1
jne 0x140142d30
movzx eax, byte [rdi + 0xf]
or rcx, rax
mov byte [rdi + 0xf], 1
cmp rcx, rbp
je 0x140142d61
mov eax, 0xffffffff
jmp 0x140142e8a
mov rbx, rbp
shr rbx, 4
test rbx, rbx
je 0x140142de2
mov qword [rsp + 0x28], r12
mov r9, r10
mov r8, rbx
mov qword [rsp + 0x20], rdi
mov rdx, r15
mov rcx, r14
call r11
shl rbx, 4
add r14, rbx
add r15, rbx
sub rbp, rbx
je 0x140142e3c
shr rbx, 4
lea r8, [rdi + 0x10]
mov r9, 0xfffffffffffffff8
mov rdx, rsi
sub r9, rdi
nop
movzx eax, byte [r8 - 1]
lea r8, [r8 - 1]
add rdx, rax
movzx ecx, bl
add rdx, rcx
shr rbx, 8
mov byte [r8], dl
lea rax, [r8 + r9]
shr rdx, 8
test rax, rax
je 0x140142dea
test rbx, rbx
jne 0x140142db0
test rdx, rdx
jne 0x140142db0
jmp 0x140142dea
mov rbp, r9
test r9, r9
je 0x140142e3c
mov rbx, qword [rsp + 0x38]
lea rdx, [rsp + 0x58]
mov r8, rbx
mov rcx, rdi
call qword [rsp + 0x40]
test rbp, rbp
je 0x140142e2a
mov rcx, rsi
nop word [rax + rax]
movzx eax, byte [rcx + r14]
inc esi
xor al, byte [rsp + rcx + 0x58]
mov byte [rcx + r15], al
xor byte [rcx + rdi + 0x10], al
mov ecx, esi
cmp rcx, rbp
jb 0x140142e10
mov rsi, qword [rsp + 0x40]
mov r8, rbx
mov rdx, r12
mov rcx, r12
call rsi
jmp 0x140142e46
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
cmp r13d, 0x10
jae 0x140142e62
mov r8d, reloc.WS2_32.dll_recv
mov ecx, r13d
sub r8d, r13d
add rcx, rdi
xor edx, edx
call fcn.14009ebe0
mov r8, rbx
lea rdx, [rsp + 0x58]
mov rcx, rdi
call rsi
mov rax, qword [rsp + 0x58]
xor qword [r12], rax
mov rax, qword [rsp + 0x60]
xor qword [rdi + 0x18], rax
movzx eax, byte [rsp + 0x30]
mov byte [rdi], al
xor eax, eax
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14009c7d0
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140144d30
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x140144e59
mov eax, 8
call fcn.14009cc40
sub rsp, rax
mov r10, rcx
xor ecx, ecx
cmp r8, 0x40
jb 0x140144e27
lea r11, [r9 - 1]
lea rax, [rdx - 1]
add r11, r8
add rax, r8
cmp r9, rax
ja 0x140144d71
cmp r11, rdx
jae 0x140144e27
lea rax, [r8 - 1]
add rax, r10
cmp r9, rax
ja 0x140144d86
cmp r11, r10
jae 0x140144e27
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov rsi, r8
and rsi, 0xffffffffffffffc0
mov qword [rsp], rdi
mov r11, r10
lea rax, [rdx + 0x10]
sub r11, rdx
mov rbx, r9
sub rbx, rdx
nop dword [rax + rax]
movdqu xmm0, xmmword [rax - 0x10]
add rcx, 0x40
movdqu xmm1, xmmword [r11 + rax - 0x10]
movdqu xmm2, xmmword [r11 + rax]
lea rax, [rax + 0x40]
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmmword [rbx + rax - 0x50], xmm1
pxor xmm2, xmm0
movdqu xmm0, xmmword [rax - 0x30]
movdqu xmm1, xmmword [r11 + rax - 0x30]
movdqu xmmword [rbx + rax - 0x40], xmm2
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm2, xmmword [r11 + rax - 0x20]
movdqu xmmword [rbx + rax - 0x30], xmm1
pxor xmm2, xmm0
movdqu xmmword [rbx + rax - 0x20], xmm2
cmp rcx, rsi
jb 0x140144db0
mov rsi, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x10]
mov rdi, qword [rsp]
cmp rcx, r8
jae 0x140144e55
sub r10, rdx
lea rax, [rcx + rdx]
sub r9, rdx
sub r8, rcx
nop dword [rax]
nop dword [rax + rax]
movzx ecx, byte [rax + r10]
xor cl, byte [rax]
mov byte [rax + r9], cl
lea rax, [rax + 1]
sub r8, 1
jne 0x140144e40
add rsp, 8
ret

Function at 0x140144f40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rdi
push r14
mov eax, 0x20
call fcn.14009cc40
sub rsp, rax
mov rdi, qword [rcx + 0x28]
mov rbx, rdx
mov rbp, rcx
cmp rdx, rdi
ja 0x140144f7e
shl rbx, 4
add rbx, qword [rcx + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
mov rcx, qword [rcx + 0x30]
cmp rbx, rcx
jb 0x140144fca
sub rdx, rcx
lea r8, [0x14022bd38]
add rdx, 4
mov r9d, WSACleanup
and rdx, 0xfffffffffffffffc
add rdx, rcx
mov rcx, qword [rbp + 0x58]
mov qword [rbp + 0x30], rdx
shl rdx, 4
call fcn.14013a240
test rax, rax
jne 0x140144fc6
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
mov qword [rbp + 0x58], rax
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], r12
mov r12, rbx
mov qword [rsp + 0x50], r15
mov r15, rdi
shl r15, 4
sub r12, rdi
nop word [rax + rax]
mov rcx, qword [rbp + 0x58]
mov edx, 1
add rcx, r15
movzx edi, byte [rcx]
lea rsi, [rcx + 0x10]
shr dil, 7
mov r8, rsi
neg dil
and dil, 0x87
call fcn.140144b80
xor byte [rsi + 0xf], dil
add r15, 0x10
sub r12, 1
jne 0x140144ff0
mov r15, qword [rsp + 0x50]
mov r12, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov qword [rbp + 0x28], rbx
shl rbx, 4
add rbx, qword [rbp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
Function at 0x14014a5e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
movsxd rbx, r9d
mov r10, r8
mov r11, rdx
cmp rdx, r8
je 0x14014a742
mov qword [rsp + 0x10], rsi
lea rsi, [rcx - 1]
not rcx
shr rsi, 0x3f
shr rcx, 0x3f
and rsi, rcx
mov ecx, dword [rdx + 8]
xor ecx, dword [r8 + 8]
dec rsi
and ecx, esi
xor dword [rdx + 8], ecx
xor dword [r8 + 8], ecx
mov ecx, dword [rdx + 0x10]
movq xmm4, rsi
xor ecx, dword [r8 + 0x10]
and ecx, esi
punpcklqdq xmm4, xmm4
xor dword [rdx + 0x10], ecx
xor dword [r8 + 0x10], ecx
mov edx, dword [rdx + 0x14]
mov ecx, dword [r8 + 0x14]
xor rcx, rdx
and ecx, 4
and rcx, rsi
mov eax, ecx
xor eax, edx
mov dword [r11 + 0x14], eax
xor dword [r8 + 0x14], ecx
xor ecx, ecx
mov edx, ecx
test r9d, r9d
jle 0x14014a702
cmp ebx, 2
jb 0x14014a702
mov r9, qword [r8]
lea rax, [rbx - 1]
mov r8, qword [r11]
mov qword [rsp + 0x18], rdi
lea rdi, [rbx - 1]
lea rdi, [r9 + rdi*8]
lea rax, [r8 + rax*8]
cmp r9, rax
ja 0x14014a68e
cmp rdi, r8
jae 0x14014a6fd
cmp r9, r10
ja 0x14014a698
cmp rdi, r10
jae 0x14014a6fd
cmp r9, r11
ja 0x14014a6a2
cmp rdi, r11
jae 0x14014a6fd
cmp r8, r10
ja 0x14014a6ac
cmp rax, r10
jae 0x14014a6fd
cmp r8, r11
ja 0x14014a6b6
cmp rax, r11
jae 0x14014a6fd
mov eax, ebx
and eax, 0xfffffffe
nop dword [rax + rax]
movdqu xmm2, xmmword [rcx + r9]
add edx, 2
movdqu xmm1, xmmword [rcx + r8]
lea rcx, [rcx + 0x10]
movdqa xmm3, xmm2
pxor xmm3, xmm1
pand xmm3, xmm4
movdqa xmm0, xmm3
pxor xmm3, xmm2
pxor xmm0, xmm1
movdqu xmmword [rcx + r8 - 0x10], xmm0
movdqu xmmword [rcx + r9 - 0x10], xmm3
cmp edx, eax
jl 0x14014a6c0
mov rdi, qword [rsp + 0x18]
movsxd rax, edx
cmp rax, rbx
jge 0x14014a73d
nop word [rax + rax]
mov rcx, qword [r11]
mov rdx, qword [rcx + rax*8]
lea r8, [rcx + rax*8]
mov rcx, qword [r10]
mov r9, rdx
xor r9, qword [rcx + rax*8]
and r9, rsi
xor rdx, r9
mov qword [r8], rdx
mov rcx, qword [r10]
xor qword [rcx + rax*8], r9
inc rax
cmp rax, rbx
jl 0x14014a710
mov rsi, qword [rsp + 0x10]
pop rbx
ret
Function at 0x140151f30
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x38
call fcn.14009cc40
sub rsp, rax
mov r10, rcx
test r9, r9
jne 0x140151f6c
mov edx, 0xe2
mov dword [rsp + 0x20], 0x9a
lea r9, str.crypto_asn1_a_int.c
lea ecx, [rax - 0x2b]
lea r8d, [rdx - 4]
call fcn.140138c80
xor eax, eax
add rsp, 0x38
ret
movzx r11d, byte [r8]
and r11d, 0x80
test rdx, rdx
je 0x140151f7f
mov dword [rdx], r11d
cmp r9, 1
jne 0x140151fa1
test r10, r10
je 0x140151f97
movzx eax, byte [r8]
test r11d, r11d
je 0x140151f95
neg al
mov byte [rcx], al
mov eax, 1
add rsp, 0x38
ret
movzx ecx, byte [r8]
test cl, cl
jne 0x140151fb3
mov eax, 1
jmp 0x14015206a
xor eax, eax
cmp cl, 0xff
jne 0x1401520a3
xor edx, edx
lea rcx, [r9 - 1]
mov eax, 1
cmp r9, rax
jbe 0x14015205f
cmp rcx, 8
jb 0x140152050
and ecx, 7
mov rdx, r9
sub rdx, rcx
xorps xmm2, xmm2
xorps xmm3, xmm3
nop word [rax + rax]
movd xmm1, dword [rax + r8]
xorps xmm0, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
por xmm2, xmm1
movd xmm1, dword [rax + r8 + 4]
punpcklbw xmm1, xmm0
add rax, 8
punpcklwd xmm1, xmm0
por xmm1, xmm3
movdqa xmm3, xmm1
cmp rax, rdx
jb 0x140151ff0
por xmm2, xmm1
movdqa xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd edx, xmm2
cmp rax, r9
jae 0x14015205f
nop dword [rax]
movzx ecx, byte [rax + r8]
inc rax
or edx, ecx
cmp rax, r9
jb 0x140152050
xor eax, eax
test edx, edx
setne al
test edx, edx
je 0x1401520a3
movzx ecx, byte [r8 + 1]
and ecx, 0x80
cmp r11d, ecx
jne 0x1401520a3
mov edx, 0xe2
mov dword [rsp + 0x20], 0xbb
lea r9, str.crypto_asn1_a_int.c
mov ecx, recv
lea r8d, [rdx - 5]
call fcn.140138c80
xor eax, eax
add rsp, 0x38
ret
mov qword [rsp + 0x30], rbx
mov rbx, r9
sub rbx, rax
test r10, r10
je 0x1401520ed
neg r11d
sbb r11d, r11d
add r9, r8
movzx r11d, r11b
mov edx, r11d
and edx, 1
test rbx, rbx
je 0x1401520ed
mov r8, rbx
nop
movzx ecx, byte [r9 - 1]
lea r9, [r9 - 1]
dec r8
xor ecx, r11d
add edx, ecx
mov byte [r8 + r10], dl
shr edx, 8
test r8, r8
jne 0x1401520d0
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
ret
Function at 0x140152200
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
mov r10, rdx
xor r11b, r11b
xor edx, edx
mov rsi, r9
mov rbx, rcx
test rcx, rcx
je 0x140152314
test r10, r10
je 0x140152314
movzx eax, byte [rcx]
test r8d, r8d
jne 0x140152245
cmp al, 0x7f
jbe 0x14015230d
mov edx, 1
mov eax, edx
add rax, r10
jmp 0x14015231c
mov r11b, 0xff
cmp al, 0x80
jbe 0x14015225b
mov edx, 1
mov eax, edx
add rax, r10
jmp 0x14015231c
jne 0x14015230d
mov eax, 1
lea rcx, [r10 - 1]
cmp r10, rax
jbe 0x1401522fe
cmp rcx, 8
jb 0x1401522f0
and ecx, 7
mov rdx, r10
sub rdx, rcx
xorps xmm3, xmm3
xorps xmm2, xmm2
nop dword [rax + rax]
movd xmm1, dword [rax + rbx]
xorps xmm0, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
por xmm3, xmm1
movd xmm1, dword [rax + rbx + 4]
punpcklbw xmm1, xmm0
add rax, 8
punpcklwd xmm1, xmm0
por xmm2, xmm1
cmp rax, rdx
jb 0x140152290
por xmm2, xmm3
movdqa xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd edx, xmm2
cmp rax, r10
jae 0x1401522fe
nop word [rax + rax]
movzx ecx, byte [rax + rbx]
inc rax
or edx, ecx
cmp rax, r10
jb 0x1401522f0
neg edx
sbb r11b, r11b
movzx r11d, r11b
mov edx, r11d
and edx, 1
mov eax, edx
add rax, r10
jmp 0x14015231c
mov eax, 1
mov r10, rdx
mov qword [rsp + 0x18], rdi
test rsi, rsi
je 0x140152375
mov rdi, qword [r9]
test rdi, rdi
je 0x140152375
movzx r8d, r11b
lea r9, [rbx + r10]
and r8d, 1
mov byte [rdi], r11b
test r10, r10
je 0x140152372
mov ebx, edx
add rbx, rdi
nop word [rax + rax]
movzx edx, byte [r9 - 1]
lea r9, [r9 - 1]
dec r10
movzx ecx, r11b
xor edx, ecx
add r8d, edx
mov byte [rbx + r10], r8b
shr r8d, 8
test r10, r10
jne 0x140152350
add qword [rsi], rax
mov rdi, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
pop rsi
ret

Function at 0x14015d8f0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xor eax, eax
mov r10, rcx
test rcx, rcx
je 0x14015d95c
movzx ecx, byte [rcx]
test cl, cl
je 0x14015d95c
mov r11d, 0x100
nop word [rax + rax]
movsx r9d, cl
lea r10, [r10 + 1]
or r9d, r11d
mov r8d, eax
mov edx, r9d
mov ecx, 0x20
shr edx, 2
add r11d, 0x100
xor edx, r9d
imul r9d, r9d
and edx, 0xf
sub ecx, edx
shr r8, cl
mov ecx, edx
mov edx, eax
mov eax, r8d
shl edx, cl
movzx ecx, byte [r10]
or eax, edx
xor eax, r9d
test cl, cl
jne 0x14015d910
mov ecx, eax
shr ecx, 0x10
xor eax, ecx
ret
Function at 0x14015da20
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x20
call fcn.14009cc40
sub rsp, rax
xor ebx, ebx
mov rdi, rcx
test rcx, rcx
je 0x14015dab3
movzx eax, byte [rcx]
test al, al
je 0x14015dab3
mov qword [rsp + 0x30], rsi
mov esi, 0x100
nop
movsx ecx, al
call fcn.14015daf0
mov r9d, eax
mov edx, ebx
or r9d, esi
lea rdi, [rdi + 1]
mov eax, ebx
mov r8d, r9d
shr r8d, 2
mov ecx, 0x20
xor r8d, r9d
add esi, 0x100
and r8d, 0xf
imul r9d, r9d
sub ecx, r8d
shr rdx, cl
mov ecx, r8d
shl eax, cl
mov ebx, edx
or ebx, eax
movzx eax, byte [rdi]
xor ebx, r9d
test al, al
jne 0x14015da50
mov rsi, qword [rsp + 0x30]
mov eax, ebx
shr eax, 0x10
xor eax, ebx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x1401811c0
Capabilities:
Encode data using base64

Disassembly:
mov eax, 0x28
call fcn.14009cc40
sub rsp, rax
mov r9d, r8d
mov r8, rdx
mov rdx, rcx
xor ecx, ecx
add rsp, 0x28
jmp fcn.140181580

Function at 0x140186120
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
mov eax, 0x30
call fcn.14009cc40
sub rsp, rax
movsxd rbx, r9d
xor edi, edi
mov qword [rsp + 0x40], rbp
mov r10, rdx
mov dword [rsp + 0x58], reloc.WS2_32.dll_recv
mov rbp, rcx
mov r9d, edi
test ebx, ebx
jle 0x140186205
cmp ebx, 0x40
jb 0x140186205
lea rax, [rbx - 1]
lea rcx, [rax + rdx]
add rax, r8
cmp rdx, rax
ja 0x140186178
cmp rcx, r8
jae 0x140186205
mov qword [rsp + 0x48], rsi
lea rcx, [rdx + 0x10]
mov r11, rbx
mov rdx, r8
and r11, 0xffffffffffffffc0
sub rdx, r10
mov rsi, 0xfffffffffffffff0
sub rsi, r10
nop dword [rax + rax]
movdqu xmm0, xmmword [rcx - 0x10]
add r9d, 0x40
movdqu xmm1, xmmword [rdx + rcx - 0x10]
movdqu xmm2, xmmword [rdx + rcx]
lea rcx, [rcx + 0x40]
pxor xmm1, xmm0
lea rax, [rsi + rcx]
movdqu xmmword [rcx - 0x50], xmm1
movdqu xmm0, xmmword [rcx - 0x40]
movdqu xmm1, xmmword [rdx + rcx - 0x30]
pxor xmm2, xmm0
movdqu xmmword [rcx - 0x40], xmm2
movdqu xmm0, xmmword [rcx - 0x30]
pxor xmm1, xmm0
movdqu xmmword [rcx - 0x30], xmm1
movdqu xmm0, xmmword [rcx - 0x20]
movdqu xmm1, xmmword [rdx + rcx - 0x20]
pxor xmm1, xmm0
movdqu xmmword [rcx - 0x20], xmm1
cmp rax, r11
jl 0x1401861a0
mov rsi, qword [rsp + 0x48]
movsxd rcx, r9d
mov rdx, rbx
cmp rcx, rbx
jge 0x140186231
sub r8, r10
lea rax, [rcx + r10]
sub rdx, rcx
nop word [rax + rax]
movzx ecx, byte [rax + r8]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x140186220
mov rcx, qword [rbp + 0x10]
lea r8, [rsp + 0x58]
mov r9, r10
mov dword [rsp + 0x20], ebx
mov rdx, r10
call fcn.14012e460
mov rbp, qword [rsp + 0x40]
test eax, eax
je 0x140186267
cmp dword [rsp + 0x58], ebx
sete dil
mov eax, edi
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x50]
xor eax, eax
add rsp, 0x30
pop rdi
ret

Function at 0x140186410
Capabilities:
Encode data using xor

Disassembly:
mov r10, rcx
test rdx, rdx
je 0x140186498
test r8, r8
je 0x140186498
mov r9, qword [rcx + 0x28]
cmp r8, r9
cmovb r9, r8
test r9, r9
je 0x140186452
add rcx, 0x30
mov r11, rdx
sub r11, r10
nop dword [rax + rax]
movzx eax, byte [r11 + rcx - 0x30]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub r9, 1
jne 0x140186440
mov rax, qword [r10 + 0x28]
cmp r8, rax
jbe 0x140186498
sub r8, rax
cmp r8, 0x10
jbe 0x14018646c
mov r8d, reloc.WS2_32.dll_recv
jmp 0x140186471
test r8, r8
je 0x140186498
xor ecx, ecx
nop dword [rax]
nop word [rax + rax]
mov rax, qword [r10 + 0x28]
add rax, rcx
movzx eax, byte [rax + rdx]
xor byte [r10 + rcx + 0x50], al
inc rcx
cmp rcx, r8
jb 0x140186480
ret

Function at 0x140188540
Capabilities:
Get thread local storage value

Disassembly:
mov eax, 0x28
call fcn.14009cc40
sub rsp, rax
lea rcx, [0x1402af018]
add rsp, 0x28
jmp fcn.140139540