joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1402e6780
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov rbx, rcx
lea rbp, [r8 + 0xe]
sub rbx, r8
lea r12, [0x1403cc8e0]
mov r15, r9
mov rsi, rdx
mov r11, rcx
movzx eax, byte [r11 + 0xf]
mov rdi, rbp
movzx ecx, byte [rbp + 1]
mov r14d, reloc.WS2_32.dll_ntohs
xor rcx, rax
mov rax, rcx
and rcx, 0xfffffffffffffff0
and eax, 0xf
lea rdx, [rcx + rsi]
add rax, rax
mov r10, qword [rsi + rax*8 + 8]
mov r8, qword [rsi + rax*8]
mov rcx, r10
and ecx, 0xf
shr r10, 4
mov rax, r8
shl r8, 0x3c
shr rax, 4
or r10, r8
xor rax, qword [r12 + rcx*8]
xor rax, qword [rdx]
xor r10, qword [rdx + 8]
nop word [rax + rax]
movzx ecx, byte [rdi]
mov r9, rax
movzx r8d, byte [rdi + rbx]
lea rdi, [rdi - 1]
xor r8, rcx
shl rax, 0x3c
mov rcx, r10
shr r9, 4
shr r10, 4
and ecx, 0xf
or rax, r10
mov rdx, r8
and edx, 0xf
and r8, 0xfffffffffffffff0
add rdx, rdx
xor r9, qword [r12 + rcx*8]
xor rax, qword [rsi + rdx*8 + 8]
xor r9, qword [rsi + rdx*8]
mov rcx, rax
mov rdx, rax
and ecx, 0xf
shr rdx, 4
mov rax, r9
shr rax, 4
mov r10, r9
shl r10, 0x3c
xor rax, qword [r12 + rcx*8]
or r10, rdx
xor rax, qword [r8 + rsi]
xor r10, qword [r8 + rsi + 8]
sub r14, 1
jne 0x1402e6810
mov rdx, rax
mov byte [r11 + 7], al
shr rdx, 0x20
add rbp, 0x10
mov ecx, edx
mov byte [r11 + 3], dl
shr ecx, 0x18
sub rbx, 0x10
mov byte [r11], cl
mov ecx, edx
shr ecx, 0x10
mov byte [r11 + 1], cl
mov ecx, edx
shr ecx, 8
mov byte [r11 + 2], cl
mov ecx, eax
shr ecx, 0x18
mov byte [r11 + 4], cl
mov ecx, eax
shr ecx, 0x10
mov byte [r11 + 5], cl
mov ecx, eax
shr ecx, 8
mov byte [r11 + 6], cl
mov rcx, r10
shr rcx, 0x20
mov eax, ecx
mov byte [r11 + 0xb], cl
shr eax, 0x18
mov byte [r11 + 8], al
mov eax, ecx
shr eax, 0x10
mov byte [r11 + 9], al
mov eax, ecx
shr eax, 8
mov byte [r11 + 0xa], al
mov eax, r10d
shr eax, 0x18
mov byte [r11 + 0xc], al
mov eax, r10d
shr eax, 0x10
mov byte [r11 + 0xd], al
mov eax, r10d
shr eax, 8
mov byte [r11 + 0xe], al
mov byte [r11 + 0xf], r10b
sub r15, 0x10
jne 0x1402e67b4
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret
Function at 0x1402e6ef0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x140463cc0]
xor rax, rsp
mov qword [rsp + 0x38], rax
movzx edi, byte [rcx]
mov rsi, r9
mov rbp, qword [rcx + 0x28]
mov r12, r8
mov r14, qword [rcx + 0x30]
mov r15, rdx
mov byte [rsp + 0x20], dil
mov rbx, rcx
test dil, 0x40
jne 0x1402e6f3e
lea rdx, [rcx + 0x10]
mov r8, r14
call rbp
mov r8d, edi
mov r13d, reloc.WS2_32.dll_ntohs
and r8d, 7
xor edi, edi
mov eax, r13d
mov dword [rsp + 0x24], r8d
sub eax, r8d
mov byte [rbx], r8b
mov ecx, edi
cmp eax, r13d
jae 0x1402e6f87
mov edx, eax
add rdx, rbx
nop word [rax + rax]
movzx eax, byte [rdx]
mov byte [rdx], dil
lea rdx, [rdx + 1]
or rcx, rax
shl rcx, 8
sub r8, 1
jne 0x1402e6f70
movzx eax, byte [rbx + 0xf]
or rcx, rax
mov byte [rbx + 0xf], 1
cmp rcx, rsi
je 0x1402e6fa1
mov eax, 0xffffffff
jmp 0x1402e70af
cmp rsi, 0x10
jb 0x1402e7022
mov r13, rsi
shr r13, 4
imul rax, r13, 0xfffffffffffffff0
add rsi, rax
nop word [rax + rax]
mov r8, r14
lea rdx, [rsp + 0x28]
mov rcx, rbx
call rbp
mov eax, 8
dec eax
add byte [rax + rbx + 8], 1
jne 0x1402e6fdf
test eax, eax
jne 0x1402e6fd2
mov rax, qword [rsp + 0x28]
lea rdx, [rbx + 0x10]
xor rax, qword [r15]
lea rcx, [rbx + 0x10]
mov qword [r12], rax
mov r8, r14
xor qword [rbx + 0x10], rax
mov rax, qword [rsp + 0x30]
xor rax, qword [r15 + 8]
mov qword [r12 + 8], rax
xor qword [rbx + 0x18], rax
call rbp
add r15, 0x10
add r12, 0x10
sub r13, 1
jne 0x1402e6fc0
mov r13d, reloc.WS2_32.dll_ntohs
test rsi, rsi
je 0x1402e7066
mov r8, r14
lea rdx, [rsp + 0x28]
mov rcx, rbx
call rbp
test rsi, rsi
je 0x1402e705a
mov rcx, rdi
nop dword [rax]
movzx eax, byte [rcx + r15]
inc edi
xor al, byte [rsp + rcx + 0x28]
mov byte [rcx + r12], al
xor byte [rcx + rbx + 0x10], al
mov ecx, edi
cmp rcx, rsi
jb 0x1402e7040
lea rcx, [rbx + 0x10]
mov r8, r14
mov rdx, rcx
call rbp
sub r13d, dword [rsp + 0x24]
cmp r13d, 0x10
jae 0x1402e7087
mov r8d, reloc.WS2_32.dll_recv
mov ecx, r13d
sub r8d, r13d
add rcx, rbx
xor edx, edx
call fcn.140374500
mov r8, r14
lea rdx, [rsp + 0x28]
mov rcx, rbx
call rbp
mov rax, qword [rsp + 0x28]
xor qword [rbx + 0x10], rax
mov rax, qword [rsp + 0x30]
xor qword [rbx + 0x18], rax
movzx eax, byte [rsp + 0x20]
mov byte [rbx], al
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14016e5c0
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1402e7460
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x78
mov rax, qword [0x140463cc0]
xor rax, rsp
mov qword [rsp + 0x60], rax
movzx edi, byte [rcx]
mov rbp, r9
mov r10, qword [rsp + 0xe0]
mov r13, r9
mov r9, qword [rcx + 0x30]
mov r15, r8
mov rax, qword [rcx + 0x28]
mov r14, rdx
mov qword [rsp + 0x38], r9
mov rbx, rcx
mov qword [rsp + 0x40], r10
mov byte [rsp + 0x30], dil
mov qword [rsp + 0x48], rax
test dil, 0x40
jne 0x1402e74cf
lea rdx, [rcx + 0x10]
mov r8, r9
call rax
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
mov r12d, reloc.WS2_32.dll_ntohs
xor esi, esi
mov r8d, edi
mov eax, r12d
and r8d, 7
mov ecx, esi
sub eax, r8d
mov dword [rsp + 0x40], r8d
mov byte [rbx], r8b
cmp eax, r12d
jae 0x1402e7517
mov edx, eax
add rdx, rbx
nop dword [rax + rax]
movzx eax, byte [rdx]
mov byte [rdx], sil
lea rdx, [rdx + 1]
or rcx, rax
shl rcx, 8
sub r8, 1
jne 0x1402e7500
movzx eax, byte [rbx + 0xf]
or rcx, rax
mov byte [rbx + 0xf], 1
cmp rcx, rbp
je 0x1402e7531
mov eax, 0xffffffff
jmp 0x1402e765d
mov rdi, rbp
shr rdi, 4
test rdi, rdi
je 0x1402e75b3
lea rax, [rbx + 0x10]
mov r8, rdi
mov qword [rsp + 0x28], rax
mov rdx, r15
mov rcx, r14
mov qword [rsp + 0x20], rbx
call r10
shl rdi, 4
add r14, rdi
add r15, rdi
sub rbp, rdi
je 0x1402e7609
shr rdi, 4
lea r8, [rbx + 0x10]
mov r9, 0xfffffffffffffff8
mov rdx, rsi
sub r9, rbx
nop
movzx eax, byte [r8 - 1]
lea r8, [r8 - 1]
add rdx, rax
movzx ecx, dil
add rdx, rcx
shr rdi, 8
mov byte [r8], dl
lea rax, [r9 + r8]
shr rdx, 8
test rax, rax
je 0x1402e75b8
test rdi, rdi
jne 0x1402e7580
test rdx, rdx
jne 0x1402e7580
jmp 0x1402e75b8
test r13, r13
je 0x1402e7609
mov rdi, qword [rsp + 0x38]
lea rdx, [rsp + 0x50]
mov r13, qword [rsp + 0x48]
mov r8, rdi
mov rcx, rbx
call r13
test rbp, rbp
je 0x1402e75fa
mov rcx, rsi
nop dword [rax + rax]
movzx eax, byte [rcx + r14]
inc esi
xor al, byte [rsp + rcx + 0x50]
mov byte [rcx + r15], al
xor byte [rcx + rbx + 0x10], al
mov ecx, esi
cmp rcx, rbp
jb 0x1402e75e0
lea rcx, [rbx + 0x10]
mov r8, rdi
mov rdx, rcx
call r13
jmp 0x1402e7613
mov r13, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x38]
sub r12d, dword [rsp + 0x40]
cmp r12d, 0x10
jae 0x1402e7634
mov r8d, reloc.WS2_32.dll_recv
mov ecx, r12d
sub r8d, r12d
add rcx, rbx
xor edx, edx
call fcn.140374500
mov r8, rdi
lea rdx, [rsp + 0x50]
mov rcx, rbx
call r13
mov rax, qword [rsp + 0x50]
xor qword [rbx + 0x10], rax
mov rax, qword [rsp + 0x58]
xor qword [rbx + 0x18], rax
movzx eax, byte [rsp + 0x30]
mov byte [rbx], al
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14016e5c0
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1402e8d30
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xor r10d, r10d
mov r11, rcx
test r8, r8
je 0x1402e8e95
cmp r8, 8
jb 0x1402e8e6d
lea rcx, [r9 - 1]
lea rax, [rdx - 1]
add rcx, r8
add rax, r8
cmp r9, rax
ja 0x1402e8d69
cmp rcx, rdx
jae 0x1402e8e6d
lea rax, [r8 - 1]
add rax, r11
cmp r9, rax
ja 0x1402e8d7e
cmp rcx, r11
jae 0x1402e8e6d
mov rcx, r11
mov qword [rsp + 0x10], rbx
sub rcx, rdx
mov qword [rsp], rdi
cmp r8, 0x40
jb 0x1402e8e27
mov rbx, r8
mov qword [rsp + 0x18], rsi
and ebx, 0x3f
mov rdi, r8
sub rdi, rbx
mov rsi, r9
lea rax, [rdx + 0x10]
sub rsi, rdx
nop dword [rax]
nop word [rax + rax]
movdqu xmm0, xmmword [rax - 0x10]
add r10, 0x40
movdqu xmm1, xmmword [rcx + rax - 0x10]
movdqu xmm2, xmmword [rcx + rax]
lea rax, [rax + 0x40]
xorps xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmmword [rsi + rax - 0x50], xmm1
xorps xmm2, xmm0
movdqu xmm0, xmmword [rcx + rax - 0x30]
movdqu xmm1, xmmword [rax - 0x30]
movdqu xmmword [rsi + rax - 0x40], xmm2
xorps xmm1, xmm0
movdqu xmm0, xmmword [rcx + rax - 0x20]
movdqu xmm2, xmmword [rax - 0x20]
movdqu xmmword [rsi + rax - 0x30], xmm1
xorps xmm2, xmm0
movdqu xmmword [rsi + rax - 0x20], xmm2
cmp r10, rdi
jb 0x1402e8dc0
mov rsi, qword [rsp + 0x18]
cmp rbx, 8
jb 0x1402e8e5f
mov rbx, r8
and rbx, 0xfffffffffffffff8
mov rdi, r9
lea rax, [r10 + rdx]
sub rdi, rdx
nop dword [rax + rax]
movq xmm1, qword [rax + rcx]
add r10, 8
movq xmm0, qword [rax]
lea rax, [rax + 8]
xorps xmm1, xmm0
movq qword [rdi + rax - 8], xmm1
cmp r10, rbx
jb 0x1402e8e40
mov rdi, qword [rsp]
mov rbx, qword [rsp + 0x10]
cmp r10, r8
jae 0x1402e8e95
sub r11, rdx
lea rax, [r10 + rdx]
sub r9, rdx
sub r8, r10
nop word [rax + rax]
movzx ecx, byte [rax + r11]
xor cl, byte [rax]
mov byte [r9 + rax], cl
lea rax, [rax + 1]
sub r8, 1
jne 0x1402e8e80
add rsp, 8
ret

Function at 0x1402e8ea0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov rdi, qword [rcx + 0x28]
mov rbx, rdx
mov rbp, rcx
cmp rdx, rdi
ja 0x1402e8ed5
shl rbx, 4
add rbx, qword [rcx + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
mov rcx, qword [rcx + 0x30]
cmp rbx, rcx
jb 0x1402e8f1e
sub rdx, rcx
lea r8, [0x140400fb1]
add rdx, 4
xor r9d, r9d
and rdx, 0xfffffffffffffffc
add rdx, rcx
mov rcx, qword [rbp + 0x58]
mov qword [rbp + 0x30], rdx
shl rdx, 4
call fcn.1401b7df0
test rax, rax
jne 0x1402e8f1a
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
mov qword [rbp + 0x58], rax
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], r12
mov r12, rbx
mov qword [rsp + 0x50], r15
mov r15, rdi
shl r15, 4
sub r12, rdi
nop word [rax + rax]
mov rcx, qword [rbp + 0x58]
mov edx, 1
add rcx, r15
movzx edi, byte [rcx]
lea rsi, [rcx + 0x10]
shr dil, 7
mov r8, rsi
neg dil
and dil, 0x87
call fcn.1402e8b80
xor byte [rsi + 0xf], dil
add r15, 0x10
sub r12, 1
jne 0x1402e8f40
mov r15, qword [rsp + 0x50]
mov r12, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov qword [rbp + 0x28], rbx
shl rbx, 4
add rbx, qword [rbp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
Function at 0x1402ea840
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Encrypt data using salsa20 or chacha

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
sub rsp, 0xc0
mov rax, qword [0x140463cc0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0x100]
mov rbp, r8
mov dword [rsp + 0x20], 0x61707865
mov rsi, rdx
mov dword [rsp + 0x24], 0x3320646e
mov rdi, rcx
mov dword [rsp + 0x28], 0x79622d32
mov dword [rsp + 0x2c], 0x6b206574
movups xmm0, xmmword [r9]
movups xmm1, xmmword [r9 + 0x10]
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
test r8, r8
je 0x1402eaa7a
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], r14
mov qword [r11 + 0x20], r15
mov r15d, dword [rsp + 0x50]
nop word [rax + rax]
mov ebx, 0x40
lea rdx, [rsp + 0x20]
cmp rbp, rbx
lea rcx, [rsp + 0x70]
cmovb rbx, rbp
call fcn.1402eaaa0
xor eax, eax
test rbx, rbx
je 0x1402eaa4b
cmp rbx, 8
jb 0x1402eaa11
lea rdx, [rdi - 1]
add rdx, rbx
lea rcx, [rsp + rbx + 0x6f]
cmp rdi, rcx
ja 0x1402ea91f
lea rcx, [rsp + 0x70]
cmp rdx, rcx
jae 0x1402eaa11
lea rcx, [rsi - 1]
add rcx, rbx
cmp rdi, rcx
ja 0x1402ea934
cmp rdx, rsi
jae 0x1402eaa11
cmp rbx, 0x40
jb 0x1402ea9dc
mov rdx, rbx
mov r8, rbx
and edx, 0x3f
sub r8, rdx
lea r9, [rsp + 0x70]
mov r11, rsi
lea r10, [rsp + 0x80]
sub r9, rdi
sub r10, rdi
lea r14, [rsp + 0x90]
sub r11, rdi
lea rcx, [rdi + 0x10]
sub r14, rdi
movdqu xmm0, xmmword [rcx + r11 - 0x10]
add rax, 0x40
movdqu xmm1, xmmword [r9 + rcx - 0x10]
movdqu xmm2, xmmword [r9 + rcx]
lea rcx, [rcx + 0x40]
xorps xmm1, xmm0
movdqu xmm0, xmmword [rcx + r11 - 0x40]
movdqu xmmword [rcx - 0x50], xmm1
xorps xmm2, xmm0
movdqu xmm0, xmmword [rcx + r11 - 0x30]
movdqu xmm1, xmmword [r10 + rcx - 0x40]
movdqu xmmword [rcx - 0x40], xmm2
xorps xmm1, xmm0
movdqu xmm0, xmmword [rcx + r11 - 0x20]
movdqu xmm2, xmmword [r14 + rcx - 0x40]
movdqu xmmword [rcx - 0x30], xmm1
xorps xmm2, xmm0
movdqu xmmword [rcx - 0x20], xmm2
cmp rax, r8
jb 0x1402ea972
cmp rdx, 8
jb 0x1402eaa0c
mov rcx, rbx
and rcx, 0xfffffffffffffff8
nop dword [rax]
nop word [rax + rax]
movq xmm1, qword [rsi + rax]
movq xmm0, qword [rsp + rax + 0x70]
xorps xmm1, xmm0
movq qword [rdi + rax], xmm1
add rax, 8
cmp rax, rcx
jb 0x1402ea9f0
cmp rax, rbx
jae 0x1402eaa4b
lea rcx, [rsp + 0x70]
mov r8, rsi
sub r8, rcx
mov r9, rdi
lea rcx, [rsp + 0x70]
sub r9, rcx
nop word [rax + rax]
lea rdx, [rsp + 0x70]
add rdx, rax
inc rax
movzx ecx, byte [rdx + r8]
xor cl, byte [rdx]
mov byte [rdx + r9], cl
cmp rax, rbx
jb 0x1402eaa30
inc r15d
add rdi, rbx
add rsi, rbx
mov dword [rsp + 0x50], r15d
sub rbp, rbx
jne 0x1402ea8d0
mov r15, qword [rsp + 0xf8]
mov r14, qword [rsp + 0xf0]
mov rbx, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.14016e5c0
add rsp, 0xc0
pop rdi
pop rsi
pop rbp
ret
Function at 0x1402ede90
Capabilities:
Encode data using xor

Disassembly:
cmp dword [rsp + 0x30], 0
je 0x1402edea8
lea rax, [0x1402ec1e0]
mov qword [rsp + 0x30], rax
jmp fcn.1402e3a20
lea rax, [0x1402ed030]
mov qword [rsp + 0x30], rax
jmp fcn.1402e3be0

Function at 0x1402ee630
Capabilities:
Encode data using xor

Disassembly:
mov r11, rdx
mov r10, rcx
test rdx, rdx
je 0x1402ee6ab
test r8, r8
je 0x1402ee6ab
mov r9, qword [rcx + 0x28]
cmp r8, r9
cmovb r9, r8
test r9, r9
je 0x1402ee671
add rcx, 0x30
sub rdx, r10
nop word [rax + rax]
movzx eax, byte [rdx + rcx - 0x30]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub r9, 1
jne 0x1402ee660
mov rax, qword [r10 + 0x28]
cmp r8, rax
jbe 0x1402ee6ab
sub r8, rax
cmp r8, 0x10
jbe 0x1402ee68b
mov r8d, reloc.WS2_32.dll_recv
jmp 0x1402ee690
test r8, r8
je 0x1402ee6ab
xor ecx, ecx
mov rax, qword [r10 + 0x28]
add rax, rcx
movzx eax, byte [rax + r11]
xor byte [r10 + rcx + 0x50], al
inc rcx
cmp rcx, r8
jb 0x1402ee692
ret

Function at 0x1402ee6b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
xor edi, edi
mov qword [rsp + 0x40], rbp
movsxd rbx, r9d
mov r11, r8
mov dword [rsp + 0x58], reloc.WS2_32.dll_recv
mov rbp, rcx
mov r10d, edi
test r9d, r9d
jle 0x1402ee7d4
cmp ebx, 8
jb 0x1402ee7d4
lea rax, [rbx - 1]
lea rcx, [rax + rdx]
add rax, r8
cmp rdx, rax
ja 0x1402ee700
cmp rcx, r8
jae 0x1402ee7d4
sub r8, rdx
cmp ebx, 0x40
jb 0x1402ee79e
mov eax, ebx
mov qword [rsp + 0x48], rsi
and eax, 0xffffffc0
mov r9, 0xfffffffffffffff0
movsxd rsi, eax
sub r9, rdx
lea rcx, [rdx + 0x10]
nop word [rax + rax]
movdqu xmm0, xmmword [rcx - 0x10]
add r10d, 0x40
movdqu xmm1, xmmword [rcx + r8 - 0x10]
lea rcx, [rcx + 0x40]
lea rax, [r9 + rcx]
xorps xmm1, xmm0
movdqu xmm0, xmmword [rcx + r8 - 0x40]
movdqu xmmword [rcx - 0x50], xmm1
movdqu xmm2, xmmword [rcx - 0x40]
movdqu xmm1, xmmword [rcx + r8 - 0x30]
xorps xmm2, xmm0
movdqu xmmword [rcx - 0x40], xmm2
movdqu xmm0, xmmword [rcx - 0x30]
xorps xmm1, xmm0
movdqu xmmword [rcx - 0x30], xmm1
movdqu xmm0, xmmword [rcx - 0x20]
movdqu xmm1, xmmword [rcx + r8 - 0x20]
xorps xmm1, xmm0
movdqu xmmword [rcx - 0x20], xmm1
cmp rax, rsi
jl 0x1402ee730
mov rsi, qword [rsp + 0x48]
mov eax, ebx
and al, 0x3f
cmp al, 8
jb 0x1402ee7d4
mov ecx, ebx
and ecx, 0xfffffff8
movsxd rax, r10d
movsxd r9, ecx
lea rcx, [rax + rdx]
nop dword [rax]
movq xmm0, qword [rcx]
add r10d, 8
movq xmm1, qword [r8 + rcx]
xorps xmm1, xmm0
movq qword [rcx], xmm1
add rcx, 8
mov rax, rcx
sub rax, rdx
cmp rax, r9
jl 0x1402ee7b0
movsxd rcx, r10d
mov r8, rbx
cmp rcx, rbx
jge 0x1402ee801
sub r11, rdx
lea rax, [rcx + rdx]
sub r8, rcx
nop dword [rax]
movzx ecx, byte [r11 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub r8, 1
jne 0x1402ee7f0
mov rcx, qword [rbp + 0x10]
lea r8, [rsp + 0x58]
mov r9, rdx
mov dword [rsp + 0x20], ebx
call fcn.140262ec0
mov rbp, qword [rsp + 0x40]
test eax, eax
je 0x1402ee834
cmp dword [rsp + 0x58], ebx
sete dil
mov eax, edi
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x50]
xor eax, eax
add rsp, 0x30
pop rdi
ret
Function at 0x1402f8f40
Capabilities:
Encrypt data using curve25519

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x1f8]
sub rsp, 0x2f8
mov rax, qword [0x140463cc0]
xor rax, rsp
mov qword [rbp + 0x1e0], rax
mov rbx, qword [rbp + 0x250]
mov r15, rcx
lea rcx, [rbp - 0x60]
mov rdi, r9
mov r14, r8
mov rsi, rdx
call fcn.140246de0
mov r8d, 0x20
lea rcx, [rbp - 0x60]
mov rdx, rbx
call fcn.140246e70
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x120]
call fcn.140246f80
movzx eax, byte [rbp + 0x13f]
lea rcx, [rbp - 0x60]
and byte [rbp + 0x120], 0xf8
and al, 0x3f
or al, 0x40
mov byte [rbp + 0x13f], al
call fcn.140246de0
mov r8d, 0x20
lea rdx, [rbp + 0x140]
lea rcx, [rbp - 0x60]
call fcn.140246e70
mov r8, r14
lea rcx, [rbp - 0x60]
mov rdx, rsi
call fcn.140246e70
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x160]
call fcn.140246f80
lea rcx, [rbp + 0x160]
call fcn.1402fe9d0
lea rdx, [rbp + 0x160]
lea rcx, [rbp + 0x80]
call fcn.1402fcf70
lea rdx, [rbp + 0xd0]
lea rcx, [rsp + 0x20]
call fcn.1402faa80
lea r8, [rsp + 0x20]
lea rdx, [rbp + 0x80]
lea rcx, [rsp + 0x70]
call fcn.1402f9bd0
lea r8, [rsp + 0x20]
lea rdx, [rbp + 0xa8]
lea rcx, [rsp + 0x48]
call fcn.1402f9bd0
lea rdx, [rsp + 0x48]
mov rcx, r15
call fcn.1402f9920
lea rcx, [rsp + 0x20]
lea rdx, [rsp + 0x70]
call fcn.1402f9920
movzx eax, byte [rsp + 0x20]
lea rcx, [rbp - 0x60]
shl al, 7
xor byte [r15 + 0x1f], al
call fcn.140246de0
mov r8d, 0x20
lea rcx, [rbp - 0x60]
mov rdx, r15
call fcn.140246e70
mov r8d, 0x20
lea rcx, [rbp - 0x60]
mov rdx, rdi
call fcn.140246e70
mov r8, r14
lea rcx, [rbp - 0x60]
mov rdx, rsi
call fcn.140246e70
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x1a0]
call fcn.140246f80
lea rcx, [rbp + 0x1a0]
call fcn.1402fe9d0
lea rcx, [r15 + 0x20]
lea r9, [rbp + 0x160]
lea r8, [rbp + 0x120]
lea rdx, [rbp + 0x1a0]
call fcn.1402ff830
mov edx, 0xd8
lea rcx, [rbp - 0x60]
call fcn.140239440
mov edx, 0x40
lea rcx, [rbp + 0x160]
call fcn.140239440
mov edx, 0x40
lea rcx, [rbp + 0x120]
call fcn.140239440
mov eax, 1
mov rcx, qword [rbp + 0x1e0]
xor rcx, rsp
call fcn.14016e5c0
add rsp, 0x2f8
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x1402f93b0
Capabilities:
Encrypt data using curve25519

Disassembly:
push rbx
sub rsp, 0x190
mov rax, qword [0x140463cc0]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov rax, rdx
lea r8, [rsp + 0x140]
mov rbx, rcx
mov edx, 0x20
mov rcx, rax
call fcn.140247790
movzx eax, byte [rsp + 0x15f]
lea rdx, [rsp + 0x140]
and byte [rsp + 0x140], 0xf8
lea rcx, [rsp + 0xa0]
and al, 0x3f
or al, 0x40
mov byte [rsp + 0x15f], al
call fcn.1402fcf70
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x20]
call fcn.1402faa80
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x70]
call fcn.1402f9bd0
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0xc8]
lea rcx, [rsp + 0x48]
call fcn.1402f9bd0
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.1402f9920
lea rcx, [rsp + 0x20]
lea rdx, [rsp + 0x70]
call fcn.1402f9920
movzx eax, byte [rsp + 0x20]
lea rcx, [rsp + 0x140]
shl al, 7
mov edx, 0x40
xor byte [rbx + 0x1f], al
call fcn.140239440
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.14016e5c0
add rsp, 0x190
pop rbx
ret
Function at 0x1402f94f0
Capabilities:
Encrypt data using curve25519

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov rax, qword [0x140463cc0]
xor rax, rsp
mov qword [rbp + 0x60], rax
movups xmm0, xmmword [rdx]
mov rbx, rcx
lea rcx, [rsp + 0x50]
movups xmm1, xmmword [rdx + 0x10]
movd eax, xmm0
movups xmmword [rbp + 0x40], xmm0
and al, 0xf8
mov byte [rbp + 0x40], al
mov rax, qword [rdx + 0x18]
lea rdx, [rbp + 0x40]
shr rax, 0x38
and al, 0x3f
or al, 0x40
movups xmmword [rbp + 0x50], xmm1
mov byte [rbp + 0x5f], al
call fcn.1402fcf70
mov ecx, dword [rsp + 0x78]
mov edx, dword [rbp - 0x60]
mov r8d, dword [rbp - 0x3c]
lea eax, [rcx + rdx]
sub edx, ecx
mov ecx, dword [rsp + 0x7c]
mov dword [rbp + 0x18], edx
mov edx, dword [rbp - 0x5c]
mov dword [rbp - 0x10], eax
lea eax, [rcx + rdx]
sub edx, ecx
mov ecx, dword [rbp - 0x80]
mov dword [rbp + 0x1c], edx
mov edx, dword [rbp - 0x58]
mov dword [rbp - 0xc], eax
lea eax, [rcx + rdx]
sub edx, ecx
mov ecx, dword [rbp - 0x7c]
mov dword [rbp + 0x20], edx
mov edx, dword [rbp - 0x54]
mov dword [rbp - 8], eax
lea eax, [rcx + rdx]
sub edx, ecx
mov ecx, dword [rbp - 0x78]
mov dword [rbp + 0x24], edx
mov edx, dword [rbp - 0x50]
mov dword [rbp - 4], eax
lea eax, [rcx + rdx]
sub edx, ecx
mov ecx, dword [rbp - 0x74]
mov dword [rbp + 0x28], edx
mov edx, dword [rbp - 0x4c]
mov dword [rbp], eax
lea eax, [rcx + rdx]
sub edx, ecx
mov ecx, dword [rbp - 0x70]
mov dword [rbp + 0x2c], edx
mov edx, dword [rbp - 0x48]
mov dword [rbp + 4], eax
lea eax, [rcx + rdx]
sub edx, ecx
mov ecx, dword [rbp - 0x6c]
mov dword [rbp + 0x30], edx
mov edx, dword [rbp - 0x44]
mov dword [rbp + 8], eax
lea eax, [rcx + rdx]
sub edx, ecx
mov ecx, dword [rbp - 0x68]
mov dword [rbp + 0x34], edx
mov edx, dword [rbp - 0x40]
mov dword [rbp + 0xc], eax
lea eax, [rcx + rdx]
sub edx, ecx
mov dword [rbp + 0x38], edx
lea rcx, [rsp + 0x20]
mov edx, dword [rbp - 0x64]
mov dword [rbp + 0x10], eax
lea eax, [rdx + r8]
sub r8d, edx
lea rdx, [rbp + 0x18]
mov dword [rbp + 0x3c], r8d
mov dword [rbp + 0x14], eax
call fcn.1402faa80
lea r8, [rsp + 0x20]
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x10]
call fcn.1402f9bd0
lea rdx, [rbp - 0x10]
mov rcx, rbx
call fcn.1402f9920
lea rcx, [rbp + 0x40]
mov edx, 0x20
call fcn.140239440
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.14016e5c0
mov rbx, qword [rsp + 0x190]
add rsp, 0x170
pop rbp
ret
Function at 0x1403019a0
Capabilities:
Encode data using xor

Disassembly:
mov r9, rcx
movd xmm4, r8d
mov r10d, r8d
pshufd xmm4, xmm4, 0
lea rcx, [rdx + 0x3c]
lea rax, [r9 + 0x3c]
cmp rdx, rax
ja 0x1403019f1
cmp rcx, r9
jb 0x1403019f1
sub r9, rdx
mov r8d, reloc.WS2_32.dll_recv
nop dword [rax + rax]
mov ecx, dword [r9 + rdx]
lea rdx, [rdx + 4]
mov eax, ecx
xor eax, dword [rdx - 4]
and eax, r10d
xor ecx, eax
mov dword [r9 + rdx - 4], ecx
xor dword [rdx - 4], eax
sub r8, 1
jne 0x1403019d0
ret
sub r9, rdx
mov eax, 4
nop dword [rax]
movdqu xmm1, xmmword [r9 + rdx]
movdqu xmm2, xmmword [rdx]
lea rdx, [rdx + 0x10]
movdqa xmm3, xmm1
xorps xmm3, xmm2
andps xmm3, xmm4
movdqa xmm0, xmm3
xorps xmm3, xmm2
xorps xmm0, xmm1
movdqu xmmword [r9 + rdx - 0x10], xmm0
movdqu xmmword [rdx - 0x10], xmm3
sub rax, 1
jne 0x140301a00
ret