joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1402e9700
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x140462cc0]
xor rax, rsp
mov qword [rsp + 0x38], rax
movzx edi, byte [rcx]
mov rsi, r9
mov rbp, qword [rcx + 0x28]
mov r12, r8
mov r14, qword [rcx + 0x30]
mov r15, rdx
mov byte [rsp + 0x20], dil
mov rbx, rcx
test dil, 0x40
jne 0x1402e974e
lea rdx, [rcx + 0x10]
mov r8, r14
call rbp
mov r8d, edi
mov r13d, reloc.WS2_32.dll_ntohs
and r8d, 7
xor edi, edi
mov eax, r13d
mov dword [rsp + 0x24], r8d
sub eax, r8d
mov byte [rbx], r8b
mov ecx, edi
cmp eax, r13d
jae 0x1402e9797
mov edx, eax
add rdx, rbx
nop word [rax + rax]
movzx eax, byte [rdx]
mov byte [rdx], dil
lea rdx, [rdx + 1]
or rcx, rax
shl rcx, 8
sub r8, 1
jne 0x1402e9780
movzx eax, byte [rbx + 0xf]
or rcx, rax
mov byte [rbx + 0xf], 1
cmp rcx, rsi
je 0x1402e97b1
mov eax, 0xffffffff
jmp 0x1402e98bf
cmp rsi, 0x10
jb 0x1402e982c
mov rdi, rsi
shr rdi, 4
imul rax, rdi, 0xfffffffffffffff0
add rsi, rax
nop word [rax + rax]
mov r8, r14
lea rdx, [rsp + 0x28]
mov rcx, rbx
call rbp
mov eax, 8
dec eax
add byte [rax + rbx + 8], 1
jne 0x1402e97ef
test eax, eax
jne 0x1402e97e2
mov rax, qword [rsp + 0x28]
lea rdx, [rbx + 0x10]
xor rax, qword [r15]
lea rcx, [rbx + 0x10]
mov qword [r12], rax
mov r8, r14
xor qword [rbx + 0x10], rax
mov rax, qword [rsp + 0x30]
xor rax, qword [r15 + 8]
mov qword [r12 + 8], rax
xor qword [rbx + 0x18], rax
call rbp
add r15, 0x10
add r12, 0x10
sub rdi, 1
jne 0x1402e97d0
test rsi, rsi
je 0x1402e9876
mov r8, r14
lea rdx, [rsp + 0x28]
mov rcx, rbx
call rbp
test rsi, rsi
je 0x1402e986a
mov rcx, rdi
nop word [rax + rax]
movzx eax, byte [rcx + r15]
inc edi
xor al, byte [rsp + rcx + 0x28]
mov byte [rcx + r12], al
xor byte [rcx + rbx + 0x10], al
mov ecx, edi
cmp rcx, rsi
jb 0x1402e9850
lea rcx, [rbx + 0x10]
mov r8, r14
mov rdx, rcx
call rbp
sub r13d, dword [rsp + 0x24]
cmp r13d, 0x10
jae 0x1402e9897
mov r8d, reloc.WS2_32.dll_recv
mov ecx, r13d
sub r8d, r13d
add rcx, rbx
xor edx, edx
call fcn.140376d40
mov r8, r14
lea rdx, [rsp + 0x28]
mov rcx, rbx
call rbp
mov rax, qword [rsp + 0x28]
xor qword [rbx + 0x10], rax
mov rax, qword [rsp + 0x30]
xor qword [rbx + 0x18], rax
movzx eax, byte [rsp + 0x20]
mov byte [rbx], al
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140170e40
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1402e9c60
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x78
mov rax, qword [0x140462cc0]
xor rax, rsp
mov qword [rsp + 0x60], rax
movzx edi, byte [rcx]
mov rbp, r9
mov r10, qword [rsp + 0xe0]
mov r13, r9
mov r9, qword [rcx + 0x30]
mov r15, r8
mov rax, qword [rcx + 0x28]
mov r14, rdx
mov qword [rsp + 0x38], r9
mov rbx, rcx
mov qword [rsp + 0x40], r10
mov byte [rsp + 0x30], dil
mov qword [rsp + 0x48], rax
test dil, 0x40
jne 0x1402e9ccf
lea rdx, [rcx + 0x10]
mov r8, r9
call rax
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
mov r12d, reloc.WS2_32.dll_ntohs
xor esi, esi
mov r8d, edi
mov eax, r12d
and r8d, 7
mov ecx, esi
sub eax, r8d
mov dword [rsp + 0x40], r8d
mov byte [rbx], r8b
cmp eax, r12d
jae 0x1402e9d17
mov edx, eax
add rdx, rbx
nop dword [rax + rax]
movzx eax, byte [rdx]
mov byte [rdx], sil
lea rdx, [rdx + 1]
or rcx, rax
shl rcx, 8
sub r8, 1
jne 0x1402e9d00
movzx eax, byte [rbx + 0xf]
or rcx, rax
mov byte [rbx + 0xf], 1
cmp rcx, rbp
je 0x1402e9d31
mov eax, 0xffffffff
jmp 0x1402e9e5d
mov rdi, rbp
shr rdi, 4
test rdi, rdi
je 0x1402e9db3
lea rax, [rbx + 0x10]
mov r8, rdi
mov qword [rsp + 0x28], rax
mov rdx, r15
mov rcx, r14
mov qword [rsp + 0x20], rbx
call r10
shl rdi, 4
add r14, rdi
add r15, rdi
sub rbp, rdi
je 0x1402e9e09
shr rdi, 4
lea r8, [rbx + 0x10]
mov r9, 0xfffffffffffffff8
mov rdx, rsi
sub r9, rbx
nop
movzx eax, byte [r8 - 1]
lea r8, [r8 - 1]
add rdx, rax
movzx ecx, dil
add rdx, rcx
shr rdi, 8
mov byte [r8], dl
lea rax, [r8 + r9]
shr rdx, 8
test rax, rax
je 0x1402e9db8
test rdi, rdi
jne 0x1402e9d80
test rdx, rdx
jne 0x1402e9d80
jmp 0x1402e9db8
test r13, r13
je 0x1402e9e09
mov rdi, qword [rsp + 0x38]
lea rdx, [rsp + 0x50]
mov r13, qword [rsp + 0x48]
mov r8, rdi
mov rcx, rbx
call r13
test rbp, rbp
je 0x1402e9dfa
mov rcx, rsi
nop dword [rax + rax]
movzx eax, byte [rcx + r14]
inc esi
xor al, byte [rsp + rcx + 0x50]
mov byte [rcx + r15], al
xor byte [rcx + rbx + 0x10], al
mov ecx, esi
cmp rcx, rbp
jb 0x1402e9de0
lea rcx, [rbx + 0x10]
mov r8, rdi
mov rdx, rcx
call r13
jmp 0x1402e9e13
mov r13, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x38]
sub r12d, dword [rsp + 0x40]
cmp r12d, 0x10
jae 0x1402e9e34
mov r8d, reloc.WS2_32.dll_recv
mov ecx, r12d
sub r8d, r12d
add rcx, rbx
xor edx, edx
call fcn.140376d40
mov r8, rdi
lea rdx, [rsp + 0x50]
mov rcx, rbx
call r13
mov rax, qword [rsp + 0x50]
xor qword [rbx + 0x10], rax
mov rax, qword [rsp + 0x58]
xor qword [rbx + 0x18], rax
movzx eax, byte [rsp + 0x30]
mov byte [rbx], al
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140170e40
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1402eb480
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xor r10d, r10d
mov r11, rcx
test r8, r8
je 0x1402eb5e5
cmp r8, 8
jb 0x1402eb5bd
lea rcx, [r9 - 1]
lea rax, [rdx - 1]
add rcx, r8
add rax, r8
cmp r9, rax
ja 0x1402eb4b9
cmp rcx, rdx
jae 0x1402eb5bd
lea rax, [r8 - 1]
add rax, r11
cmp r9, rax
ja 0x1402eb4ce
cmp rcx, r11
jae 0x1402eb5bd
mov rcx, r11
mov qword [rsp + 0x10], rbx
sub rcx, rdx
mov qword [rsp], rdi
cmp r8, 0x40
jb 0x1402eb577
mov rdi, r8
mov qword [rsp + 0x18], rsi
and edi, 0x3f
mov rsi, r8
sub rsi, rdi
mov rbx, r9
lea rax, [rdx + 0x10]
sub rbx, rdx
nop dword [rax]
nop word [rax + rax]
movdqu xmm0, xmmword [rax - 0x10]
add r10, 0x40
movdqu xmm1, xmmword [rcx + rax - 0x10]
movdqu xmm2, xmmword [rcx + rax]
lea rax, [rax + 0x40]
xorps xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmmword [rbx + rax - 0x50], xmm1
xorps xmm2, xmm0
movdqu xmm0, xmmword [rax - 0x30]
movdqu xmm1, xmmword [rcx + rax - 0x30]
movdqu xmmword [rbx + rax - 0x40], xmm2
xorps xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm2, xmmword [rcx + rax - 0x20]
movdqu xmmword [rbx + rax - 0x30], xmm1
xorps xmm2, xmm0
movdqu xmmword [rbx + rax - 0x20], xmm2
cmp r10, rsi
jb 0x1402eb510
mov rsi, qword [rsp + 0x18]
cmp rdi, 8
jb 0x1402eb5af
mov rbx, r8
and rbx, 0xfffffffffffffff8
mov rdi, r9
lea rax, [r10 + rdx]
sub rdi, rdx
nop dword [rax + rax]
movq xmm1, qword [rcx + rax]
add r10, 8
movq xmm0, qword [rax]
lea rax, [rax + 8]
xorps xmm1, xmm0
movq qword [rax + rdi - 8], xmm1
cmp r10, rbx
jb 0x1402eb590
mov rdi, qword [rsp]
mov rbx, qword [rsp + 0x10]
cmp r10, r8
jae 0x1402eb5e5
sub r11, rdx
lea rax, [r10 + rdx]
sub r9, rdx
sub r8, r10
nop word [rax + rax]
movzx ecx, byte [rax + r11]
xor cl, byte [rax]
mov byte [rax + r9], cl
lea rax, [rax + 1]
sub r8, 1
jne 0x1402eb5d0
add rsp, 8
ret

Function at 0x1402eb5f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov rdi, qword [rcx + 0x28]
mov rbx, rdx
mov rbp, rcx
cmp rdx, rdi
ja 0x1402eb625
shl rbx, 4
add rbx, qword [rcx + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
mov rcx, qword [rcx + 0x30]
cmp rbx, rcx
jb 0x1402eb66e
sub rdx, rcx
lea r8, [0x140400661]
add rdx, 4
xor r9d, r9d
and rdx, 0xfffffffffffffffc
add rdx, rcx
mov rcx, qword [rbp + 0x58]
mov qword [rbp + 0x30], rdx
shl rdx, 4
call fcn.1401ba6a0
test rax, rax
jne 0x1402eb66a
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
mov qword [rbp + 0x58], rax
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], r12
mov r12, rbx
mov qword [rsp + 0x50], r15
mov r15, rdi
shl r15, 4
sub r12, rdi
nop word [rax + rax]
mov rcx, qword [rbp + 0x58]
mov edx, 1
add rcx, r15
movzx edi, byte [rcx]
lea rsi, [rcx + 0x10]
shr dil, 7
mov r8, rsi
neg dil
and dil, 0x87
call fcn.1402eb2d0
xor byte [rsi + 0xf], dil
add r15, 0x10
sub r12, 1
jne 0x1402eb690
mov r15, qword [rsp + 0x50]
mov r12, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov qword [rbp + 0x28], rbx
shl rbx, 4
add rbx, qword [rbp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
Function at 0x1402ecf90
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Encrypt data using salsa20 or chacha

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
sub rsp, 0xc0
mov rax, qword [0x140462cc0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0x100]
mov rbp, r8
mov dword [rsp + 0x60], 0x61707865
mov rsi, rdx
mov dword [rsp + 0x64], 0x3320646e
mov rdi, rcx
mov dword [rsp + 0x68], 0x79622d32
mov dword [rsp + 0x6c], 0x6b206574
movups xmm0, xmmword [r9]
movups xmm1, xmmword [r9 + 0x10]
movups xmmword [rsp + 0x70], xmm0
movups xmmword [r11 - 0x58], xmm1
movups xmm0, xmmword [rax]
movups xmmword [r11 - 0x48], xmm0
test r8, r8
je 0x1402ed1a1
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], r14
nop dword [rax]
mov ebx, 0x40
lea rdx, [rsp + 0x60]
cmp rbp, rbx
lea rcx, [rsp + 0x20]
cmovb rbx, rbp
call fcn.1402ed1c0
xor eax, eax
test rbx, rbx
je 0x1402ed17b
cmp rbx, 8
jb 0x1402ed141
lea rdx, [rdi - 1]
add rdx, rbx
lea rcx, [rsp + rbx + 0x1f]
cmp rdi, rcx
ja 0x1402ed05f
lea rcx, [rsp + 0x20]
cmp rdx, rcx
jae 0x1402ed141
lea rcx, [rsi - 1]
add rcx, rbx
cmp rdi, rcx
ja 0x1402ed074
cmp rdx, rsi
jae 0x1402ed141
cmp rbx, 0x40
jb 0x1402ed116
mov r8, rbx
mov r10, rbx
and r8d, 0x3f
sub r10, r8
mov rdx, rsi
lea r9, [rsp + 0x20]
lea r11, [rsp + 0x30]
sub rdx, rdi
sub r9, rdi
lea r14, [rsp + 0x40]
sub r11, rdi
lea rcx, [rdi + 0x10]
sub r14, rdi
nop dword [rax]
movdqu xmm0, xmmword [r9 + rcx - 0x10]
add rax, 0x40
movdqu xmm1, xmmword [rcx + rdx - 0x10]
movdqu xmm2, xmmword [r9 + rcx]
lea rcx, [rcx + 0x40]
xorps xmm1, xmm0
movdqu xmm0, xmmword [rcx + rdx - 0x40]
movdqu xmmword [rcx - 0x50], xmm1
xorps xmm2, xmm0
movdqu xmm0, xmmword [rcx + r11 - 0x40]
movdqu xmm1, xmmword [rdx + rcx - 0x30]
movdqu xmmword [rcx - 0x40], xmm2
xorps xmm1, xmm0
movdqu xmm0, xmmword [rcx + r14 - 0x40]
movdqu xmm2, xmmword [rdx + rcx - 0x20]
movdqu xmmword [rcx - 0x30], xmm1
xorps xmm2, xmm0
movdqu xmmword [rcx - 0x20], xmm2
cmp rax, r10
jb 0x1402ed0b0
cmp r8, 8
jb 0x1402ed13c
mov rcx, rbx
and rcx, 0xfffffffffffffff8
nop dword [rax]
movq xmm1, qword [rsi + rax]
movq xmm0, qword [rsp + rax + 0x20]
xorps xmm1, xmm0
movq qword [rdi + rax], xmm1
add rax, 8
cmp rax, rcx
jb 0x1402ed120
cmp rax, rbx
jae 0x1402ed17b
lea rcx, [rsp + 0x20]
mov r8, rsi
sub r8, rcx
mov r9, rdi
lea rcx, [rsp + 0x20]
sub r9, rcx
nop word [rax + rax]
lea rdx, [rsp + 0x20]
add rdx, rax
inc rax
movzx ecx, byte [rdx + r8]
xor cl, byte [rdx]
mov byte [rdx + r9], cl
cmp rax, rbx
jb 0x1402ed160
inc dword [rsp + 0x90]
add rdi, rbx
add rsi, rbx
sub rbp, rbx
jne 0x1402ed010
mov r14, qword [rsp + 0xf0]
mov rbx, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140170e40
add rsp, 0xc0
pop rdi
pop rsi
pop rbp
ret
Function at 0x1402f0600
Capabilities:
Encode data using xor

Disassembly:
cmp dword [rsp + 0x30], 0
je 0x1402f0618
lea rax, [0x1402ee950]
mov qword [rsp + 0x30], rax
jmp fcn.1402e61a0
lea rax, [0x1402ef7a0]
mov qword [rsp + 0x30], rax
jmp fcn.1402e6360

Function at 0x1402f0da0
Capabilities:
Encode data using xor

Disassembly:
mov r10, rcx
test rdx, rdx
je 0x1402f0e28
test r8, r8
je 0x1402f0e28
mov r9, qword [rcx + 0x28]
cmp r8, r9
cmovb r9, r8
test r9, r9
je 0x1402f0de2
add rcx, 0x30
mov r11, rdx
sub r11, r10
nop dword [rax + rax]
movzx eax, byte [r11 + rcx - 0x30]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub r9, 1
jne 0x1402f0dd0
mov rax, qword [r10 + 0x28]
cmp r8, rax
jbe 0x1402f0e28
sub r8, rax
cmp r8, 0x10
jbe 0x1402f0dfc
mov r8d, reloc.WS2_32.dll_recv
jmp 0x1402f0e01
test r8, r8
je 0x1402f0e28
xor ecx, ecx
nop dword [rax]
nop word [rax + rax]
mov rax, qword [r10 + 0x28]
add rax, rcx
movzx eax, byte [rax + rdx]
xor byte [r10 + rcx + 0x50], al
inc rcx
cmp rcx, r8
jb 0x1402f0e10
ret

Function at 0x1402f0e30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
xor edi, edi
mov qword [rsp + 0x40], rbp
movsxd rbx, r9d
mov r11, r8
mov dword [rsp + 0x58], reloc.WS2_32.dll_recv
mov rbp, rcx
mov r10d, edi
test r9d, r9d
jle 0x1402f0f54
cmp ebx, 8
jb 0x1402f0f54
lea rax, [rbx - 1]
lea rcx, [rax + rdx]
add rax, r8
cmp rdx, rax
ja 0x1402f0e80
cmp rcx, r8
jae 0x1402f0f54
sub r8, rdx
cmp ebx, 0x40
jb 0x1402f0f1d
mov eax, ebx
mov qword [rsp + 0x48], rsi
and eax, 0xffffffc0
mov r9, 0xfffffffffffffff0
movsxd rsi, eax
sub r9, rdx
lea rcx, [rdx + 0x10]
nop word [rax + rax]
movdqu xmm0, xmmword [rcx - 0x10]
add r10d, 0x40
movdqu xmm1, xmmword [r8 + rcx - 0x10]
movdqu xmm2, xmmword [r8 + rcx]
lea rcx, [rcx + 0x40]
xorps xmm1, xmm0
lea rax, [r9 + rcx]
movdqu xmmword [rcx - 0x50], xmm1
movdqu xmm0, xmmword [rcx - 0x40]
movdqu xmm1, xmmword [r8 + rcx - 0x30]
xorps xmm2, xmm0
movdqu xmmword [rcx - 0x40], xmm2
movdqu xmm0, xmmword [rcx - 0x30]
xorps xmm1, xmm0
movdqu xmmword [rcx - 0x30], xmm1
movdqu xmm0, xmmword [rcx - 0x20]
movdqu xmm1, xmmword [r8 + rcx - 0x20]
xorps xmm1, xmm0
movdqu xmmword [rcx - 0x20], xmm1
cmp rax, rsi
jl 0x1402f0eb0
mov rsi, qword [rsp + 0x48]
mov eax, ebx
and al, 0x3f
cmp al, 8
jb 0x1402f0f54
mov ecx, ebx
and ecx, 0xfffffff8
movsxd rax, r10d
movsxd r9, ecx
lea rcx, [rax + rdx]
nop dword [rax]
movq xmm0, qword [rcx]
add r10d, 8
movq xmm1, qword [r8 + rcx]
xorps xmm1, xmm0
movq qword [rcx], xmm1
add rcx, 8
mov rax, rcx
sub rax, rdx
cmp rax, r9
jl 0x1402f0f30
movsxd rcx, r10d
mov r8, rbx
cmp rcx, rbx
jge 0x1402f0f81
sub r11, rdx
lea rax, [rcx + rdx]
sub r8, rcx
nop dword [rax]
movzx ecx, byte [rax + r11]
xor byte [rax], cl
lea rax, [rax + 1]
sub r8, 1
jne 0x1402f0f70
mov rcx, qword [rbp + 0x10]
lea r8, [rsp + 0x58]
mov r9, rdx
mov dword [rsp + 0x20], ebx
call fcn.140265890
mov rbp, qword [rsp + 0x40]
test eax, eax
je 0x1402f0fb4
cmp dword [rsp + 0x58], ebx
sete dil
mov eax, edi
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x50]
xor eax, eax
add rsp, 0x30
pop rdi
ret
Function at 0x1402fb6d0
Capabilities:
Encrypt data using curve25519

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x1f8]
sub rsp, 0x2f8
mov rax, qword [0x140462cc0]
xor rax, rsp
mov qword [rbp + 0x1e0], rax
mov rbx, qword [rbp + 0x250]
mov r15, rcx
lea rcx, [rbp - 0x60]
mov rdi, r9
mov r14, r8
mov rsi, rdx
call fcn.140249770
mov r8d, 0x20
lea rcx, [rbp - 0x60]
mov rdx, rbx
call fcn.140249800
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x120]
call fcn.140249910
movzx eax, byte [rbp + 0x13f]
lea rcx, [rbp - 0x60]
and byte [rbp + 0x120], 0xf8
and al, 0x3f
or al, 0x40
mov byte [rbp + 0x13f], al
call fcn.140249770
mov r8d, 0x20
lea rdx, [rbp + 0x140]
lea rcx, [rbp - 0x60]
call fcn.140249800
mov r8, r14
lea rcx, [rbp - 0x60]
mov rdx, rsi
call fcn.140249800
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x160]
call fcn.140249910
lea rcx, [rbp + 0x160]
call fcn.140301190
lea rdx, [rbp + 0x160]
lea rcx, [rbp + 0x80]
call fcn.1402ff720
lea rdx, [rbp + 0xd0]
lea rcx, [rsp + 0x20]
call fcn.1402fd200
lea r8, [rsp + 0x20]
lea rdx, [rbp + 0x80]
lea rcx, [rsp + 0x70]
call fcn.1402fc350
lea r8, [rsp + 0x20]
lea rdx, [rbp + 0xa8]
lea rcx, [rsp + 0x48]
call fcn.1402fc350
lea rdx, [rsp + 0x48]
mov rcx, r15
call fcn.1402fc0a0
lea rcx, [rsp + 0x20]
lea rdx, [rsp + 0x70]
call fcn.1402fc0a0
movzx eax, byte [rsp + 0x20]
lea rcx, [rbp - 0x60]
shl al, 7
xor byte [r15 + 0x1f], al
call fcn.140249770
mov r8d, 0x20
lea rcx, [rbp - 0x60]
mov rdx, r15
call fcn.140249800
mov r8d, 0x20
lea rcx, [rbp - 0x60]
mov rdx, rdi
call fcn.140249800
mov r8, r14
lea rcx, [rbp - 0x60]
mov rdx, rsi
call fcn.140249800
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x1a0]
call fcn.140249910
lea rcx, [rbp + 0x1a0]
call fcn.140301190
lea rcx, [r15 + 0x20]
lea r9, [rbp + 0x160]
lea r8, [rbp + 0x120]
lea rdx, [rbp + 0x1a0]
call fcn.140301fe0
mov edx, 0xd8
lea rcx, [rbp - 0x60]
call fcn.14023bdd0
mov edx, 0x40
lea rcx, [rbp + 0x160]
call fcn.14023bdd0
mov edx, 0x40
lea rcx, [rbp + 0x120]
call fcn.14023bdd0
mov eax, 1
mov rcx, qword [rbp + 0x1e0]
xor rcx, rsp
call fcn.140170e40
add rsp, 0x2f8
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x1402fbb30
Capabilities:
Encrypt data using curve25519

Disassembly:
push rbx
sub rsp, 0x190
mov rax, qword [0x140462cc0]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov rax, rdx
lea r8, [rsp + 0x140]
mov rbx, rcx
mov edx, 0x20
mov rcx, rax
call fcn.14024a120
movzx eax, byte [rsp + 0x15f]
lea rdx, [rsp + 0x140]
and byte [rsp + 0x140], 0xf8
lea rcx, [rsp + 0xa0]
and al, 0x3f
or al, 0x40
mov byte [rsp + 0x15f], al
call fcn.1402ff720
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x20]
call fcn.1402fd200
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x70]
call fcn.1402fc350
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0xc8]
lea rcx, [rsp + 0x48]
call fcn.1402fc350
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.1402fc0a0
lea rcx, [rsp + 0x20]
lea rdx, [rsp + 0x70]
call fcn.1402fc0a0
movzx eax, byte [rsp + 0x20]
lea rcx, [rsp + 0x140]
shl al, 7
mov edx, 0x40
xor byte [rbx + 0x1f], al
call fcn.14023bdd0
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.140170e40
add rsp, 0x190
pop rbx
ret
Function at 0x1402fbc70
Capabilities:
Encrypt data using curve25519

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov rax, qword [0x140462cc0]
xor rax, rsp
mov qword [rbp + 0x60], rax
movups xmm0, xmmword [rdx]
mov rbx, rcx
lea rcx, [rsp + 0x50]
movups xmm1, xmmword [rdx + 0x10]
movd eax, xmm0
movups xmmword [rbp + 0x40], xmm0
and al, 0xf8
mov byte [rbp + 0x40], al
mov rax, qword [rdx + 0x18]
lea rdx, [rbp + 0x40]
shr rax, 0x38
and al, 0x3f
or al, 0x40
movups xmmword [rbp + 0x50], xmm1
mov byte [rbp + 0x5f], al
call fcn.1402ff720
mov ecx, dword [rsp + 0x78]
mov edx, dword [rbp - 0x60]
mov r8d, dword [rbp - 0x3c]
lea eax, [rcx + rdx]
sub edx, ecx
mov ecx, dword [rsp + 0x7c]
mov dword [rbp + 0x18], edx
mov edx, dword [rbp - 0x5c]
mov dword [rbp - 0x10], eax
lea eax, [rcx + rdx]
sub edx, ecx
mov ecx, dword [rbp - 0x80]
mov dword [rbp + 0x1c], edx
mov edx, dword [rbp - 0x58]
mov dword [rbp - 0xc], eax
lea eax, [rcx + rdx]
sub edx, ecx
mov ecx, dword [rbp - 0x7c]
mov dword [rbp + 0x20], edx
mov edx, dword [rbp - 0x54]
mov dword [rbp - 8], eax
lea eax, [rcx + rdx]
sub edx, ecx
mov ecx, dword [rbp - 0x78]
mov dword [rbp + 0x24], edx
mov edx, dword [rbp - 0x50]
mov dword [rbp - 4], eax
lea eax, [rcx + rdx]
sub edx, ecx
mov ecx, dword [rbp - 0x74]
mov dword [rbp + 0x28], edx
mov edx, dword [rbp - 0x4c]
mov dword [rbp], eax
lea eax, [rcx + rdx]
sub edx, ecx
mov ecx, dword [rbp - 0x70]
mov dword [rbp + 0x2c], edx
mov edx, dword [rbp - 0x48]
mov dword [rbp + 4], eax
lea eax, [rcx + rdx]
sub edx, ecx
mov ecx, dword [rbp - 0x6c]
mov dword [rbp + 0x30], edx
mov edx, dword [rbp - 0x44]
mov dword [rbp + 8], eax
lea eax, [rcx + rdx]
sub edx, ecx
mov ecx, dword [rbp - 0x68]
mov dword [rbp + 0x34], edx
mov edx, dword [rbp - 0x40]
mov dword [rbp + 0xc], eax
lea eax, [rcx + rdx]
sub edx, ecx
mov dword [rbp + 0x38], edx
lea rcx, [rsp + 0x20]
mov edx, dword [rbp - 0x64]
mov dword [rbp + 0x10], eax
lea eax, [rdx + r8]
sub r8d, edx
lea rdx, [rbp + 0x18]
mov dword [rbp + 0x3c], r8d
mov dword [rbp + 0x14], eax
call fcn.1402fd200
lea r8, [rsp + 0x20]
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x10]
call fcn.1402fc350
lea rdx, [rbp - 0x10]
mov rcx, rbx
call fcn.1402fc0a0
lea rcx, [rbp + 0x40]
mov edx, 0x20
call fcn.14023bdd0
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.140170e40
mov rbx, qword [rsp + 0x190]
add rsp, 0x170
pop rbp
ret
Function at 0x140304150
Capabilities:
Encode data using xor

Disassembly:
mov r9, rcx
movd xmm4, r8d
mov r10d, r8d
pshufd xmm4, xmm4, 0
lea rcx, [rdx + 0x3c]
lea rax, [r9 + 0x3c]
cmp rdx, rax
ja 0x1403041a1
cmp rcx, r9
jb 0x1403041a1
sub r9, rdx
mov r8d, reloc.WS2_32.dll_recv
nop dword [rax + rax]
mov ecx, dword [rdx + r9]
lea rdx, [rdx + 4]
mov eax, ecx
xor eax, dword [rdx - 4]
and eax, r10d
xor ecx, eax
mov dword [rdx + r9 - 4], ecx
xor dword [rdx - 4], eax
sub r8, 1
jne 0x140304180
ret
sub r9, rdx
mov eax, 4
nop dword [rax]
movdqu xmm1, xmmword [r9 + rdx]
movdqu xmm2, xmmword [rdx]
lea rdx, [rdx + 0x10]
movdqa xmm3, xmm1
xorps xmm3, xmm2
andps xmm3, xmm4
movdqa xmm0, xmm3
xorps xmm3, xmm2
xorps xmm0, xmm1
movdqu xmmword [r9 + rdx - 0x10], xmm0
movdqu xmmword [rdx - 0x10], xmm3
sub rax, 1
jne 0x1403041b0
ret
Function at 0x140309ca0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x70
mov rax, qword [0x140462cc0]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rax, r8
lea rbp, [r8 + r8]
shl rax, 7
xor edi, edi
mov rsi, r8
mov rbx, rdx
mov r14, rcx
movups xmm0, xmmword [rax + rdx - 0x40]
movups xmm1, xmmword [rax + rdx - 0x30]
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm1
movups xmm0, xmmword [rax + rdx - 0x20]
movups xmm1, xmmword [rax + rdx - 0x10]
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm1
test rbp, rbp
je 0x140309de0
nop dword [rax]
nop word [rax + rax]
xor eax, eax
lea rcx, [rbx + 0x3c]
lea rdx, [rsp + 0x20]
cmp rdx, rcx
ja 0x140309d45
lea rcx, [rsp + 0x5c]
cmp rcx, rbx
jb 0x140309d45
nop word [rax + rax]
mov ecx, dword [rbx]
add rbx, 4
xor dword [rsp + rax*4 + 0x20], ecx
inc rax
cmp rax, 0x10
jb 0x140309d30
jmp 0x140309d88
movdqu xmm0, xmmword [rbx]
xorps xmm0, xmmword [rsp + 0x20]
movdqu xmmword [rsp + 0x20], xmm0
movdqu xmm0, xmmword [rbx + 0x10]
xorps xmm0, xmmword [rsp + 0x30]
movdqu xmmword [rsp + 0x30], xmm0
movdqu xmm0, xmmword [rbx + 0x20]
xorps xmm0, xmmword [rsp + 0x40]
movdqu xmmword [rsp + 0x40], xmm0
movdqu xmm0, xmmword [rbx + 0x30]
add rbx, 0x40
xorps xmm0, xmmword [rsp + 0x50]
movdqu xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x20]
call fcn.140309810
movups xmm0, xmmword [rsp + 0x20]
mov rcx, rdi
movups xmm1, xmmword [rsp + 0x30]
and ecx, 1
imul rcx, rsi
mov rax, rdi
inc rdi
shr rax, 1
add rcx, rax
shl rcx, 6
movups xmmword [rcx + r14], xmm0
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rcx + r14 + 0x10], xmm1
movups xmm1, xmmword [rsp + 0x50]
movups xmmword [rcx + r14 + 0x20], xmm0
movups xmmword [rcx + r14 + 0x30], xmm1
cmp rdi, rbp
jb 0x140309d10
mov edx, 0x40
lea rcx, [rsp + 0x20]
call fcn.14023bdd0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140170e40
add rsp, 0x70
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret