joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140108fc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r9
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [rbp + 0x50]
mov r12, rcx
movzx ecx, byte [rax + 7]
lea rdi, [rax + 1]
mov r13, qword [rbp + 0x58]
mov rsi, rdx
movzx edx, byte [rdi + 3]
xor r15d, r15d
movzx r11d, byte [rax]
mov r14d, r8d
movzx eax, byte [rdi]
mov ebx, dword [r13]
shl eax, 8
or r11d, eax
shl ecx, 8
movzx eax, byte [rdi + 1]
shl eax, 0x10
or r11d, eax
movzx eax, byte [rdi + 2]
shl eax, 0x18
or r11d, eax
movzx eax, byte [rdi + 4]
shl eax, 8
or edx, eax
mov dword [rbp - 8], r11d
movzx eax, byte [rdi + 5]
or ecx, eax
mov byte [rbp - 0x10], r11b
shl ecx, 0x10
mov eax, r11d
shr eax, 8
or edx, ecx
mov byte [rbp - 0xf], al
mov eax, r11d
shr eax, 0x10
mov byte [rbp - 0xe], al
mov eax, r11d
shr eax, 0x18
mov byte [rbp - 0xd], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0xb], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0xa], al
mov eax, edx
shr eax, 0x18
mov dword [rbp - 4], edx
mov byte [rbp - 0xc], dl
mov byte [rbp - 9], al
test r8d, r8d
je 0x140109160
mov r13, qword [rbp + 0x48]
sub r12, rsi
movzx r8d, dl
movzx r9d, r11b
nop dword [rax]
dec r14d
test ebx, ebx
jne 0x140109102
mov rdx, r13
lea rcx, [rbp - 8]
call fcn.140108c60
mov r11d, dword [rbp - 8]
mov eax, r11d
mov edx, dword [rbp - 4]
movzx r9d, byte [rbp - 8]
movzx r8d, byte [rbp - 4]
shr eax, 8
mov byte [rbp - 0xf], al
mov eax, r11d
shr eax, 0x10
mov byte [rbp - 0xe], al
mov eax, r11d
shr eax, 0x18
mov byte [rbp - 0xd], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0xb], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0xa], al
mov eax, edx
shr eax, 0x18
mov byte [rbp - 9], al
inc r15d
mov byte [rbp - 0x10], r9b
mov byte [rbp - 0xc], r8b
movsxd rax, ebx
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [r12 + rsi]
mov byte [rsi], cl
inc rsi
inc ebx
and ebx, 7
test r14d, r14d
jne 0x1401090a0
mov r13, qword [rbp + 0x58]
test r15d, r15d
je 0x140109160
mov rax, qword [rbp + 0x50]
mov byte [rax], r9b
mov eax, r11d
shr eax, 8
mov byte [rdi], al
mov eax, r11d
shr eax, 0x10
mov byte [rdi + 1], al
mov eax, edx
shr eax, 8
shr r11d, 0x18
mov byte [rdi + 2], r11b
mov byte [rdi + 3], r8b
mov byte [rdi + 4], al
mov eax, edx
shr eax, 0x10
shr edx, 0x18
mov byte [rdi + 5], al
mov byte [rdi + 6], dl
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov dword [r13], ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140109de0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r8
call fcn.14010a050
test eax, eax
js 0x14010a044
mov ecx, dword [rbx + 0xf0]
lea eax, [rcx*4]
movsxd r9, eax
test eax, eax
jle 0x140109e73
lea r8, [rbx + 8]
xor r10d, r10d
lea r8, [r8 + r9*4]
lea rax, [rbx + 8]
nop dword [rax]
mov edx, dword [rax - 8]
add r10, 4
mov ecx, dword [r8 - 8]
lea r8, [r8 - 0x10]
mov dword [rax - 8], ecx
lea rax, [rax + 0x10]
mov ecx, dword [r8 + 0xc]
sub r9, 4
mov dword [r8 + 8], edx
mov edx, dword [rax - 0x14]
mov dword [rax - 0x14], ecx
mov ecx, dword [r8 + 0x10]
mov dword [r8 + 0xc], edx
mov edx, dword [rax - 0x10]
mov dword [rax - 0x10], ecx
mov ecx, dword [r8 + 0x14]
mov dword [r8 + 0x10], edx
mov edx, dword [rax - 0xc]
mov dword [rax - 0xc], ecx
mov dword [r8 + 0x14], edx
cmp r10, r9
jl 0x140109e20
mov ecx, dword [rbx + 0xf0]
mov r11d, 1
cmp ecx, r11d
jle 0x14010a042
mov qword [rsp + 0x30], rdi
lea r10, [rbx + 4]
lea rdi, [0x140000000]
nop dword [rax]
nop word [rax + rax]
mov r9d, dword [r10 + 0x10]
lea r10, [r10 + 0x10]
mov edx, dword [r10 - 4]
inc r11d
movzx eax, byte [r10 - 3]
movzx ecx, byte [rdi + rax*4 + 0x20cd00]
mov eax, edx
shr rax, 0x18
mov r8d, dword [rdi + rcx*4 + 0x20e100]
movzx eax, byte [rdi + rax*4 + 0x20cd00]
xor r8d, dword [rdi + rax*4 + 0x20d900]
movzx eax, dl
movzx ecx, byte [rdi + rax*4 + 0x20cd00]
movzx eax, byte [r10 - 2]
xor r8d, dword [rdi + rcx*4 + 0x20e500]
movzx ecx, byte [rdi + rax*4 + 0x20cd00]
mov eax, r9d
shr eax, 0x10
xor r8d, dword [rdi + rcx*4 + 0x20dd00]
movzx ecx, al
mov eax, r9d
shr eax, 8
mov dword [r10 - 4], r8d
movzx edx, byte [rdi + rcx*4 + 0x20cd00]
movzx ecx, al
mov r8d, dword [rdi + rdx*4 + 0x20dd00]
movzx eax, byte [rdi + rcx*4 + 0x20cd00]
xor r8d, dword [rdi + rax*4 + 0x20e100]
mov eax, r9d
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0x20cd00]
movzx eax, r9b
mov r9d, dword [r10 + 4]
xor r8d, dword [rdi + rcx*4 + 0x20d900]
movzx ecx, byte [rdi + rax*4 + 0x20cd00]
mov eax, r9d
shr eax, 0x10
xor r8d, dword [rdi + rcx*4 + 0x20e500]
movzx ecx, al
mov eax, r9d
shr eax, 8
mov dword [r10], r8d
movzx edx, byte [rdi + rcx*4 + 0x20cd00]
movzx ecx, al
mov r8d, dword [rdi + rdx*4 + 0x20dd00]
movzx eax, byte [rdi + rcx*4 + 0x20cd00]
xor r8d, dword [rdi + rax*4 + 0x20e100]
mov eax, r9d
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0x20cd00]
movzx eax, r9b
mov r9d, dword [r10 + 8]
xor r8d, dword [rdi + rcx*4 + 0x20d900]
movzx ecx, byte [rdi + rax*4 + 0x20cd00]
mov eax, r9d
shr eax, 0x10
xor r8d, dword [rdi + rcx*4 + 0x20e500]
movzx ecx, al
mov eax, r9d
shr eax, 8
mov dword [r10 + 4], r8d
movzx edx, byte [rdi + rcx*4 + 0x20cd00]
movzx ecx, al
mov r8d, dword [rdi + rdx*4 + 0x20dd00]
movzx eax, byte [rdi + rcx*4 + 0x20cd00]
xor r8d, dword [rdi + rax*4 + 0x20e100]
mov eax, r9d
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0x20cd00]
movzx eax, r9b
xor r8d, dword [rdi + rcx*4 + 0x20d900]
movzx ecx, byte [rdi + rax*4 + 0x20cd00]
xor r8d, dword [rdi + rcx*4 + 0x20e500]
mov dword [r10 + 8], r8d
cmp r11d, dword [rbx + 0xf0]
jl 0x140109ea0
mov rdi, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x14010b4a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x40
mov r15, qword [rsp + 0xa8]
mov r14, rdx
mov rdx, qword [rsp + 0xb0]
mov r10, r9
mov rdi, r8
mov rbp, rcx
mov ebx, dword [rdx]
test ebx, ebx
je 0x14010b4f7
test rdi, rdi
je 0x14010b4f7
mov eax, ebx
dec rdi
movzx ecx, byte [rax + r15]
xor cl, byte [rbp]
inc rbp
mov byte [r14], cl
inc r14
inc ebx
and ebx, 0xf
jne 0x14010b4d5
mov r9, qword [rsp + 0xb8]
mov r13d, reloc.WS2_32.dll_recv
mov qword [rsp + 0x38], r12
mov esi, 1
cmp rdi, r13
jb 0x14010b61b
mov rcx, rdi
xor ebx, ebx
shr rcx, 4
mov r15, r14
imul rax, rcx, 0xfffffffffffffff0
mov r12, rbp
mov dword [rsp + 0x20], ebx
mov rbx, qword [rsp + 0xa8]
add rdi, rax
mov rax, rcx
mov qword [rsp + 0x90], rdi
mov rdi, qword [rsp + 0x98]
sub r15, rbx
shl rax, 4
sub r12, rbx
add r14, rax
add rbp, rax
mov qword [rsp + 0x88], r14
mov qword [rsp + 0x80], rbp
mov r14, rcx
mov rbp, qword [rsp + 0xa0]
nop dword [rax + rax]
mov r8, rdi
mov rdx, rbx
mov rcx, rbp
call r9
mov r8d, r13d
lea rdx, [rbp + 0x10]
mov ecx, esi
nop word [rax + rax]
movzx eax, byte [rdx - 1]
lea rdx, [rdx - 1]
add ecx, eax
mov byte [rdx], cl
shr ecx, 8
add r8d, 0xffffffff
jne 0x14010b5a0
mov rax, rbx
lea edx, [r8 + 2]
nop dword [rax]
mov rcx, qword [r12 + rax]
xor rcx, qword [rax]
mov qword [r15 + rax], rcx
lea rax, [rax + 8]
sub rdx, rsi
jne 0x14010b5c0
mov r9, qword [rsp + 0xb8]
add r15, r13
add r12, r13
sub r14, rsi
jne 0x14010b580
mov ebx, dword [rsp + 0x20]
mov rdi, qword [rsp + 0x90]
mov r14, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x80]
mov r15, qword [rsp + 0xa8]
mov rdx, qword [rsp + 0xb0]
mov r10, qword [rsp + 0x98]
test rdi, rdi
je 0x14010b682
mov r12, qword [rsp + 0xa0]
mov r8, r10
mov rcx, r12
mov rdx, r15
call r9
lea rcx, [r12 + 0x10]
nop dword [rax]
movzx eax, byte [rcx - 1]
lea rcx, [rcx - 1]
add esi, eax
mov byte [rcx], sil
shr esi, 8
add r13d, 0xffffffff
jne 0x14010b640
nop word [rax + rax]
mov ecx, ebx
inc ebx
movzx eax, byte [rcx + rbp]
xor al, byte [rcx + r15]
mov byte [rcx + r14], al
sub rdi, 1
jne 0x14010b660
mov rax, qword [rsp + 0xb0]
mov dword [rax], ebx
jmp 0x14010b684
mov dword [rdx], ebx
mov r12, qword [rsp + 0x38]
add rsp, 0x40
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14010b6a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x40
mov r11, r9
mov rbx, r8
mov r9, qword [rsp + 0xb0]
mov r14, rdx
mov rbp, rcx
mov edi, dword [r9]
mov dword [rsp + 0x30], edi
test edi, edi
je 0x14010b705
mov rdx, qword [rsp + 0xa8]
nop word [rax + rax]
test rbx, rbx
je 0x14010b701
mov eax, edi
dec rbx
movzx ecx, byte [rax + rdx]
xor cl, byte [rbp]
inc rbp
mov byte [r14], cl
inc r14
inc edi
and edi, 0xf
jne 0x14010b6e0
mov dword [rsp + 0x30], edi
mov rax, qword [rsp + 0xa0]
mov esi, 1
mov r8d, dword [rax + 0xc]
lea r15, [rax + 0xc]
mov r10, qword [rsp + 0xb8]
mov qword [rsp + 0x80], r12
lea r13d, [rsi + 0xb]
bswap r8d
mov dword [rsp + 0x90], r8d
cmp rbx, 0x10
jb 0x14010b825
mov rdi, qword [rsp + 0xa0]
mov eax, 0x10000000
mov rdx, rbx
mov qword [rsp + 0x20], rdi
shr rdx, 4
mov r9, r11
cmp rdx, rax
cmova rdx, rax
add r8d, edx
mov r12, rdx
mov eax, r8d
mov ecx, r8d
sub r12, rax
cmp rax, rdx
cmovae r12, rdx
xor r8d, r8d
cmp rax, rdx
mov rdx, r14
cmovae r8d, ecx
mov rcx, rbp
mov dword [rsp + 0x90], r8d
mov r8, r12
call r10
mov r8d, dword [rsp + 0x90]
mov eax, r8d
bswap eax
mov dword [r15], eax
test r8d, r8d
jne 0x14010b7dd
mov r8d, r13d
mov eax, esi
mov rdx, r15
nop word [rax + rax]
movzx ecx, byte [rdx - 1]
lea rdx, [rdx - 1]
add eax, ecx
mov byte [rdx], al
shr eax, 8
add r8d, 0xffffffff
jne 0x14010b7c0
mov r8d, dword [rsp + 0x90]
mov r10, qword [rsp + 0xb8]
mov eax, 0x10000000
mov r11, qword [rsp + 0x98]
shl r12, 4
sub rbx, r12
add r14, r12
add rbp, r12
cmp rbx, 0x10
jae 0x14010b750
mov edi, dword [rsp + 0x30]
mov r9, qword [rsp + 0xb0]
mov rax, qword [rsp + 0xa0]
mov dword [rsp + 0x90], r8d
test rbx, rbx
je 0x14010b8b2
mov r12, qword [rsp + 0xa8]
xor ecx, ecx
mov r9, r11
mov qword [rsp + 0x20], rax
mov r8, rsi
mov rdx, r12
mov qword [r12], rcx
mov qword [r12 + 8], rcx
mov rcx, r12
call r10
mov r8d, dword [rsp + 0x90]
add r8d, esi
bswap r8d
mov dword [r15], r8d
jne 0x14010b890
nop dword [rax + rax]
movzx eax, byte [r15 - 1]
lea r15, [r15 - 1]
add esi, eax
mov byte [r15], sil
shr esi, 8
add r13d, 0xffffffff
jne 0x14010b870
nop word [rax + rax]
mov ecx, edi
inc edi
movzx eax, byte [rcx + rbp]
xor al, byte [rcx + r12]
mov byte [rcx + r14], al
sub rbx, 1
jne 0x14010b890
mov rax, qword [rsp + 0xb0]
mov dword [rax], edi
jmp 0x14010b8b5
mov dword [r9], edi
mov r12, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14010b8d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r12
push r15
sub rsp, 0x28
mov rsi, qword [rsp + 0x88]
mov r10, r9
mov rbp, qword [rsp + 0x80]
mov rdi, r8
mov r15, rdx
mov r12, rcx
mov ebx, dword [rsi]
test ebx, ebx
je 0x14010b925
test rdi, rdi
je 0x14010b925
mov eax, ebx
dec rdi
movzx ecx, byte [rax + rbp]
xor cl, byte [r12]
inc r12
mov byte [r15], cl
inc r15
inc ebx
and ebx, 0xf
jne 0x14010b903
mov r9, qword [rsp + 0x90]
cmp rdi, 0x10
jb 0x14010b9e9
mov qword [rsp + 0x60], r13
mov rsi, r15
mov r13, rdi
mov qword [rsp + 0x20], r14
shr r13, 4
mov r14, r12
imul rax, r13, 0xfffffffffffffff0
sub rsi, rbp
sub r14, rbp
add rdi, rax
mov rax, r13
shl rax, 4
add r15, rax
mov qword [rsp + 0x68], r15
add r12, rax
mov r15, qword [rsp + 0x78]
mov r8, r15
mov rdx, rbp
mov rcx, rbp
call r9
cmp ebx, 0x10
jae 0x14010b9b5
mov edx, send
mov eax, ebx
sub edx, ebx
add rax, rbp
shr edx, 3
inc edx
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [r14 + rax]
xor rcx, qword [rax]
mov qword [rsi + rax], rcx
lea rax, [rax + 8]
sub rdx, 1
jne 0x14010b9a0
mov r9, qword [rsp + 0x90]
add rsi, 0x10
add r14, 0x10
xor ebx, ebx
sub r13, 1
jne 0x14010b972
mov r15, qword [rsp + 0x68]
mov r10, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x88]
mov r14, qword [rsp + 0x20]
mov r13, qword [rsp + 0x60]
test rdi, rdi
je 0x14010ba16
mov r8, r10
mov rdx, rbp
mov rcx, rbp
call r9
nop word [rax + rax]
mov ecx, ebx
inc ebx
movzx eax, byte [rcx + r12]
xor al, byte [rcx + rbp]
mov byte [rcx + r15], al
sub rdi, 1
jne 0x14010ba00
mov dword [rsi], ebx
add rsp, 0x28
pop r15
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14010ba30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test r8, r8
je 0x14010bc70
mov rax, rsp
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rbx
push rbp
push r14
push r15
sub rsp, 0x68
mov rbx, qword [rsp + 0xb0]
mov r14, r9
mov qword [rax + 8], rsi
mov r15, rcx
mov qword [rax - 0x28], rdi
xor ebp, ebp
mov qword [rax - 0x30], r12
mov r12, qword [rsp + 0xc8]
mov qword [rax - 0x38], r13
mov r13d, dword [rsp + 0xc0]
nop
movups xmm0, xmmword [rbx]
movzx eax, bpl
mov ecx, 7
and al, 7
mov rsi, rbp
sub cl, al
shr rsi, 3
mov eax, 1
mov r8, r14
shl eax, cl
mov rdx, rbx
mov rcx, rbx
and al, byte [rsi + r15]
neg al
movups xmmword [rsp + 0x20], xmm0
sbb dil, dil
and dil, 0x80
call r12
movzx r9d, dil
xor r9b, byte [rbx]
movzx eax, r9b
test r13d, r13d
jne 0x14010bad0
movzx r9d, dil
movzx r8d, byte [rsp + 0x21]
movzx edx, byte [rsp + 0x20]
movzx ecx, r8b
shr cl, 7
add dl, dl
or dl, cl
add r8b, r8b
mov byte [rbx], dl
movzx edx, byte [rsp + 0x22]
movzx ecx, dl
add dl, dl
shr cl, 7
or cl, r8b
movzx r8d, byte [rsp + 0x23]
mov byte [rbx + 1], cl
movzx ecx, r8b
shr cl, 7
add r8b, r8b
or cl, dl
movzx edx, byte [rsp + 0x24]
mov byte [rbx + 2], cl
movzx ecx, dl
shr cl, 7
add dl, dl
or cl, r8b
movzx r8d, byte [rsp + 0x25]
mov byte [rbx + 3], cl
movzx ecx, r8b
shr cl, 7
add r8b, r8b
or cl, dl
movzx edx, byte [rsp + 0x26]
mov byte [rbx + 4], cl
movzx ecx, dl
shr cl, 7
add dl, dl
or cl, r8b
movzx r8d, byte [rsp + 0x27]
mov byte [rbx + 5], cl
movzx ecx, r8b
shr cl, 7
add r8b, r8b
or cl, dl
movzx edx, byte [rsp + 0x28]
mov byte [rbx + 6], cl
movzx ecx, dl
shr cl, 7
add dl, dl
or cl, r8b
movzx r8d, byte [rsp + 0x29]
mov byte [rbx + 7], cl
movzx ecx, r8b
shr cl, 7
add r8b, r8b
or cl, dl
movzx edx, byte [rsp + 0x2a]
mov byte [rbx + 8], cl
movzx ecx, dl
shr cl, 7
add dl, dl
or cl, r8b
movzx r8d, byte [rsp + 0x2b]
mov byte [rbx + 9], cl
movzx ecx, r8b
shr cl, 7
add r8b, r8b
or cl, dl
movzx edx, byte [rsp + 0x2c]
mov byte [rbx + 0xa], cl
movzx ecx, dl
shr cl, 7
add dl, dl
or cl, r8b
movzx r8d, byte [rsp + 0x2d]
mov byte [rbx + 0xb], cl
movzx ecx, r8b
shr cl, 7
or cl, dl
movzx edx, byte [rsp + 0x2e]
mov byte [rbx + 0xc], cl
add r8b, r8b
movzx ecx, dl
shr r9b, 7
shr cl, 7
add dl, dl
or r8b, cl
and al, 0x80
mov byte [rbx + 0xd], r8b
movzx r8d, byte [rsp + 0x2f]
movzx ecx, r8b
add r8b, r8b
or r9b, r8b
shr cl, 7
or cl, dl
mov byte [rbx + 0xf], r9b
mov r9, qword [rsp + 0x98]
mov edx, ebp
mov byte [rbx + 0xe], cl
and edx, 7
mov ecx, 7
sub ecx, edx
movzx r8d, byte [rsi + r9]
btr r8d, ecx
movzx ecx, bpl
and cl, 7
inc rbp
shr al, cl
or r8b, al
mov byte [rsi + r9], r8b
cmp rbp, qword [rsp + 0xa0]
jb 0x14010ba80
mov r13, qword [rsp + 0x50]
mov r12, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x90]
add rsp, 0x68
pop r15
pop r14
pop rbp
pop rbx
ret
Function at 0x14010bd30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
cmp dword [rsp + 0x90], 0
mov r10, r9
mov r15, qword [rsp + 0x88]
mov rdi, r8
mov rbp, qword [rsp + 0x80]
mov rsi, rdx
mov r14, rcx
mov ebx, dword [r15]
je 0x14010be8e
test ebx, ebx
je 0x14010bda4
nop word [rax + rax]
test rdi, rdi
je 0x14010bda4
movzx eax, byte [r14]
dec rdi
mov ecx, ebx
inc r14
xor byte [rcx + rbp], al
movzx eax, byte [rcx + rbp]
mov byte [rsi], al
inc rsi
inc ebx
and ebx, 0xf
jne 0x14010bd80
mov r9, qword [rsp + 0x98]
cmp rdi, 0x10
jb 0x14010be54
mov r15, rsi
mov r13, rdi
shr r13, 4
mov r12, r14
imul rax, r13, 0xfffffffffffffff0
sub r15, rbp
sub r12, rbp
add rdi, rax
mov rax, r13
shl rax, 4
add rsi, rax
mov qword [rsp + 0x68], rsi
add r14, rax
mov rsi, qword [rsp + 0x78]
nop word [rax + rax]
mov r8, rsi
mov rdx, rbp
mov rcx, rbp
call r9
cmp ebx, 0x10
jae 0x14010be2a
mov edx, send
mov ecx, ebx
sub edx, ebx
add rcx, rbp
shr edx, 3
inc edx
mov rax, qword [r12 + rcx]
xor qword [rcx], rax
mov rax, qword [rcx]
mov qword [r15 + rcx], rax
lea rcx, [rcx + 8]
sub rdx, 1
jne 0x14010be12
mov r9, qword [rsp + 0x98]
add r15, 0x10
add r12, 0x10
xor ebx, ebx
sub r13, 1
jne 0x14010bdf0
mov rsi, qword [rsp + 0x68]
mov r10, qword [rsp + 0x78]
mov r15, qword [rsp + 0x88]
test rdi, rdi
je 0x14010bf9b
mov r8, r10
mov rdx, rbp
mov rcx, rbp
call r9
nop dword [rax]
mov ecx, ebx
inc ebx
movzx eax, byte [rcx + r14]
xor byte [rcx + rbp], al
movzx eax, byte [rcx + rbp]
mov byte [rcx + rsi], al
sub rdi, 1
jne 0x14010be70
jmp 0x14010bf9b
test ebx, ebx
je 0x14010beb8
test rdi, rdi
je 0x14010beb8
movzx edx, byte [r14]
dec rdi
mov ecx, ebx
inc r14
movzx eax, byte [rcx + rbp]
xor al, dl
mov byte [rsi], al
inc rsi
inc ebx
mov byte [rcx + rbp], dl
and ebx, 0xf
jne 0x14010be92
mov r13, qword [rsp + 0x98]
cmp rdi, 0x10
jb 0x14010bf65
mov r12, rdi
mov r15, rsi
shr r12, 4
sub r15, rbp
imul rax, r12, 0xfffffffffffffff0
add rdi, rax
mov qword [rsp + 0x70], rdi
mov rdi, qword [rsp + 0x78]
nop dword [rax + rax]
mov r8, rdi
mov rdx, rbp
mov rcx, rbp
call r13
cmp ebx, 0x10
jae 0x14010bf3f
mov r9d, send
mov r8d, ebx
sub r9d, ebx
mov r10, r14
shr r9d, 3
add r8, rbp
sub r10, rsi
inc r9d
nop dword [rax]
mov rax, qword [r8]
lea rcx, [r15 + r8]
mov rdx, qword [rcx + r10]
lea r8, [r8 + 8]
xor rax, rdx
mov qword [rcx], rax
mov qword [r8 - 8], rdx
sub r9, 1
jne 0x14010bf20
add rsi, 0x10
add r15, 0x10
add r14, 0x10
xor ebx, ebx
sub r12, 1
jne 0x14010bef0
mov rdi, qword [rsp + 0x70]
mov r10, qword [rsp + 0x78]
mov r15, qword [rsp + 0x88]
test rdi, rdi
je 0x14010bf9b
mov r8, r10
mov rdx, rbp
mov rcx, rbp
call r13
nop word [rax + rax]
mov ecx, ebx
inc ebx
movzx edx, byte [rcx + r14]
movzx eax, byte [rcx + rbp]
xor al, dl
mov byte [rcx + rsi], al
mov byte [rcx + rbp], dl
sub rdi, 1
jne 0x14010bf80
mov dword [r15], ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14010bfc0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x38], 0
mov rdi, r8
mov r14, rdx
mov rbp, rcx
je 0x14010bfe7
mov eax, 0xfffffffe
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
mov rcx, qword [rcx + 0x30]
movabs rax, 0x2000000000000000
add rcx, r8
cmp rcx, rax
ja 0x14010c0e2
cmp rcx, r8
jb 0x14010c0e2
mov qword [rsp + 0x40], rbx
lea rbx, [rbp + 0x40]
mov qword [rsp + 0x48], rsi
mov esi, dword [rbp + 0x174]
mov qword [rsp + 0x50], r12
mov qword [rbp + 0x30], rcx
test esi, esi
je 0x14010c075
nop dword [rax + rax]
test rdi, rdi
je 0x14010c060
movzx eax, byte [r14]
lea rbx, [rbp + 0x40]
mov ecx, esi
inc r14
dec rdi
xor byte [rcx + rbx], al
inc esi
and esi, 0xf
jne 0x14010c030
lea r12, [rbp + 0x60]
mov rcx, rbx
mov rdx, r12
call fcn.14010d390
jmp 0x14010c079
test esi, esi
jne 0x14010c0c2
lea r12, [rbp + 0x60]
mov rcx, rbx
mov rdx, r12
call fcn.14010d390
jmp 0x14010c079
lea r12, [rbp + 0x60]
mov qword [rsp + 0x58], r15
mov r15, rdi
and r15, 0xfffffffffffffff0
je 0x14010c09e
mov r9, r15
mov r8, r14
mov rdx, r12
mov rcx, rbx
call fcn.14010d230
add r14, r15
sub rdi, r15
mov r15, qword [rsp + 0x58]
test rdi, rdi
je 0x14010c0c2
mov esi, edi
sub r14, rbp
nop dword [rax]
movzx eax, byte [r14 + rbx - 0x40]
xor byte [rbx], al
lea rbx, [rbx + 1]
sub rdi, 1
jne 0x14010c0b0
mov rbx, qword [rsp + 0x40]
xor eax, eax
mov r12, qword [rsp + 0x50]
mov dword [rbp + 0x174], esi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
or eax, 0xffffffff
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
Function at 0x14010cf60
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
push r13
sub rsp, 0x28
xor r13d, r13d
mov rdi, r8
mov qword [rcx + 0x30], r13
mov rsi, rdx
mov qword [rcx + 0x38], r13
mov rbx, rcx
mov qword [rcx + 0x170], r13
cmp r8, 0xc
jne 0x14010cfa9
movsd xmm0, qword [rdx]
lea edi, [r8 - 0xb]
movsd qword [rcx], xmm0
mov eax, dword [rdx + 8]
mov dword [rcx + 8], eax
mov dword [rcx + 0xc], 0x1000000
jmp 0x14010d0e0
mov qword [rsp + 0x50], rbp
mov rbp, rdi
mov qword [rsp + 0x58], r12
mov qword [rcx + 0x40], r13
mov qword [rsp + 0x60], r14
mov qword [rcx + 0x48], r13
cmp rdi, 0x10
jb 0x14010d06f
mov qword [rsp + 0x20], r15
mov r15, rdi
shr r15, 4
imul rax, r15, 0xfffffffffffffff0
add rdi, rax
movzx eax, byte [rsi]
lea rdx, [rbx + 0x60]
xor byte [rbx + 0x40], al
lea rcx, [rbx + 0x40]
movzx eax, byte [rsi + 1]
xor byte [rbx + 0x41], al
movzx eax, byte [rsi + 2]
xor byte [rbx + 0x42], al
movzx eax, byte [rsi + 3]
xor byte [rbx + 0x43], al
movzx eax, byte [rsi + 4]
xor byte [rbx + 0x44], al
movzx eax, byte [rsi + 5]
xor byte [rbx + 0x45], al
movzx eax, byte [rsi + 6]
xor byte [rbx + 0x46], al
movzx eax, byte [rsi + 7]
xor byte [rbx + 0x47], al
movzx eax, byte [rsi + 8]
xor byte [rbx + 0x48], al
movzx eax, byte [rsi + 9]
xor byte [rbx + 0x49], al
movzx eax, byte [rsi + 0xa]
xor byte [rbx + 0x4a], al
movzx eax, byte [rsi + 0xb]
xor byte [rbx + 0x4b], al
movzx eax, byte [rsi + 0xc]
xor byte [rbx + 0x4c], al
movzx eax, byte [rsi + 0xd]
xor byte [rbx + 0x4d], al
movzx eax, byte [rsi + 0xe]
xor byte [rbx + 0x4e], al
movzx eax, byte [rsi + 0xf]
xor byte [rbx + 0x4f], al
call fcn.14010d390
add rsi, 0x10
sub r15, 1
jne 0x14010cfe0
mov r15, qword [rsp + 0x20]
test rdi, rdi
je 0x14010d09e
lea rcx, [rbx + 0x40]
sub rsi, rbx
nop dword [rax + rax]
movzx eax, byte [rsi + rcx - 0x40]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub rdi, 1
jne 0x14010d080
lea rdx, [rbx + 0x60]
lea rcx, [rbx + 0x40]
call fcn.14010d390
shl rbp, 3
lea rdx, [rbx + 0x60]
bswap rbp
xor qword [rbx + 0x48], rbp
lea rcx, [rbx + 0x40]
call fcn.14010d390
mov rax, qword [rbx + 0x40]
mov edi, dword [rbx + 0x4c]
mov r14, qword [rsp + 0x60]
mov r12, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
mov qword [rbx], rax
mov rax, qword [rbx + 0x48]
mov qword [rbx + 8], rax
bswap edi
nop dword [rax]
mov qword [rbx + 0x40], r13
lea rdx, [rbx + 0x20]
mov qword [rbx + 0x48], r13
mov rcx, rbx
mov r8, qword [rbx + 0x180]
call qword [rbx + 0x178]
inc edi
bswap edi
mov dword [rbx + 0xc], edi
add rsp, 0x28
pop r13
pop rdi
pop rsi
pop rbx
ret