joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14018d940
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x1405ec140]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor edi, edi
lea rsi, [rsp]
mov r11d, edi
mov rbx, rcx
nop word [rax + rax]
mov ecx, 4
lea rsi, [rsi + 8]
mov r10d, r11d
mov eax, 0xcccccccd
mul r11d
mov r9d, edx
shr r9d, 2
sub ecx, r9d
lea eax, [r9 + r9*4]
lea r8d, [r11 + rcx*4]
sub r10d, eax
add r8d, ecx
mov ecx, 3
sub ecx, r9d
mov rdx, qword [rbx + r8*8]
lea eax, [r11 + rcx*4]
add ecx, eax
xor rdx, qword [rbx + rcx*8]
mov ecx, 2
sub ecx, r9d
lea eax, [r11 + rcx*4]
inc r11d
add ecx, eax
lea eax, [r10 + 5]
xor rdx, qword [rbx + rcx*8]
xor rdx, qword [rbx + rax*8]
xor rdx, qword [rbx + r10*8]
mov qword [rsi - 8], rdx
cmp r11d, 5
jb 0x14018d970
mov r9, qword [rsp + 0x20]
mov r11, qword [rsp + 8]
mov r10, qword [rsp + 0x10]
mov rcx, r11
mov rdx, qword [rsp]
mov r8, qword [rsp + 0x18]
shr rcx, 0x3f
lea rax, [r11 + r11]
xor rcx, rax
lea rax, [r10 + r10]
xor rcx, r9
mov qword [rsp + 0x28], rcx
mov rcx, r10
shr rcx, 0x3f
xor rcx, rax
lea rax, [r8 + r8]
xor rcx, rdx
mov qword [rsp + 0x30], rcx
mov rcx, r8
shr rcx, 0x3f
xor rcx, rax
lea rax, [r9 + r9]
xor rcx, r11
mov qword [rsp + 0x38], rcx
mov rcx, r9
shr rcx, 0x3f
lea r9, [rsp + 0x28]
xor rcx, rax
lea rax, [rdx + rdx]
xor rcx, r10
mov qword [rsp + 0x40], rcx
mov rcx, rdx
shr rcx, 0x3f
xor rcx, rax
xor rcx, r8
mov qword [rsp + 0x48], rcx
nop dword [rax + rax]
mov r8, qword [r9]
lea r9, [r9 + 8]
mov ecx, edi
mov eax, 0xcccccccd
mul edi
shr edx, 2
lea eax, [rdx + rdx*4]
sub ecx, eax
mov eax, ecx
add eax, 5
xor qword [rbx + rcx*8], r8
mov ecx, 2
sub ecx, edx
xor qword [rbx + rax*8], r8
lea eax, [rdi + rcx*4]
add ecx, eax
xor qword [rbx + rcx*8], r8
mov ecx, 3
sub ecx, edx
lea eax, [rdi + rcx*4]
add ecx, eax
xor qword [rbx + rcx*8], r8
mov ecx, 4
sub ecx, edx
lea eax, [rdi + rcx*4]
inc edi
add ecx, eax
xor qword [rbx + rcx*8], r8
cmp edi, 5
jb 0x14018da70
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1403ff380
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x14018de40
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push r12
sub rsp, 0x28
mov ebp, dword [rcx + 0xc8]
mov r12, r8
shr ebp, 3
mov rsi, rdx
cmp dword [rcx + 0xd0], 0
mov rdi, rcx
je 0x14018de74
mov eax, 1
add rsp, 0x28
pop r12
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + 0x58], r13
xor r13d, r13d
mov qword [rsp + 0x60], r14
mov r14d, r13d
test r12, r12
je 0x14018e04d
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x20], r15
nop word [rax + rax]
mov r8d, dword [rdi + 0xcc]
test r8d, r8d
jne 0x14018dff3
lea rax, [r14 + rbp]
mov r15d, ebp
cmp r12, rax
jb 0x14018dff3
mov rbx, r12
sub rbx, r14
cmp rbx, r15
jb 0x14018dfeb
nop
mov eax, r13d
test ebp, ebp
je 0x14018dfd4
cmp ebp, 8
jb 0x14018dfaf
lea ecx, [rbp - 1]
lea r8, [rcx + rdi]
add rcx, rsi
cmp rdi, rcx
ja 0x14018defc
cmp r8, rsi
jae 0x14018dfaf
cmp ebp, 0x40
jb 0x14018df87
mov r8d, ebp
mov r9d, ebp
and r8d, 0x3f
sub r9d, r8d
mov r10d, 0x20
nop dword [rax + rax]
mov ecx, eax
add eax, 0x40
movdqu xmm0, xmmword [rdi + rcx]
movdqu xmm1, xmmword [rcx + rsi]
xorps xmm1, xmm0
movdqu xmmword [rdi + rcx], xmm1
lea ecx, [r10 - 0x10]
movdqu xmm0, xmmword [rdi + rcx]
movdqu xmm1, xmmword [rcx + rsi]
xorps xmm1, xmm0
movdqu xmmword [rdi + rcx], xmm1
mov ecx, r10d
movdqu xmm0, xmmword [rcx + rdi]
movdqu xmm1, xmmword [rcx + rsi]
xorps xmm1, xmm0
movdqu xmmword [rcx + rdi], xmm1
lea ecx, [r10 + 0x10]
add r10d, 0x40
movdqu xmm0, xmmword [rdi + rcx]
movdqu xmm1, xmmword [rcx + rsi]
xorps xmm1, xmm0
movdqu xmmword [rdi + rcx], xmm1
cmp eax, r9d
jb 0x14018df20
cmp r8d, 8
jb 0x14018dfab
mov edx, ebp
and edx, 0xfffffff8
nop dword [rax]
mov ecx, eax
add eax, 8
movq xmm0, qword [rdi + rcx]
movq xmm1, qword [rcx + rsi]
xorps xmm1, xmm0
movq qword [rdi + rcx], xmm1
cmp eax, edx
jb 0x14018df90
cmp eax, ebp
jae 0x14018dfd4
mov ecx, eax
mov r9d, ebp
sub r9d, eax
lea r8, [rcx + rsi]
lea rdx, [rcx + rdi]
nop
movzx eax, byte [r8]
lea r8, [r8 + 1]
xor byte [rdx], al
lea rdx, [rdx + 1]
sub r9, 1
jne 0x14018dfc0
mov rcx, rdi
call fcn.14018d7f0
add rsi, r15
sub rbx, r15
cmp rbx, r15
jae 0x14018ded0
mov r14, r12
sub r14, rbx
jmp 0x14018e03a
mov edx, r12d
mov ecx, ebp
sub edx, r14d
sub ecx, r8d
lea eax, [rdx + r8]
cmp eax, ebp
cmovbe ecx, edx
mov rdx, rsi
mov ebx, ecx
mov r9d, ecx
mov rcx, rdi
add r14, rbx
call fcn.14018d670
add dword [rdi + 0xcc], ebx
add rsi, rbx
cmp dword [rdi + 0xcc], ebp
jne 0x14018e03a
mov rcx, rdi
call fcn.14018d7f0
mov dword [rdi + 0xcc], r13d
cmp r14, r12
jb 0x14018dea0
mov r15, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x60]
xor eax, eax
mov r13, qword [rsp + 0x58]
add rsp, 0x28
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14019ed20
Capabilities:
Delete service
Stop service

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1405ec140]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rcx
mov rcx, qword [rcx + 8]
cmp rcx, 0xffffffffffffffff
je 0x14019ed48
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
jne 0x14019ed66
mov al, 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1403ff380
add rsp, 0x50
pop rbx
ret
cmp byte [rbx], 0
mov qword [rsp + 0x68], rdi
mov dil, 1
jne 0x14019edbb
lea r8, [rsp + 0x20]
mov edx, 1
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, qword [rbx + 0x18]
test eax, eax
setne dil
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x14019edbb
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.e_43_1me_1_37m_msr_____e_0m
mov ecx, 3
mov r9d, eax
lea rdx, str._s_e_0_31mfailed_to_remove_WinRing0_driver__error__ue_0m
call fcn.140026a00
xor dil, dil
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
movzx eax, dil
mov qword [rbx + 0x18], 0
mov rdi, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1403ff380
add rsp, 0x50
pop rbx
ret
Function at 0x1401a0fe0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push r12
push r14
sub rsp, 0x30
mov esi, dword [rcx + 8]
mov r14, rcx
mov eax, dword [rcx + 0xc]
lea ebx, [rsi + 4]
cmp ebx, eax
ja 0x1401a1026
nop
mov rax, qword [r14]
mov edx, esi
mov r9, qword [r14 + 0x10]
mov ecx, esi
shl rcx, 6
add rcx, qword [rax + 0x18]
call fcn.1401b1c4c
mov eax, dword [r14 + 0xc]
add esi, 4
add ebx, 4
cmp ebx, eax
jbe 0x1401a1000
cmp esi, eax
jae 0x1401a11f4
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], r15
mov r15d, dword [0x1405ec188]
nop dword [rax]
nop dword [rax + rax]
mov rdi, qword [r14 + 0x10]
mov r9d, 0x40
mov rax, qword [r14]
mov ecx, esi
mov ebx, esi
mov rbp, qword [rdi]
mov edx, dword [rdi + 0x20]
add rdx, rcx
shl rbx, 6
add rbx, qword [rax + 0x18]
mov ecx, dword [rdi + 0x24]
mov r8, rbx
mov eax, dword [rdi + 0x1c]
imul rdx, rax
mov dword [rsp + 0x28], 0x40
shr rdx, cl
mov ecx, esi
imul edx, dword [rdi + 0x18]
mov qword [rsp + 0x20], rbx
sub ecx, edx
shl rcx, 6
movups xmm0, xmmword [rcx + rbp]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rcx + rbp + 0x10]
movups xmmword [rbx + 0x10], xmm1
movups xmm0, xmmword [rcx + rbp + 0x20]
movups xmmword [rbx + 0x20], xmm0
movups xmm1, xmmword [rcx + rbp + 0x30]
mov ecx, 0x200
movups xmmword [rbx + 0x30], xmm1
xor dword [rbx], esi
call fcn.140015c90
xor r10d, r10d
xor r11d, r11d
nop
mov ecx, dword [rdi + 0x24]
mov rdx, r11
and edx, 0xf
mov eax, r10d
xor eax, esi
imul r8d, eax, 0x1000193
mov eax, dword [rdi + 0x1c]
xor r8d, dword [rbx + rdx*4]
mov edx, dword [rdi + 0x20]
add rdx, r8
imul rdx, rax
shr rdx, cl
imul edx, dword [rdi + 0x18]
sub r8d, edx
mov edx, r8d
shl rdx, 6
add rdx, rbp
cmp r15d, 2
jl 0x1401a1185
lea rax, [rdx + 0x3c]
lea rcx, [rbx + 0x3c]
cmp rbx, rax
ja 0x1401a1122
cmp rcx, rdx
jae 0x1401a1185
movdqu xmm1, xmmword [rbx]
movdqa xmm2, xmmword [0x1405a6ef0]
movdqu xmm0, xmmword [rdx]
pmulld xmm1, xmm2
xorps xmm1, xmm0
movdqu xmm0, xmmword [rdx + 0x10]
movdqu xmmword [rbx], xmm1
movdqu xmm1, xmmword [rbx + 0x10]
pmulld xmm1, xmm2
xorps xmm1, xmm0
movdqu xmm0, xmmword [rdx + 0x20]
movdqu xmmword [rbx + 0x10], xmm1
movdqu xmm1, xmmword [rbx + 0x20]
pmulld xmm1, xmm2
xorps xmm1, xmm0
movdqu xmm0, xmmword [rdx + 0x30]
movdqu xmmword [rbx + 0x20], xmm1
movdqu xmm1, xmmword [rbx + 0x30]
pmulld xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rbx + 0x30], xmm1
jmp 0x1401a11a8
mov rax, rbx
sub rdx, rbx
mov r9d, reloc.WS2_32.dll_recv
imul ecx, dword [rax], 0x1000193
lea rax, [rax + 4]
xor ecx, dword [rdx + rax - 4]
mov dword [rax - 4], ecx
sub r9, 1
jne 0x1401a1191
inc r10d
inc r11
cmp r10d, 0x200
jne 0x1401a10d0
mov dword [rsp + 0x28], 0x40
mov r9d, 0x40
mov r8, rbx
mov qword [rsp + 0x20], rbx
mov ecx, r10d
call fcn.140015c90
inc esi
cmp esi, dword [r14 + 0xc]
jb 0x1401a1050
mov r15, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop r12
pop rsi
ret
Function at 0x1401a7b50
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rdx + 0x3f8]
lea r8, [rcx + 0x3f8]
cmp rcx, rax
ja 0x1401a7b83
cmp r8, rdx
jb 0x1401a7b83
sub rdx, rcx
mov r8d, 0x80
mov rax, qword [rdx + rcx]
xor qword [rcx], rax
lea rcx, [rcx + 8]
sub r8, 1
jne 0x1401a7b71
ret
lea rax, [rcx + 0x10]
sub rdx, rcx
mov ecx, reloc.WS2_32.dll_recv
nop
movdqu xmm0, xmmword [rax - 0x10]
movdqu xmm1, xmmword [rax + rdx - 0x10]
movdqu xmm2, xmmword [rax + rdx]
lea rax, [rax + 0x40]
xorps xmm1, xmm0
movdqu xmmword [rax - 0x50], xmm1
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmm1, xmmword [rax + rdx - 0x30]
xorps xmm2, xmm0
movdqu xmmword [rax - 0x40], xmm2
movdqu xmm0, xmmword [rax - 0x30]
xorps xmm1, xmm0
movdqu xmmword [rax - 0x30], xmm1
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm1, xmmword [rax + rdx - 0x20]
xorps xmm1, xmm0
movdqu xmmword [rax - 0x20], xmm1
sub rcx, 1
jne 0x1401a7b90
ret
Function at 0x1401b1af0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x80
mov rax, qword [0x1405ec140]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, rdx
mov rsi, rcx
test dl, 0x3f
je 0x1401b1b1f
xor al, al
jmp 0x1401b1c31
mov r14d, 0x40
shr rbx, 6
mov dword [rsp + 0x28], r14d
mov ecx, 0x200
mov qword [rsp + 0x20], rsi
lea r9d, [r14 - 0x20]
call fcn.140015c90
lea edi, [r14 - 0x3f]
cmp ebx, edi
je 0x1401b1b7a
mov ecx, edi
lea r8d, [rdi - 1]
shl rcx, 6
mov r9d, r14d
add rcx, rsi
shl r8, 6
mov dword [rsp + 0x28], r14d
add r8, rsi
mov qword [rsp + 0x20], rcx
mov ecx, 0x200
call fcn.140015c90
inc edi
cmp edi, ebx
jne 0x1401b1b49
mov ebp, 3
xor edi, edi
test ebx, ebx
je 0x1401b1c25
xor edx, edx
mov r9d, edi
shl r9, 6
add r9, rsi
mov eax, dword [r9]
div ebx
lea eax, [rbx - 1]
mov r8d, edx
add eax, edi
xor edx, edx
div ebx
lea rax, [rsp + 0x30]
mov ecx, edx
mov edx, r8d
shl rcx, 6
mov r8d, reloc.WS2_32.dll_recv
shl rdx, 6
sub rdx, rax
add rdx, rsi
movups xmm0, xmmword [rcx + rsi]
movups xmm1, xmmword [rcx + rsi + 0x10]
movaps xmmword [rsp + 0x30], xmm0
movups xmm0, xmmword [rcx + rsi + 0x20]
movaps xmmword [rsp + 0x40], xmm1
movups xmm1, xmmword [rcx + rsi + 0x30]
lea rcx, [rsp + 0x30]
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x60], xmm1
mov eax, dword [rdx + rcx]
xor dword [rcx], eax
lea rcx, [rcx + 4]
sub r8, 1
jne 0x1401b1bf0
mov dword [rsp + 0x28], r14d
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r9
mov ecx, 0x200
mov r9d, r14d
call fcn.140015c90
inc edi
cmp edi, ebx
jne 0x1401b1b89
sub rbp, 1
jne 0x1401b1b7f
mov al, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1403ff380
add rsp, 0x80
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1401b4fe0
Capabilities:
Hash data using sha256

Disassembly:
mov r11, rsp
push rbx
push rsi
push r14
sub rsp, 0xc0
mov rax, qword [0x1405ec140]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rsi, r8
mov rbx, rdx
mov r14, rcx
movups xmm0, xmmword [0x140558928]
movups xmm1, xmmword [0x140558938]
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [r11 - 0x58], xmm1
mov qword [r11 - 0x48], 0
cmp r8, 0x80
jae 0x1401b503e
lea rcx, [rsp + 0x30]
call fcn.1401b4e50
jmp 0x1401b50a4
mov qword [rsp + 0xb8], rbp
mov qword [rsp + 0xb0], rdi
mov rdi, rsi
shr rdi, 6
imul rbp, rdi, 0xffffffffffffffc0
add rbp, rsi
nop dword [rax]
lea rdx, [rsp + 0x70]
mov rcx, rbx
call fcn.1401b27f0
add rbx, 0x40
sub rdi, 1
jne 0x1401b5060
mov rdi, qword [rsp + 0xb0]
test rbp, rbp
je 0x1401b5094
mov r8, rbp
lea rcx, [rsp + 0x30]
mov rdx, rbx
call fcn.140431380
add qword [rsp + 0x90], rsi
mov rbp, qword [rsp + 0xb8]
mov r9, r14
lea rcx, [rsp + 0x30]
call fcn.1401b4f00
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1403ff380
add rsp, 0xc0
pop r14
pop rsi
pop rbx
ret
Function at 0x140256770
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x28
call fcn.1403ffe50
sub rsp, rax
mov r10, rcx
test r9, r9
jne 0x1402567ba
call fcn.14025a6f0
lea r8, str.c2i_ibuf
mov edx, 0xa0
lea rcx, str.crypto_asn1_a_int.c
call fcn.14025a810
xor r8d, r8d
mov edx, 0xde
lea ecx, [r8 + 0xd]
call fcn.14025a910
xor eax, eax
add rsp, 0x28
ret
mov qword [rsp + 0x20], rbx
movzx ebx, byte [r8]
and ebx, 0x80
test rdx, rdx
je 0x1402567d0
mov dword [rdx], ebx
cmp r9, 1
jne 0x1402567f6
test r10, r10
je 0x1402567e7
movzx eax, byte [r8]
test ebx, ebx
je 0x1402567e5
neg al
mov byte [rcx], al
mov rbx, qword [rsp + 0x20]
mov eax, 1
add rsp, 0x28
ret
movzx ecx, byte [r8]
xor r11d, r11d
mov eax, r11d
test cl, cl
jne 0x140256811
mov eax, 1
mov r11d, eax
jmp 0x1402568d1
cmp cl, 0xff
jne 0x14025691a
mov eax, 1
lea rcx, [r9 - 1]
mov edx, r11d
cmp r9, rax
jbe 0x1402568bf
cmp rcx, 8
jb 0x1402568b0
and ecx, 7
mov rdx, r9
sub rdx, rcx
xorps xmm2, xmm2
xorps xmm3, xmm3
nop dword [rax]
nop dword [rax + rax]
movd xmm1, dword [rax + r8]
xorps xmm0, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
por xmm2, xmm1
movd xmm1, dword [rax + r8 + 4]
punpcklbw xmm1, xmm0
add rax, 8
punpcklwd xmm1, xmm0
por xmm1, xmm3
movdqa xmm3, xmm1
cmp rax, rdx
jb 0x140256850
por xmm2, xmm1
movdqa xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd edx, xmm2
cmp rax, r9
jae 0x1402568bf
nop dword [rax]
movzx ecx, byte [rax + r8]
inc rax
or edx, ecx
cmp rax, r9
jb 0x1402568b0
test edx, edx
mov eax, r11d
setne al
test edx, edx
setne r11b
test edx, edx
je 0x14025691a
movzx ecx, byte [r8 + 1]
and ecx, 0x80
cmp ebx, ecx
jne 0x14025691a
call fcn.14025a6f0
lea r8, str.c2i_ibuf
mov edx, 0xc1
lea rcx, str.crypto_asn1_a_int.c
call fcn.14025a810
xor r8d, r8d
mov edx, 0xdd
lea ecx, [r8 + 0xd]
call fcn.14025a910
mov rbx, qword [rsp + 0x20]
xor eax, eax
add rsp, 0x28
ret
mov ecx, eax
sub r9, rcx
test r10, r10
je 0x14025696d
neg ebx
lea rax, [r11 + r8]
sbb r11d, r11d
movzx r11d, r11b
mov ecx, r11d
and ecx, 1
test r9, r9
je 0x14025696d
lea r8, [rax + r9]
mov rdx, r8
sub rdx, r8
add rdx, r9
nop dword [rax]
movzx eax, byte [r8 - 1]
lea r8, [r8 - 1]
dec rdx
xor eax, r11d
add ecx, eax
mov byte [r10 + rdx], cl
shr ecx, 8
test rdx, rdx
jne 0x140256950
mov rbx, qword [rsp + 0x20]
mov rax, r9
add rsp, 0x28
ret
Function at 0x140256980
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
xor r10d, r10d
xor r11b, r11b
mov rsi, r9
mov rbx, rcx
test rcx, rcx
je 0x140256a98
test rdx, rdx
je 0x140256a98
movzx eax, byte [rcx]
test r8d, r8d
jne 0x1402569c5
cmp al, 0x7f
jbe 0x140256a90
mov r10d, 1
mov eax, r10d
add rax, rdx
jmp 0x140256aa0
mov r11b, 0xff
cmp al, 0x80
jbe 0x1402569dd
mov r10d, 1
mov eax, r10d
add rax, rdx
jmp 0x140256aa0
jne 0x140256a90
mov eax, 1
lea rcx, [rdx - 1]
cmp rdx, rax
jbe 0x140256a7f
cmp rcx, 8
jb 0x140256a70
and ecx, 7
mov r8, rdx
sub r8, rcx
xorps xmm3, xmm3
xorps xmm2, xmm2
nop word [rax + rax]
movd xmm1, dword [rax + rbx]
xorps xmm0, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
por xmm3, xmm1
movd xmm1, dword [rax + rbx + 4]
punpcklbw xmm1, xmm0
add rax, 8
punpcklwd xmm1, xmm0
por xmm2, xmm1
cmp rax, r8
jb 0x140256a10
por xmm2, xmm3
movdqa xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd r10d, xmm2
cmp rax, rdx
jae 0x140256a7f
nop word [rax + rax]
movzx ecx, byte [rax + rbx]
inc rax
or r10d, ecx
cmp rax, rdx
jb 0x140256a70
neg r10d
sbb r11b, r11b
movzx r11d, r11b
mov r10d, r11d
and r10d, 1
mov eax, r10d
add rax, rdx
jmp 0x140256aa0
mov eax, 1
mov rdx, r10
test rsi, rsi
je 0x140256b0a
mov rcx, qword [r9]
test rcx, rcx
je 0x140256b0a
mov qword [rsp + 0x10], rdi
mov edi, r10d
movzx r8d, r11b
add rdi, rcx
and r8d, 1
mov byte [rcx], r11b
test rdx, rdx
je 0x140256b02
lea r10, [rbx + rdx]
mov r9, r10
sub r9, r10
add r9, rdx
nop word [rax + rax]
movzx edx, byte [r10 - 1]
lea r10, [r10 - 1]
dec r9
movzx ecx, r11b
xor edx, ecx
add r8d, edx
mov byte [rdi + r9], r8b
shr r8d, 8
test r9, r9
jne 0x140256ae0
add qword [rsi], rax
mov rdi, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
pop rsi
ret

Function at 0x140256d00
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x28
call fcn.1403ffe50
sub rsp, rax
mov r8d, dword [rcx + 4]
mov r9, rdx
movsxd rdx, dword [rcx]
and r8d, 0x100
mov rcx, qword [rcx + 8]
add rsp, 0x28
jmp fcn.140256980

Function at 0x14025a5e0
Capabilities:
Set thread local storage value

Disassembly:
mov eax, 0x28
call fcn.1403ffe50
sub rsp, rax
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x140260850
Capabilities:
Encode data using add xor sub operations

Disassembly:
xor eax, eax
mov r10, rcx
test rcx, rcx
je 0x1402608bc
movzx ecx, byte [rcx]
test cl, cl
je 0x1402608bc
mov r11d, 0x100
nop word [rax + rax]
movsx r9d, cl
lea r10, [r10 + 1]
or r9d, r11d
mov r8d, eax
mov edx, r9d
mov ecx, 0x20
shr edx, 2
add r11d, 0x100
xor edx, r9d
imul r9d, r9d
and edx, 0xf
sub ecx, edx
shr r8, cl
mov ecx, edx
mov edx, eax
mov eax, r8d
shl edx, cl
movzx ecx, byte [r10]
or eax, edx
xor eax, r9d
test cl, cl
jne 0x140260870
mov ecx, eax
shr ecx, 0x10
xor eax, ecx
ret
Function at 0x1402608c0
Capabilities:
Encode data using add xor sub operations

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x20
call fcn.1403ffe50
sub rsp, rax
xor ebx, ebx
mov rdi, rcx
test rcx, rcx
je 0x140260953
movzx eax, byte [rcx]
test al, al
je 0x140260953
mov qword [rsp + 0x30], rsi
mov esi, 0x100
nop
movsx ecx, al
call fcn.1402c4550
mov r9d, eax
mov edx, ebx
or r9d, esi
lea rdi, [rdi + 1]
mov eax, ebx
mov r8d, r9d
shr r8d, 2
mov ecx, 0x20
xor r8d, r9d
add esi, 0x100
and r8d, 0xf
imul r9d, r9d
sub ecx, r8d
shr rdx, cl
mov ecx, r8d
shl eax, cl
mov ebx, edx
or ebx, eax
movzx eax, byte [rdi]
xor ebx, r9d
test al, al
jne 0x1402608f0
mov rsi, qword [rsp + 0x30]
mov eax, ebx
shr eax, 0x10
xor eax, ebx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rdi
ret

Function at 0x14026fd20
Capabilities:
Get thread local storage value

Disassembly:
mov eax, 0x28
call fcn.1403ffe50
sub rsp, rax
lea rcx, [0x1405f6490]
add rsp, 0x28
jmp fcn.14025a460

Function at 0x140284740
Capabilities:
Encode data using xor

Disassembly:
xor r9b, r9b
mov r10, rdx
test r8, r8
je 0x140284767
sub r10, rcx
nop
movzx edx, byte [r10 + rcx]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
xor dl, al
or r9b, dl
sub r8, 1
jne 0x140284750
movzx eax, r9b
ret
Function at 0x1402992e0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov eax, 0x280
call fcn.1403ffe50
sub rsp, rax
mov rax, qword [0x1405ec140]
xor rax, rsp
mov qword [rsp + 0x270], rax
cmp dword [0x1405f6778], 0
lea rax, [0x140298c50]
mov qword [rsp + 0x28], rax
lea rbx, str.getaddrinfo
lea rax, str.getnameinfo
movzx ebp, cx
mov qword [rsp + 0x30], rax
lea rax, [0x1402990a0]
mov qword [rsp + 0x38], rax
lea rax, str.freeaddrinfo
mov qword [rsp + 0x40], rax
lea rax, [0x140298bf0]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x20], rbx
jne 0x1402994b9
mov edx, 0x104
lea rcx, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1402994af
lea r8, [rsp + 0x160]
mov qword [rsp + 0x290], rsi
mov edx, 0x10c
lea rcx, [rsp + 0x50]
call fcn.140418fa8
lea r8, str.ws2_32
mov edx, 0x10c
lea rcx, [rsp + 0x50]
call fcn.140419008
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x1402993da
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x14029943a
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea r8, [rsp + 0x160]
mov edx, 0x10c
lea rcx, [rsp + 0x50]
call fcn.140418fa8
lea r8, str.wship6
mov edx, 0x10c
lea rcx, [rsp + 0x50]
call fcn.140419008
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x1402994a7
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x14029943a
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1402994a7
mov qword [rsp + 0x298], rdi
lea rbx, [rsp + 0x28]
xor edi, edi
nop dword [rax]
mov rdx, qword [rbx - 8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx], rax
test rax, rax
je 0x140299496
inc edi
add rbx, 0x10
cmp edi, 3
jl 0x140299450
mov rax, qword [rsp + 0x28]
mov qword [0x1405ea390], rax
mov rax, qword [rsp + 0x38]
mov qword [0x1405ea3a0], rax
mov rax, qword [rsp + 0x48]
mov qword [0x1405ea3b0], rax
jmp 0x14029949f
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rdi, qword [rsp + 0x298]
mov rsi, qword [rsp + 0x290]
mov dword [0x1405f6778], 1
mov rax, rbp
lea rcx, str.getaddrinfo
add rax, rax
mov rax, qword [rcx + rax*8 + 8]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1403ff380
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x280
pop rbp
ret