joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140121a90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
cmp dword [rcx + 0x48], 0x1060
mov rax, qword [rcx + 0x50]
mov rbx, rcx
mov rdi, qword [rax + 8]
jne 0x140121bb1
movsxd rax, dword [rcx + 0x60]
mov r8d, 1
xor r9d, r9d
lea rdx, [rdi + rax]
sub r8d, eax
call fcn.14015ae30
mov edx, dword [rbx + 0x60]
mov ecx, eax
mov eax, 1
sub eax, edx
cmp ecx, eax
jge 0x140121af5
mov r8d, ecx
mov edx, WSASetLastError
mov rcx, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
jmp fcn.14015b960
lea eax, [rdx + rcx]
mov dword [rbx + 0x48], 0x1061
mov dword [rbx + 0x60], eax
movzx eax, byte [rdi]
cmp al, 5
je 0x140121bb1
test al, al
je 0x140121b5b
cmp dword [rbx + 0x158], 0
jne 0x140121b2d
mov rcx, rbx
mov qword [rbx + 0x158], 3
call fcn.140122ab0
mov edx, WSASetLastError
lea r9, [0x1402815f0]
mov dword [rsp + 0x20], 0x397
lea ecx, [rdx - 0x5a]
lea r8d, [rdx + 0x66]
call fcn.1400d9be0
or eax, 0xffffffff
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
mov edx, WSASetLastError
lea r9, [0x140281668]
mov dword [rsp + 0x20], 0x39b
lea ecx, [rdx - 0x5a]
lea r8d, [rdx + 0x5a]
call fcn.1400d9be0
movsxd rax, dword [rbx + 0x60]
mov r8d, 3
lea rdx, [rdi + rax]
xor r9d, r9d
mov rcx, rbx
sub r8d, eax
call fcn.14015ae30
mov edx, WSASetLastError
mov rcx, rbx
mov r8d, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
jmp fcn.14015b960
mov rax, qword [rbx + 0x50]
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rsi
mov rsi, qword [rax + 8]
mov rax, qword [rbx + 0x78]
xor r9d, r9d
mov ebp, dword [rax + 0x90]
movsxd rax, dword [rbx + 0x60]
mov rcx, rbx
inc ebp
lea rdx, [rsi + rax]
mov edi, ebp
sub edi, eax
mov r8d, edi
call fcn.14015ae30
cmp eax, edi
jge 0x140121c02
mov r8d, eax
mov edx, WSASetLastError
mov rcx, rbx
call fcn.14015b960
jmp 0x140121cbd
mov r10, qword [rbx + 0x98]
test r10, r10
je 0x140121c34
mov rax, qword [rbx + 0xa0]
mov edx, dword [rbx]
movsxd rcx, ebp
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rcx
xor ecx, ecx
mov r9, rsi
xor r8d, r8d
call r10
mov rax, qword [rbx + 0x78]
xor dl, dl
lea rcx, [rsi + 1]
mov r8d, dword [rax + 0x90]
lea r9, [rax + 0x94]
test r8, r8
je 0x140121cb8
sub r9, rcx
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r9 + rcx]
lea rcx, [rcx + 1]
xor al, byte [rcx - 1]
or dl, al
dec r8
jne 0x140121c60
test dl, dl
je 0x140121cb8
cmp dword [rbx + 0x158], r8d
jne 0x140121c93
mov rcx, rbx
mov qword [rbx + 0x158], 3
call fcn.140122ab0
mov edx, WSASetLastError
lea r9, [0x140281640]
mov dword [rsp + 0x20], 0x3b1
lea ecx, [rdx - 0x5a]
lea r8d, [rdx + 0x1a]
call fcn.1400d9be0
or eax, 0xffffffff
jmp 0x140121cbd
mov eax, 1
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140126980
Capabilities:
Encode data using base64

Disassembly:
sub rsp, 8
xor r11d, r11d
mov r9d, r8d
test r8d, r8d
jle 0x140126a79
mov qword [rsp], rbx
lea r10, [rdx + 1]
lea rbx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
movzx edx, byte [r10 - 1]
cmp r9d, 3
jl 0x140126a00
movzx eax, byte [r10]
shl edx, 8
or edx, eax
movzx eax, byte [r10 + 1]
shl edx, 8
or edx, eax
mov eax, edx
mov r8d, edx
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rax + rbx]
mov byte [rcx], al
mov eax, edx
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rax + rbx]
mov byte [rcx + 1], al
mov eax, edx
shr rax, 6
and eax, 0x3f
and r8d, 0x3f
movzx eax, byte [rax + rbx]
mov byte [rcx + 2], al
movzx eax, byte [r8 + rbx]
mov byte [rcx + 3], al
jmp 0x140126a51
shl edx, 0x10
cmp r9d, 2
jne 0x140126a12
movzx eax, byte [r10]
shl eax, 8
or edx, eax
mov rax, rdx
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rax + rbx]
mov byte [rcx], al
mov rax, rdx
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rax + rbx]
mov byte [rcx + 1], al
cmp r9d, 1
jne 0x140126a3f
lea eax, [r9 + 0x3c]
jmp 0x140126a4a
shr rdx, 6
and edx, 0x3f
movzx eax, byte [rdx + rbx]
mov byte [rcx + 2], al
mov byte [rcx + 3], 0x3d
sub r9d, 3
add rcx, 4
add r11d, 4
add r10, 3
test r9d, r9d
jg 0x1401269a2
mov rbx, qword [rsp]
mov byte [rcx], 0
mov eax, r11d
add rsp, 8
ret
mov byte [rcx], r11b
mov eax, r11d
add rsp, 8
ret
Function at 0x1401272c0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
sub rsp, 0xb8
mov rax, qword [0x1402581e0]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov r12, qword [rsp + 0x110]
xor ebx, ebx
mov rbp, r9
movsxd rsi, r8d
mov r14, rdx
mov rdi, rcx
mov eax, ebx
test r9, r9
je 0x140127307
lea eax, [rbx + 1]
mov qword [rcx], r9
jmp 0x14012730a
mov rbp, qword [rcx]
mov qword [rsp + 0xb0], r15
test rdx, rdx
je 0x140127439
mov eax, dword [rbp + 0x5c]
cmp eax, 0x80
jg 0x140127402
cmp eax, esi
jge 0x14012737d
mov r8, r12
mov rdx, rbp
add rcx, 8
call fcn.1400fb400
test eax, eax
je 0x140127512
lea rcx, [rdi + 8]
mov r8, rsi
mov rdx, r14
call qword [rdi + 0x30]
test eax, eax
je 0x140127512
lea r14, [rdi + 0x98]
lea rdx, [rdi + 0x9c]
lea rcx, [rdi + 8]
mov r8, r14
call fcn.1400fb6a0
test eax, eax
je 0x140127512
jmp 0x14012739e
cmp esi, 0x80
ja 0x1401273cb
mov r8, rsi
add rcx, 0x9c
call sub.MSVCR120.dll_memcpy
lea r14, [rdi + 0x98]
mov dword [r14], esi
mov ecx, dword [r14]
cmp ecx, 0x80
je 0x140127441
mov eax, ecx
mov r8d, 0x80
xor edx, edx
sub r8d, ecx
lea rcx, [rdi + 0x9c]
add rcx, rax
call sub.MSVCR120.dll_memset
jmp 0x140127441
lea r9, str.len_0__len__int_sizeof_ctx__key_
lea rdx, str.....opensslopensslcryptohmachmac.c
lea rcx, str._s__d_:_OpenSSL_internal_error__assertion_failed:__s_n
mov r8d, 0x75
call fcn.1400f6440
mov ecx, reloc.WS2_32.dll_shutdown
call qword [sym.imp.MSVCR120.dll_raise]
mov ecx, 3
call qword [sym.imp.MSVCR120.dll__exit]
int3
lea r9, str.j____int_sizeof_ctx__key_
lea rdx, [0x140287bd0]
lea rcx, str._s__d_:_OpenSSL_internal_error__assertion_failed:__s_n
mov r8d, 0x68
call fcn.1400f6440
mov ecx, reloc.WS2_32.dll_shutdown
call qword [sym.imp.MSVCR120.dll_raise]
mov ecx, 3
call qword [sym.imp.MSVCR120.dll__exit]
int3
test eax, eax
je 0x140127501
lea rcx, [rsp + 0x20]
mov rax, rdi
mov rdx, rbx
sub rax, rcx
lea rsi, [rax + 0x9c]
lea r14, [rax + 0x9d]
nop dword [rax]
lea rcx, [rsp + 0x20]
add rcx, rdx
add rdx, 2
movzx eax, byte [rsi + rcx]
xor al, 0x36
mov byte [rcx], al
movzx eax, byte [r14 + rcx]
xor al, 0x36
mov byte [rcx + 1], al
cmp rdx, 0x80
jl 0x140127460
lea rcx, [rdi + 0x38]
mov r8, r12
mov rdx, rbp
call fcn.1400fb400
test eax, eax
je 0x140127512
movsxd r8, dword [rbp + 0x5c]
lea rdx, [rsp + 0x20]
lea rcx, [rdi + 0x38]
call qword [rdi + 0x60]
test eax, eax
je 0x140127512
nop
lea rcx, [rsp + 0x20]
add rcx, rbx
add rbx, 2
movzx eax, byte [rsi + rcx]
xor al, 0x5c
mov byte [rcx], al
movzx eax, byte [r14 + rcx]
xor al, 0x5c
mov byte [rcx + 1], al
cmp rbx, 0x80
jl 0x1401274b0
lea rcx, [rdi + 0x68]
mov r8, r12
mov rdx, rbp
call fcn.1400fb400
test eax, eax
je 0x140127512
movsxd r8, dword [rbp + 0x5c]
lea rdx, [rsp + 0x20]
lea rcx, [rdi + 0x68]
call qword [rdi + 0x90]
test eax, eax
je 0x140127512
lea rdx, [rdi + 0x38]
lea rcx, [rdi + 8]
call fcn.1400fb750
test eax, eax
jne 0x140127516
xor eax, eax
jmp 0x14012751b
mov eax, 1
mov r15, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1401bddc0
add rsp, 0xb8
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140127c90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
xor r8d, r8d
lea r14, [0x140218b88]
mov r13d, ecx
mov r11, r14
mov ebx, r8d
mov r10d, r8d
nop dword [rax]
cmp r10, 5
ja 0x140127ceb
mov eax, dword [r11]
shl eax, 0xa
test ecx, eax
je 0x140127ce2
inc ebx
inc r10
add r11, 4
jmp 0x140127cd0
mov ecx, dword [rsp + 0x120]
mov rsi, qword [rsp + 0x128]
mov r12, qword [rsp + 0x118]
mov eax, ecx
cdq
idiv ebx
cmp ebx, 1
movsxd rbx, dword [rsp + 0x138]
cmove ecx, r8d
mov r8, rbx
xor edx, edx
mov dword [rsp + 0x120], ecx
mov rcx, rsi
mov dword [rsp + 0x110], eax
call sub.MSVCR120.dll_memset
mov rdi, qword [rsp + 0x130]
xor r8d, r8d
lea r15, [0x1402ddbb8]
mov ebp, r8d
cmp rbp, 5
ja 0x140127efe
mov eax, dword [r14]
test eax, eax
je 0x140127d5c
mov rcx, qword [r15]
jmp 0x140127d5f
mov rcx, r8
shl eax, 0xa
test r13d, eax
je 0x140127ec4
test rcx, rcx
je 0x140127ed4
mov eax, dword [rsp + 0x100]
mov r8d, dword [rsp + 0x120]
mov r9, qword [rsp + 0xc8]
mov dword [rsp + 0x70], ebx
mov qword [rsp + 0x68], rdi
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0xf8]
and r8d, 1
mov rdx, r12
add r8d, dword [rsp + 0x110]
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0xf0]
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0xe0]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0xd0]
mov dword [rsp + 0x20], eax
call fcn.1401277b0
xor r8d, r8d
test eax, eax
je 0x140127ef9
movsxd rax, dword [rsp + 0x110]
mov r9d, r8d
add r12, rax
test ebx, ebx
jle 0x140127e8e
cmp ebx, 0x20
jb 0x140127e8e
lea eax, [rbx - 1]
mov edx, r8d
movsxd rcx, eax
lea rax, [rcx + rdi]
lea r8, [rcx + rsi]
cmp rsi, rax
ja 0x140127e31
cmp r8, rdi
jae 0x140127e8b
mov eax, ebx
and eax, 0x8000001f
jge 0x140127e41
dec eax
or eax, 0xffffffe0
inc eax
mov r8d, ebx
sub r8d, eax
nop word [rax + rax]
movsxd rax, edx
add r9, 0x20
movdqu xmm0, xmmword [rax + rsi]
movdqu xmm1, xmmword [rax + rdi]
pxor xmm1, xmm0
movdqu xmmword [rax + rsi], xmm1
lea eax, [rdx + 0x10]
add edx, 0x20
movsxd rcx, eax
movdqu xmm1, xmmword [rcx + rdi]
movdqu xmm0, xmmword [rcx + rsi]
pxor xmm1, xmm0
movdqu xmmword [rcx + rsi], xmm1
cmp edx, r8d
jl 0x140127e50
xor r8d, r8d
cmp r9, rbx
jge 0x140127ec4
mov r8, rdi
mov rdx, rbx
lea rax, [r9 + rsi]
sub r8, rsi
sub rdx, r9
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r8 + rax]
lea rax, [rax + 1]
xor byte [rax - 1], cl
dec rdx
jne 0x140127eb0
xor r8d, r8d
inc rbp
add r14, 4
add r15, 8
jmp 0x140127d46
mov edx, 0x11c
lea r9, [0x140287c78]
mov ecx, setsockopt
lea r8d, [rdx + 0x2a]
mov dword [rsp + 0x20], 0x114
call fcn.1400d9be0
xor r8d, r8d
mov eax, r8d
jmp 0x140127f03
mov eax, 1
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14012f540
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov eax, dword [rcx]
mov r11, rcx
lea ebx, [r9 + 1]
cmp eax, 0x302
jge 0x14012f562
cmp eax, 0x100
je 0x14012f562
cmp ebx, dword [rdx + 4]
jbe 0x14012f57e
xor eax, eax
pop rbx
ret
mov ecx, dword [rdx + 4]
lea eax, [rbx + r8]
cmp eax, ecx
ja 0x14012f55e
mov eax, r8d
add qword [rdx + 0x10], rax
add qword [rdx + 0x18], rax
sub ecx, r8d
mov dword [rdx + 4], ecx
mov ecx, dword [rdx + 4]
mov rax, qword [rdx + 0x10]
or r10d, 0xffffffff
dec ecx
test dword [r11 + 0x19c], 0x200
movzx r8d, byte [rcx + rax]
je 0x14012f5d8
cmp qword [r11 + 0xe0], 0
jne 0x14012f5d8
mov rcx, qword [r11 + 0x80]
mov rax, qword [rcx + 8]
cmp rax, qword [0x1402dddd8]
jne 0x14012f5c4
test r8b, 1
jne 0x14012f5c4
or dword [rcx], 8
mov rax, qword [r11 + 0x80]
test byte [rax], 8
je 0x14012f5d8
test r8d, r8d
je 0x14012f5d8
add r8d, r10d
mov rax, qword [r11 + 0xd0]
mov rcx, qword [rax]
test dword [rcx + 0x10], 0x200000
je 0x14012f5f9
sub r10d, r8d
mov eax, 1
add dword [rdx + 4], r10d
pop rbx
ret
mov qword [rsp + 0x18], rsi
mov esi, 0xff
mov qword [rsp + 0x20], rdi
mov edi, dword [rdx + 4]
mov r9d, edi
sub r9d, r8d
lea eax, [rdi - 1]
sub r9d, ebx
not r9d
sar r9d, 0x1f
cmp eax, esi
cmovb esi, eax
xor r11d, r11d
test esi, esi
je 0x14012f66f
mov qword [rsp + 0x10], rbp
mov rbp, qword [rdx + 0x10]
mov ebx, r8d
nop word [rax + rax]
mov eax, edi
sub eax, r11d
inc r11d
dec eax
movzx ecx, byte [rax + rbp]
mov eax, ebx
add ebx, r10d
xor ecx, r8d
not eax
sar eax, 0x1f
movzx eax, al
and ecx, eax
not ecx
and r9d, ecx
cmp r11d, esi
jb 0x14012f640
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov eax, r9d
shr eax, 4
and r9d, eax
mov eax, r9d
shr eax, 2
and r9d, eax
lea eax, [r8 + 1]
lea ecx, [r9 + r9]
and ecx, r9d
shl ecx, 0x1e
sar ecx, 0x1f
and eax, ecx
sub edi, eax
shl eax, 8
or dword [rdx], eax
mov eax, ecx
not ecx
and eax, 1
mov dword [rdx + 4], edi
mov rdi, qword [rsp + 0x20]
or eax, ecx
pop rbx
ret
Function at 0x14012f6c0
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0xe0
mov rax, qword [0x1402581e0]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rsi, rcx
mov qword [rsp + 0x30], rcx
mov ecx, dword [rdx + 4]
xor r12d, r12d
sub ecx, r8d
mov r13d, r9d
mov edi, r8d
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], ecx
mov r14d, r12d
cmp r9d, r8d
jb 0x14012f876
cmp edi, 0x40
ja 0x14012f83f
mov qword [r11 + 0x10], rbx
mov qword [r11 - 0x30], rbp
lea rax, [rsp + 0x40]
neg rax
lea rbp, [rsp + 0x40]
mov qword [r11 - 0x38], r15
and eax, 0x3f
add rbp, rax
lea eax, [rdi + 0x100]
cmp r9d, eax
jbe 0x14012f750
mov r14d, r9d
sub r14d, edi
sub r14d, 0x100
xor edx, edx
mov eax, edi
mov r8, rdi
and eax, 0xfffffffe
mov r15, rdi
shl eax, 0x17
sub eax, r14d
add eax, ecx
mov rcx, rbp
div edi
mov ebx, edx
xor edx, edx
call sub.MSVCR120.dll_memset
cmp r14d, r13d
jae 0x14012f7dc
mov rax, qword [rsp + 0x28]
mov r8d, r14d
mov r9d, r14d
mov esi, dword [rax + 4]
add r9, qword [rax + 0x10]
sub r8d, esi
sub esi, dword [rsp + 0x20]
sub r13d, r14d
mov r10d, r13d
nop word [rax + rax]
mov ecx, r8d
lea edx, [rsi + r8]
inc r8d
not ecx
not edx
lea r9, [r9 + 1]
sar ecx, 0x1f
sar edx, 0x1f
not cl
and cl, byte [r9 - 1]
and cl, dl
or byte [r12 + rbp], cl
inc r12d
mov eax, r12d
sub eax, edi
sar eax, 0x1f
and r12d, eax
dec r10
jne 0x14012f7a0
mov rsi, qword [rsp + 0x30]
test edi, edi
je 0x14012f807
mov eax, ebx
mov ecx, ebx
inc ebx
xor rax, 0x20
lea rsi, [rsi + 1]
movzx eax, byte [rax + rbp]
movzx eax, byte [rcx + rbp]
mov byte [rsi - 1], al
mov eax, ebx
sub eax, edi
sar eax, 0x1f
and ebx, eax
dec r15
jne 0x14012f7e0
mov rbp, qword [rsp + 0xd8]
mov rbx, qword [rsp + 0x118]
mov r15, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1401bddc0
add rsp, 0xe0
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
lea r9, [0x14028a668]
lea rdx, [0x14028a6e0]
lea rcx, str._s__d_:_OpenSSL_internal_error__assertion_failed:__s_n
mov r8d, 0x114
call fcn.1400f6440
mov ecx, reloc.WS2_32.dll_shutdown
call qword [sym.imp.MSVCR120.dll_raise]
mov ecx, 3
call qword [sym.imp.MSVCR120.dll__exit]
int3
lea r9, str.orig_len___md_size
lea rdx, [0x14028a688]
lea rcx, str._s__d_:_OpenSSL_internal_error__assertion_failed:__s_n
mov r8d, 0x113
call fcn.1400f6440
mov ecx, reloc.WS2_32.dll_shutdown
call qword [sym.imp.MSVCR120.dll_raise]
mov ecx, 3
call qword [sym.imp.MSVCR120.dll__exit]
int3
Function at 0x140131280
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub rsp, 0x28
cmp dword [reloc.WS2_32.dll_accept], 0
je 0x1401312d0
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x1401312a4
mov dword [reloc.WS2_32.dll_accept], eax
jmp 0x1401312d0
call fcn.1400d8c40
test rax, rax
je 0x1401312c7
mov r8, qword [rax + 0x18]
test r8, r8
je 0x1401312c7
xorps xmm2, xmm2
lea rcx, [rsp + 0x38]
mov edx, 8
call r8
cmp dword [reloc.WS2_32.dll_accept], 0
jne 0x1401312fd
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x30], eax
call fcn.1400d8c40
test rax, rax
je 0x1401312fd
mov r8, qword [rax + 0x18]
test r8, r8
je 0x1401312fd
xorps xmm2, xmm2
lea rcx, [rsp + 0x30]
mov edx, 4
call r8
add rsp, 0x28
ret

Function at 0x140146910
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
test r8, r8
jne 0x14014693f
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
test rcx, rcx
je 0x1401469d4
test rdx, rdx
je 0x140146998
mov rcx, qword [rcx + 0x10]
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x28], r8
call fcn.1400f3b50
test rax, rax
jne 0x1401469c0
lea rdx, [0x1402614d4]
sub rdx, rbx
movzx ecx, byte [rbx]
movzx eax, byte [rbx + rdx]
sub ecx, eax
jne 0x140146986
inc rbx
test eax, eax
jne 0x140146974
test ecx, ecx
jne 0x140146998
mov rcx, rdi
call qword [sym.imp.MSVCR120.dll_getenv]
test rax, rax
jne 0x1401469dd
mov rcx, qword [rsi + 0x10]
lea rax, [0x140291388]
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rdi
call fcn.1400f3b50
test rax, rax
je 0x14014692d
mov rax, qword [rax + 0x10]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov rcx, r8
call qword [sym.imp.MSVCR120.dll_getenv]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x14014fb80
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x1402581e0]
xor rax, rsp
mov qword [rsp + 0x38], rax
movzx edi, byte [rcx]
mov r12, qword [rcx + 0x28]
mov r13, qword [rcx + 0x30]
mov rbp, r9
mov r15, r8
mov r14, rdx
mov rbx, rcx
mov byte [rsp + 0x20], dil
test dil, 0x40
jne 0x14014fbcf
lea rdx, [rcx + 0x10]
mov r8, r13
call r12
movzx eax, dil
mov edi, reloc.WS2_32.dll_ntohs
xor esi, esi
and eax, 7
mov r8d, edi
mov ecx, esi
sub r8d, eax
mov byte [rbx], al
mov dword [rsp + 0x24], r8d
cmp r8d, edi
jae 0x14014fc16
mov edx, r8d
add rdx, rbx
sub edi, r8d
nop word [rax + rax]
movzx eax, byte [rdx]
mov byte [rdx], sil
lea rdx, [rdx + 1]
or rcx, rax
shl rcx, 8
dec rdi
jne 0x14014fc00
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0xf], 1
or rcx, rax
cmp rcx, rbp
je 0x14014fc2e
or eax, 0xffffffff
jmp 0x14014fd2b
cmp rbp, 0x10
jb 0x14014fc9c
mov rsi, rbp
shr rsi, 4
imul rax, rsi, 0xfffffffffffffff0
add rbp, rax
lea rdx, [rsp + 0x28]
mov r8, r13
mov rcx, rbx
call r12
mov eax, 8
dec eax
inc byte [rax + rbx + 8]
jne 0x14014fc61
test eax, eax
jne 0x14014fc55
mov rax, qword [r14]
lea rdx, [rbx + 0x10]
lea rcx, [rbx + 0x10]
xor rax, qword [rsp + 0x28]
mov r8, r13
mov qword [r15], rax
xor qword [rbx + 0x10], rax
mov rax, qword [r14 + 8]
xor rax, qword [rsp + 0x30]
mov qword [r15 + 8], rax
xor qword [rbx + 0x18], rax
call r12
add r14, 0x10
add r15, 0x10
dec rsi
jne 0x14014fc42
test rbp, rbp
je 0x14014fcea
lea rdx, [rsp + 0x28]
mov r8, r13
mov rcx, rbx
call r12
test rbp, rbp
je 0x14014fcdd
mov rdx, rsi
nop word [rax + rax]
movzx ecx, byte [rdx + r14]
movzx eax, byte [rsp + rdx + 0x28]
inc esi
xor ecx, eax
mov byte [rdx + r15], cl
xor byte [rdx + rbx + 0x10], cl
mov edx, esi
cmp rdx, rbp
jb 0x14014fcc0
lea rcx, [rbx + 0x10]
mov r8, r13
mov rdx, rcx
call r12
mov edx, dword [rsp + 0x24]
cmp edx, 0x10
jae 0x14014fd02
mov ecx, reloc.WS2_32.dll_recv
lea rdi, [rbx + rdx]
sub ecx, edx
xor eax, eax
rep stosb byte [rdi], al
lea rdx, [rsp + 0x28]
mov r8, r13
mov rcx, rbx
call r12
mov rax, qword [rsp + 0x28]
xor qword [rbx + 0x10], rax
mov rax, qword [rsp + 0x30]
xor qword [rbx + 0x18], rax
movzx eax, byte [rsp + 0x20]
mov byte [rbx], al
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1401bddc0
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140150040
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x68
mov rax, qword [0x1402581e0]
xor rax, rsp
mov qword [rsp + 0x58], rax
movzx edi, byte [rcx]
mov r10, qword [rsp + 0xd0]
mov rax, qword [rcx + 0x28]
mov r15, qword [rcx + 0x30]
mov rbp, r9
mov r13, r8
mov r12, rdx
mov rbx, rcx
mov qword [rsp + 0x40], r10
mov byte [rsp + 0x30], dil
mov qword [rsp + 0x38], rax
test dil, 0x40
jne 0x1401500a2
lea rdx, [rcx + 0x10]
mov r8, r15
call rax
mov r10, qword [rsp + 0x40]
movzx eax, dil
mov edi, reloc.WS2_32.dll_ntohs
xor esi, esi
and eax, 7
mov r14d, edi
mov ecx, esi
sub r14d, eax
mov byte [rbx], al
cmp r14d, edi
jae 0x1401500e6
mov edx, r14d
add rdx, rbx
sub edi, r14d
nop dword [rax + rax]
movzx eax, byte [rdx]
mov byte [rdx], sil
lea rdx, [rdx + 1]
or rcx, rax
shl rcx, 8
dec rdi
jne 0x1401500d0
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0xf], 1
or rcx, rax
cmp rcx, rbp
je 0x1401500fe
or eax, 0xffffffff
jmp 0x14015020b
mov rdi, rbp
shr rdi, 4
test rdi, rdi
je 0x140150181
lea rax, [rbx + 0x10]
mov r9, r15
mov r8, rdi
mov qword [rsp + 0x28], rax
mov rdx, r13
mov rcx, r12
mov qword [rsp + 0x20], rbx
call r10
shl rdi, 4
add r12, rdi
add r13, rdi
sub rbp, rdi
je 0x1401501c9
lea r9, [rbx + 8]
shr rdi, 4
mov rdx, rsi
lea r8, [r9 + 8]
neg r9
nop dword [rax]
movzx eax, byte [r8 - 1]
lea r8, [r8 - 1]
movzx ecx, dil
add rdx, rax
lea rax, [r9 + r8]
shr rdi, 8
add rdx, rcx
mov byte [r8], dl
shr rdx, 8
test rax, rax
je 0x140150181
test rdi, rdi
jne 0x140150150
test rdx, rdx
jne 0x140150150
test rbp, rbp
je 0x1401501c9
mov rdi, qword [rsp + 0x38]
lea rdx, [rsp + 0x48]
mov r8, r15
mov rcx, rbx
call rdi
test rbp, rbp
je 0x1401501bd
mov rdx, rsi
movzx ecx, byte [rdx + r12]
movzx eax, byte [rsp + rdx + 0x48]
inc esi
xor ecx, eax
mov byte [rdx + r13], cl
xor byte [rdx + rbx + 0x10], cl
mov edx, esi
cmp rdx, rbp
jb 0x1401501a0
lea rcx, [rbx + 0x10]
mov r8, r15
mov rdx, rcx
call rdi
cmp r14d, 0x10
jae 0x1401501e1
mov ecx, reloc.WS2_32.dll_recv
mov edi, r14d
sub ecx, r14d
add rdi, rbx
xor eax, eax
rep stosb byte [rdi], al
lea rdx, [rsp + 0x48]
mov r8, r15
mov rcx, rbx
call qword [rsp + 0x38]
mov rax, qword [rsp + 0x48]
xor qword [rbx + 0x10], rax
mov rax, qword [rsp + 0x50]
xor qword [rbx + 0x18], rax
movzx eax, byte [rsp + 0x30]
mov byte [rbx], al
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1401bddc0
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140150580
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
push r13
push r14
sub rsp, 0x20
mov r13, qword [rcx + 0x160]
xor r14d, r14d
mov rsi, r8
mov qword [rcx], r14
mov qword [rcx + 8], r14
mov qword [rcx + 0x40], r14
mov qword [rcx + 0x48], r14
mov qword [rcx + 0x30], r14
mov qword [rcx + 0x38], r14
mov qword [rcx + 0x170], r14
mov rdi, rdx
mov rbx, rcx
cmp r8, 0xc
jne 0x1401505de
movsd xmm0, qword [rdx]
lea edi, [r8 - 0xb]
movsd qword [rcx], xmm0
mov eax, dword [rdx + 8]
mov dword [rcx + 8], eax
mov byte [rcx + 0xf], 1
jmp 0x140150759
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x50], r8
mov rbp, r8
cmp r8, 0x10
jb 0x140150692
mov qword [rsp + 0x60], r12
shr rbp, 4
mov r12, rcx
mov qword [rsp + 0x68], r15
neg r12
lea r15, [rcx + 0xf]
imul rax, rbp, 0xfffffffffffffff0
add rsi, rax
nop dword [rax]
nop dword [rax + rax]
lea r8, [r12 + rdi]
lea rax, [r8 + r15]
cmp rbx, rax
ja 0x140150660
cmp r15, rdi
jb 0x140150660
mov rax, rbx
mov edx, reloc.WS2_32.dll_recv
nop word [rax + rax]
movzx ecx, byte [r8 + rax]
lea rax, [rax + 1]
xor byte [rax - 1], cl
dec rdx
jne 0x140150640
jmp 0x140150670
movdqu xmm1, xmmword [rbx]
movdqu xmm0, xmmword [rdi]
pxor xmm1, xmm0
movdqu xmmword [rbx], xmm1
lea rdx, [rbx + 0x60]
mov rcx, rbx
call r13
add rdi, 0x10
dec rbp
jne 0x140150620
mov rbp, qword [rsp + 0x50]
mov r15, qword [rsp + 0x68]
mov r12, qword [rsp + 0x60]
test rsi, rsi
je 0x14015073a
cmp rsi, 0x20
jb 0x140150703
lea rax, [rdi - 1]
lea rcx, [rbx - 1]
add rax, rsi
add rcx, rsi
cmp rbx, rax
ja 0x1401506b9
cmp rcx, rdi
jae 0x140150703
mov rax, rsi
mov rdx, rsi
mov rcx, rdi
and eax, 0x1f
sub rdx, rax
mov rax, rbx
sub rcx, rbx
nop
movdqu xmm0, xmmword [rax]
movdqu xmm1, xmmword [rax + rcx]
add r14, 0x20
lea rax, [rax + 0x20]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x20], xmm1
movdqu xmm1, xmmword [rcx + rax - 0x10]
movdqu xmm0, xmmword [rax - 0x10]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x10], xmm1
cmp r14, rdx
jb 0x1401506d0
cmp r14, rsi
jae 0x140150730
sub rdi, rbx
lea rcx, [r14 + rbx]
sub rsi, r14
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rcx + rdi]
lea rcx, [rcx + 1]
xor byte [rcx - 1], al
dec rsi
jne 0x140150720
lea rdx, [rbx + 0x60]
mov rcx, rbx
call r13
shl rbp, 3
lea rdx, [rbx + 0x60]
mov rcx, rbx
bswap rbp
xor qword [rbx + 8], rbp
call r13
mov edi, dword [rbx + 0xc]
mov rbp, qword [rsp + 0x58]
bswap edi
mov r8, qword [rbx + 0x180]
lea rdx, [rbx + 0x20]
mov rcx, rbx
call qword [rbx + 0x178]
inc edi
bswap edi
mov dword [rbx + 0xc], edi
add rsp, 0x20
pop r14
pop r13
pop rdi
pop rsi
pop rbx
ret