joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14018ae70
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov ebx, dword [rcx + 0xb828]
mov r11, rdx
mov edx, dword [rcx + 0xb820]
xor r9d, r9d
mov r10d, edx
sub r10d, ebx
cmp dword [rcx + 0x72a0], 2
jne 0x14018aeb1
movsxd r8, dword [rcx + 0x6e38]
mov rax, qword [rcx + 0x6fb0]
cmp word [rax + r8*2], r9w
jne 0x14018aeb1
cmp edx, ebx
cmovg r10d, r9d
mov edx, 1
cmp dword [rcx + 0xb82c], r9d
je 0x14018aee5
movsxd r8, dword [rcx + 0x6f50]
mov rax, qword [rcx + 0x6f98]
cmp byte [r8 + rax], 2
je 0x14018aee2
mov rax, qword [rcx + 0x6fb0]
test byte [rax + r8*2], 0x3f
je 0x14018aee5
mov r9d, edx
lea rbx, [0x140000000]
test r10d, r10d
je 0x14018af55
lea r8d, [r10 + r10]
sub edx, r8d
cmovns r8d, edx
dec r8d
cmp r8d, 0x3f
jl 0x14018af16
cmp r8d, 0x40
je 0x14018af16
mov eax, reloc.WLDAP32.dll_Ordinal_127
sub eax, r8d
mov r8d, eax
movsxd rcx, r9d
sar r9d, 1
add r9d, 2
movzx edx, byte [rcx + r11 + 0x80]
movzx eax, byte [rbx + rdx*2 + 0x2fee31]
xor rdx, 1
mov byte [rcx + r11 + 0x80], al
movzx edx, word [rbx + rdx*2 + 0x2fef70]
add edx, dword [r11 + 0x40]
mov dword [r11 + 0x40], edx
sub r8d, 1
jne 0x14018af16
jmp 0x14018af59
mov edx, dword [r11 + 0x40]
movsxd rax, r9d
movzx ecx, byte [rax + r11 + 0x80]
movzx eax, word [rbx + rcx*2 + 0x2fef70]
mov rbx, qword [rsp + 8]
add eax, edx
mov dword [r11 + 0x40], eax
ret

Function at 0x14018af80
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
movsxd rax, r9d
lea rbx, [0x140000000]
mov r10, rdx
mov rdx, rcx
movzx ecx, byte [rax + rbx + 0x326670]
movsxd rax, r8d
lea r8, [rax + rax*4]
xor eax, eax
lea r9, [r8*8]
lea r8, [r9 + rcx]
cmp byte [r8 + rdx + 0xb55f], al
jle 0x14018afcd
cmp byte [rcx + rdx + 0xb78f], al
mov r11d, 1
cmove eax, r11d
cmp byte [r8 + rdx + 0xb558], 0
jle 0x14018afe5
cmp byte [rcx + rdx + 0xb788], 0
jne 0x14018afe5
add eax, 2
add rcx, r9
movsx r9d, byte [rcx + rdx + 0xb560]
test r9d, r9d
jle 0x14018b036
nop word [rax + rax]
movsxd rdx, eax
dec r9d
sar eax, 2
add eax, 4
movzx r8d, byte [rdx + r10 + 0x7a]
movzx ecx, byte [rbx + r8*2 + 0x2fee31]
xor r8, 1
mov byte [rdx + r10 + 0x7a], cl
movzx ecx, word [rbx + r8*2 + 0x2fef70]
add dword [r10 + 0x40], ecx
test r9d, r9d
jg 0x14018b000
movsxd rcx, eax
movzx edx, byte [rcx + r10 + 0x7a]
movzx eax, byte [rbx + rdx*2 + 0x2fee30]
mov byte [rcx + r10 + 0x7a], al
movzx eax, word [rbx + rdx*2 + 0x2fef70]
add dword [r10 + 0x40], eax
mov rbx, qword [rsp + 8]
ret
Function at 0x14018b060
Capabilities:
Encode data using xor

Disassembly:
movsxd rax, r8d
lea r11, [0x140000000]
mov r9, rdx
movzx r8d, byte [rax + r11 + 0x326670]
add r8, rcx
xor ecx, ecx
cmp byte [r8 + 0xb55f], cl
movsx r10d, byte [r8 + 0xb560]
setg cl
cmp byte [r8 + 0xb558], 0
lea eax, [rcx + 2]
cmovle eax, ecx
test r10d, r10d
jle 0x14018b0d6
movsxd rdx, eax
dec r10d
sar eax, 2
add eax, 4
movzx r8d, byte [rdx + r9 + 0x7a]
movzx ecx, byte [r11 + r8*2 + 0x2fee31]
xor r8, 1
mov byte [rdx + r9 + 0x7a], cl
movzx ecx, word [r11 + r8*2 + 0x2fef70]
add dword [r9 + 0x40], ecx
test r10d, r10d
jg 0x14018b0a0
movsxd rcx, eax
movzx edx, byte [rcx + r9 + 0x7a]
movzx eax, byte [r11 + rdx*2 + 0x2fee30]
mov byte [rcx + r9 + 0x7a], al
movzx eax, word [r11 + rdx*2 + 0x2fef70]
add dword [r9 + 0x40], eax
ret
Function at 0x14019e5e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rsi
push rdi
push r13
sub rsp, 0x28
mov rdi, rdx
movsxd rsi, r8d
lea r13, [0x140000000]
mov rbx, rcx
lea eax, [rsi*4]
movsxd r10, eax
movzx r11d, byte [r10 + r13 + 0x326670]
movsx rax, byte [r11 + rcx + 0xb4bf]
movzx edx, byte [rax + r13 + 0x3267d1]
movsx rax, byte [r11 + rcx + 0xb4b8]
movzx ecx, byte [rax + r13 + 0x3267d1]
mov eax, 2
cmp dl, cl
cmovge edx, ecx
mov rcx, rdi
movsx edx, dl
test edx, edx
cmovs edx, eax
movsxd rax, r9d
movsx r8d, byte [rax + r13 + 0x3267d1]
call fcn.14011c3f0
mov rdx, rdi
mov rcx, rbx
call fcn.14018a640
mov eax, dword [rbx + 0x72b0]
bt eax, esi
jae 0x14019e7a7
cmp dword [rbx + 0x3318], 3
mov rcx, rsi
jne 0x14019e787
mov qword [rsp + 0x50], rbp
lea rbp, [0x140326acf]
mov qword [rsp + 0x58], r12
lea r12, [rdi + 0x44]
mov qword [rsp + 0x60], r14
lea r14, [r13 + 0x326670]
lea r14, [r14 + rsi*4]
mov qword [rsp + 0x20], r15
add rsi, 0x56
mov r15d, 3
shl rsi, 8
add rsi, rbx
nop dword [rax]
movzx eax, byte [r14]
movzx r10d, byte [rbp]
lea r8, [rax + rbx]
movzx eax, byte [rax + rbx + 0xb4e0]
movzx ecx, word [r13 + r10*2 + 0x326c48]
neg al
sbb rdx, rdx
xor eax, eax
and edx, 2
add rcx, r12
cmp byte [r8 + 0xb4e7], al
setne al
add rdx, rcx
add rdx, rax
cmp byte [r8 + 0xb4e8], 0
movzx eax, byte [rdx]
je 0x14019e73a
movzx ecx, byte [r13 + rax*2 + 0x2fee31]
mov r9, rdi
mov byte [rdx], cl
xor rax, 1
mov r8d, r10d
movzx ecx, word [r13 + rax*2 + 0x2fef70]
add dword [rdi + 0x40], ecx
mov rcx, rsi
mov edx, dword [rbx + 0x6e64]
call qword [rbx + 0xe468]
jmp 0x14019e751
movzx ecx, byte [r13 + rax*2 + 0x2fee30]
mov byte [rdx], cl
movzx ecx, word [r13 + rax*2 + 0x2fef70]
add dword [rdi + 0x40], ecx
add rsi, 0x400
add r14, 0x10
inc rbp
sub r15, 1
jne 0x14019e6c0
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x60]
mov r12, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
add rsp, 0x28
pop r13
pop rdi
pop rsi
pop rbx
ret
mov edx, dword [rbx + 0x6e64]
add rcx, 0x56
shl rcx, 8
mov r9, rdi
add rcx, rbx
mov r8d, 5
call qword [rbx + 0xe468]
add rsp, 0x28
pop r13
pop rdi
pop rsi
pop rbx
ret
Function at 0x1401a9740
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
push r15
xor esi, esi
lea r11, [0x140414c80]
mov ebx, esi
lea r10, [0x140415b80]
mov edi, esi
lea r14, [0x140000000]
mov ebp, 0x100
lea r15, [0x140416300]
nop
mov r9d, esi
mov eax, esi
movzx edx, r9b
cmp ebx, 1
jle 0x1401a97c1
lea r8d, [rbx - 1]
nop dword [rax]
nop word [rax + rax]
movzx ecx, dl
movzx edx, byte [r14 + rcx*2 + 0x2fee31]
xor rcx, 1
movzx ecx, word [r14 + rcx*2 + 0x2fef70]
add eax, ecx
sub r8, 1
jne 0x1401a97a0
lea rcx, [rdi - 1]
cmp rcx, 0xc
ja 0x1401a97e2
movzx ecx, dl
movzx edx, byte [r14 + rcx*2 + 0x2fee30]
movzx ecx, word [r14 + rcx*2 + 0x2fef70]
add eax, ecx
add ax, bp
mov byte [r10], dl
mov word [r11], ax
inc r9d
add r11, 2
inc r10
cmp r9d, 0x80
jl 0x1401a9783
inc ebx
inc rdi
cmp r10, r15
jl 0x1401a9780
lea rbx, [0x140410850]
lea rdi, [0x1404108d0]
nop dword [rax + rax]
movzx r11d, sil
lea rdi, [rdi + 2]
inc esi
lea rbx, [rbx + 1]
movzx r10d, byte [r14 + r11*2 + 0x2fee31]
xor r11, 1
movzx r8d, byte [r14 + r10*2 + 0x2fee31]
xor r10, 1
movzx ecx, byte [r14 + r8*2 + 0x2fee31]
xor r8, 1
movzx eax, byte [r14 + rcx*2 + 0x2fee31]
xor rcx, 1
movzx r9d, byte [r14 + rax*2 + 0x2fee31]
xor rax, 1
mov byte [rbx - 1], r9b
movzx edx, word [r14 + rax*2 + 0x2fef70]
add dx, word [r14 + rcx*2 + 0x2fef70]
add dx, word [r14 + r8*2 + 0x2fef70]
add dx, word [r14 + r10*2 + 0x2fef70]
add dx, word [r14 + r11*2 + 0x2fef70]
add dx, bp
mov word [rdi - 2], dx
cmp esi, 0x80
jl 0x1401a9820
mov rbx, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
pop r15
pop r14
ret
Function at 0x1401b0f10
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
movsxd rax, dword [rdx + 0x68]
mov rsi, rdx
mov rbx, qword [rcx + 0xbec0]
mov rdi, rcx
imul r9, rax, 0xc8
mov rax, qword [rbx + 0x138]
cmp dword [r9 + rax + 8], 0
movzx ebp, byte [r9 + rax]
je 0x1401b1113
mov eax, dword [rbx + 0x1d0]
test eax, eax
jns 0x1401b1011
mov r9, qword [rbx + 0x128]
lea rcx, [rsp + 0x40]
mov edx, 1
inc eax
mov r8d, edx
mov dword [rbx + 0x1d0], eax
call fcn.14027efc0
test rax, rax
je 0x1401b0ff6
movsxd rcx, dword [rbx + 0x1d0]
mov edx, 2
movsxd r8, dword [rbx + 0x1d4]
mov r9, qword [rbx + 0x128]
mov rcx, qword [rbx + rcx*8 + 0x1c0]
call fcn.14027efc0
mov ecx, dword [rbx + 0x1d4]
cmp rax, rcx
jne 0x1401b0ff6
movzx ecx, byte [rsp + 0x40]
cmp cl, bpl
je 0x1401b1011
mov eax, dword [rbx + 0x1d0]
cmp eax, 1
jne 0x1401b0f62
movzx eax, bpl
lea r8, str.MB_tree_frametype__d_doesnt_match_actual_frametype__d._n
movzx r9d, cl
xor edx, edx
mov rcx, rdi
mov dword [rsp + 0x20], eax
call fcn.14010dde0
mov eax, 0xffffffff
jmp 0x1401b111a
lea r8, str.Incomplete_MB_tree_stats_file._n
xor edx, edx
mov rcx, rdi
call fcn.14010dde0
mov eax, 0xffffffff
jmp 0x1401b111a
cmp dword [rbx + 0x1d8], 0
je 0x1401b1023
mov rcx, qword [rbx + 0x1e0]
jmp 0x1401b102a
mov rcx, qword [rsi + 0x3090]
movsxd rdx, dword [rbx + 0x1d0]
mov r8d, dword [rbx + 0x1d4]
mov rdx, qword [rbx + rdx*8 + 0x1c0]
call qword [rdi + 0xe0e0]
cmp dword [rbx + 0x1d8], 0
je 0x1401b1061
mov r8, qword [rsi + 0x3090]
mov rdx, rbx
mov rcx, rdi
call fcn.1401ae960
cmp dword [rdi + 0x5388], 0
je 0x1401b110b
xor r8d, r8d
cmp dword [rdi + 0x6e08], r8d
jle 0x1401b110b
movss xmm2, dword [0x14031b5e4]
lea r11, [0x1402fc020]
movss xmm3, dword [0x14031b5f0]
xor r10d, r10d
xor r9d, r9d
nop dword [rax + rax]
mov rax, qword [rsi + 0x3090]
movaps xmm0, xmm3
movss xmm1, dword [rax + r9]
mulss xmm1, xmm2
subss xmm0, xmm1
cvttss2si ecx, xmm0
test ecx, ecx
jns 0x1401b10c4
xor edx, edx
jmp 0x1401b10eb
cmp ecx, 0x3ff
jle 0x1401b10d3
mov edx, 0xffff
jmp 0x1401b10eb
mov eax, ecx
sar ecx, 6
and eax, 0x3f
movzx edx, byte [rax + r11]
add edx, 0x100
shl edx, cl
sar edx, 8
mov rax, qword [rsi + 0x30b8]
inc r8d
add r9, 4
mov word [r10 + rax], dx
add r10, 2
cmp r8d, dword [rdi + 0x6e08]
jl 0x1401b10a0
dec dword [rbx + 0x1d0]
jmp 0x1401b1118
call fcn.1401b0730
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x1401bf600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x130
movsxd rax, dword [rcx + 0x6e64]
mov r8, rcx
shl rax, 5
mov rdi, rdx
lea rdx, [0x140000000]
xor r12d, r12d
mov r13, r9
mov esi, 0xffffffff
mov ebp, r12d
movzx ecx, word [rax + rdx + 0x2ff136]
movzx r15d, word [rax + rdx + 0x2ff176]
movzx eax, word [0x1402ff1b6]
mov dword [rsp + 0x188], ecx
mov rcx, r9
mov dword [rsp + 0x170], eax
call qword [r8 + 0xe298]
cdqe
lea r14, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov ebx, r12d
sub r14, 4
mov eax, dword [r13 + rbx*4]
lea rcx, [0x140000000]
movzx edx, byte [rbx + rcx + 0x2fc018]
add edx, dword [rsp + 0x188]
test eax, eax
je 0x1401bf6d3
add r14, 4
mov r8d, 1
mov rcx, rdi
inc esi
mov dword [r14], eax
call fcn.140003c40
cmp rbx, qword [rsp + 0x20]
je 0x1401bf7a8
lea rax, [0x140000000]
movzx edx, byte [rbx + rax + 0x2fc018]
add edx, r15d
xor r8d, r8d
mov rcx, rdi
call fcn.140003c40
inc ebp
inc rbx
cmp rbx, 7
jne 0x1401bf680
inc esi
movsxd rax, ebp
movsxd rdx, esi
mov ecx, dword [r13 + rax*4]
lea r13, [0x140000000]
mov dword [rsp + rdx*4 + 0x30], ecx
mov ebx, dword [rsp + 0x170]
movsxd r15, esi
nop dword [rax + rax]
mov r14d, dword [rsp + r15*4 + 0x30]
mov rcx, rdi
mov eax, r14d
sar r14d, 0x1f
cdq
mov ebp, eax
xor ebp, edx
sub ebp, edx
movzx edx, byte [r12 + r13 + 0x328e28]
add edx, ebx
cmp ebp, 1
jle 0x1401bf7ec
mov r8d, 1
call fcn.140003c40
movzx esi, byte [r12 + r13 + 0x328e38]
add esi, ebx
mov ebx, reloc.WS2_32.dll_ntohs
cmp ebp, ebx
cmovl ebx, ebp
sub ebx, 2
test ebx, ebx
jle 0x1401bf786
nop dword [rax]
nop word [rax + rax]
mov r8d, 1
mov edx, esi
mov rcx, rdi
call fcn.140003c40
dec ebx
test ebx, ebx
jg 0x1401bf770
mov rcx, rdi
cmp ebp, 0xf
jge 0x1401bf7d1
xor r8d, r8d
mov edx, esi
call fcn.140003c40
mov ebx, dword [rsp + 0x170]
lea rax, [0x140328e48]
jmp 0x1401bf7fb
movsxd rax, ebp
lea r13, [0x140000000]
mov r8d, 1
mov rcx, rdi
movzx edx, byte [rax + r13 + 0x2fc018]
add edx, r15d
call fcn.140003c40
jmp 0x1401bf701
lea r8d, [rbp - 0xf]
xor edx, edx
call fcn.140158e80
mov ebx, dword [rsp + 0x170]
lea rax, [0x140328e48]
jmp 0x1401bf7fb
xor r8d, r8d
call fcn.140003c40
lea rax, [0x140328e40]
movzx r12d, byte [r12 + rax]
mov edx, r14d
mov rcx, rdi
call fcn.140003cc0
sub r15, 1
jns 0x1401bf710
mov rbx, qword [rsp + 0x178]
add rsp, 0x130
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401e4e90
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov rax, rdx
mov rdx, rcx
mov rcx, rax
jmp 0x1401e51c0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
sub rsi, rcx
mov r9d, 4
nop dword [rax]
mov r8d, 4
nop word [rax + rax]
movzx eax, byte [rsi + rcx + 0xa0]
xor byte [rcx], al
inc rcx
sub r8, 1
jne 0x1401e5200
sub r9, 1
jne 0x1401e51f0
mov bpl, 9
lea rdi, [rsi + 0x90]
lea r14, [0x140333500]
nop word [rax + rax]
movzx eax, byte [rbx + 9]
mov r8, rbx
movzx ecx, byte [rbx + 0xd]
mov r9d, 4
mov byte [rbx + 0xd], al
movzx eax, byte [rbx + 5]
mov byte [rbx + 9], al
movzx eax, byte [rbx + 1]
mov byte [rbx + 5], al
movzx eax, byte [rbx + 0xa]
mov byte [rbx + 1], cl
movzx ecx, byte [rbx + 2]
mov byte [rbx + 2], al
movzx eax, byte [rbx + 0xe]
mov byte [rbx + 0xa], cl
movzx ecx, byte [rbx + 6]
mov byte [rbx + 6], al
movzx eax, byte [rbx + 7]
mov byte [rbx + 0xe], cl
movzx ecx, byte [rbx + 3]
mov byte [rbx + 3], al
movzx eax, byte [rbx + 0xb]
mov byte [rbx + 7], al
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0xb], al
mov byte [rbx + 0xf], cl
nop dword [rax]
mov rcx, r8
mov edx, 4
nop dword [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 4]
movzx eax, byte [rax + r14]
mov byte [rcx - 4], al
sub rdx, 1
jne 0x1401e52a0
inc r8
sub r9, 1
jne 0x1401e5290
mov rax, rbx
lea r8d, [rdx + 4]
nop word [rax + rax]
mov edx, 4
nop word [rax + rax]
movzx ecx, byte [rdi + rax]
xor byte [rax], cl
inc rax
sub rdx, 1
jne 0x1401e52e0
sub r8, 1
jne 0x1401e52d0
mov rcx, rbx
call fcn.1401e53e0
sub rdi, 0x10
add bpl, 0xff
jne 0x1401e5230
movzx eax, byte [rbx + 9]
mov r8, rbx
movzx ecx, byte [rbx + 0xd]
mov r9d, 4
mov byte [rbx + 0xd], al
movzx eax, byte [rbx + 5]
mov byte [rbx + 9], al
movzx eax, byte [rbx + 1]
mov byte [rbx + 5], al
movzx eax, byte [rbx + 0xa]
mov byte [rbx + 1], cl
movzx ecx, byte [rbx + 2]
mov byte [rbx + 2], al
movzx eax, byte [rbx + 0xe]
mov byte [rbx + 0xa], cl
movzx ecx, byte [rbx + 6]
mov byte [rbx + 6], al
movzx eax, byte [rbx + 7]
mov byte [rbx + 0xe], cl
movzx ecx, byte [rbx + 3]
mov byte [rbx + 3], al
movzx eax, byte [rbx + 0xb]
mov byte [rbx + 7], al
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0xb], al
mov byte [rbx + 0xf], cl
nop dword [rax + rax]
mov rcx, r8
mov edx, 4
nop dword [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 4]
movzx eax, byte [rax + r14]
mov byte [rcx - 4], al
sub rdx, 1
jne 0x1401e5380
inc r8
sub r9, 1
jne 0x1401e5370
lea edx, [r9 + 4]
mov ecx, 4
nop word [rax + rax]
movzx eax, byte [rbx + rsi]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x1401e53b0
sub rdx, 1
jne 0x1401e53a2
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1401e51c0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov rax, rdx
mov rdx, rcx
mov rcx, rax
jmp 0x1401e51c0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
sub rsi, rcx
mov r9d, 4
nop dword [rax]
mov r8d, 4
nop word [rax + rax]
movzx eax, byte [rsi + rcx + 0xa0]
xor byte [rcx], al
inc rcx
sub r8, 1
jne 0x1401e5200
sub r9, 1
jne 0x1401e51f0
mov bpl, 9
lea rdi, [rsi + 0x90]
lea r14, [0x140333500]
nop word [rax + rax]
movzx eax, byte [rbx + 9]
mov r8, rbx
movzx ecx, byte [rbx + 0xd]
mov r9d, 4
mov byte [rbx + 0xd], al
movzx eax, byte [rbx + 5]
mov byte [rbx + 9], al
movzx eax, byte [rbx + 1]
mov byte [rbx + 5], al
movzx eax, byte [rbx + 0xa]
mov byte [rbx + 1], cl
movzx ecx, byte [rbx + 2]
mov byte [rbx + 2], al
movzx eax, byte [rbx + 0xe]
mov byte [rbx + 0xa], cl
movzx ecx, byte [rbx + 6]
mov byte [rbx + 6], al
movzx eax, byte [rbx + 7]
mov byte [rbx + 0xe], cl
movzx ecx, byte [rbx + 3]
mov byte [rbx + 3], al
movzx eax, byte [rbx + 0xb]
mov byte [rbx + 7], al
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0xb], al
mov byte [rbx + 0xf], cl
nop dword [rax]
mov rcx, r8
mov edx, 4
nop dword [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 4]
movzx eax, byte [rax + r14]
mov byte [rcx - 4], al
sub rdx, 1
jne 0x1401e52a0
inc r8
sub r9, 1
jne 0x1401e5290
mov rax, rbx
lea r8d, [rdx + 4]
nop word [rax + rax]
mov edx, 4
nop word [rax + rax]
movzx ecx, byte [rdi + rax]
xor byte [rax], cl
inc rax
sub rdx, 1
jne 0x1401e52e0
sub r8, 1
jne 0x1401e52d0
mov rcx, rbx
call fcn.1401e53e0
sub rdi, 0x10
add bpl, 0xff
jne 0x1401e5230
movzx eax, byte [rbx + 9]
mov r8, rbx
movzx ecx, byte [rbx + 0xd]
mov r9d, 4
mov byte [rbx + 0xd], al
movzx eax, byte [rbx + 5]
mov byte [rbx + 9], al
movzx eax, byte [rbx + 1]
mov byte [rbx + 5], al
movzx eax, byte [rbx + 0xa]
mov byte [rbx + 1], cl
movzx ecx, byte [rbx + 2]
mov byte [rbx + 2], al
movzx eax, byte [rbx + 0xe]
mov byte [rbx + 0xa], cl
movzx ecx, byte [rbx + 6]
mov byte [rbx + 6], al
movzx eax, byte [rbx + 7]
mov byte [rbx + 0xe], cl
movzx ecx, byte [rbx + 3]
mov byte [rbx + 3], al
movzx eax, byte [rbx + 0xb]
mov byte [rbx + 7], al
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0xb], al
mov byte [rbx + 0xf], cl
nop dword [rax + rax]
mov rcx, r8
mov edx, 4
nop dword [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 4]
movzx eax, byte [rax + r14]
mov byte [rcx - 4], al
sub rdx, 1
jne 0x1401e5380
inc r8
sub r9, 1
jne 0x1401e5370
lea edx, [r9 + 4]
mov ecx, 4
nop word [rax + rax]
movzx eax, byte [rbx + rsi]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x1401e53b0
sub rdx, 1
jne 0x1401e53a2
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1401e53e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
lea rbp, [rcx + 2]
mov qword [rsp + 0x20], 4
mov qword [rsp + 0x18], rbp
nop word [rax + rax]
movzx r9d, byte [rbp - 1]
movzx edx, byte [rbp - 2]
movzx ebx, r9b
movzx r8d, byte [rbp]
movzx eax, dl
shr al, 7
add bl, bl
movzx ecx, byte [rbp + 1]
movzx eax, al
imul eax, eax, 0x1b
mov byte [rsp + 0x78], r9b
mov byte [rsp + 0x88], dl
add dl, dl
mov byte [rsp + 0x80], r8b
xor dl, al
mov dword [rsp + 8], eax
movzx eax, dl
movzx esi, dl
shr al, 7
add sil, sil
movzx eax, al
imul eax, eax, 0x1b
xor sil, al
mov dword [rsp + 4], eax
movzx eax, r9b
movzx r9d, r8b
shr al, 7
add r9b, r9b
movzx eax, al
imul r15d, eax, 0x1b
xor bl, r15b
movzx eax, bl
movzx r10d, bl
shr al, 7
add r10b, r10b
movzx eax, al
imul eax, eax, 0x1b
xor r10b, al
mov dword [rsp + 0x10], eax
movzx eax, r8b
shr al, 7
movzx eax, al
imul r12d, eax, 0x1b
xor r9b, r12b
mov dword [rsp + 0xc], r12d
movzx eax, r9b
movzx r8d, r9b
shr al, 7
xor r9b, dl
movzx eax, al
add r8b, r8b
imul ebp, eax, 0x1b
movzx eax, cl
shr al, 7
add cl, cl
movzx eax, al
imul eax, eax, 0x1b
xor r8b, bpl
xor cl, al
mov dword [rsp + 0x14], eax
movzx eax, cl
movzx r13d, cl
shr al, 7
add r13b, r13b
movzx eax, al
imul r14d, eax, 0x1b
xor r13b, r14b
xor r9b, r13b
movzx eax, r13b
shr al, 7
xor r9b, r8b
movzx eax, al
xor r9b, r10b
imul edi, eax, 0x1b
xor r9b, sil
movzx eax, r8b
mov byte [rsp], r9b
shr al, 7
movzx eax, al
imul r11d, eax, 0x1b
movzx eax, r10b
shr al, 7
xor r13b, cl
movzx eax, al
xor r13b, r8b
imul r9d, eax, 0x1b
xor r13b, r10b
mov r12, qword [rsp + 0x18]
xor r13b, bl
movzx ebx, byte [rsp + 0x80]
xor r13b, sil
mov rcx, qword [rsp + 0x18]
movzx eax, sil
shr al, 7
movzx esi, byte [rsp + 0x78]
mov r8d, dword [rsp + 0x10]
movzx r10d, byte [rcx + 1]
movzx eax, al
imul edx, eax, 0x1b
movzx eax, byte [rsp]
xor al, byte [rsp + 0x78]
xor al, byte [rsp + 0x88]
add al, al
xor al, dl
xor al, r9b
xor al, r11b
xor al, dil
xor al, bpl
xor al, r15b
xor al, byte [rsp + 4]
xor al, byte [rsp + 8]
xor al, byte [r12 + 1]
xor al, byte [rsp + 0x80]
xor al, byte [rsp + 0x78]
mov byte [r12 - 2], al
movzx eax, r13b
mov r12d, dword [rsp + 0xc]
xor al, bl
xor al, sil
xor r13b, r10b
add al, al
xor al, dl
xor al, r9b
xor al, r11b
xor al, dil
xor al, r14b
xor al, r12b
xor al, r8b
xor al, r15b
movzx r15d, byte [rsp + 0x88]
xor r13b, r15b
xor al, r10b
add r13b, r13b
xor al, bl
xor r13b, dl
xor al, r15b
mov byte [rcx - 1], al
xor r13b, r9b
mov eax, dword [rsp + 0x14]
xor r13b, r11b
movzx ecx, byte [rsp]
xor r13b, dil
xor cl, r10b
xor r13b, r14b
xor cl, bl
xor r13b, al
add cl, cl
xor r13b, r8b
xor cl, dl
xor cl, r9b
xor cl, r11b
xor cl, dil
xor cl, al
xor cl, bpl
mov rbp, qword [rsp + 0x18]
xor cl, r12b
xor cl, byte [rsp + 4]
xor cl, r10b
xor cl, sil
xor cl, r15b
xor r13b, byte [rsp + 8]
mov byte [rbp], cl
xor r13b, bl
xor r13b, sil
xor r13b, r15b
mov byte [rbp + 1], r13b
add rbp, 4
sub qword [rsp + 0x20], 1
mov qword [rsp + 0x18], rbp
jne 0x1401e5410
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401faae0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r9
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
cmp rcx, 0xffffffffffffffff
jne 0x1401fab22
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, gethostname
mov qword [rbx], 0
cmp eax, 0x2733
mov edx, 0x51
cmove ecx, edx
mov eax, ecx
add rsp, 0x20
pop rbx
ret
mov qword [rbx], rcx
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x1401facc0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x130
mov rax, qword [0x140398b38]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov rsi, qword [rsp + 0x190]
mov rbp, rcx
mov rcx, qword [rcx + 0x18]
mov r15, r8
movsxd r8, edx
mov r12, r9
mov rax, r8
shl rax, 5
lea rbx, [rcx + 0x230]
mov r14, qword [rcx + r8*8 + 0x1e8]
add rbx, rax
mov rax, qword [rcx + 0x418]
mov rdi, qword [rbx + 8]
sub rdi, qword [rbx + 0x10]
test byte [rax + 0x84], 3
je 0x1401fadcc
lea rax, [0x1401fab70]
cmp qword [rcx + r8*8 + 0x210], rax
jne 0x1401fadcc
cmp qword [rbx], 0
je 0x1401fad51
test rdi, rdi
je 0x1401fadcc
mov rdx, 0xffffffffffffffff
xor r9d, r9d
mov r8, rdx
mov rcx, r14
call fcn.14020b800
cmp eax, 0xffffffff
je 0x1401fadcc
test al, 1
je 0x1401fadcc
mov rcx, qword [rbx]
test rcx, rcx
jne 0x1401fadab
mov eax, dword [rbp + 0x71c]
add eax, eax
movsxd rcx, eax
mov qword [rbx + 8], rcx
call qword [fcn.14027b1c8]
mov qword [rbx], rax
mov rcx, rax
test rax, rax
je 0x1401fae06
mov rdi, qword [rbx + 8]
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0
mov rdx, qword [rbx + 0x10]
xor r9d, r9d
add rdx, rcx
mov r8d, edi
mov rcx, r14
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
test eax, eax
jle 0x1401fadcc
add qword [rbx + 0x10], rcx
xor r9d, r9d
mov r8d, r12d
mov rdx, r15
mov rcx, r14
call qword [sym.imp.WS2_32.dll_send]
movsxd rbx, eax
mov dword [rsi], 0
cmp rbx, 0xffffffffffffffff
jne 0x1401fae45
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
cmp eax, 0x2733
jne 0x1401fae15
xor ebx, ebx
mov dword [rsi], 0x51
jmp 0x1401fae45
mov dword [rsi], reloc.WLDAP32.dll_Ordinal_27
mov rax, 0xffffffffffffffff
jmp 0x1401fae48
mov r8d, 0x100
lea rdx, [rsp + 0x20]
mov ecx, edi
call fcn.14020ebb0
mov r8, rax
lea rdx, str.Send_failure:__s
mov rcx, rbp
call fcn.1401fa850
mov dword [rbp + 0xdd4], edi
mov dword [rsi], gethostname
mov rax, rbx
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.14025e930
add rsp, 0x130
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1401fb2d0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub rsp, 0x28
cmp byte [rcx + 0x280], 0
je 0x1401fb2ed
call fcn.1401f3d20
test eax, eax
jne 0x1401fb313
xor al, al
add rsp, 0x28
ret
mov rcx, qword [rcx + 0x1e8]
cmp rcx, 0xffffffffffffffff
je 0x1401fb2e6
mov r9d, 2
lea rdx, [rsp + 0x30]
lea r8d, [r9 - 1]
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x1401fb2e6
mov al, 1
add rsp, 0x28
ret