joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140c573c0
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbp
push rdi
push r14
push r15
sub rsp, 0x20
mov qword [rsp + 0x48], rsi
mov rdi, rcx
mov rsi, qword [rcx + 8]
mov rbp, r9
sub rsi, rcx
mov r14, r8
sub rsi, 0x10
mov ecx, 0x2000000
sar rsi, 2
mov r15d, edx
call fcn.140c5e230
test eax, eax
je 0x140c57411
mov rcx, rdi
shr rcx, 2
and ecx, 3
je 0x140c57411
mov eax, 4
sub eax, ecx
jmp 0x140c57413
xor eax, eax
cmp eax, esi
je 0x140c5744b
mov qword [rsp + 0x40], rbx
mov ebx, eax
mov eax, dword [rdi]
add rbx, 4
inc eax
shl eax, 4
movsxd r8, eax
mov eax, esi
lea rbx, [rdi + rbx*4]
add rax, 4
mov rcx, rbx
lea rdx, [rdi + rax*4]
call fcn.140da1510
mov qword [rdi + 8], rbx
mov rbx, qword [rsp + 0x40]
mov ecx, 0x2000000
call fcn.140c5e230
mov rsi, qword [rsp + 0x48]
mov rcx, rdi
test eax, eax
je 0x140c5747d
mov r9, rbp
mov r8, r14
mov edx, r15d
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
jmp fcn.140c5dec0
mov r8, rbp
mov rdx, r14
cmp r15d, 1
jne 0x140c5749c
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
jmp fcn.140c59160
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
jmp fcn.140c58980
Function at 0x140c59ce0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x14100f500]
xor rax, rsp
mov qword [rsp + 0x50], rax
xorps xmm0, xmm0
lea r14, [rsp + 0x20]
xor ebp, ebp
mov r15, rdx
movups xmmword [rsp + 0x20], xmm0
mov esi, ebp
mov rbx, rcx
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
nop word [rax + rax]
mov eax, reloc.WS2_32.dll_recv
add byte [rbx + rax - 1], 1
jne 0x140c59d44
dec rax
test rax, rax
jg 0x140c59d35
mov r9, r14
lea rcx, [rbx + 0x28]
mov r8, rbx
mov edx, 1
call fcn.140c573c0
mov edi, eax
test eax, eax
jne 0x140c59dc5
add r14, 0x10
add esi, 0x10
cmp esi, 0x30
jl 0x140c59d30
lea rax, [rsp + 0x20]
sub r15, rax
nop dword [rax]
nop word [rax + rax]
lea rax, [rsp + 0x20]
add rax, rbp
add rbp, 0x10
movdqu xmm0, xmmword [rax]
movdqu xmm1, xmmword [r15 + rax]
xorps xmm1, xmm0
movdqu xmmword [rax], xmm1
cmp rbp, 0x30
jl 0x140c59d80
mov r8d, 0x100
lea rdx, [rsp + 0x20]
lea rcx, [rbx + 0x28]
call fcn.140c57fc0
mov edi, eax
test eax, eax
jne 0x140c59dc5
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rbx], xmm0
mov edx, gethostbyaddr
lea rcx, [rsp + 0x20]
call fcn.140c5d6e0
mov eax, edi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140cd9320
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140c5d700
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm1, xmmword [rdx]
aeskeygenassist xmm0, xmm1, 1
pshufd xmm3, xmm0, 0xff
xorps xmm3, xmm1
movups xmmword [rcx], xmm1
pslldq xmm1, 4
xorps xmm3, xmm1
pslldq xmm1, 4
xorps xmm3, xmm1
pslldq xmm1, 4
xorps xmm3, xmm1
aeskeygenassist xmm0, xmm3, 2
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm3
movdqu xmmword [rcx + 0x10], xmm3
pslldq xmm3, 4
movdqa xmm0, xmm3
pslldq xmm3, 4
xorps xmm0, xmm1
movdqa xmm2, xmm3
xorps xmm2, xmm0
pslldq xmm3, 4
xorps xmm2, xmm3
aeskeygenassist xmm0, xmm2, 4
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm2
movdqu xmmword [rcx + 0x20], xmm2
pslldq xmm2, 4
movdqa xmm0, xmm2
pslldq xmm2, 4
xorps xmm0, xmm1
movdqa xmm3, xmm2
xorps xmm3, xmm0
pslldq xmm2, 4
xorps xmm3, xmm2
aeskeygenassist xmm0, xmm3, 8
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm3
movdqu xmmword [rcx + 0x30], xmm3
pslldq xmm3, 4
movdqa xmm0, xmm3
pslldq xmm3, 4
xorps xmm0, xmm1
movdqa xmm2, xmm3
xorps xmm2, xmm0
pslldq xmm3, 4
xorps xmm2, xmm3
aeskeygenassist xmm0, xmm2, 0x10
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm2
movdqu xmmword [rcx + 0x40], xmm2
pslldq xmm2, 4
movdqa xmm0, xmm2
pslldq xmm2, 4
xorps xmm0, xmm1
movdqa xmm3, xmm2
xorps xmm3, xmm0
pslldq xmm2, 4
xorps xmm3, xmm2
aeskeygenassist xmm0, xmm3, 0x20
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm3
movdqu xmmword [rcx + 0x50], xmm3
pslldq xmm3, 4
movdqa xmm0, xmm3
pslldq xmm3, 4
xorps xmm0, xmm1
movdqa xmm2, xmm3
xorps xmm2, xmm0
pslldq xmm3, 4
xorps xmm2, xmm3
aeskeygenassist xmm0, xmm2, 0x40
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm2
movdqu xmmword [rcx + 0x60], xmm2
pslldq xmm2, 4
movdqa xmm0, xmm2
pslldq xmm2, 4
movdqa xmm3, xmm2
xorps xmm0, xmm1
xorps xmm3, xmm0
pslldq xmm2, 4
xorps xmm3, xmm2
aeskeygenassist xmm0, xmm3, 0x80
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm3
movdqu xmmword [rcx + 0x70], xmm3
pslldq xmm3, 4
movdqa xmm0, xmm3
pslldq xmm3, 4
xorps xmm0, xmm1
movdqa xmm2, xmm3
xorps xmm2, xmm0
pslldq xmm3, 4
xorps xmm2, xmm3
aeskeygenassist xmm0, xmm2, 0x1b
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm2
movdqu xmmword [rcx + 0x80], xmm2
pslldq xmm2, 4
movdqa xmm0, xmm2
pslldq xmm2, 4
xorps xmm0, xmm1
movdqa xmm3, xmm2
xorps xmm3, xmm0
pslldq xmm2, 4
xorps xmm3, xmm2
aeskeygenassist xmm0, xmm3, 0x36
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm3
movdqu xmmword [rcx + 0x90], xmm3
pslldq xmm3, 4
movdqa xmm0, xmm3
pslldq xmm3, 4
xorps xmm0, xmm1
movdqa xmm1, xmm3
xorps xmm1, xmm0
pslldq xmm3, 4
xorps xmm1, xmm3
movdqu xmmword [rcx + 0xa0], xmm1
ret
Function at 0x140c5dec0
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [r8]
mov rax, qword [rcx + 8]
mov r8d, dword [rcx]
dec r8d
xorps xmm0, xmmword [rax]
add rax, 0x10
test edx, edx
jne 0x140c5defb
test r8d, r8d
je 0x140c5deef
nop
aesdec xmm0, xmmword [rax]
add rax, 0x10
add r8d, 0xffffffff
jne 0x140c5dee0
aesdeclast xmm0, xmmword [rax]
movups xmmword [r9], xmm0
xor eax, eax
ret
test r8d, r8d
je 0x140c5df0f
aesenc xmm0, xmmword [rax]
add rax, 0x10
add r8d, 0xffffffff
jne 0x140c5df00
aesenclast xmm0, xmmword [rax]
movups xmmword [r9], xmm0
xor eax, eax
ret

Function at 0x140c5e2a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movsxd rax, r8d
shl rax, 4
add rax, rdx
movdqu xmm0, xmmword [rax]
sub rax, 0x10
movdqu xmmword [rcx], xmm0
add rcx, 0x10
cmp rax, rdx
jbe 0x140c5e2d6
nop
aesimc xmm0, xmmword [rax]
sub rax, 0x10
movdqu xmmword [rcx], xmm0
lea rcx, [rcx + 0x10]
cmp rax, rdx
ja 0x140c5e2c0
movdqu xmm0, xmmword [rax]
movdqu xmmword [rcx], xmm0
ret
Function at 0x140c721d0
Capabilities:
Encrypt data using openssl rsa

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rsi, rcx
lea rbx, [0x140e59bb0]
mov r14, rdx
mov rcx, rbx
test rsi, rsi
je 0x140c7222e
cmp qword [0x140e59bb0], 0
je 0x140c7222e
mov rdi, qword [rsi + 8]
cmp qword [rcx + 8], rdi
jne 0x140c72221
mov rdx, qword [rsi + 0x10]
mov r8, rdi
mov rcx, qword [rcx]
call fcn.140da1410
test eax, eax
je 0x140c72249
add rbx, 0x28
mov rcx, rbx
cmp qword [rbx], 0
jne 0x140c72208
mov eax, 0xffffffd2
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
test rbx, rbx
je 0x140c7222e
mov eax, dword [rbx + 0x20]
mov dword [r14], eax
xor eax, eax
jmp 0x140c72233

Function at 0x140c72300
Capabilities:
Encrypt data using openssl rsa

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
sub rsp, 0x20
mov rsi, rcx
lea rbx, [0x140e59980]
mov r14, r8
mov r15, rdx
mov rcx, rbx
test rsi, rsi
je 0x140c72366
cmp qword [0x140e59980], 0
je 0x140c72366
mov rdi, qword [rsi + 8]
cmp qword [rcx + 8], rdi
jne 0x140c72359
mov rdx, qword [rsi + 0x10]
mov r8, rdi
mov rcx, qword [rcx]
call fcn.140da1410
test eax, eax
je 0x140c72386
add rbx, 0x28
mov rcx, rbx
cmp qword [rbx], 0
jne 0x140c72340
mov eax, 0xffffffd2
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
test rbx, rbx
je 0x140c72366
mov eax, dword [rbx + 0x20]
mov dword [r15], eax
mov eax, dword [rbx + 0x24]
mov dword [r14], eax
xor eax, eax
jmp 0x140c7236b
Function at 0x140c75020
Capabilities:
Hash data using sha384
Hash data using sha512

Disassembly:
xor eax, eax
movabs r8, 0xcbbb9d5dc1059ed8
mov qword [rcx], rax
test edx, edx
mov qword [rcx + 8], rax
movabs rax, 0x6a09e667f3bcc908
cmovne rax, r8
movabs r8, 0x629a292a367cd507
mov qword [rcx + 0x10], rax
movabs rax, 0xbb67ae8584caa73b
cmovne rax, r8
movabs r8, 0x9159015a3070dd17
mov qword [rcx + 0x18], rax
movabs rax, 0x3c6ef372fe94f82b
cmovne rax, r8
movabs r8, 0x152fecd8f70e5939
mov qword [rcx + 0x20], rax
movabs rax, 0xa54ff53a5f1d36f1
cmovne rax, r8
movabs r8, 0x67332667ffc00b31
mov qword [rcx + 0x28], rax
movabs rax, 0x510e527fade682d1
cmovne rax, r8
movabs r8, 0x8eb44a8768581511
mov qword [rcx + 0x30], rax
movabs rax, 0x9b05688c2b3e6c1f
cmovne rax, r8
movabs r8, 0xdb0c2e0d64f98fa7
mov qword [rcx + 0x38], rax
movabs rax, 0x1f83d9abfb41bd6b
cmovne rax, r8
movabs r8, 0x47b5481dbefa4fa4
mov qword [rcx + 0x40], rax
movabs rax, 0x5be0cd19137e2179
cmovne rax, r8
mov qword [rcx + 0x48], rax
xor eax, eax
mov dword [rcx + 0xd0], edx
ret
Function at 0x140c7b330
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
xor eax, eax
mov r8d, 0xc1059ed8
mov qword [rcx], rax
test edx, edx
mov eax, 0x6a09e667
cmovne eax, r8d
mov r8d, 0x367cd507
mov dword [rcx + 8], eax
mov eax, 0xbb67ae85
cmovne eax, r8d
mov r8d, 0x3070dd17
mov dword [rcx + 0xc], eax
mov eax, 0x3c6ef372
cmovne eax, r8d
mov r8d, 0xf70e5939
mov dword [rcx + 0x10], eax
mov eax, 0xa54ff53a
cmovne eax, r8d
mov r8d, 0xffc00b31
mov dword [rcx + 0x14], eax
mov eax, 0x510e527f
cmovne eax, r8d
mov r8d, 0x68581511
mov dword [rcx + 0x18], eax
mov eax, 0x9b05688c
cmovne eax, r8d
mov r8d, 0x64f98fa7
mov dword [rcx + 0x1c], eax
mov eax, 0x1f83d9ab
cmovne eax, r8d
mov r8d, 0xbefa4fa4
mov dword [rcx + 0x20], eax
mov eax, 0x5be0cd19
cmovne eax, r8d
mov dword [rcx + 0x24], eax
xor eax, eax
mov dword [rcx + 0x68], edx
ret
Function at 0x140c7ca60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
push r15
mov rax, qword [rdx + 8]
mov r15, r8
mov rsi, rdx
mov rdi, rcx
cmp qword [rcx + 8], rax
je 0x140c7ca89
mov eax, 0xfffffffc
mov rsi, qword [rsp + 0x30]
pop r15
pop rdi
ret
mov r11d, dword [rcx]
mov eax, dword [rdx]
sar eax, 1
mov qword [rsp + 0x18], rbx
and eax, 1
sar r11d, 1
and r11d, 1
mov qword [rsp + 0x28], r14
xor eax, r11d
mov ebx, eax
and ebx, r11d
mov dword [r8], ebx
mov r14, qword [rcx + 8]
test r14, r14
je 0x140c7cb80
mov qword [rsp + 0x20], rbp
mov ebp, 1
sub ebp, r11d
nop dword [rax]
mov rcx, qword [rdi + 0x10]
mov r10d, 1
sub r10d, eax
mov r8, qword [rcx + r14*8 - 8]
mov rcx, qword [rsi + 0x10]
mov rdx, qword [rcx + r14*8 - 8]
mov rcx, rdx
sub rdx, r8
xor rcx, r8
shr rdx, 0x3f
mov r9, rcx
shr r8, 0x3f
not r9
shr rcx, 0x3f
and ecx, r8d
shr r9, 0x3f
and r9d, edx
or r9d, ecx
and r10d, r9d
or eax, r9d
and r10d, r11d
or r10d, ebx
mov ebx, 1
mov dword [r15], r10d
sub ebx, eax
mov rcx, qword [rsi + 0x10]
and ebx, ebp
mov r8, qword [rcx + r14*8 - 8]
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rcx + r14*8 - 8]
mov rcx, rdx
sub rdx, r8
xor rcx, r8
shr rdx, 0x3f
mov r9, rcx
shr r8, 0x3f
not r9
shr rcx, 0x3f
shr r9, 0x3f
and ecx, r8d
and r9d, edx
or r9d, ecx
and ebx, r9d
or eax, r9d
or ebx, r10d
mov dword [r15], ebx
sub r14, 1
jne 0x140c7cad0
mov rbp, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
xor eax, eax
mov rbx, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x30]
pop r15
pop rdi
ret
Function at 0x140c816d0
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, dword [rcx]
mov r10, rcx
mov ebx, dword [rcx + 4]
test rdx, rdx
je 0x140c81732
sub r8, r9
nop word [rax + rax]
lea eax, [r11 + 1]
movzx r11d, al
lea r9, [r9 + 1]
movzx ecx, byte [r11 + r10 + 8]
lea eax, [rbx + rcx]
movzx ebx, al
movzx eax, byte [rbx + r10 + 8]
mov byte [r11 + r10 + 8], al
add al, cl
mov byte [rbx + r10 + 8], cl
movzx eax, al
movzx ecx, byte [rax + r10 + 8]
xor cl, byte [r9 + r8 - 1]
mov byte [r9 - 1], cl
sub rdx, 1
jne 0x140c816f0
mov dword [r10 + 4], ebx
xor eax, eax
mov rbx, qword [rsp + 8]
mov dword [r10], r11d
ret

Function at 0x140c82320
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rbx
push rbp
push rsi
push rdi
push r12
push r15
sub rsp, 0x28
xor r15d, r15d
mov r12, r9
mov rbx, r8
mov rbp, rdx
mov rdi, rcx
test rdx, rdx
je 0x140c8237e
mov r10, rbx
mov rcx, r9
sub r10, r9
mov rdx, qword [rdi + 0x80]
cmp rdx, 0x40
jae 0x140c8237e
movzx eax, byte [r10 + rcx]
inc r15
xor al, byte [rdx + rdi + 0x40]
mov byte [rcx], al
inc rcx
inc qword [rdi + 0x80]
sub rbp, 1
jne 0x140c82353
lea rsi, [rdi + 0x40]
cmp rbp, 0x40
jb 0x140c82489
mov qword [rsp + 0x60], r13
mov r12, rbp
mov qword [rsp + 0x20], r14
mov r13, rbx
shr r12, 6
lea rbx, [r9 + 1]
imul rax, r12, 0xffffffffffffffc0
mov r14, rdi
sub r13, r9
sub r14, r15
add rbp, rax
sub r14, r9
mov rax, r12
shl rax, 6
add rbx, r15
add r14, 0x40
add r15, rax
nop dword [rax + rax]
mov rdx, rsi
mov rcx, rdi
call fcn.140c81b50
inc dword [rdi + 0x30]
mov ecx, 8
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r14 + rbx - 1]
xor al, byte [rbx + r13 - 1]
mov byte [rbx - 1], al
movzx eax, byte [r14 + rbx]
xor al, byte [rbx + r13]
mov byte [rbx], al
movzx eax, byte [r14 + rbx + 1]
xor al, byte [rbx + r13 + 1]
mov byte [rbx + 1], al
movzx eax, byte [r14 + rbx + 2]
xor al, byte [rbx + r13 + 2]
mov byte [rbx + 2], al
movzx eax, byte [r14 + rbx + 3]
xor al, byte [rbx + r13 + 3]
mov byte [rbx + 3], al
movzx eax, byte [r14 + rbx + 4]
xor al, byte [rbx + r13 + 4]
mov byte [rbx + 4], al
movzx eax, byte [r14 + rbx + 5]
xor al, byte [rbx + r13 + 5]
mov byte [rbx + 5], al
movzx eax, byte [r14 + rbx + 6]
xor al, byte [rbx + r13 + 6]
mov byte [rbx + 6], al
add rbx, 8
sub rcx, 1
jne 0x140c823f0
sub r14, 0x40
sub r12, 1
jne 0x140c823d0
mov r14, qword [rsp + 0x20]
mov r13, qword [rsp + 0x60]
mov r12, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
test rbp, rbp
je 0x140c824cd
mov rdx, rsi
mov rcx, rdi
call fcn.140c81b50
inc dword [rdi + 0x30]
mov rcx, rbp
sub r15, rdi
lea rdx, [r15 + rbx]
lea r8, [r15 + r12]
nop word [rax + rax]
movzx eax, byte [rsi + rdx - 0x40]
xor al, byte [rsi]
mov byte [r8 + rsi - 0x40], al
lea rsi, [rsi + 1]
sub rcx, 1
jne 0x140c824b0
mov qword [rdi + 0x80], rbp
xor eax, eax
add rsp, 0x28
pop r15
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140c82b00
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x14100f500]
xor rax, rsp
mov qword [rsp + 0x48], rax
xorps xmm0, xmm0
mov qword [rsp + 0x30], 0
lea rax, [rsp + 0x30]
mov r8d, reloc.WS2_32.dll_recv
lea r9, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x38]
mov rbx, rcx
movups xmmword [rsp + 0x38], xmm0
call fcn.140c81350
test eax, eax
jne 0x140c82cfa
movzx eax, byte [rsp + 0x39]
movzx ecx, byte [rsp + 0x3c]
shl ecx, 8
mov qword [rsp + 0x68], rbp
mov ebp, 2
mov qword [rsp + 0x70], rsi
movzx esi, byte [rsp + 0x40]
mov qword [rsp + 0x78], rdi
movzx edi, byte [rsp + 0x38]
shl edi, 8
or edi, eax
shl esi, 8
movzx eax, byte [rsp + 0x3a]
shl edi, 8
or edi, eax
movzx eax, byte [rsp + 0x3b]
shl edi, 8
or rdi, rax
movzx eax, byte [rsp + 0x3d]
or ecx, eax
shl rdi, 0x20
movzx eax, byte [rsp + 0x3e]
shl ecx, 8
or eax, ecx
movzx ecx, byte [rsp + 0x44]
shl eax, 8
or rdi, rax
shl ecx, 8
movzx eax, byte [rsp + 0x3f]
or rdi, rax
movzx eax, byte [rsp + 0x41]
or esi, eax
mov qword [rbx + 0x118], rdi
movzx eax, byte [rsp + 0x42]
shl esi, 8
or esi, eax
movzx eax, byte [rsp + 0x43]
shl esi, 8
or rsi, rax
movzx eax, byte [rsp + 0x45]
or ecx, eax
shl rsi, 0x20
movzx eax, byte [rsp + 0x46]
shl ecx, 8
or eax, ecx
mov ecx, ebp
shl eax, 8
or rsi, rax
movzx eax, byte [rsp + 0x47]
or rsi, rax
mov qword [rbx + 0x98], rsi
call fcn.140c5e230
test eax, eax
jne 0x140c82ce9
mov qword [rbx + 0xd8], 0
mov qword [rbx + 0x58], 0
mov r8d, 4
nop dword [rax + rax]
mov eax, esi
mov rcx, rdi
and eax, 1
shl rcx, 0x3f
imul edx, eax, 0xe1000000
mov rax, rsi
shr rax, 1
mov rsi, rcx
or rsi, rax
mov rax, rdi
shr rax, 1
mov qword [rbx + r8*8 + 0x58], rsi
mov ecx, edx
shl rcx, 0x20
mov rdi, rcx
xor rdi, rax
mov qword [rbx + r8*8 + 0xd8], rdi
shr r8d, 1
jne 0x140c82c40
mov r8, rbp
nop word [rax + rax]
mov r9, qword [rbx + r8*8 + 0xd8]
mov r10, qword [rbx + r8*8 + 0x58]
cmp r8, 1
jle 0x140c82cd8
lea rax, [rbx + 0x60]
lea rdx, [r8 - 1]
nop dword [rax + rax]
mov rcx, r9
xor rcx, qword [rax + 0x80]
mov qword [rax + r8*8 + 0x80], rcx
lea rax, [rax + 8]
mov rcx, r10
xor rcx, qword [rax - 8]
mov qword [rax + r8*8 - 8], rcx
sub rdx, 1
jne 0x140c82cb0
lea eax, [rbp*2]
add r8, r8
mov ebp, eax
cmp eax, 8
jle 0x140c82c90
mov rdi, qword [rsp + 0x78]
xor eax, eax
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140cd9320
add rsp, 0x50
pop rbx
ret
Function at 0x140c834c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, qword [rcx + 0x158]
lea rax, [r8 - 4]
mov rbp, qword [rcx + 0x160]
mov rsi, r8
shl r14, 3
mov rbx, rdx
shl rbp, 3
mov rdi, rcx
cmp rax, 0xc
ja 0x140c83618
lea rdx, [rcx + 0x168]
mov rcx, rbx
call fcn.140da1510
test r14, r14
jne 0x140c83524
test rbp, rbp
je 0x140c83614
lea rdx, [rdi + 0x188]
mov rax, rbp
shr rax, 0x38
mov r8, rdx
xor byte [rdx], al
mov rcx, rdi
mov rax, rbp
shr rax, 0x30
xor byte [rdi + 0x189], al
mov rax, rbp
shr rax, 0x28
xor byte [rdi + 0x18a], al
mov rax, rbp
shr rax, 0x20
xor byte [rdi + 0x18b], al
mov rax, rbp
shr rax, 0x18
xor byte [rdi + 0x18c], al
mov rax, rbp
shr rax, 0x10
xor byte [rdi + 0x18d], al
mov rax, rbp
shr rax, 8
xor byte [rdi + 0x18e], al
mov rax, r14
xor byte [rdi + 0x18f], bpl
shr rax, 0x38
xor byte [rdi + 0x190], al
mov rax, r14
shr rax, 0x30
xor byte [rdi + 0x191], al
mov rax, r14
shr rax, 0x28
xor byte [rdi + 0x192], al
mov rax, r14
shr rax, 0x20
xor byte [rdi + 0x193], al
mov rax, r14
shr rax, 0x18
xor byte [rdi + 0x194], al
mov rax, r14
shr rax, 0x10
xor byte [rdi + 0x195], al
mov rax, r14
shr rax, 8
xor byte [rdi + 0x196], al
xor byte [rdi + 0x197], r14b
call fcn.140c82d10
test rsi, rsi
je 0x140c83614
sub rdi, rbx
nop
movzx eax, byte [rdi + rbx + 0x188]
xor byte [rbx], al
lea rbx, [rbx + 1]
sub rsi, 1
jne 0x140c83600
xor eax, eax
jmp 0x140c8361d
mov eax, 0xffffffec
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140c87aa0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movzx r10d, byte [r8 + 1]
mov rbx, rcx
movzx ecx, byte [r8 + 5]
mov r11d, edx
movzx eax, byte [r8]
mov rsi, r9
movzx edi, byte [r8 + 4]
movzx edx, byte [r8 + 3]
shl eax, 8
or eax, r10d
shl edi, 8
movzx r10d, byte [r8 + 2]
or edi, ecx
movzx ecx, byte [r8 + 6]
shl eax, 8
shl edi, 8
or eax, r10d
or edi, ecx
shl eax, 8
movzx ecx, byte [r8 + 7]
or eax, edx
shl edi, 8
mov r10d, reloc.WS2_32.dll_recv
or edi, ecx
test r11d, r11d
jne 0x140c87b65
lea r11, [rbx + 0x44]
nop
xor eax, dword [r11]
lea r11, [r11 - 4]
mov ecx, eax
mov r9d, eax
shr ecx, 0x10
mov edx, ecx
movzx ecx, cl
shr rdx, 8
mov r8d, dword [rbx + rdx*4 + 0x48]
add r8d, dword [rbx + rcx*4 + 0x448]
mov ecx, eax
shr ecx, 8
movzx edx, cl
movzx ecx, al
xor r8d, dword [rbx + rdx*4 + 0x848]
mov eax, r8d
add eax, dword [rbx + rcx*4 + 0xc48]
xor eax, edi
mov edi, r9d
sub r10, 1
jne 0x140c87b10
xor r9d, dword [rbx]
xor eax, dword [rbx + 4]
jmp 0x140c87bc4
mov r11, rbx
nop dword [rax + rax]
xor eax, dword [r11]
lea r11, [r11 + 4]
mov ecx, eax
mov r9d, eax
shr ecx, 0x10
mov edx, ecx
movzx ecx, cl
shr rdx, 8
mov r8d, dword [rbx + rdx*4 + 0x48]
add r8d, dword [rbx + rcx*4 + 0x448]
mov ecx, eax
shr ecx, 8
movzx edx, cl
movzx ecx, al
xor r8d, dword [rbx + rdx*4 + 0x848]
mov eax, r8d
add eax, dword [rbx + rcx*4 + 0xc48]
xor eax, edi
mov edi, r9d
sub r10, 1
jne 0x140c87b70
xor r9d, dword [rbx + 0x44]
xor eax, dword [rbx + 0x40]
mov rbx, qword [rsp + 8]
mov ecx, r9d
mov rdi, qword [rsp + 0x18]
shr ecx, 0x18
mov byte [rsi], cl
mov ecx, r9d
shr ecx, 0x10
mov byte [rsi + 1], cl
mov ecx, r9d
shr ecx, 8
mov byte [rsi + 2], cl
mov ecx, eax
shr ecx, 0x18
mov byte [rsi + 4], cl
mov ecx, eax
shr ecx, 0x10
mov byte [rsi + 5], cl
mov ecx, eax
mov byte [rsi + 7], al
xor eax, eax
shr ecx, 8
mov byte [rsi + 6], cl
mov byte [rsi + 3], r9b
mov rsi, qword [rsp + 0x10]
ret
Function at 0x140c8a4b0
Capabilities:
Hash data using sha384
Hash data using sha512

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x70]
add rcx, 0x4ac
call fcn.140c76040
mov rcx, qword [rbx + 0x70]
add rcx, 0x504
call fcn.140c78380
mov rcx, qword [rbx + 0x70]
xor edx, edx
add rcx, 0x560
call fcn.140c7b330
mov rcx, qword [rbx + 0x70]
mov edx, 1
add rcx, 0x5d0
add rsp, 0x20
pop rbx
jmp fcn.140c75020
Function at 0x140ca9b80
Capabilities:
Send data
Send data on socket

Disassembly:
movsx edx, byte [rcx + 0x4ed]
mov rcx, qword [rcx]
jmp fcn.140cb4e10

Function at 0x140cac390
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
call fcn.140cf5204
xor ebp, ebp
xor r9d, r9d
mov r8d, ebx
mov dword [rax], ebp
mov rax, qword [rdi + 0x3c8]
mov rcx, qword [rdi + 0x4b0]
test rax, rax
je 0x140cac3f1
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x1c
mov qword [rsp + 0x28], rdx
mov rdx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_recvfrom]
jmp 0x140cac3fa
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_recv]
mov ebx, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
test ebx, ebx
js 0x140cac415
jne 0x140cac411
mov eax, 0xffffffff
jmp 0x140cac439
mov eax, ebx
jmp 0x140cac439
cmp edx, 0x2733
je 0x140cac434
mov eax, 0xffffffff
cmp edx, 0x2714
mov ecx, 0xfffffffc
cmovne ecx, eax
mov eax, ecx
jmp 0x140cac439
mov eax, 0xfffffffc
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret