joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009b610
Capabilities:
Encode data using xor

Disassembly:
mov dword [rsp + 0x18], r8d
push rbx
sub rsp, 0x30
mov rax, qword [rcx + 8]
mov rbx, rcx
mov edx, 0x11d0
lea rcx, [rsp + 0x50]
lea r8d, [rdx + 1]
mov r9d, socket
mov qword [rsp + 0x28], rcx
mov rcx, rbx
mov dword [rsp + 0x20], 0x40
call qword [rax + 0x60]
cmp dword [rsp + 0x50], 0
mov edx, eax
je 0x14009b737
mov rax, qword [rbx + 0x80]
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rdi
cmp dword [rax + 0x1c8], 0
jne 0x14009b68e
mov edi, 0xa
mov dword [rsp + 0x20], 0x103
lea r9, [0x140195308]
mov r8d, 0x9a
jmp 0x14009b70e
mov dword [rax + 0x1c8], 0
mov r9, qword [rbx + 0x80]
mov rcx, qword [rbx + 0x58]
movsxd rdi, dword [r9 + 0x394]
cmp edi, edx
je 0x14009b6c8
mov edi, 0x32
mov dword [rsp + 0x20], 0x10e
lea r9, [0x140195330]
lea r8d, [rdi + 0x3d]
jmp 0x14009b70e
xor dl, dl
test edi, edi
je 0x14009b73d
lea r10, [r9 + 0x314]
mov r8, rdi
sub r10, rcx
nop dword [rax + rax]
movzx eax, byte [r10 + rcx]
lea rcx, [rcx + 1]
xor al, byte [rcx - 1]
or dl, al
dec r8
jne 0x14009b6e0
test dl, dl
je 0x14009b73d
lea edi, [r8 + 0x33]
mov dword [rsp + 0x20], 0x115
lea r9, [0x140195358]
lea r8d, [rdi + 0x62]
mov edx, 0x8c
lea ecx, [rdx - 0x78]
call fcn.140073540
mov r8d, edi
mov edx, 2
mov rcx, rbx
call fcn.1400990f0
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
xor eax, eax
add rsp, 0x30
pop rbx
ret
cmp dword [rbx + 4], 0x2000
jne 0x14009b7bb
cmp edi, 0x40
jg 0x14009b784
lea rcx, [r9 + 0x418]
lea rdx, [r9 + 0x314]
mov r8, rdi
call sub.MSVCR120.dll_memcpy
mov rax, qword [rbx + 0x80]
mov rsi, qword [rsp + 0x40]
mov byte [rax + 0x458], dil
mov rdi, qword [rsp + 0x48]
mov eax, 1
add rsp, 0x30
pop rbx
ret
lea r9, [0x140195380]
lea rdx, [0x140195398]
lea rcx, str._s__d_:_OpenSSL_internal_error__assertion_failed:__s_n
mov r8d, 0x11d
call fcn.140090b40
mov ecx, reloc.WS2_32.dll_shutdown
call qword [sym.imp.MSVCR120.dll_raise]
mov ecx, 3
call qword [sym.imp.MSVCR120.dll__exit]
int3
cmp edi, 0x40
jg 0x14009b7f9
lea rcx, [r9 + 0x459]
lea rdx, [r9 + 0x314]
mov r8, rdi
call sub.MSVCR120.dll_memcpy
mov rax, qword [rbx + 0x80]
mov rsi, qword [rsp + 0x40]
mov byte [rax + 0x499], dil
mov rdi, qword [rsp + 0x48]
mov eax, 1
add rsp, 0x30
pop rbx
ret
lea r9, str.i___EVP_MAX_MD_SIZE
lea rdx, [0x1401953d8]
lea rcx, str._s__d_:_OpenSSL_internal_error__assertion_failed:__s_n
mov r8d, 0x124
call fcn.140090b40
mov ecx, reloc.WS2_32.dll_shutdown
call qword [sym.imp.MSVCR120.dll_raise]
mov ecx, 3
call qword [sym.imp.MSVCR120.dll__exit]
int3
Function at 0x1400bb370
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
cmp dword [rcx + 0x48], 0x1060
mov rax, qword [rcx + 0x50]
mov rbx, rcx
mov rdi, qword [rax + 8]
jne 0x1400bb491
movsxd rax, dword [rcx + 0x60]
mov r8d, 1
xor r9d, r9d
lea rdx, [rdi + rax]
sub r8d, eax
call fcn.1400f4d60
mov edx, dword [rbx + 0x60]
mov ecx, eax
mov eax, 1
sub eax, edx
cmp ecx, eax
jge 0x1400bb3d5
mov r8d, ecx
mov edx, WSASetLastError
mov rcx, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
jmp fcn.1400f5890
lea eax, [rdx + rcx]
mov dword [rbx + 0x48], 0x1061
mov dword [rbx + 0x60], eax
movzx eax, byte [rdi]
cmp al, 5
je 0x1400bb491
test al, al
je 0x1400bb43b
cmp dword [rbx + 0x158], 0
jne 0x1400bb40d
mov rcx, rbx
mov qword [rbx + 0x158], 3
call fcn.1400bc390
mov edx, WSASetLastError
lea r9, [0x1401a01c8]
mov dword [rsp + 0x20], 0x397
lea ecx, [rdx - 0x5a]
lea r8d, [rdx + 0x66]
call fcn.140073540
or eax, 0xffffffff
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
mov edx, WSASetLastError
lea r9, [0x1401a01a0]
mov dword [rsp + 0x20], 0x39b
lea ecx, [rdx - 0x5a]
lea r8d, [rdx + 0x5a]
call fcn.140073540
movsxd rax, dword [rbx + 0x60]
mov r8d, 3
lea rdx, [rdi + rax]
xor r9d, r9d
mov rcx, rbx
sub r8d, eax
call fcn.1400f4d60
mov edx, WSASetLastError
mov rcx, rbx
mov r8d, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
jmp fcn.1400f5890
mov rax, qword [rbx + 0x50]
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rsi
mov rsi, qword [rax + 8]
mov rax, qword [rbx + 0x78]
xor r9d, r9d
mov ebp, dword [rax + 0x90]
movsxd rax, dword [rbx + 0x60]
mov rcx, rbx
inc ebp
lea rdx, [rsi + rax]
mov edi, ebp
sub edi, eax
mov r8d, edi
call fcn.1400f4d60
cmp eax, edi
jge 0x1400bb4e2
mov r8d, eax
mov edx, WSASetLastError
mov rcx, rbx
call fcn.1400f5890
jmp 0x1400bb59d
mov r10, qword [rbx + 0x98]
test r10, r10
je 0x1400bb514
mov rax, qword [rbx + 0xa0]
mov edx, dword [rbx]
movsxd rcx, ebp
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rcx
xor ecx, ecx
mov r9, rsi
xor r8d, r8d
call r10
mov rax, qword [rbx + 0x78]
xor dl, dl
lea rcx, [rsi + 1]
mov r8d, dword [rax + 0x90]
lea r9, [rax + 0x94]
test r8, r8
je 0x1400bb598
sub r9, rcx
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r9 + rcx]
lea rcx, [rcx + 1]
xor al, byte [rcx - 1]
or dl, al
dec r8
jne 0x1400bb540
test dl, dl
je 0x1400bb598
cmp dword [rbx + 0x158], r8d
jne 0x1400bb573
mov rcx, rbx
mov qword [rbx + 0x158], 3
call fcn.1400bc390
mov edx, WSASetLastError
lea r9, [0x1401a0218]
mov dword [rsp + 0x20], 0x3b1
lea ecx, [rdx - 0x5a]
lea r8d, [rdx + 0x1a]
call fcn.140073540
or eax, 0xffffffff
jmp 0x1400bb59d
mov eax, 1
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1400c0af0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub rsp, 0x28
cmp dword [0x14017fa1c], 0
je 0x1400c0b40
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x1400c0b14
mov dword [0x14017fa1c], eax
jmp 0x1400c0b40
call fcn.14006f600
test rax, rax
je 0x1400c0b37
mov r8, qword [rax + 0x18]
test r8, r8
je 0x1400c0b37
xorps xmm2, xmm2
lea rcx, [rsp + 0x38]
mov edx, 8
call r8
cmp dword [0x14017fa1c], 0
jne 0x1400c0b6d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x30], eax
call fcn.14006f600
test rax, rax
je 0x1400c0b6d
mov r8, qword [rax + 0x18]
test r8, r8
je 0x1400c0b6d
xorps xmm2, xmm2
lea rcx, [rsp + 0x30]
mov edx, 4
call r8
add rsp, 0x28
ret

Function at 0x1400c1090
Capabilities:
Encode data using base64

Disassembly:
sub rsp, 8
xor r11d, r11d
mov r9d, r8d
test r8d, r8d
jle 0x1400c1189
mov qword [rsp], rbx
lea r10, [rdx + 1]
lea rbx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
movzx edx, byte [r10 - 1]
cmp r9d, 3
jl 0x1400c1110
movzx eax, byte [r10]
shl edx, 8
or edx, eax
movzx eax, byte [r10 + 1]
shl edx, 8
or edx, eax
mov eax, edx
mov r8d, edx
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rax + rbx]
mov byte [rcx], al
mov eax, edx
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rax + rbx]
mov byte [rcx + 1], al
mov eax, edx
shr rax, 6
and eax, 0x3f
and r8d, 0x3f
movzx eax, byte [rax + rbx]
mov byte [rcx + 2], al
movzx eax, byte [r8 + rbx]
mov byte [rcx + 3], al
jmp 0x1400c1161
shl edx, 0x10
cmp r9d, 2
jne 0x1400c1122
movzx eax, byte [r10]
shl eax, 8
or edx, eax
mov rax, rdx
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rax + rbx]
mov byte [rcx], al
mov rax, rdx
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rax + rbx]
mov byte [rcx + 1], al
cmp r9d, 1
jne 0x1400c114f
lea eax, [r9 + 0x3c]
jmp 0x1400c115a
shr rdx, 6
and edx, 0x3f
movzx eax, byte [rdx + rbx]
mov byte [rcx + 2], al
mov byte [rcx + 3], 0x3d
sub r9d, 3
add rcx, 4
add r11d, 4
add r10, 3
test r9d, r9d
jg 0x1400c10b2
mov rbx, qword [rsp]
mov byte [rcx], 0
mov eax, r11d
add rsp, 8
ret
mov byte [rcx], r11b
mov eax, r11d
add rsp, 8
ret
Function at 0x1400c19d0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
sub rsp, 0xb8
mov rax, qword [0x140177090]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov r12, qword [rsp + 0x110]
xor ebx, ebx
mov rbp, r9
movsxd rsi, r8d
mov r14, rdx
mov rdi, rcx
mov eax, ebx
test r9, r9
je 0x1400c1a17
lea eax, [rbx + 1]
mov qword [rcx], r9
jmp 0x1400c1a1a
mov rbp, qword [rcx]
mov qword [rsp + 0xb0], r15
test rdx, rdx
je 0x1400c1b49
mov eax, dword [rbp + 0x5c]
cmp eax, 0x80
jg 0x1400c1b12
cmp eax, esi
jge 0x1400c1a8d
mov r8, r12
mov rdx, rbp
add rcx, 8
call fcn.140095b00
test eax, eax
je 0x1400c1c22
lea rcx, [rdi + 8]
mov r8, rsi
mov rdx, r14
call qword [rdi + 0x30]
test eax, eax
je 0x1400c1c22
lea r14, [rdi + 0x98]
lea rdx, [rdi + 0x9c]
lea rcx, [rdi + 8]
mov r8, r14
call fcn.140095da0
test eax, eax
je 0x1400c1c22
jmp 0x1400c1aae
cmp esi, 0x80
ja 0x1400c1adb
mov r8, rsi
add rcx, 0x9c
call sub.MSVCR120.dll_memcpy
lea r14, [rdi + 0x98]
mov dword [r14], esi
mov ecx, dword [r14]
cmp ecx, 0x80
je 0x1400c1b51
mov eax, ecx
mov r8d, 0x80
xor edx, edx
sub r8d, ecx
lea rcx, [rdi + 0x9c]
add rcx, rax
call sub.MSVCR120.dll_memset
jmp 0x1400c1b51
lea r9, str.len_0__len__int_sizeof_ctx__key_
lea rdx, str.....opensslopensslcryptohmachmac.c
lea rcx, str._s__d_:_OpenSSL_internal_error__assertion_failed:__s_n
mov r8d, 0x75
call fcn.140090b40
mov ecx, reloc.WS2_32.dll_shutdown
call qword [sym.imp.MSVCR120.dll_raise]
mov ecx, 3
call qword [sym.imp.MSVCR120.dll__exit]
int3
lea r9, str.j____int_sizeof_ctx__key_
lea rdx, [0x1401a72f8]
lea rcx, str._s__d_:_OpenSSL_internal_error__assertion_failed:__s_n
mov r8d, 0x68
call fcn.140090b40
mov ecx, reloc.WS2_32.dll_shutdown
call qword [sym.imp.MSVCR120.dll_raise]
mov ecx, 3
call qword [sym.imp.MSVCR120.dll__exit]
int3
test eax, eax
je 0x1400c1c11
lea rcx, [rsp + 0x20]
mov rax, rdi
mov rdx, rbx
sub rax, rcx
lea rsi, [rax + 0x9c]
lea r14, [rax + 0x9d]
nop dword [rax]
lea rcx, [rsp + 0x20]
add rcx, rdx
add rdx, 2
movzx eax, byte [rsi + rcx]
xor al, 0x36
mov byte [rcx], al
movzx eax, byte [r14 + rcx]
xor al, 0x36
mov byte [rcx + 1], al
cmp rdx, 0x80
jl 0x1400c1b70
lea rcx, [rdi + 0x38]
mov r8, r12
mov rdx, rbp
call fcn.140095b00
test eax, eax
je 0x1400c1c22
movsxd r8, dword [rbp + 0x5c]
lea rdx, [rsp + 0x20]
lea rcx, [rdi + 0x38]
call qword [rdi + 0x60]
test eax, eax
je 0x1400c1c22
nop
lea rcx, [rsp + 0x20]
add rcx, rbx
add rbx, 2
movzx eax, byte [rsi + rcx]
xor al, 0x5c
mov byte [rcx], al
movzx eax, byte [r14 + rcx]
xor al, 0x5c
mov byte [rcx + 1], al
cmp rbx, 0x80
jl 0x1400c1bc0
lea rcx, [rdi + 0x68]
mov r8, r12
mov rdx, rbp
call fcn.140095b00
test eax, eax
je 0x1400c1c22
movsxd r8, dword [rbp + 0x5c]
lea rdx, [rsp + 0x20]
lea rcx, [rdi + 0x68]
call qword [rdi + 0x90]
test eax, eax
je 0x1400c1c22
lea rdx, [rdi + 0x38]
lea rcx, [rdi + 8]
call fcn.140095e50
test eax, eax
jne 0x1400c1c26
xor eax, eax
jmp 0x1400c1c2b
mov eax, 1
mov r15, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140129b50
add rsp, 0xb8
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400c23a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
xor r8d, r8d
lea r14, [0x14013abe8]
mov r13d, ecx
mov r11, r14
mov ebx, r8d
mov r10d, r8d
nop dword [rax]
cmp r10, 5
ja 0x1400c23fb
mov eax, dword [r11]
shl eax, 0xa
test ecx, eax
je 0x1400c23f2
inc ebx
inc r10
add r11, 4
jmp 0x1400c23e0
mov ecx, dword [rsp + 0x120]
mov rsi, qword [rsp + 0x128]
mov r12, qword [rsp + 0x118]
mov eax, ecx
cdq
idiv ebx
cmp ebx, 1
movsxd rbx, dword [rsp + 0x138]
cmove ecx, r8d
mov r8, rbx
xor edx, edx
mov dword [rsp + 0x120], ecx
mov rcx, rsi
mov dword [rsp + 0x110], eax
call sub.MSVCR120.dll_memset
mov rdi, qword [rsp + 0x130]
xor r8d, r8d
lea r15, [0x1401f28a0]
mov ebp, r8d
cmp rbp, 5
ja 0x1400c25ee
mov eax, dword [r14]
test eax, eax
je 0x1400c246c
mov rcx, qword [r15]
jmp 0x1400c246f
mov rcx, r8
shl eax, 0xa
test r13d, eax
je 0x1400c25b4
test rcx, rcx
je 0x1400c25c4
mov eax, dword [rsp + 0x100]
mov r8d, dword [rsp + 0x120]
mov r9, qword [rsp + 0xc8]
mov dword [rsp + 0x70], ebx
mov qword [rsp + 0x68], rdi
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0xf8]
and r8d, 1
mov rdx, r12
add r8d, dword [rsp + 0x110]
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0xf0]
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0xe0]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0xd0]
mov dword [rsp + 0x20], eax
call fcn.1400c1ec0
xor r8d, r8d
test eax, eax
je 0x1400c25e9
movsxd rax, dword [rsp + 0x110]
mov r9d, r8d
add r12, rax
test ebx, ebx
jle 0x1400c2584
cmp ebx, 0x10
jb 0x1400c2584
lea eax, [rbx - 1]
mov edx, r8d
movsxd rcx, eax
lea rax, [rcx + rdi]
lea r8, [rcx + rsi]
cmp rsi, rax
ja 0x1400c2541
cmp r8, rdi
jae 0x1400c2581
mov eax, ebx
and eax, 0x8000000f
jge 0x1400c2551
dec eax
or eax, 0xfffffff0
inc eax
mov ecx, ebx
sub ecx, eax
nop word [rax + rax]
movsxd rax, edx
add edx, 0x10
add r9, 0x10
movdqu xmm1, xmmword [rax + rdi]
movdqu xmm0, xmmword [rax + rsi]
pxor xmm1, xmm0
movdqu xmmword [rax + rsi], xmm1
cmp edx, ecx
jl 0x1400c2560
xor r8d, r8d
cmp r9, rbx
jge 0x1400c25b4
mov r8, rdi
mov rdx, rbx
lea rax, [r9 + rsi]
sub r8, rsi
sub rdx, r9
nop dword [rax]
movzx ecx, byte [r8 + rax]
lea rax, [rax + 1]
xor byte [rax - 1], cl
dec rdx
jne 0x1400c25a0
xor r8d, r8d
inc rbp
add r14, 4
add r15, 8
jmp 0x1400c2456
mov edx, 0x11c
lea r9, [0x1401a7368]
mov ecx, socket
lea r8d, [rdx + 0x2a]
mov dword [rsp + 0x20], 0x114
call fcn.140073540
xor r8d, r8d
mov eax, r8d
jmp 0x1400c25f3
mov eax, 1
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400c9ab0
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov eax, dword [rcx]
mov r11, rcx
lea ebx, [r9 + 1]
cmp eax, 0x302
jge 0x1400c9ad2
cmp eax, 0x100
je 0x1400c9ad2
cmp ebx, dword [rdx + 4]
jbe 0x1400c9aee
xor eax, eax
pop rbx
ret
mov ecx, dword [rdx + 4]
lea eax, [rbx + r8]
cmp eax, ecx
ja 0x1400c9ace
mov eax, r8d
add qword [rdx + 0x10], rax
add qword [rdx + 0x18], rax
sub ecx, r8d
mov dword [rdx + 4], ecx
mov ecx, dword [rdx + 4]
mov rax, qword [rdx + 0x10]
or r10d, 0xffffffff
dec ecx
test dword [r11 + 0x19c], 0x200
movzx r8d, byte [rcx + rax]
je 0x1400c9b48
cmp qword [r11 + 0xe0], 0
jne 0x1400c9b48
mov rcx, qword [r11 + 0x80]
mov rax, qword [rcx + 8]
cmp rax, qword [0x1401f2ad8]
jne 0x1400c9b34
test r8b, 1
jne 0x1400c9b34
or dword [rcx], 8
mov rax, qword [r11 + 0x80]
test byte [rax], 8
je 0x1400c9b48
test r8d, r8d
je 0x1400c9b48
add r8d, r10d
mov rax, qword [r11 + 0xd0]
mov rcx, qword [rax]
test dword [rcx + 0x10], 0x200000
je 0x1400c9b69
sub r10d, r8d
mov eax, 1
add dword [rdx + 4], r10d
pop rbx
ret
mov qword [rsp + 0x18], rsi
mov esi, 0xff
mov qword [rsp + 0x20], rdi
mov edi, dword [rdx + 4]
mov r9d, edi
sub r9d, r8d
lea eax, [rdi - 1]
sub r9d, ebx
not r9d
sar r9d, 0x1f
cmp eax, esi
cmovb esi, eax
xor r11d, r11d
test esi, esi
je 0x1400c9bdf
mov qword [rsp + 0x10], rbp
mov rbp, qword [rdx + 0x10]
mov ebx, r8d
nop word [rax + rax]
mov eax, edi
sub eax, r11d
inc r11d
dec eax
movzx ecx, byte [rax + rbp]
mov eax, ebx
add ebx, r10d
xor ecx, r8d
not eax
sar eax, 0x1f
movzx eax, al
and ecx, eax
not ecx
and r9d, ecx
cmp r11d, esi
jb 0x1400c9bb0
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov eax, r9d
shr eax, 4
and r9d, eax
mov eax, r9d
shr eax, 2
and r9d, eax
lea eax, [r8 + 1]
lea ecx, [r9 + r9]
and ecx, r9d
shl ecx, 0x1e
sar ecx, 0x1f
and eax, ecx
sub edi, eax
shl eax, 8
or dword [rdx], eax
mov eax, ecx
not ecx
and eax, 1
mov dword [rdx + 4], edi
mov rdi, qword [rsp + 0x20]
or eax, ecx
pop rbx
ret
Function at 0x1400c9c30
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0xe0
mov rax, qword [0x140177090]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rsi, rcx
mov qword [rsp + 0x30], rcx
mov ecx, dword [rdx + 4]
xor r12d, r12d
sub ecx, r8d
mov r13d, r9d
mov edi, r8d
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], ecx
mov r14d, r12d
cmp r9d, r8d
jb 0x1400c9de6
cmp edi, 0x40
ja 0x1400c9daf
mov qword [r11 + 0x10], rbx
mov qword [r11 - 0x30], rbp
lea rax, [rsp + 0x40]
neg rax
lea rbp, [rsp + 0x40]
mov qword [r11 - 0x38], r15
and eax, 0x3f
add rbp, rax
lea eax, [rdi + 0x100]
cmp r9d, eax
jbe 0x1400c9cc0
mov r14d, r9d
sub r14d, edi
sub r14d, 0x100
xor edx, edx
mov eax, edi
mov r8, rdi
and eax, 0xfffffffe
mov r15, rdi
shl eax, 0x17
sub eax, r14d
add eax, ecx
mov rcx, rbp
div edi
mov ebx, edx
xor edx, edx
call sub.MSVCR120.dll_memset
cmp r14d, r13d
jae 0x1400c9d4c
mov rax, qword [rsp + 0x28]
mov r8d, r14d
mov r9d, r14d
mov esi, dword [rax + 4]
add r9, qword [rax + 0x10]
sub r8d, esi
sub esi, dword [rsp + 0x20]
sub r13d, r14d
mov r10d, r13d
nop word [rax + rax]
mov ecx, r8d
lea edx, [rsi + r8]
inc r8d
not ecx
not edx
lea r9, [r9 + 1]
sar ecx, 0x1f
sar edx, 0x1f
not cl
and cl, byte [r9 - 1]
and cl, dl
or byte [r12 + rbp], cl
inc r12d
mov eax, r12d
sub eax, edi
sar eax, 0x1f
and r12d, eax
dec r10
jne 0x1400c9d10
mov rsi, qword [rsp + 0x30]
test edi, edi
je 0x1400c9d77
mov eax, ebx
mov ecx, ebx
inc ebx
xor rax, 0x20
lea rsi, [rsi + 1]
movzx eax, byte [rax + rbp]
movzx eax, byte [rcx + rbp]
mov byte [rsi - 1], al
mov eax, ebx
sub eax, edi
sar eax, 0x1f
and ebx, eax
dec r15
jne 0x1400c9d50
mov rbp, qword [rsp + 0xd8]
mov rbx, qword [rsp + 0x118]
mov r15, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140129b50
add rsp, 0xe0
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
lea r9, [0x1401a9c40]
lea rdx, [0x1401a9cb8]
lea rcx, str._s__d_:_OpenSSL_internal_error__assertion_failed:__s_n
mov r8d, 0x114
call fcn.140090b40
mov ecx, reloc.WS2_32.dll_shutdown
call qword [sym.imp.MSVCR120.dll_raise]
mov ecx, 3
call qword [sym.imp.MSVCR120.dll__exit]
int3
lea r9, str.orig_len___md_size
lea rdx, [0x1401a9c60]
lea rcx, str._s__d_:_OpenSSL_internal_error__assertion_failed:__s_n
mov r8d, 0x113
call fcn.140090b40
mov ecx, reloc.WS2_32.dll_shutdown
call qword [sym.imp.MSVCR120.dll_raise]
mov ecx, 3
call qword [sym.imp.MSVCR120.dll__exit]
int3
Function at 0x1400e08e0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
test r8, r8
jne 0x1400e090f
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
test rcx, rcx
je 0x1400e09a4
test rdx, rdx
je 0x1400e0968
mov rcx, qword [rcx + 0x10]
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x28], r8
call fcn.14008e4e0
test rax, rax
jne 0x1400e0990
lea rdx, [0x140180084]
sub rdx, rbx
movzx ecx, byte [rbx]
movzx eax, byte [rbx + rdx]
sub ecx, eax
jne 0x1400e0956
inc rbx
test eax, eax
jne 0x1400e0944
test ecx, ecx
jne 0x1400e0968
mov rcx, rdi
call qword [sym.imp.MSVCR120.dll_getenv]
test rax, rax
jne 0x1400e09ad
mov rcx, qword [rsi + 0x10]
lea rax, [0x1401aff18]
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rdi
call fcn.14008e4e0
test rax, rax
je 0x1400e08fd
mov rax, qword [rax + 0x10]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov rcx, r8
call qword [sym.imp.MSVCR120.dll_getenv]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x1400e9b00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x140177090]
xor rax, rsp
mov qword [rsp + 0x38], rax
movzx edi, byte [rcx]
mov r12, qword [rcx + 0x28]
mov r13, qword [rcx + 0x30]
mov rbp, r9
mov r15, r8
mov r14, rdx
mov rbx, rcx
mov byte [rsp + 0x20], dil
test dil, 0x40
jne 0x1400e9b4f
lea rdx, [rcx + 0x10]
mov r8, r13
call r12
movzx eax, dil
mov edi, reloc.WS2_32.dll_ntohs
xor esi, esi
and eax, 7
mov r8d, edi
mov ecx, esi
sub r8d, eax
mov byte [rbx], al
mov dword [rsp + 0x24], r8d
cmp r8d, edi
jae 0x1400e9b96
mov edx, r8d
add rdx, rbx
sub edi, r8d
nop word [rax + rax]
movzx eax, byte [rdx]
mov byte [rdx], sil
lea rdx, [rdx + 1]
or rcx, rax
shl rcx, 8
dec rdi
jne 0x1400e9b80
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0xf], 1
or rcx, rax
cmp rcx, rbp
je 0x1400e9bae
or eax, 0xffffffff
jmp 0x1400e9cad
cmp rbp, 0x10
jb 0x1400e9c1c
mov rsi, rbp
shr rsi, 4
imul rax, rsi, 0xfffffffffffffff0
add rbp, rax
lea rdx, [rsp + 0x28]
mov r8, r13
mov rcx, rbx
call r12
mov eax, 8
dec eax
inc byte [rax + rbx + 8]
jne 0x1400e9be1
test eax, eax
jne 0x1400e9bd5
mov rax, qword [r14]
lea rdx, [rbx + 0x10]
lea rcx, [rbx + 0x10]
xor rax, qword [rsp + 0x28]
mov r8, r13
mov qword [r15], rax
xor qword [rbx + 0x10], rax
mov rax, qword [r14 + 8]
xor rax, qword [rsp + 0x30]
mov qword [r15 + 8], rax
xor qword [rbx + 0x18], rax
call r12
add r14, 0x10
add r15, 0x10
dec rsi
jne 0x1400e9bc2
test rbp, rbp
je 0x1400e9c6a
lea rdx, [rsp + 0x28]
mov r8, r13
mov rcx, rbx
call r12
test rbp, rbp
je 0x1400e9c5d
mov rdx, rsi
nop word [rax + rax]
movzx ecx, byte [rdx + r14]
movzx eax, byte [rsp + rdx + 0x28]
inc esi
xor ecx, eax
mov byte [rdx + r15], cl
xor byte [rdx + rbx + 0x10], cl
mov edx, esi
cmp rdx, rbp
jb 0x1400e9c40
lea rcx, [rbx + 0x10]
mov r8, r13
mov rdx, rcx
call r12
mov ecx, dword [rsp + 0x24]
cmp ecx, 0x10
jae 0x1400e9c84
mov eax, reloc.WS2_32.dll_recv
lea rdi, [rbx + rcx]
sub eax, ecx
mov ecx, eax
xor eax, eax
rep stosb byte [rdi], al
lea rdx, [rsp + 0x28]
mov r8, r13
mov rcx, rbx
call r12
mov rax, qword [rsp + 0x28]
xor qword [rbx + 0x10], rax
mov rax, qword [rsp + 0x30]
xor qword [rbx + 0x18], rax
movzx eax, byte [rsp + 0x20]
mov byte [rbx], al
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140129b50
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400e9f90
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x68
mov rax, qword [0x140177090]
xor rax, rsp
mov qword [rsp + 0x58], rax
movzx edi, byte [rcx]
mov r10, qword [rsp + 0xd0]
mov rax, qword [rcx + 0x28]
mov r15, qword [rcx + 0x30]
mov rbp, r9
mov r13, r8
mov r12, rdx
mov rbx, rcx
mov qword [rsp + 0x40], r10
mov byte [rsp + 0x30], dil
mov qword [rsp + 0x38], rax
test dil, 0x40
jne 0x1400e9ff2
lea rdx, [rcx + 0x10]
mov r8, r15
call rax
mov r10, qword [rsp + 0x40]
movzx eax, dil
mov edi, reloc.WS2_32.dll_ntohs
xor esi, esi
and eax, 7
mov r14d, edi
mov ecx, esi
sub r14d, eax
mov byte [rbx], al
cmp r14d, edi
jae 0x1400ea036
mov edx, r14d
add rdx, rbx
sub edi, r14d
nop dword [rax + rax]
movzx eax, byte [rdx]
mov byte [rdx], sil
lea rdx, [rdx + 1]
or rcx, rax
shl rcx, 8
dec rdi
jne 0x1400ea020
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0xf], 1
or rcx, rax
cmp rcx, rbp
je 0x1400ea04e
or eax, 0xffffffff
jmp 0x1400ea15b
mov rdi, rbp
shr rdi, 4
test rdi, rdi
je 0x1400ea0d1
lea rax, [rbx + 0x10]
mov r9, r15
mov r8, rdi
mov qword [rsp + 0x28], rax
mov rdx, r13
mov rcx, r12
mov qword [rsp + 0x20], rbx
call r10
shl rdi, 4
add r12, rdi
add r13, rdi
sub rbp, rdi
je 0x1400ea119
lea r9, [rbx + 8]
shr rdi, 4
mov rdx, rsi
lea r8, [r9 + 8]
neg r9
nop dword [rax]
movzx eax, byte [r8 - 1]
lea r8, [r8 - 1]
movzx ecx, dil
add rdx, rax
lea rax, [r9 + r8]
shr rdi, 8
add rdx, rcx
mov byte [r8], dl
shr rdx, 8
test rax, rax
je 0x1400ea0d1
test rdi, rdi
jne 0x1400ea0a0
test rdx, rdx
jne 0x1400ea0a0
test rbp, rbp
je 0x1400ea119
mov rdi, qword [rsp + 0x38]
lea rdx, [rsp + 0x48]
mov r8, r15
mov rcx, rbx
call rdi
test rbp, rbp
je 0x1400ea10d
mov rdx, rsi
movzx ecx, byte [rdx + r12]
movzx eax, byte [rsp + rdx + 0x48]
inc esi
xor ecx, eax
mov byte [rdx + r13], cl
xor byte [rdx + rbx + 0x10], cl
mov edx, esi
cmp rdx, rbp
jb 0x1400ea0f0
lea rcx, [rbx + 0x10]
mov r8, r15
mov rdx, rcx
call rdi
cmp r14d, 0x10
jae 0x1400ea131
mov ecx, reloc.WS2_32.dll_recv
mov edi, r14d
add rdi, rbx
sub ecx, r14d
xor eax, eax
rep stosb byte [rdi], al
lea rdx, [rsp + 0x48]
mov r8, r15
mov rcx, rbx
call qword [rsp + 0x38]
mov rax, qword [rsp + 0x48]
xor qword [rbx + 0x10], rax
mov rax, qword [rsp + 0x50]
xor qword [rbx + 0x18], rax
movzx eax, byte [rsp + 0x30]
mov byte [rbx], al
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140129b50
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret