joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140177820
Capabilities:
Hash data using ripemd256
Hash data with md5

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x14036a040]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xd0]
mov r13, r9
mov rbp, qword [rsp + 0xd8]
mov r15, r8
mov qword [rsp + 0x38], rdx
mov rdi, rdx
mov qword [rsp + 0x40], rax
mov rbx, rcx
mov qword [rsp + 0x30], rbp
test rax, rax
je 0x140177a4e
xor esi, esi
mov dword [rcx + 0x54], 0x67452301
mov dword [rcx + 0x50], esi
mov qword [rcx + 8], rsi
mov dword [rcx + 0x58], 0xefcdab89
mov dword [rcx + 0x5c], 0x98badcfe
mov dword [rcx + 0x60], 0x10325476
mov dword [rcx + 0x64], 0x76543210
mov dword [rcx + 0x68], 0xfedcba98
mov dword [rcx + 0x6c], 0x89abcdef
mov dword [rcx + 0x70], 0x1234567
mov ecx, 0x4e28
call fcn.140098af0
mov r14, rax
test rax, rax
je 0x140177a4e
mov qword [rsp + 0x68], r12
mov rcx, rdi
mov r12b, 1
mov dword [rsp + 0x48], esi
call fcn.140187cf0
test al, al
jne 0x140177a2e
nop word [rax + rax]
mov qword [rsp + 0x28], r13
lea r9, [rsp + 0x48]
mov r8d, 0x4e20
mov qword [rsp + 0x20], r15
mov rdx, r14
mov rcx, rdi
call fcn.140187f40
movzx r12d, al
test al, al
je 0x140177a2e
mov esi, dword [rsp + 0x48]
test esi, esi
je 0x140177a08
test rbp, rbp
je 0x14017793f
mov r8d, esi
mov rdx, r14
mov rcx, rbp
call fcn.1400c5440
mov esi, dword [rsp + 0x48]
mov rbp, r14
cmp esi, 1
jb 0x1401779ed
nop dword [rax + rax]
mov edx, dword [rbx + 0x50]
test edx, edx
jne 0x140177995
cmp esi, 0x40
jb 0x140177995
movups xmm0, xmmword [rbp]
mov rcx, rbx
movups xmmword [rbx + 0x10], xmm0
movups xmm1, xmmword [rbp + 0x10]
movups xmmword [rbx + 0x20], xmm1
movups xmm0, xmmword [rbp + 0x20]
movups xmmword [rbx + 0x30], xmm0
movups xmm1, xmmword [rbp + 0x30]
movups xmmword [rbx + 0x40], xmm1
call fcn.1401766b0
add qword [rbx + 8], 0x200
add rbp, 0x40
add esi, 0xffffffc0
jmp 0x1401779dc
mov ecx, 0x40
mov eax, esi
sub ecx, edx
cmp esi, ecx
cmovae eax, ecx
lea rcx, [rbx + 0x10]
add rcx, rdx
mov r8d, eax
mov rdx, rbp
mov edi, eax
call sub.VCRUNTIME140.dll_memcpy
add dword [rbx + 0x50], edi
add rbp, rdi
sub esi, edi
cmp dword [rbx + 0x50], 0x40
jne 0x1401779dc
mov rcx, rbx
call fcn.1401766b0
add qword [rbx + 8], 0x200
mov dword [rbx + 0x50], 0
test esi, esi
jne 0x140177950
mov esi, dword [rsp + 0x48]
mov rdi, qword [rsp + 0x38]
test r15, r15
je 0x140177a03
mov edx, esi
mov r8, r13
mov rcx, r15
call fcn.14014e010
test al, al
jne 0x140177a1a
mov rbp, qword [rsp + 0x30]
mov rcx, rdi
call fcn.140187cf0
test al, al
je 0x1401778f0
jmp 0x140177a2e
mov rax, qword [r13]
lea rdx, str.RIPEMD256_aborted_by_application
mov rcx, r13
call qword [rax + 0x28]
xor r12b, r12b
mov rcx, r14
call fcn.14008b8c0
mov rdx, qword [rsp + 0x40]
mov rcx, rbx
call fcn.140177a70
movzx eax, r12b
mov r12, qword [rsp + 0x68]
jmp 0x140177a50
xor al, al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14008b8a0
add rsp, 0x70
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140177d30
Capabilities:
Hash data using ripemd256
Hash data with md5

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor eax, eax
mov dword [rcx + 0x54], 0x67452301
mov dword [rcx + 0x50], eax
mov rdi, r9
mov qword [rcx + 8], rax
mov rbx, rcx
mov dword [rcx + 0x58], 0xefcdab89
mov dword [rcx + 0x5c], 0x98badcfe
mov dword [rcx + 0x60], 0x10325476
mov dword [rcx + 0x64], 0x76543210
mov dword [rcx + 0x68], 0xfedcba98
mov dword [rcx + 0x6c], 0x89abcdef
mov dword [rcx + 0x70], 0x1234567
call fcn.140177c40
mov rdx, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140177a70
Function at 0x140179710
Capabilities:
Hash data using ripemd320
Hash data using sha1

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x14036a040]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xd0]
mov r13, r9
mov rbp, qword [rsp + 0xd8]
mov r15, r8
mov qword [rsp + 0x38], rdx
mov rdi, rdx
mov qword [rsp + 0x40], rax
mov rbx, rcx
mov qword [rsp + 0x30], rbp
test rax, rax
je 0x14017994e
xor esi, esi
mov dword [rcx + 0x54], 0x67452301
mov dword [rcx + 0x50], esi
mov qword [rcx + 8], rsi
mov dword [rcx + 0x58], 0xefcdab89
mov dword [rcx + 0x5c], 0x98badcfe
mov dword [rcx + 0x60], 0x10325476
mov dword [rcx + 0x64], 0xc3d2e1f0
mov dword [rcx + 0x68], 0x76543210
mov dword [rcx + 0x6c], 0xfedcba98
mov dword [rcx + 0x70], 0x89abcdef
mov dword [rcx + 0x74], 0x1234567
mov dword [rcx + 0x78], 0x3c2d1e0f
mov ecx, 0x4e28
call fcn.140098af0
mov r14, rax
test rax, rax
je 0x14017994e
mov qword [rsp + 0x68], r12
mov rcx, rdi
mov r12b, 1
mov dword [rsp + 0x48], esi
call fcn.140187cf0
test al, al
jne 0x14017992e
nop dword [rax]
nop word [rax + rax]
mov qword [rsp + 0x28], r13
lea r9, [rsp + 0x48]
mov r8d, 0x4e20
mov qword [rsp + 0x20], r15
mov rdx, r14
mov rcx, rdi
call fcn.140187f40
movzx r12d, al
test al, al
je 0x14017992e
mov esi, dword [rsp + 0x48]
test esi, esi
je 0x140179908
test rbp, rbp
je 0x14017983f
mov r8d, esi
mov rdx, r14
mov rcx, rbp
call fcn.1400c5440
mov esi, dword [rsp + 0x48]
mov rbp, r14
cmp esi, 1
jb 0x1401798ed
nop dword [rax + rax]
mov edx, dword [rbx + 0x50]
test edx, edx
jne 0x140179895
cmp esi, 0x40
jb 0x140179895
movups xmm0, xmmword [rbp]
mov rcx, rbx
movups xmmword [rbx + 0x10], xmm0
movups xmm1, xmmword [rbp + 0x10]
movups xmmword [rbx + 0x20], xmm1
movups xmm0, xmmword [rbp + 0x20]
movups xmmword [rbx + 0x30], xmm0
movups xmm1, xmmword [rbp + 0x30]
movups xmmword [rbx + 0x40], xmm1
call fcn.140177e00
add qword [rbx + 8], 0x200
add rbp, 0x40
add esi, 0xffffffc0
jmp 0x1401798dc
mov ecx, 0x40
mov eax, esi
sub ecx, edx
cmp esi, ecx
cmovae eax, ecx
lea rcx, [rbx + 0x10]
add rcx, rdx
mov r8d, eax
mov rdx, rbp
mov edi, eax
call sub.VCRUNTIME140.dll_memcpy
add dword [rbx + 0x50], edi
add rbp, rdi
sub esi, edi
cmp dword [rbx + 0x50], 0x40
jne 0x1401798dc
mov rcx, rbx
call fcn.140177e00
add qword [rbx + 8], 0x200
mov dword [rbx + 0x50], 0
test esi, esi
jne 0x140179850
mov esi, dword [rsp + 0x48]
mov rdi, qword [rsp + 0x38]
test r15, r15
je 0x140179903
mov edx, esi
mov r8, r13
mov rcx, r15
call fcn.14014e010
test al, al
jne 0x14017991a
mov rbp, qword [rsp + 0x30]
mov rcx, rdi
call fcn.140187cf0
test al, al
je 0x1401797f0
jmp 0x14017992e
mov rax, qword [r13]
lea rdx, str.RIPEMD320_aborted_by_application
mov rcx, r13
call qword [rax + 0x28]
xor r12b, r12b
mov rcx, r14
call fcn.14008b8c0
mov rdx, qword [rsp + 0x40]
mov rcx, rbx
call fcn.140179970
movzx eax, r12b
mov r12, qword [rsp + 0x68]
jmp 0x140179950
xor al, al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14008b8a0
add rsp, 0x70
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140179c60
Capabilities:
Hash data using ripemd320
Hash data using sha1

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor eax, eax
mov dword [rcx + 0x54], 0x67452301
mov dword [rcx + 0x50], eax
mov rdi, r9
mov qword [rcx + 8], rax
mov rbx, rcx
mov dword [rcx + 0x58], 0xefcdab89
mov dword [rcx + 0x5c], 0x98badcfe
mov dword [rcx + 0x60], 0x10325476
mov dword [rcx + 0x64], 0xc3d2e1f0
mov dword [rcx + 0x68], 0x76543210
mov dword [rcx + 0x6c], 0xfedcba98
mov dword [rcx + 0x70], 0x89abcdef
mov dword [rcx + 0x74], 0x1234567
mov dword [rcx + 0x78], 0x3c2d1e0f
call fcn.140179b70
mov rdx, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140179970

Function at 0x140179ce0
Capabilities:
Hash data with md5

Disassembly:
lea rax, vtable._ckMd4.0
mov dword [rcx + 8], 0x67452301
mov qword [rcx], rax
xor eax, eax
mov qword [rcx + 0x18], rax
mov rax, rcx
mov dword [rcx + 0xc], 0xefcdab89
mov dword [rcx + 0x10], 0x98badcfe
mov dword [rcx + 0x14], 0x10325476
ret

Function at 0x140179d50
Capabilities:
Hash data with md5

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x48
mov rax, qword [0x14036a040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r13, qword [rsp + 0xb0]
mov r14, r9
mov rbp, qword [rsp + 0xb8]
mov rsi, r8
mov r15, rdx
mov rdi, rcx
test r13, r13
je 0x140179e90
mov dword [rcx + 8], 0x67452301
xor r12d, r12d
mov qword [rcx + 0x18], r12
mov dword [rcx + 0xc], 0xefcdab89
mov dword [rcx + 0x10], 0x98badcfe
mov dword [rcx + 0x14], 0x10325476
mov ecx, 0x4e28
call fcn.140098af0
mov rbx, rax
test rax, rax
je 0x140179e90
mov dword [rsp + 0x30], r12d
mov rcx, r15
mov r12b, 1
call fcn.140187cf0
test al, al
jne 0x140179e77
nop word [rax + rax]
mov qword [rsp + 0x28], r14
lea r9, [rsp + 0x30]
mov r8d, 0x4e20
mov qword [rsp + 0x20], rsi
mov rdx, rbx
mov rcx, r15
call fcn.140187f40
test al, al
je 0x140179e77
mov r8d, dword [rsp + 0x30]
test r8d, r8d
je 0x140179e56
test rbp, rbp
je 0x140179e33
mov rdx, rbx
mov rcx, rbp
call fcn.1400c5440
mov r8d, dword [rsp + 0x30]
mov rdx, rbx
mov rcx, rdi
call fcn.14017a6a0
test rsi, rsi
je 0x140179e56
mov edx, dword [rsp + 0x30]
mov r8, r14
mov rcx, rsi
call fcn.14014e010
test al, al
jne 0x140179e64
mov rcx, r15
call fcn.140187cf0
test al, al
je 0x140179df0
jmp 0x140179e77
mov rax, qword [r14]
lea rdx, str.MD4_aborted_by_application
mov rcx, r14
call qword [rax + 0x28]
xor r12b, r12b
mov rcx, rbx
call fcn.14008b8c0
mov rdx, r13
mov rcx, rdi
call fcn.140179eb0
movzx eax, r12b
jmp 0x140179e92
xor al, al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14008b8a0
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140179fd0
Capabilities:
Hash data with md5

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x14036a040]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x20]
call fcn.1400c4dc0
nop
lea r8, [rsp + 0x20]
xor edx, edx
mov rcx, rbx
call fcn.1400903a0
xor eax, eax
mov qword [rdi + 0x18], rax
mov dword [rdi + 8], 0x67452301
mov dword [rdi + 0xc], 0xefcdab89
mov dword [rdi + 0x10], 0x98badcfe
mov dword [rdi + 0x14], 0x10325476
lea rcx, [rsp + 0x20]
call fcn.1400c9940
mov ebx, eax
lea rcx, [rsp + 0x20]
call fcn.1400c9610
mov rdx, rax
mov r8d, ebx
mov rcx, rdi
call fcn.14017a6a0
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.140179eb0
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.1400c5440
nop
lea rcx, [rsp + 0x20]
call fcn.1400c4f70
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14008b8a0
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x14017a9e0
Capabilities:
Hash data using sha1
Hash data using sha224
Hash data using sha256
Resolve function by parsing pe exports

Disassembly:
cmp dword [rcx + 0x10], 0x100
jle fcn.14017d460
jmp fcn.14017f5b0

Function at 0x14017aa00
Capabilities:
Hash data using sha1
Hash data using sha224
Hash data using sha256

Disassembly:
mov edx, dword [rcx + 0x10]
xor r8d, r8d
sub edx, 0xa0
je 0x14017ab90
sub edx, 0x40
je 0x14017aaa2
sub edx, 0x20
je 0x14017ab50
sub edx, 0x80
je 0x14017aae0
cmp edx, 0x80
jne 0x14017abb7
mov rax, qword [0x1403b0540]
mov qword [rcx + 0x40], rax
mov rax, qword [0x1403b0548]
mov qword [rcx + 0x48], rax
mov rax, qword [0x1403b0550]
mov qword [rcx + 0x50], rax
mov rax, qword [0x1403b0558]
mov qword [rcx + 0x58], rax
mov rax, qword [0x1403b0560]
mov qword [rcx + 0x60], rax
mov rax, qword [0x1403b0568]
mov qword [rcx + 0x68], rax
mov rax, qword [0x1403b0570]
mov qword [rcx + 0x70], rax
mov rax, qword [0x1403b0578]
mov qword [rcx + 0x78], rax
mov qword [rcx + 0x80], r8
mov qword [rcx + 0x88], r8
mov dword [rcx + 0x14], 0xc1059ed8
mov dword [rcx + 0x18], 0x367cd507
mov dword [rcx + 0x1c], 0x3070dd17
mov dword [rcx + 0x20], 0xf70e5939
mov dword [rcx + 0x24], 0xffc00b31
mov dword [rcx + 0x28], 0x68581511
mov dword [rcx + 0x2c], 0x64f98fa7
mov dword [rcx + 0x30], 0xbefa4fa4
mov qword [rcx + 0x34], r8
ret
mov rax, qword [0x1403b0280]
mov qword [rcx + 0x40], rax
mov rax, qword [0x1403b0288]
mov qword [rcx + 0x48], rax
mov rax, qword [0x1403b0290]
mov qword [rcx + 0x50], rax
mov rax, qword [0x1403b0298]
mov qword [rcx + 0x58], rax
mov rax, qword [0x1403b02a0]
mov qword [rcx + 0x60], rax
mov rax, qword [0x1403b02a8]
mov qword [rcx + 0x68], rax
mov rax, qword [0x1403b02b0]
mov qword [rcx + 0x70], rax
mov rax, qword [0x1403b02b8]
mov qword [rcx + 0x78], rax
mov qword [rcx + 0x80], r8
mov qword [rcx + 0x88], r8
ret
mov dword [rcx + 0x14], 0x6a09e667
mov dword [rcx + 0x18], 0xbb67ae85
mov dword [rcx + 0x1c], 0x3c6ef372
mov dword [rcx + 0x20], 0xa54ff53a
mov dword [rcx + 0x24], 0x510e527f
mov dword [rcx + 0x28], 0x9b05688c
mov dword [rcx + 0x2c], 0x1f83d9ab
mov dword [rcx + 0x30], 0x5be0cd19
mov qword [rcx + 0x34], r8
ret
mov dword [rcx + 0x14], 0x67452301
mov dword [rcx + 0x18], 0xefcdab89
mov dword [rcx + 0x1c], 0x98badcfe
mov dword [rcx + 0x20], 0x10325476
mov dword [rcx + 0x24], 0xc3d2e1f0
mov qword [rcx + 0x34], r8
ret
Function at 0x14017c9c0
Capabilities:
Hash data using sha1
Hash data using sha224
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov edi, ecx
xor esi, esi
mov qword [rsp + 0x38], rsi
mov ecx, 0x110
call fcn.14008bb90
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14017cbcc
mov rcx, rax
call fcn.1400b66e0
nop
lea rax, vtable._ckSha2.0
mov qword [rbx], rax
call fcn.14008c7a0
mov byte [0x140375800], al
call fcn.14017c4d0
test edi, edi
jle 0x14017cbc7
mov ecx, edi
sub ecx, 0xa0
je 0x14017cba0
sub ecx, 0x40
je 0x14017cb60
sub ecx, 0x20
je 0x14017cb20
sub ecx, 0x80
je 0x14017cab0
cmp ecx, 0x80
jne 0x14017cbc7
mov rax, qword [0x1403b0540]
mov qword [rbx + 0x40], rax
mov rax, qword [0x1403b0548]
mov qword [rbx + 0x48], rax
mov rax, qword [0x1403b0550]
mov qword [rbx + 0x50], rax
mov rax, qword [0x1403b0558]
mov qword [rbx + 0x58], rax
mov rax, qword [0x1403b0560]
mov qword [rbx + 0x60], rax
mov rax, qword [0x1403b0568]
mov qword [rbx + 0x68], rax
mov rax, qword [0x1403b0570]
mov qword [rbx + 0x70], rax
mov rax, qword [0x1403b0578]
jmp 0x14017cb04
mov rax, qword [0x1403b0280]
mov qword [rbx + 0x40], rax
mov rax, qword [0x1403b0288]
mov qword [rbx + 0x48], rax
mov rax, qword [0x1403b0290]
mov qword [rbx + 0x50], rax
mov rax, qword [0x1403b0298]
mov qword [rbx + 0x58], rax
mov rax, qword [0x1403b02a0]
mov qword [rbx + 0x60], rax
mov rax, qword [0x1403b02a8]
mov qword [rbx + 0x68], rax
mov rax, qword [0x1403b02b0]
mov qword [rbx + 0x70], rax
mov rax, qword [0x1403b02b8]
mov qword [rbx + 0x78], rax
mov qword [rbx + 0x80], rsi
mov qword [rbx + 0x88], rsi
jmp 0x14017cbc7
mov dword [rbx + 0x14], 0x6a09e667
mov dword [rbx + 0x18], 0xbb67ae85
mov dword [rbx + 0x1c], 0x3c6ef372
mov dword [rbx + 0x20], 0xa54ff53a
mov dword [rbx + 0x24], 0x510e527f
mov dword [rbx + 0x28], 0x9b05688c
mov dword [rbx + 0x2c], 0x1f83d9ab
mov dword [rbx + 0x30], 0x5be0cd19
jmp 0x14017cbc3
mov dword [rbx + 0x14], 0xc1059ed8
mov dword [rbx + 0x18], 0x367cd507
mov dword [rbx + 0x1c], 0x3070dd17
mov dword [rbx + 0x20], 0xf70e5939
mov dword [rbx + 0x24], 0xffc00b31
mov dword [rbx + 0x28], 0x68581511
mov dword [rbx + 0x2c], 0x64f98fa7
mov dword [rbx + 0x30], 0xbefa4fa4
jmp 0x14017cbc3
mov dword [rbx + 0x14], 0x67452301
mov dword [rbx + 0x18], 0xefcdab89
mov dword [rbx + 0x1c], 0x98badcfe
mov dword [rbx + 0x20], 0x10325476
mov dword [rbx + 0x24], 0xc3d2e1f0
mov qword [rbx + 0x34], rsi
mov dword [rbx + 0x10], edi
jmp 0x14017cbcf
mov rbx, rsi
mov qword [rsp + 0x38], rbx
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x14017cc00
Capabilities:
Hash data using sha1
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, 0x100
jmp fcn.14017c9c0
Function at 0x140182ea0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x1e0
mov rax, qword [0x14036a040]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov rsi, r8
mov edi, edx
mov rbx, rcx
test r8, r8
jne 0x140182ed8
xor al, al
jmp 0x140182fb0
lea rcx, [rsp + 0x20]
call fcn.1401823e0
test edi, edi
je 0x140182efe
test rbx, rbx
je 0x140182efe
mov r9b, reloc.WS2_32.dll_select
lea rcx, [rsp + 0x20]
mov r8d, edi
mov rdx, rbx
call fcn.140183790
movzx eax, byte [rsp + 0x1c0]
mov byte [rsp + 0x187], 0
mov byte [rsp + rax + 0xf8], 6
movzx edx, byte [rsp + 0x1c0]
or byte [rsp + 0x187], 0x80
inc dl
cmp dl, 0x8f
jae 0x140182f4d
movzx eax, dl
lea rcx, [rsp + 0xf8]
add rcx, rax
mov eax, 0x8f
sub al, dl
xor edx, edx
movzx r8d, al
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x30]
mov edx, reloc.WS2_32.dll_select
nop word [rax + rax]
mov rcx, qword [rax + 0xc8]
xor qword [rax], rcx
lea rax, [rax + 8]
sub rdx, 1
jne 0x140182f60
lea rcx, [rsp + 0x30]
call fcn.1401824e0
mov eax, dword [rsp + 0x48]
lea rcx, [rsp + 0x20]
movaps xmm0, xmmword [rsp + 0x30]
movsd xmm1, qword [rsp + 0x40]
movups xmmword [rsi], xmm0
movsd qword [rsi + 0x10], xmm1
mov dword [rsi + 0x18], eax
lea rax, vtable._ckSha3.0
mov qword [rsp + 0x20], rax
call fcn.1400b67f0
mov al, 1
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.14008b8a0
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x140183020
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x1e0
mov rax, qword [0x14036a040]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov rsi, r8
mov edi, edx
mov rbx, rcx
test r8, r8
jne 0x140183058
xor al, al
jmp 0x140183127
lea rcx, [rsp + 0x20]
call fcn.1401823e0
test edi, edi
je 0x14018307e
test rbx, rbx
je 0x14018307e
mov r9b, send
lea rcx, [rsp + 0x20]
mov r8d, edi
mov rdx, rbx
call fcn.140183790
movzx eax, byte [rsp + 0x1c0]
mov byte [rsp + 0x17f], 0
mov byte [rsp + rax + 0xf8], 6
movzx edx, byte [rsp + 0x1c0]
or byte [rsp + 0x17f], 0x80
inc dl
cmp dl, 0x87
jae 0x1401830cd
movzx eax, dl
lea rcx, [rsp + 0xf8]
add rcx, rax
mov eax, 0x87
sub al, dl
xor edx, edx
movzx r8d, al
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x30]
mov edx, send
nop word [rax + rax]
mov rcx, qword [rax + 0xc8]
xor qword [rax], rcx
lea rax, [rax + 8]
sub rdx, 1
jne 0x1401830e0
lea rcx, [rsp + 0x30]
call fcn.1401824e0
movaps xmm0, xmmword [rsp + 0x30]
lea rax, vtable._ckSha3.0
movaps xmm1, xmmword [rsp + 0x40]
lea rcx, [rsp + 0x20]
movups xmmword [rsi], xmm0
mov qword [rsp + 0x20], rax
movups xmmword [rsi + 0x10], xmm1
call fcn.1400b67f0
mov al, 1
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.14008b8a0
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140183190
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x1e0
mov rax, qword [0x14036a040]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov rsi, r8
mov edi, edx
mov rbx, rcx
test r8, r8
jne 0x1401831c8
xor al, al
jmp 0x1401832a0
lea rcx, [rsp + 0x20]
call fcn.1401823e0
test edi, edi
je 0x1401831ee
test rbx, rbx
je 0x1401831ee
mov r9b, ntohs
lea rcx, [rsp + 0x20]
mov r8d, edi
mov rdx, rbx
call fcn.140183790
movzx eax, byte [rsp + 0x1c0]
mov byte [rsp + 0x15f], 0
mov byte [rsp + rax + 0xf8], 6
movzx edx, byte [rsp + 0x1c0]
or byte [rsp + 0x15f], 0x80
inc dl
cmp dl, 0x67
jae 0x14018323d
movzx eax, dl
lea rcx, [rsp + 0xf8]
add rcx, rax
mov eax, 0x67
sub al, dl
xor edx, edx
movzx r8d, al
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x30]
mov edx, recv
nop word [rax + rax]
mov rcx, qword [rax + 0xc8]
xor qword [rax], rcx
lea rax, [rax + 8]
sub rdx, 1
jne 0x140183250
lea rcx, [rsp + 0x30]
call fcn.1401824e0
movaps xmm0, xmmword [rsp + 0x30]
lea rax, vtable._ckSha3.0
movaps xmm1, xmmword [rsp + 0x40]
lea rcx, [rsp + 0x20]
movups xmmword [rsi], xmm0
mov qword [rsp + 0x20], rax
movaps xmm0, xmmword [rsp + 0x50]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi + 0x20], xmm0
call fcn.1400b67f0
mov al, 1
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.14008b8a0
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x140183310
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x1e0
mov rax, qword [0x14036a040]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov rsi, r8
mov edi, edx
mov rbx, rcx
test r8, r8
jne 0x140183348
xor al, al
jmp 0x140183429
lea rcx, [rsp + 0x20]
call fcn.1401823e0
test edi, edi
je 0x14018336e
test rbx, rbx
je 0x14018336e
mov r9b, 9
lea rcx, [rsp + 0x20]
mov r8d, edi
mov rdx, rbx
call fcn.140183790
movzx eax, byte [rsp + 0x1c0]
mov byte [rsp + 0x13f], 0
mov byte [rsp + rax + 0xf8], 6
movzx edx, byte [rsp + 0x1c0]
or byte [rsp + 0x13f], 0x80
inc dl
cmp dl, 0x47
jae 0x1401833bd
movzx eax, dl
lea rcx, [rsp + 0xf8]
add rcx, rax
mov eax, 0x47
sub al, dl
xor edx, edx
movzx r8d, al
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x30]
mov edx, 9
nop word [rax + rax]
mov rcx, qword [rax + 0xc8]
xor qword [rax], rcx
lea rax, [rax + 8]
sub rdx, 1
jne 0x1401833d0
lea rcx, [rsp + 0x30]
call fcn.1401824e0
movaps xmm0, xmmword [rsp + 0x30]
lea rax, vtable._ckSha3.0
movaps xmm1, xmmword [rsp + 0x40]
lea rcx, [rsp + 0x20]
movups xmmword [rsi], xmm0
mov qword [rsp + 0x20], rax
movaps xmm0, xmmword [rsp + 0x50]
movups xmmword [rsi + 0x10], xmm1
movaps xmm1, xmmword [rsp + 0x60]
movups xmmword [rsi + 0x20], xmm0
movups xmmword [rsi + 0x30], xmm1
call fcn.1400b67f0
mov al, 1
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.14008b8a0
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1401836c0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movzx eax, r8b
lea rdi, [rcx + 0x10]
mov rbx, rdx
movzx esi, r9b
mov rdx, rcx
lea eax, [rax*8]
mov byte [rax + rcx + 0xd7], 0
lea r11d, [rax - 1]
mov r10d, eax
movzx eax, byte [rcx + 0x1a0]
mov byte [rax + rcx + 0xd8], 6
or byte [r10 + rcx + 0xd7], 0x80
movzx ecx, byte [rcx + 0x1a0]
inc cl
movzx eax, cl
cmp eax, r11d
jge 0x140183735
movzx eax, cl
inc cl
mov byte [rax + rdx + 0xd8], 0
movzx eax, cl
cmp eax, r11d
jl 0x140183720
test r8b, r8b
je 0x140183755
mov rax, rdi
movzx edx, r8b
mov rcx, qword [rax + 0xc8]
xor qword [rax], rcx
lea rax, [rax + 8]
sub rdx, 1
jne 0x140183741
mov rcx, rdi
call fcn.1401824e0
test sil, sil
je 0x140183780
sub rdi, rbx
mov rcx, rsi
nop dword [rax + rax]
movzx eax, byte [rdi + rbx]
mov byte [rbx], al
lea rbx, [rbx + 1]
sub rcx, 1
jne 0x140183770
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140183790
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov qword [rsp + 0x40], rbp
movzx ecx, byte [rcx + 0x1a0]
mov esi, r8d
mov qword [rsp + 0x50], r14
mov rdi, rdx
movzx r14d, r9b
test cl, cl
je 0x140183857
movzx eax, r14b
movzx r9d, sil
shl al, 3
sub al, cl
movzx r8d, al
cmp r8d, esi
cmovbe r9d, r8d
xor dl, dl
lea r8, [rbx + rcx]
test r9b, r9b
je 0x1401837f7
movzx ecx, dl
inc dl
movzx eax, byte [rcx + rdi]
mov byte [rcx + r8 + 0xd8], al
cmp dl, r9b
jb 0x1401837e1
add byte [rbx + 0x1a0], dl
movzx ecx, byte [rbx + 0x1a0]
movzx eax, dl
add rdi, rax
movzx eax, dl
sub esi, eax
mov eax, r14d
shl eax, 3
cmp ecx, eax
jne 0x140183857
test r14b, r14b
je 0x140183844
lea rcx, [rbx + 0x10]
mov rdx, r14
nop word [rax + rax]
mov rax, qword [rcx + 0xc8]
xor qword [rcx], rax
lea rcx, [rcx + 8]
sub rdx, 1
jne 0x140183830
mov rcx, rbx
add rcx, 0x10
call fcn.1401824e0
mov byte [rbx + 0x1a0], 0
mov ebp, r14d
shl ebp, 3
cmp esi, ebp
jb 0x1401838be
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x58], r15
mov r12d, ebp
nop
test r14b, r14b
je 0x1401838a2
mov r8, rdi
lea rax, [rbx + 0x10]
sub r8, rbx
mov rdx, r14
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [r8 + rax - 0x10]
xor qword [rax], rcx
lea rax, [rax + 8]
sub rdx, 1
jne 0x140183890
lea rcx, [rbx + 0x10]
call fcn.1401824e0
sub esi, ebp
add rdi, r12
cmp esi, ebp
jae 0x140183870
mov r15, qword [rsp + 0x58]
mov r12, qword [rsp + 0x48]
mov r14, qword [rsp + 0x50]
xor dl, dl
mov rbp, qword [rsp + 0x40]
test esi, esi
je 0x1401838e7
nop
movzx ecx, dl
inc dl
movzx eax, byte [rcx + rdi]
mov byte [rcx + rbx + 0xd8], al
movzx eax, dl
cmp eax, esi
jb 0x1401838d0
add byte [rbx + 0x1a0], dl
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret