joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14029e460
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rbp
push rsi
push r12
push r13
push r14
sub rsp, 0x68
mov rax, qword [0x140601e40]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, qword [rsp + 0xc0]
lea r9, str.recv
mov r13, qword [rsp + 0xc8]
mov rbx, rcx
mov r14, rdx
add rcx, 0x1e0
xor r12d, r12d
mov edx, dword [rbx + 0x1c]
call fcn.1402a2d80
mov ebp, eax
test eax, eax
je 0x14029e6d2
mov qword [rsp + 0xb8], rdi
cmp byte [rbx + 0x2ea], r12b
je 0x14029e4d6
mov edi, 0xfffffff5
mov dword [rbx + 0x28], edi
mov eax, edi
jmp 0x14029e6ca
mov qword [rsp + 0x60], r15
mov r15d, 0xffffffff
cmp byte [rbx + 0x132], r12b
je 0x14029e5ae
lea rcx, [rbx + 0x2d8]
call fcn.14029bad0
mov rcx, qword [rbx + 0x320]
mov edx, 0x7066756c
call fcn.1402a2d30
xor edi, edi
mov dword [rsp + 0x30], eax
test ebp, ebp
jle 0x14029e56a
test r14, r14
je 0x14029e56a
cmp dword [rbx + 0x1c], 1
mov r8d, ebp
mov rcx, qword [rbx + 0x320]
mov rdx, r14
je 0x14029e53b
lea r9, [rbx + 0x2ec]
call fcn.1402a28a0
jmp 0x14029e540
call fcn.1402a29c0
mov edi, eax
test eax, eax
jle 0x14029e56c
test rsi, rsi
je 0x14029e56a
mov edx, reloc.WS2_32.dll_recv
lea r8, [rbx + 0x2ec]
mov r9d, edx
mov rcx, rsi
call fcn.140295280
mov dword [r13], reloc.WS2_32.dll_recv
test edi, edi
jne 0x14029e577
mov edi, r15d
mov r12d, 0x2733
lea rcx, [rbx + 0x2d8]
mov dword [rbx + 0x28], 0
call fcn.14029bd50
cmp dword [rsp + 0x30], 0
je 0x14029e697
mov rcx, qword [0x14062e6a8]
mov rcx, qword [rcx + 0x80]
call qword [sym.imp.WS2_32.dll_WSASetEvent]
jmp 0x14029e697
xor edi, edi
cmp qword [rbx + 0x10], 0xffffffffffffffff
jne 0x14029e5c4
mov edi, 0xfffffff5
mov dword [rbx + 0x28], edi
jmp 0x14029e69b
test rsi, rsi
je 0x14029e671
cmp dword [rbx + 0x18], 2
jne 0x14029e5f2
mov rcx, qword [rbx + 0x10]
xor r9d, r9d
mov qword [rsp + 0x28], r13
mov r8d, ebp
mov rdx, r14
mov qword [rsp + 0x20], rsi
call qword [sym.imp.WS2_32.dll_recvfrom]
mov edi, eax
cmp dword [rbx + 0x18], 0x17
jne 0x14029e655
mov rcx, qword [rbx + 0x10]
mov eax, 2
mov word [rsp + 0x38], ax
xor r9d, r9d
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0x1c
mov qword [rsp + 0x28], rax
mov r8d, ebp
lea rax, [rsp + 0x38]
mov rdx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_recvfrom]
mov edi, eax
test eax, eax
jle 0x14029e655
mov rcx, qword [0x14062e6a8]
lea r8, [rsp + 0x38]
add rcx, 0x90
mov r9, r13
mov rdx, rsi
call fcn.1402a1920
call fcn.1402a3cf0
mov byte [rsi + 0xb], al
shr eax, 8
mov byte [rsi + 0xa], al
shr eax, 8
mov byte [rsi + 9], al
shr eax, 8
mov byte [rsi + 8], al
jmp 0x14029e686
mov rcx, qword [rbx + 0x10]
xor r9d, r9d
mov r8d, ebp
mov rdx, r14
call qword [sym.imp.WS2_32.dll_recv]
mov edi, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2738
mov r12d, eax
cmove edi, ebp
test edi, edi
je 0x14029e6a8
mov edx, r12d
mov ecx, edi
call fcn.14029fbb0
mov r15d, eax
mov edx, dword [rbx + 0x28]
lea rcx, [rbx + 0x1e0]
lea r8, str.recv
call fcn.1402a2f50
mov eax, r15d
mov dword [rbx + 0x28], r15d
mov r15, qword [rsp + 0x60]
mov rdi, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140284180
add rsp, 0x68
pop r14
pop r13
pop r12
pop rsi
pop rbp
pop rbx
ret
Function at 0x14029e6f0
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x140601e40]
xor rax, rsp
mov qword [rsp + 0x50], rax
cmp byte [rcx + 0x134], 0
mov esi, r8d
mov rdi, qword [rsp + 0xb0]
mov rbp, rdx
mov r14, qword [0x14062e6a8]
mov rbx, rcx
je 0x14029e75c
mov r9, rdx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], r8d
lea rcx, [r14 + 0xb8]
mov r8d, dword [rbx + 0x1c]
mov rdx, rbx
call fcn.1402a3130
test eax, eax
je 0x14029e75c
mov ecx, 0xfffffff9
cmovs eax, ecx
jmp 0x14029e848
cmp qword [rbx + 0x10], 0xffffffffffffffff
jne 0x14029e774
mov dword [rbx + 0x28], 0xfffffff5
mov eax, 0xfffffff5
jmp 0x14029e848
mov edx, dword [rbx + 0x1c]
lea rcx, [rbx + 0x138]
lea r9, str.send
mov r8d, esi
call fcn.1402a2d80
mov esi, eax
test eax, eax
je 0x14029e848
test rdi, rdi
jne 0x14029e7b1
mov rcx, qword [rbx + 0x10]
xor r9d, r9d
mov r8d, esi
mov rdx, rbp
call qword [sym.imp.WS2_32.dll_send]
jmp 0x14029e81f
cmp dword [rbx + 0x18], 0x17
jne 0x14029e7fc
mov edx, 0x1c
lea rcx, [rsp + 0x30]
call fcn.140295260
mov eax, reloc.WS2_32.dll_socket
mov dword [rsp + 0xb8], 0x1c
lea rcx, [r14 + 0x90]
mov word [rsp + 0x30], ax
lea r9, [rsp + 0xb8]
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.1402a1920
lea rdi, [rsp + 0x30]
mov eax, dword [rsp + 0xb8]
xor r9d, r9d
mov rcx, qword [rbx + 0x10]
mov r8d, esi
mov dword [rsp + 0x28], eax
mov rdx, rbp
mov qword [rsp + 0x20], rdi
call qword [sym.imp.WS2_32.dll_sendto]
lea rcx, [rbx + 0x138]
mov edx, eax
lea r8, str.send
mov edi, eax
call fcn.1402a2f50
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
mov ecx, edi
call fcn.14029fbb0
mov dword [rbx + 0x28], eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140284180
add rsp, 0x60
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14029f180
Capabilities:
Set socket configuration

Disassembly:
cmp ecx, 1
je 0x14029e43f
mov rax, qword [0x14062e6a8]
mov ecx, dword [rax + 0x5c]
mov r9d, r8d
mov r8d, edx
mov edx, ecx
mov rcx, 0xffffffffffffffff
jmp 0x14029f180
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rsi, qword [0x14062e6a8]
mov eax, 1
xor r13d, r13d
mov dword [r11 + 0x18], eax
cmp r8d, eax
mov dword [r11 - 0x38], r13d
mov r12d, r9d
mov ebp, r8d
mov r9, qword [rsi + 0x68]
mov r14d, edx
mov r8d, dword [rsi + 0x64]
mov rdi, rcx
mov r15d, 8
mov edx, 0x64736f63
mov ecx, 0x330
cmovne r15d, eax
call fcn.140251930
mov rbx, rax
test rax, rax
je 0x14029f25e
mov edx, 0x330
mov rcx, rax
call fcn.140295260
cmp rdi, 0xffffffffffffffff
jne 0x14029f225
mov dword [rsp + 0x28], 1
xor r9d, r9d
mov r8d, r12d
mov dword [rsp + 0x20], r13d
mov edx, ebp
mov ecx, r14d
call qword [sym.imp.WS2_32.dll_WSASocketW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14029f249
mov r8, qword [rsi + 0x68]
mov ecx, r15d
mov edx, dword [rsi + 0x64]
call fcn.1402a27e0
mov qword [rbx + 0x320], rax
mov rcx, rdi
test rax, rax
jne 0x14029f265
call qword [sym.imp.WS2_32.dll_closesocket]
mov r9, qword [rsi + 0x68]
mov edx, 0x64736f63
mov r8d, dword [rsi + 0x64]
mov rcx, rbx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
xor eax, eax
jmp 0x14029f37d
lea r8, [rsp + 0x80]
mov dword [rbx + 0x318], 0xffffffff
mov edx, 0x8004667e
mov qword [rbx + 0x10], rdi
mov dword [rbx + 0x28], r13d
mov byte [rbx + 0x133], 1
call qword [sym.imp.WS2_32.dll_ioctlsocket]
cmp ebp, 2
jne 0x14029f2a1
mov edx, 0xffff
lea r8d, [rbp + 0x1e]
jmp 0x14029f2ac
cmp ebp, 3
jne 0x14029f2c5
xor edx, edx
lea r8d, [rbp - 1]
lea r9, [rsp + 0x80]
mov dword [rsp + 0x20], 4
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp r14d, 0x17
jne 0x14029f2e9
lea r9, [rsp + 0x30]
mov dword [rsp + 0x20], 4
lea edx, [r14 + 0x12]
mov rcx, rdi
lea r8d, [r14 + 4]
call qword [sym.imp.WS2_32.dll_setsockopt]
lea eax, [rbp - 2]
mov dword [rbx + 0x18], r14d
cmp eax, 1
mov dword [rbx + 0x1c], ebp
mov dword [rbx + 0x20], r12d
setbe cl
mov byte [rbx + 0x134], 1
mov byte [rbx + 0x132], cl
cmp ebp, 2
jne 0x14029f327
xor r9d, r9d
mov qword [rsp + 0x20], r13
xor r8d, r8d
mov edx, 0x75637274
mov rcx, rbx
call fcn.14029d1e0
lea rcx, [rbx + 0x2b8]
mov edx, 0x20
call fcn.140295260
call qword [sym.imp.WS2_32.dll_WSACreateEvent]
lea rcx, [rbx + 0x2d8]
mov qword [rbx + 0x2d0], rax
lea rdx, [0x14047d1f0]
call fcn.14029bb00
call fcn.1402a3cf0
xor ecx, ecx
mov dword [rbx + 0x28c], eax
call fcn.14029bad0
mov rax, qword [rsi]
xor ecx, ecx
mov qword [rbx], rax
mov qword [rsi], rbx
call fcn.14029bd50
mov rax, rbx
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1402a9150
Capabilities:
Hash data using sha224
Hash data using sha256
Hash data using sha384
Hash data using sha512

Disassembly:
cmp dl, 0x30
mov dword [rcx], 0
mov eax, 0x80
mov byte [rcx + 6], 0
mov r8d, 0x40
mov byte [rcx + 4], dl
cmovb eax, r8d
mov byte [rcx + 5], al
cmp dl, 0x1c
jne 0x1402a91b0
mov dword [rcx + 8], 0xc1059ed8
mov dword [rcx + 0xc], 0x367cd507
mov dword [rcx + 0x10], 0x3070dd17
mov dword [rcx + 0x14], 0xf70e5939
mov dword [rcx + 0x18], 0xffc00b31
mov dword [rcx + 0x1c], 0x68581511
mov dword [rcx + 0x20], 0x64f98fa7
mov dword [rcx + 0x24], 0xbefa4fa4
ret
cmp dl, 0x20
jne 0x1402a91ee
mov dword [rcx + 8], 0x6a09e667
mov dword [rcx + 0xc], 0xbb67ae85
mov dword [rcx + 0x10], 0x3c6ef372
mov dword [rcx + 0x14], 0xa54ff53a
mov dword [rcx + 0x18], 0x510e527f
mov dword [rcx + 0x1c], 0x9b05688c
mov dword [rcx + 0x20], 0x1f83d9ab
mov dword [rcx + 0x24], 0x5be0cd19
ret
cmp dl, 0x30
jne 0x1402a9264
movabs rax, 0xcbbb9d5dc1059ed8
mov qword [rcx + 8], rax
movabs rax, 0x629a292a367cd507
mov qword [rcx + 0x10], rax
movabs rax, 0x9159015a3070dd17
mov qword [rcx + 0x18], rax
movabs rax, 0x152fecd8f70e5939
mov qword [rcx + 0x20], rax
movabs rax, 0x67332667ffc00b31
mov qword [rcx + 0x28], rax
movabs rax, 0x8eb44a8768581511
mov qword [rcx + 0x30], rax
movabs rax, 0xdb0c2e0d64f98fa7
mov qword [rcx + 0x38], rax
movabs rax, 0x47b5481dbefa4fa4
mov qword [rcx + 0x40], rax
ret
cmp dl, r8b
jne 0x1402a92d9
movabs rax, 0x6a09e667f3bcc908
mov qword [rcx + 8], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rcx + 0x10], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rcx + 0x18], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rcx + 0x20], rax
movabs rax, 0x510e527fade682d1
mov qword [rcx + 0x28], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x30], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x38], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rcx + 0x40], rax
ret
Function at 0x1402aadf0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov ebx, r8d
mov edx, 0x50
mov rsi, rcx
call fcn.140295260
mov r8d, ebx
mov dword [rsi + 0x40], 1
mov rdx, rdi
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x1402ab510
movzx eax, byte [rdx + 2]
mov r10, rcx
movzx r9d, byte [rdx + 3]
shl r9d, 8
or r9d, eax
movzx eax, byte [rdx + 1]
shl r9d, 8
or r9d, eax
movzx eax, byte [rdx]
shl r9d, 8
or r9d, eax
mov dword [rcx + 0x10], r9d
movzx eax, byte [rdx + 6]
movzx ecx, byte [rdx + 7]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 4]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x14], ecx
movzx eax, byte [rdx + 0xa]
movzx ecx, byte [rdx + 0xb]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 8]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x18], ecx
movzx eax, byte [rdx + 0xe]
movzx ecx, byte [rdx + 0xf]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0xd]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0xc]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x1c], ecx
cmp r8d, 0x20
jne 0x1402ab5b8
add rdx, 0x10
lea r8, [0x14047d740]
jmp 0x1402ab5bf
lea r8, [0x14047d750]
movzx eax, byte [rdx + 2]
movzx ecx, byte [rdx + 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x20], ecx
movzx eax, byte [rdx + 6]
movzx ecx, byte [rdx + 7]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 4]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x24], ecx
movzx eax, byte [rdx + 0xa]
movzx ecx, byte [rdx + 0xb]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 8]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x28], ecx
movzx eax, byte [rdx + 0xe]
movzx ecx, byte [rdx + 0xf]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0xd]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0xc]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x2c], ecx
movsx eax, byte [r8 + 2]
movsx ecx, byte [r8 + 3]
shl ecx, 8
or ecx, eax
movsx eax, byte [r8 + 1]
shl ecx, 8
or ecx, eax
movsx eax, byte [r8]
shl ecx, 8
or ecx, eax
mov dword [r10], ecx
movsx eax, byte [r8 + 6]
movsx ecx, byte [r8 + 7]
shl ecx, 8
or ecx, eax
movsx eax, byte [r8 + 5]
shl ecx, 8
or ecx, eax
movsx eax, byte [r8 + 4]
shl ecx, 8
or ecx, eax
mov dword [r10 + 4], ecx
movsx eax, byte [r8 + 0xa]
movsx ecx, byte [r8 + 0xb]
shl ecx, 8
or ecx, eax
movsx eax, byte [r8 + 9]
shl ecx, 8
or ecx, eax
movsx eax, byte [r8 + 8]
shl ecx, 8
or ecx, eax
mov dword [r10 + 8], ecx
movsx ecx, byte [r8 + 0xf]
movsx eax, byte [r8 + 0xe]
shl ecx, 8
or ecx, eax
movsx eax, byte [r8 + 0xd]
shl ecx, 8
or ecx, eax
movsx eax, byte [r8 + 0xc]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0xc], ecx
ret
Function at 0x1402ab2c0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], rbx
push rdi
sub rsp, 0xd0
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
movaps xmmword [rax - 0x38], xmm8
movaps xmmword [rax - 0x48], xmm9
movaps xmmword [rax - 0x58], xmm10
movaps xmmword [rax - 0x68], xmm11
mov rax, qword [0x140601e40]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov edi, dword [rcx + 0x30]
mov r11d, r8d
mov dword [rcx + 0x30], 0
mov r10, rdx
movdqu xmm6, xmmword [rcx]
mov rbx, rcx
movdqu xmm5, xmmword [rcx + 0x10]
movdqa xmm8, xmm6
movdqu xmm2, xmmword [rcx + 0x20]
movdqa xmm9, xmm5
movdqu xmm0, xmmword [rcx + 0x30]
movdqa xmm10, xmm2
movdqa xmm11, xmm0
mov eax, 0xa
nop dword [rax]
movdqa xmm1, xmm5
paddd xmm1, xmm6
xorps xmm0, xmm1
movdqa xmm6, xmm0
psrld xmm0, 0x10
pslld xmm6, 0x10
xorps xmm6, xmm0
movdqa xmm4, xmm6
paddd xmm4, xmm2
movdqa xmm0, xmm4
xorps xmm0, xmm5
movdqa xmm2, xmm0
pslld xmm0, 0xc
psrld xmm2, 0x14
xorps xmm2, xmm0
movdqa xmm5, xmm2
paddd xmm5, xmm1
xorps xmm6, xmm5
movdqa xmm3, xmm6
pslld xmm6, 8
psrld xmm3, 0x18
xorps xmm3, xmm6
movdqa xmm6, xmm3
paddd xmm6, xmm4
movdqa xmm1, xmm6
xorps xmm1, xmm2
movdqa xmm0, xmm1
pslld xmm1, 7
psrld xmm0, 0x19
xorps xmm0, xmm1
pshufd xmm1, xmm6, 0x4e
pshufd xmm2, xmm0, 0x39
pshufd xmm0, xmm3, 0x93
movdqa xmm7, xmm2
paddd xmm7, xmm5
xorps xmm0, xmm7
movdqa xmm5, xmm0
psrld xmm0, 0x10
pslld xmm5, 0x10
xorps xmm5, xmm0
paddd xmm1, xmm5
movdqa xmm0, xmm1
xorps xmm0, xmm2
movdqa xmm4, xmm0
pslld xmm0, 0xc
psrld xmm4, 0x14
xorps xmm4, xmm0
movdqa xmm6, xmm4
paddd xmm6, xmm7
xorps xmm5, xmm6
movdqa xmm3, xmm5
pslld xmm5, 8
psrld xmm3, 0x18
xorps xmm3, xmm5
movdqa xmm2, xmm3
paddd xmm2, xmm1
movdqa xmm1, xmm2
pshufd xmm2, xmm2, 0x4e
xorps xmm1, xmm4
movdqa xmm0, xmm1
pslld xmm1, 7
psrld xmm0, 0x19
xorps xmm0, xmm1
pshufd xmm5, xmm0, 0x93
pshufd xmm0, xmm3, 0x39
sub rax, 1
jne 0x1402ab340
paddd xmm8, xmm6
lea r8, [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm8
paddd xmm9, xmm5
and byte [rsp + 0x27], 0xf
paddd xmm10, xmm2
and byte [rsp + 0x2b], 0xf
paddd xmm11, xmm0
and byte [rsp + 0x2f], 0xf
mov r9d, 0x20
and byte [rsp + 0x24], 0xfc
mov edx, r11d
and byte [rsp + 0x28], 0xfc
mov rcx, r10
and byte [rsp + 0x2c], 0xfc
psrldq xmm8, 3
movd eax, xmm8
movdqa xmmword [rsp + 0x30], xmm9
movdqa xmmword [rsp + 0x40], xmm10
and al, 0xf
movdqa xmmword [rsp + 0x50], xmm11
mov byte [rsp + 0x23], al
call fcn.140295280
mov dword [rbx + 0x30], edi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140284180
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
mov rsp, r11
pop rdi
ret
Function at 0x1402ac5a0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x140601e40]
xor rax, rsp
mov qword [rsp + 0x78], rax
movsxd rbx, dword [rsp + 0xf8]
lea rax, [rsp + 0x68]
mov dword [rsp + 0x50], ebx
mov rdi, rdx
mov rdx, qword [rsp + 0xe0]
mov esi, r9d
mov qword [rsp + 0x48], rax
mov r9, r8
mov eax, dword [rsp + 0xe8]
mov r8, qword [rsp + 0xd0]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0xd8]
mov qword [rsp + 0x38], rdx
mov edx, 1
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
mov r8, rdi
mov dword [rsp + 0x20], esi
call fcn.1402ac770
test eax, eax
jne 0x1402ac758
mov r10, qword [rsp + 0xf0]
xor edx, edx
mov r9d, edx
test ebx, ebx
jle 0x1402ac70c
cmp ebx, 8
jb 0x1402ac70c
mov ecx, ebx
mov qword [rsp + 0x88], rbp
xorps xmm4, xmm4
xorps xmm3, xmm3
and ecx, 0x80000007
jge 0x1402ac65f
dec ecx
or ecx, 0xfffffff8
inc ecx
mov eax, ebx
mov r8, r10
sub eax, ecx
mov r11, r10
movsxd rbp, eax
lea rax, [rsp + 0x68]
sub r8, rax
lea rax, [rsp + 0x68]
sub r11, rax
nop dword [rax]
movd xmm1, dword [rsp + rdx + 0x68]
lea rcx, [rsp + 0x68]
xorps xmm0, xmm0
add rcx, rdx
punpcklbw xmm1, xmm0
add r9d, 8
punpcklwd xmm1, xmm0
movd xmm2, dword [rcx + r11]
lea rcx, [rsp + 0x68]
punpcklbw xmm2, xmm0
add rcx, rdx
punpcklwd xmm2, xmm0
xorps xmm2, xmm1
orps xmm4, xmm2
movd xmm2, dword [rsp + rdx + 0x6c]
movd xmm1, dword [r8 + rcx + 4]
add rdx, 8
punpcklbw xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
orps xmm3, xmm2
cmp rdx, rbp
jl 0x1402ac680
mov rbp, qword [rsp + 0x88]
orps xmm3, xmm4
movdqa xmm0, xmm3
psrldq xmm0, 8
orps xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
orps xmm3, xmm0
movd edx, xmm3
movsxd rax, r9d
cmp rax, rbx
jge 0x1402ac741
lea rcx, [rsp + 0x68]
sub r10, rcx
nop dword [rax]
lea r8, [rsp + 0x68]
add r8, rax
movzx r9d, byte [r8 + r10]
movzx r8d, byte [rsp + rax + 0x68]
inc rax
xor r9d, r8d
or edx, r9d
cmp rax, rbx
jl 0x1402ac720
test edx, edx
je 0x1402ac756
mov edx, esi
mov rcx, rdi
call fcn.140295260
mov eax, 0xffffffff
jmp 0x1402ac758
xor eax, eax
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140284180
add rsp, 0x90
pop rdi
pop rsi
pop rbx
ret
Function at 0x1402ac770
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r15
sub rsp, 0x68
mov rax, qword [0x140601e40]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xe8]
mov ebx, edx
mov rbp, qword [rsp + 0xc8]
mov rdi, rcx
movsxd rsi, dword [rsp + 0xe0]
add rcx, 0x120
mov edx, reloc.WS2_32.dll_recv
mov qword [rsp + 0x28], rax
mov r15, r9
mov r12, r8
call fcn.140295260
lea rcx, [rdi + 0x130]
mov edx, reloc.WS2_32.dll_recv
call fcn.140295260
xor eax, eax
mov dword [rdi + 0x140], ebx
cmp dword [rsp + 0xd0], 0xc
mov qword [rdi + 0x100], rax
mov qword [rdi + 0x108], rax
jne 0x1402ac9d1
lea rcx, [rdi + 0x120]
mov qword [rsp + 0x60], r14
lea r8d, [rax + 0xc]
mov rdx, rbp
call fcn.140295270
lea r8, [rdi + 0x110]
mov byte [rdi + 0x12f], 1
lea rdx, [rdi + 0x120]
lea rcx, [rdi + 0x144]
call fcn.140299ed0
mov r14, qword [rsp + 0xd8]
mov qword [rdi + 0x108], rsi
test esi, esi
jle 0x1402ac8a7
nop word [rax + rax]
mov ebx, reloc.WS2_32.dll_recv
cmp esi, ebx
cmovl ebx, esi
movsxd rdx, ebx
test ebx, ebx
jle 0x1402ac885
mov r8, r14
lea rax, [rdi + 0x130]
sub r8, rdi
nop
movzx ecx, byte [r8 + rax - 0x130]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x1402ac870
lea r8, [rdi + 0x130]
mov rcx, rdi
lea rdx, [rdi + 0x130]
call fcn.1402acdf0
movsxd rax, ebx
sub esi, ebx
add r14, rax
test esi, esi
jg 0x1402ac850
movsxd rbp, dword [rsp + 0xc0]
add qword [rdi + 0x100], rbp
test ebp, ebp
jle 0x1402ac9b5
mov rsi, 0xfffffffffffffee1
mov qword [rsp + 0xa8], r13
sub rsi, rdi
mov ebx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x40]
cmp ebp, ebx
mov rdx, r15
cmovl ebx, ebp
mov r8d, ebx
call fcn.140295270
lea rcx, [rdi + 0x12f]
add byte [rcx], 1
jne 0x1402ac903
dec rcx
lea rax, [rsi + rcx]
cmp rax, 0xc
jg 0x1402ac8f1
lea r8, [rsp + 0x30]
lea rdx, [rdi + 0x120]
lea rcx, [rdi + 0x144]
call fcn.140299ed0
movsxd r9, ebx
test ebx, ebx
jle 0x1402ac981
lea r10, [rsp + 0x30]
mov r11, r12
lea r8, [rsp + 0x40]
sub r10, rdi
sub r8, rdi
lea rcx, [rdi + 0x130]
sub r11, rdi
nop
cmp dword [rdi + 0x140], 1
jne 0x1402ac954
movzx eax, byte [rcx + r8 - 0x130]
xor byte [rcx], al
movzx edx, byte [r10 + rcx - 0x130]
xor dl, byte [rcx + r8 - 0x130]
mov byte [r11 + rcx - 0x130], dl
cmp dword [rdi + 0x140], 0
jne 0x1402ac978
xor byte [rcx], dl
inc rcx
sub r9, 1
jne 0x1402ac940
lea r8, [rdi + 0x130]
mov rcx, rdi
lea rdx, [rdi + 0x130]
call fcn.1402acdf0
movsxd rax, ebx
sub ebp, ebx
add r15, rax
movsxd rax, ebx
add r12, rax
test ebp, ebp
jg 0x1402ac8d0
mov r13, qword [rsp + 0xa8]
mov r8d, dword [rsp + 0xf0]
mov rcx, rdi
mov rdx, qword [rsp + 0x28]
call fcn.1402ac9f0
mov r14, qword [rsp + 0x60]
jmp 0x1402ac9d6
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140284180
add rsp, 0x68
pop r15
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1402ac9f0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x80
mov rax, qword [0x140601e40]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rdi, qword [rcx + 0x100]
mov rbx, rdx
mov r14, qword [rcx + 0x108]
shl rdi, 3
shl r14, 3
mov dword [rsp + 0x20], r8d
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], r14
cmp r8d, 0x10
jle 0x1402aca4d
mov eax, 0xffffffff
jmp 0x1402acbdb
test r8d, r8d
jle 0x1402aca61
lea rdx, [rcx + 0x110]
mov rcx, rbx
call fcn.140295270
test rdi, rdi
jne 0x1402aca6f
test r14, r14
je 0x1402acbd9
mov qword [rsp + 0xb8], rbp
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x78], rsi
mov edx, reloc.WS2_32.dll_recv
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x60], r15
call fcn.140295260
mov rbx, qword [rsp + 0x28]
mov rax, r14
mov r8, qword [rsp + 0x30]
mov r9, r14
shr rax, 0x38
mov rsi, r14
mov r12, r14
shr r8, 0x18
xor byte [rbx + 0x130], al
mov rcx, r14
mov rax, qword [rsp + 0x40]
mov r10, r14
mov rbp, r14
shr rcx, 0x18
shr r9, 0x30
mov rdx, rdi
xor byte [rbx + 0x131], r9b
mov r11, rdi
shr rdx, 0x38
mov r14, rdi
shr rsi, 0x28
mov r13, rdi
xor byte [rbx + 0x132], sil
mov r15, rdi
shr r10, 0x10
mov rsi, rbx
shr r11, 0x30
shr r12, 0x20
xor byte [rbx + 0x133], r12b
xor byte [rbx + 0x134], cl
mov rcx, rbx
xor byte [rbx + 0x135], r10b
shr rbp, 8
xor byte [rbx + 0x136], bpl
xor byte [rbx + 0x137], al
xor byte [rbx + 0x138], dl
lea rdx, [rbx + 0x130]
xor byte [rbx + 0x139], r11b
mov rax, qword [rsp + 0x30]
shr r14, 0x28
xor byte [rbx + 0x13a], r14b
shr r13, 0x20
xor byte [rbx + 0x13b], r13b
xor byte [rbx + 0x13c], r8b
lea r8, [rbx + 0x130]
shr rdi, 0x10
xor byte [rbx + 0x13d], dil
shr r15, 8
xor byte [rbx + 0x13e], r15b
xor byte [rbx + 0x13f], al
call fcn.1402acdf0
movsxd rcx, dword [rsp + 0x20]
mov r15, qword [rsp + 0x60]
mov r13, qword [rsp + 0x68]
mov r12, qword [rsp + 0x70]
mov rbp, qword [rsp + 0xb8]
mov rbx, qword [rsp + 0x38]
test rcx, rcx
jle 0x1402acbd4
sub rsi, rbx
nop word [rax + rax]
movzx eax, byte [rsi + rbx + 0x130]
xor byte [rbx], al
lea rbx, [rbx + 1]
sub rcx, 1
jne 0x1402acbc0
mov rsi, qword [rsp + 0x78]
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140284180
add rsp, 0x80
pop r14
pop rdi
pop rbx
ret