joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140224690
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rdi
mov eax, 0x80
call fcn.1402563a0
sub rsp, rax
mov rax, qword [0x1403bb2d8]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rbx, r8
mov rdi, rdx
mov rbp, rcx
test rdx, rdx
je 0x14022481c
test rbx, rbx
je 0x14022481c
mov rax, qword [rcx + 0x78]
mov qword [rsp + 0x78], rsi
test rax, rax
je 0x140224715
mov esi, reloc.WS2_32.dll_recv
sub rsi, rax
cmp rbx, rsi
jb 0x140224715
lea rcx, [rax + rcx + 0x64]
mov r8, rsi
call fcn.1402550b0
lea rdx, [rbp + 0x64]
mov rcx, rbp
call fcn.1402244a0
test eax, eax
je 0x1402247fb
sub rbx, rsi
mov qword [rbp + 0x78], 0
add rdi, rsi
mov qword [rsp + 0x70], r12
cmp rbx, 0x10
jb 0x1402247d4
lea r12, [rbp + 0x80]
nop dword [rax + rax]
cmp qword [rbp + 0x28], 0x10
mov rax, qword [rdi]
mov cl, 2
mov qword [rsp + 0x38], rax
mov rax, qword [rdi + 8]
mov qword [rsp + 0x40], rax
mov rax, qword [rdi]
mov qword [rsp + 0x48], rax
mov rax, qword [rdi + 8]
mov qword [rsp + 0x50], rax
je 0x14022476e
mov rax, qword [rdi]
mov cl, 3
mov qword [rsp + 0x58], rax
mov rax, qword [rdi + 8]
mov qword [rsp + 0x60], rax
movzx esi, cl
mov dword [rsp + 0x30], reloc.WS2_32.dll_recv
shl esi, 4
movsxd rdx, esi
test esi, esi
jle 0x1402247a0
lea r8, [rsp + 0x38]
mov rcx, r12
sub r8, r12
nop
movzx eax, byte [r8 + rcx]
inc rcx
xor byte [rcx - 1], al
dec rdx
jne 0x140224790
mov rcx, qword [rbp + 0x10]
lea r8, [rsp + 0x30]
mov r9, r12
mov rdx, r12
mov dword [rsp + 0x20], esi
call fcn.1400db810
test eax, eax
je 0x140224818
cmp dword [rsp + 0x30], esi
jne 0x140224818
sub rbx, 0x10
add rdi, 0x10
cmp rbx, 0x10
jae 0x140224730
test rbx, rbx
je 0x1402247f1
mov rax, qword [rbp + 0x78]
mov r8, rbx
mov rdx, rdi
lea rcx, [rax + rbp + 0x64]
call fcn.1402550b0
add qword [rbp + 0x78], rbx
mov eax, 1
mov r12, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140254f60
add rsp, 0x80
pop rdi
pop rbp
pop rbx
ret
xor eax, eax
jmp 0x1402247f6
mov eax, 1
jmp 0x140224800
Function at 0x140228fb0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push rbx
push r12
push r13
mov eax, gethostbyname
call fcn.1402563a0
sub rsp, rax
mov qword [rsp + 0x60], rdi
mov rdi, qword [rsp + 0x78]
mov qword [rsp + 0x28], r14
mov r12, rdx
mov qword [rsp + 0x20], r15
mov r13, r9
shl r12, 5
mov r14, rdx
mov rbx, rcx
mov r15, r8
test r12, r12
je 0x140229023
mov r10, r12
movzx eax, byte [rcx]
add rdi, 4
add rcx, 4
mov dword [rdi - 4], eax
movzx eax, byte [rcx - 3]
shl eax, 8
or dword [rdi - 4], eax
movzx eax, byte [rcx - 2]
shl eax, 0x10
or dword [rdi - 4], eax
movzx eax, byte [rcx - 1]
shl eax, 0x18
or dword [rdi - 4], eax
dec r10
jne 0x140228ff2
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rsi
cmp r8, 1
jbe 0x140229059
mov rsi, rdx
lea rbp, [r8 - 1]
shl rsi, 7
nop
mov rdx, rdi
mov r8, r14
mov rcx, rdi
sub rdx, rsi
call fcn.140228ba0
add rdi, rsi
dec rbp
jne 0x140229040
lea rdx, [r15 - 1]
mov r8, r14
mov rcx, r13
imul rdx, r14
shl rdx, 7
add rdx, qword [rsp + 0x78]
call fcn.140228ba0
test r15, r15
je 0x1402290eb
mov rdi, qword [rsp + 0x70]
mov rbp, r14
mov rsi, r15
shl rbp, 7
nop dword [rax]
mov eax, dword [r13 + rbp - 0x40]
xor edx, edx
div r15
mov r8d, edx
imul r8, r14
shl r8, 7
add r8, qword [rsp + 0x78]
test r12, r12
je 0x1402290d8
mov r9, r13
mov rcx, rdi
mov rdx, r12
sub r9, rdi
nop dword [rax + rax]
mov eax, dword [r9 + rcx]
add rcx, 4
add r8, 4
xor eax, dword [r8 - 4]
dec rdx
mov dword [rcx - 4], eax
jne 0x1402290c0
mov r8, r14
mov rdx, rdi
mov rcx, r13
call fcn.140228ba0
dec rsi
jne 0x140229090
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
xor edx, edx
test r12, r12
je 0x14022913a
nop dword [rax + rax]
mov ecx, dword [r13 + rdx*4]
inc rdx
add rbx, 4
mov byte [rbx - 4], cl
mov eax, ecx
shr eax, 8
mov byte [rbx - 3], al
mov eax, ecx
shr ecx, 0x18
shr eax, 0x10
mov byte [rbx - 2], al
mov byte [rbx - 1], cl
cmp rdx, r12
jb 0x140229110
add rsp, 0x30
pop r13
pop r12
pop rbx
ret
Function at 0x14022b740
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r12
push r13
mov eax, 0x50
call fcn.1402563a0
sub rsp, rax
mov r13, rdx
test rdx, rdx
mov r12, r9
mov rdx, r8
mov rbp, r8
je 0x14022b8c1
mov qword [rsp + 0x70], rbx
mov rbx, qword [rsp + 0xa0]
mov qword [rsp + 0x80], rdi
mov rdi, qword [rsp + 0xa8]
mov qword [rsp + 0x48], r14
lea r14, [r9 + 1]
mov r9, qword [rsp + 0x90]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], r15
mov r15, qword [rsp + 0x98]
shr r14, 1
mov qword [rsp + 0x28], rbx
mov r8, r14
mov qword [rsp + 0x20], r15
call fcn.14022b530
test eax, eax
je 0x14022b817
lea rdx, str.providersimplementationskdfs_tls1_prf.c
mov r8d, 0x186
mov rcx, rdi
mov qword [rsp + 0x78], rsi
call fcn.1400b4520
mov rsi, rax
test rax, rax
jne 0x14022b838
call fcn.1400baef0
lea r8, str.tls1_prf_alg
lea rcx, str.providersimplementationskdfs_tls1_prf.c
mov edx, 0x187
call fcn.1400baf60
lea ecx, [rsi + 0x39]
xor r8d, r8d
mov edx, 0xc0100
call fcn.1400bb1b0
xor eax, eax
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
mov r14, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x70]
mov r15, qword [rsp + 0x40]
add rsp, 0x50
pop r13
pop r12
pop rbp
ret
mov r9, qword [rsp + 0x90]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rax
sub rbp, r14
mov r8, r14
mov rcx, r13
lea rdx, [r12 + rbp]
mov qword [rsp + 0x20], r15
call fcn.14022b530
test eax, eax
jne 0x14022b87f
lea r8, str.providersimplementationskdfs_tls1_prf.c
mov r9d, 0x18d
mov rdx, rdi
mov rcx, rsi
call fcn.1400b4620
jmp 0x14022b810
test rdi, rdi
je 0x14022b89f
mov rdx, rsi
mov rcx, rdi
sub rdx, rbx
nop dword [rax]
movzx eax, byte [rdx + rbx]
inc rbx
xor byte [rbx - 1], al
dec rcx
jne 0x14022b890
lea r8, str.providersimplementationskdfs_tls1_prf.c
mov r9d, 0x192
mov rdx, rdi
mov rcx, rsi
call fcn.1400b4620
mov eax, 1
jmp 0x14022b812
mov rax, qword [rsp + 0xa8]
mov r9, qword [rsp + 0x90]
mov r8, r12
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x20], rax
call fcn.14022b530
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x50
pop r13
pop r12
pop rbp
ret
Function at 0x14023bfd0
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, reloc.WS2_32.dll_WSASetLastError
call fcn.1402563a0
sub rsp, rax
mov rax, qword [0x1403bb2d8]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, r9
mov rbx, rcx
cmp edx, 0x1d
je 0x140183577
mov eax, 0xfffffffe
jmp 0x14018369c
test rcx, rcx
jne 0x140183583
xor eax, eax
jmp 0x14018369c
cmp r8d, 0x30
jne 0x14018357c
mov r8d, gethostbyname
mov rdx, r9
call fcn.140183260
test eax, eax
jle 0x14018357c
movabs rax, 0x3636363636363636
lea rdx, [rsp + 0x20]
mov r8d, 0x28
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
call fcn.140183260
test eax, eax
je 0x14018357c
lea rcx, [rsp + 0x48]
mov rdx, rbx
call fcn.1401833b0
test eax, eax
je 0x14018357c
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 0x60]
call fcn.1402547c0
mov r8d, gethostbyname
mov rdx, rdi
mov rcx, rbx
mov dword [rbx], 0x67452301
mov dword [rbx + 4], 0xefcdab89
mov dword [rbx + 8], 0x98badcfe
mov dword [rbx + 0xc], 0x10325476
mov dword [rbx + 0x10], 0xc3d2e1f0
call fcn.140183260
test eax, eax
jle 0x14018357c
movabs rax, 0x5c5c5c5c5c5c5c5c
lea rdx, [rsp + 0x20]
mov r8d, 0x28
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
call fcn.140183260
test eax, eax
je 0x14018357c
lea rdx, [rsp + 0x48]
mov r8d, socket
mov rcx, rbx
call fcn.140183260
test eax, eax
je 0x14018357c
lea rcx, [rsp + 0x48]
mov edx, socket
call fcn.1400f5f30
mov eax, 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140254f60
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
push rbx
mov eax, 0x20
call fcn.1402563a0
sub rsp, rax
mov rax, rdx
mov rbx, rcx
test rcx, rcx
jne 0x14023bff2
xor eax, eax
add rsp, 0x20
pop rbx
ret
test rdx, rdx
je 0x14023c02b
lea rdx, str.ssl3_ms
mov rcx, rax
call fcn.140103f00
test rax, rax
je 0x14023c02b
cmp dword [rax + 8], 5
jne 0x14023c02b
mov r9, qword [rax + 0x10]
mov r8d, dword [rax + 0x18]
mov edx, 0x1d
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x140183540
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x14024c8e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x20
call fcn.1402563a0
sub rsp, rax
add qword [rcx], r8
mov rsi, qword [rcx + 8]
mov rdi, qword [rcx + 0x10]
mov rbp, qword [rcx + 0x18]
mov rbx, qword [rcx + 0x20]
mov r12, rcx
mov ecx, dword [rcx + 0x28]
mov r13, r8
mov r14, rdx
test ecx, ecx
je 0x14024ca08
mov r15d, 8
sub r15d, ecx
lea rcx, [rcx + r12 + 0x38]
cmp r8, r15
jae 0x14024c94e
call fcn.1402550b0
add dword [r12 + 0x28], r13d
jmp 0x14024cb11
mov r8, r15
call fcn.1402550b0
movzx eax, byte [r12 + 0x3e]
movzx ecx, byte [r12 + 0x3f]
shl rcx, 8
sub r13, r15
add r14, r15
or rcx, rax
movzx eax, byte [r12 + 0x3d]
shl rcx, 8
or rcx, rax
movzx eax, byte [r12 + 0x3c]
shl rcx, 8
or rcx, rax
movzx eax, byte [r12 + 0x3b]
shl rcx, 8
or rcx, rax
movzx eax, byte [r12 + 0x3a]
shl rcx, 8
or rcx, rax
movzx eax, byte [r12 + 0x39]
shl rcx, 8
or rcx, rax
movzx eax, byte [r12 + 0x38]
shl rcx, 8
or rcx, rax
xor rbx, rcx
cmp dword [r12 + 0x30], 0
jbe 0x14024ca05
mov eax, dword [r12 + 0x30]
nop dword [rax]
add rsi, rdi
add rbp, rbx
rol rdi, 0xd
xor rdi, rsi
rol rbx, 0x10
xor rbx, rbp
rol rsi, 0x20
add rbp, rdi
add rsi, rbx
rol rbx, 0x15
xor rbx, rsi
rol rdi, 0x11
xor rdi, rbp
rol rbp, 0x20
dec rax
jne 0x14024c9d0
xor rsi, rcx
mov r15d, r13d
mov rdx, r14
and r15d, 7
movsxd r8, r15d
sub rdx, r8
add rdx, r13
cmp r14, rdx
je 0x14024cae9
mov r10d, dword [r12 + 0x30]
lea r9, [r14 + 6]
nop dword [rax]
movzx eax, byte [r9]
movzx ecx, byte [r9 + 1]
shl rcx, 8
or rcx, rax
movzx eax, byte [r9 - 1]
shl rcx, 8
or rcx, rax
movzx eax, byte [r9 - 2]
shl rcx, 8
or rcx, rax
movzx eax, byte [r9 - 3]
shl rcx, 8
or rcx, rax
movzx eax, byte [r9 - 4]
shl rcx, 8
or rcx, rax
movzx eax, byte [r9 - 5]
shl rcx, 8
or rcx, rax
movzx eax, byte [r9 - 6]
shl rcx, 8
or rcx, rax
xor rbx, rcx
test r10d, r10d
je 0x14024cad5
mov eax, dword [r12 + 0x30]
nop word [rax + rax]
add rsi, rdi
add rbp, rbx
rol rdi, 0xd
xor rdi, rsi
rol rbx, 0x10
xor rbx, rbp
rol rsi, 0x20
add rbp, rdi
add rsi, rbx
rol rbx, 0x15
xor rbx, rsi
rol rdi, 0x11
xor rdi, rbp
rol rbp, 0x20
dec rax
jne 0x14024caa0
add r9, 8
xor rsi, rcx
lea rax, [r9 - 6]
cmp rax, rdx
jne 0x14024ca30
test r15d, r15d
je 0x14024caf8
lea rcx, [r12 + 0x38]
call fcn.1402550b0
mov dword [r12 + 0x28], r15d
mov qword [r12 + 8], rsi
mov qword [r12 + 0x10], rdi
mov qword [r12 + 0x18], rbp
mov qword [r12 + 0x20], rbx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14024cb30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
mov r10, qword [rcx + 0x10]
mov r11, qword [rcx + 0x18]
mov r9, qword [rcx + 0x20]
mov rax, r8
mov r8, qword [rcx]
mov rdi, rdx
mov rdx, qword [rcx + 8]
shl r8, 0x38
cmp dword [rcx + 0x30], 0
mov rbx, rcx
je 0x14024cd82
test rax, rax
je 0x14024cd82
mov ebp, dword [rcx + 0x2c]
cmp rax, rbp
jne 0x14024cd82
mov eax, dword [rcx + 0x28]
dec eax
cmp eax, 6
ja case.default.0x14024cba0
mov qword [rsp + 0x10], r12
lea r12, [0x140000000]
mov ecx, dword [r12 + rax*4 + 0x24cd90]
add rcx, r12
mov r12, qword [rsp + 0x10]
jmp rcx
movzx eax, byte [rbx + 0x3e]
shl rax, 0x30
or r8, rax
movzx eax, byte [rbx + 0x3d]
shl rax, 0x28
or r8, rax
movzx eax, byte [rbx + 0x3c]
shl rax, 0x20
or r8, rax
movzx eax, byte [rbx + 0x3b]
shl rax, 0x18
or r8, rax
movzx eax, byte [rbx + 0x3a]
shl rax, 0x10
or r8, rax
movzx eax, byte [rbx + 0x39]
shl rax, 8
or r8, rax
movzx eax, byte [rbx + 0x38]
or r8, rax
xor r9, r8
cmp dword [rbx + 0x30], 0
jbe 0x14024cc35
mov eax, dword [rbx + 0x30]
nop word [rax + rax]
add rdx, r10
add r11, r9
rol r10, 0xd
xor r10, rdx
rol r9, 0x10
xor r9, r11
rol rdx, 0x20
add r11, r10
add rdx, r9
rol r9, 0x15
xor r9, rdx
rol r10, 0x11
xor r10, r11
rol r11, 0x20
dec rax
jne 0x14024cc00
xor rdx, r8
cmp ebp, 0x10
jne 0x14024cc46
xor r11, 0xee
jmp 0x14024cc4d
xor r11, 0xff
mov eax, dword [rbx + 0x34]
test eax, eax
je 0x14024cc95
mov ecx, eax
nop word [rax + rax]
add rdx, r10
add r11, r9
rol r10, 0xd
xor r10, rdx
rol r9, 0x10
xor r9, r11
rol rdx, 0x20
add r11, r10
add rdx, r9
rol r9, 0x15
xor r9, rdx
rol r10, 0x11
xor r10, r11
rol r11, 0x20
dec rcx
jne 0x14024cc60
mov rcx, r9
xor rcx, r11
xor rcx, r10
xor rcx, rdx
mov eax, ecx
mov byte [rdi], cl
shr eax, 8
mov byte [rdi + 1], al
mov eax, ecx
shr eax, 0x10
mov byte [rdi + 2], al
mov eax, ecx
shr rcx, 0x20
shr eax, 0x18
mov byte [rdi + 4], cl
mov byte [rdi + 3], al
mov eax, ecx
shr eax, 8
mov byte [rdi + 5], al
mov eax, ecx
shr ecx, 0x18
shr eax, 0x10
mov byte [rdi + 7], cl
mov byte [rdi + 6], al
cmp dword [rbx + 0x2c], 8
je 0x14024cd71
mov eax, dword [rbx + 0x34]
xor r10, 0xdd
test eax, eax
je 0x14024cd27
mov ecx, eax
add rdx, r10
add r11, r9
rol r10, 0xd
xor r10, rdx
rol r9, 0x10
xor r9, r11
rol rdx, 0x20
add r11, r10
add rdx, r9
rol r9, 0x15
xor r9, rdx
rol r10, 0x11
xor r10, r11
rol r11, 0x20
dec rcx
jne 0x14024ccf2
xor r9, r11
xor r9, r10
xor r9, rdx
mov eax, r9d
mov byte [rdi + 8], r9b
shr eax, 8
mov byte [rdi + 9], al
mov eax, r9d
shr eax, 0x10
mov byte [rdi + 0xa], al
mov eax, r9d
shr r9, 0x20
shr eax, 0x18
mov byte [rdi + 0xc], r9b
mov byte [rdi + 0xb], al
mov eax, r9d
shr eax, 8
mov byte [rdi + 0xd], al
mov eax, r9d
shr eax, 0x10
shr r9d, 0x18
mov byte [rdi + 0xf], r9b
mov byte [rdi + 0xe], al
mov eax, 1
mov rbx, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
pop rdi
ret
mov rbx, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
xor eax, eax
pop rdi
ret
Function at 0x14024cdb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movzx r9d, byte [rdx]
lea eax, [r8 - 1]
xor edi, edi
movzx r11d, r9b
mov esi, r8d
mov rbx, rcx
shr r11b, 7
test eax, eax
jle 0x14024ce12
mov r10, rcx
sub rdx, rcx
mov edi, eax
mov r8d, eax
nop word [rax + rax]
movzx ecx, byte [rdx + r10 + 1]
add r9b, r9b
inc r10
movzx eax, cl
shr al, 7
or al, r9b
dec r8
movzx r9d, cl
mov byte [r10 - 1], al
jne 0x14024cdf0
mov eax, 0x87
cmp esi, 0x10
mov rsi, qword [rsp + 0x10]
mov ecx, 0x1b
cmove ecx, eax
movsxd rax, edi
mov rdi, qword [rsp + 0x18]
neg r11b
add r9b, r9b
and cl, r11b
xor cl, r9b
mov byte [rax + rbx], cl
mov rbx, qword [rsp + 8]
ret
Function at 0x14024edb0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
mov eax, reloc.WS2_32.dll_WSASetLastError
call fcn.1402563a0
sub rsp, rax
mov rax, qword [0x1403bb2d8]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, r9
mov rbx, r9
mov rsi, r8
and edi, 0xf
mov r12, rdx
mov rbp, rcx
jne 0x14024ee07
mov rax, qword [rcx + 0xa8]
mov r8, rdx
mov rdx, rsi
call qword [rax + reloc.WS2_32.dll_htonl]
xor ecx, ecx
test eax, eax
cmove rbx, rcx
mov rax, rbx
jmp 0x14024ef3d
mov rax, 0xfffffffffffffff0
sub rax, rdi
add rbx, rax
je 0x14024ee3a
mov rax, qword [rcx + 0xa8]
mov r8, rdx
mov r9, rbx
mov rdx, rsi
call qword [rax + reloc.WS2_32.dll_htonl]
test eax, eax
jne 0x14024ee34
xor eax, eax
jmp 0x14024ef3d
add r12, rbx
add rsi, rbx
mov rax, qword [rbp + 0x9c]
lea r8, [r12 + rdi]
mov qword [rsp + 0x68], r13
mov r13, qword [r8]
mov qword [rsp + 0x20], rax
xor eax, eax
mov qword [rsp + 0x60], r14
mov r14, qword [r8 + 8]
mov qword [rsp + 0x58], r15
mov r15, qword [rbp + 0x94]
mov qword [rbp + 0x94], rax
mov qword [rbp + 0x9c], rax
mov rax, qword [rbp + 0xa8]
lea rdx, [rsp + 0x38]
mov r9d, reloc.WS2_32.dll_recv
mov rcx, rbp
call qword [rax + reloc.WS2_32.dll_htonl]
test eax, eax
je 0x14024ef17
lea rcx, [rsp + 0x28]
mov r8, rdi
mov rdx, r12
call fcn.1402550b0
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + rdi + 0x38]
lea rcx, [rsp + rdi + 0x28]
sub r8, rdi
call fcn.1402550b0
xor ecx, ecx
test rdi, rdi
je 0x14024eee5
nop word [rax + rax]
movzx eax, byte [rsp + rcx + 0x28]
inc rcx
xor al, byte [rsp + rcx + 0x37]
mov byte [rsi + rcx + 0xf], al
cmp rcx, rdi
jb 0x14024eed0
mov rax, qword [rsp + 0x20]
mov qword [rbp + 0x94], r15
lea r8, [rsp + 0x28]
mov qword [rbp + 0x9c], rax
mov rax, qword [rbp + 0xa8]
mov r9d, reloc.WS2_32.dll_recv
mov rdx, rsi
mov rcx, rbp
call qword [rax + reloc.WS2_32.dll_htonl]
test eax, eax
jne 0x14024ef1b
xor eax, eax
jmp 0x14024ef2e
mov qword [rbp + 0x94], r13
lea rax, [rbx + rdi + 0x10]
mov qword [rbp + 0x9c], r14
mov r14, qword [rsp + 0x60]
mov r13, qword [rsp + 0x68]
mov r15, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140254f60
add rsp, 0x70
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14024f060
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push r12
mov eax, 0x88
call fcn.1402563a0
sub rsp, rax
mov rax, qword [0x1403bb2d8]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rdi, r9
mov rsi, r8
mov r12, rdx
mov rbp, rcx
cmp r9, 0x10
jae 0x14024f09b
xor eax, eax
jmp 0x14024f217
mov qword [rsp + 0x78], r13
cmp r9, 0x10
jne 0x14024f0c3
mov rax, qword [rcx + 0xa8]
mov r8, rdx
mov rdx, rsi
call qword [rax + reloc.WS2_32.dll_htonl]
neg eax
sbb rax, rax
and eax, 0x10
jmp 0x14024f212
mov qword [rsp + 0x80], rbx
mov rbx, r9
mov r13d, reloc.WS2_32.dll_recv
and ebx, 0xf
mov rax, 0xfffffffffffffff0
cmove ebx, r13d
sub rax, rbx
add rdi, rax
je 0x14024f10e
mov rax, qword [rcx + 0xa8]
mov r8, rdx
mov r9, rdi
mov rdx, rsi
call qword [rax + reloc.WS2_32.dll_htonl]
test eax, eax
jne 0x14024f108
xor eax, eax
jmp 0x14024f20a
add r12, rdi
add rsi, rdi
mov rax, qword [rbp + 0x94]
mov qword [rsp + 0x70], r14
mov r14, qword [r12]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x9c]
mov qword [rsp + 0x68], r15
mov r15, qword [r12 + 8]
mov qword [rsp + 0x20], rax
xor eax, eax
mov qword [rbp + 0x94], rax
mov qword [rbp + 0x9c], rax
mov rax, qword [rbp + 0xa8]
lea rdx, [rsp + 0x40]
mov r9, r13
mov r8, r12
mov rcx, rbp
call qword [rax + reloc.WS2_32.dll_htonl]
test eax, eax
je 0x14024f1e9
lea rdx, [r12 + 0x10]
lea rcx, [rsp + 0x30]
mov r8, rbx
call fcn.1402550b0
cmp rbx, r13
je 0x14024f195
mov r8, r13
lea rdx, [rsp + rbx + 0x40]
lea rcx, [rsp + rbx + 0x30]
sub r8, rbx
call fcn.1402550b0
xor ecx, ecx
test rbx, rbx
je 0x14024f1b5
nop dword [rax]
movzx eax, byte [rsp + rcx + 0x30]
inc rcx
xor al, byte [rsp + rcx + 0x3f]
mov byte [rsi + rcx + 0xf], al
cmp rcx, rbx
jb 0x14024f1a0
mov rax, qword [rsp + 0x28]
lea r8, [rsp + 0x30]
mov r9, r13
mov qword [rbp + 0x94], rax
mov rax, qword [rsp + 0x20]
mov rdx, rsi
mov qword [rbp + 0x9c], rax
mov rax, qword [rbp + 0xa8]
mov rcx, rbp
call qword [rax + reloc.WS2_32.dll_htonl]
test eax, eax
jne 0x14024f1ed
xor eax, eax
jmp 0x14024f200
mov qword [rbp + 0x94], r14
lea rax, [rdi + rbx + 0x10]
mov qword [rbp + 0x9c], r15
mov r14, qword [rsp + 0x70]
mov r15, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x80]
mov r13, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140254f60
add rsp, 0x88
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140253650
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push r12
mov eax, 0x78
call fcn.1402563a0
sub rsp, rax
mov rax, qword [0x1403bb2d8]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [rcx + 0x3c]
mov rdi, r9
mov rbp, r8
mov r12, rdx
mov rsi, rcx
test eax, eax
je 0x140253788
dec eax
mov qword [rsp + 0x70], rbx
lea rbx, [rcx + 0x10]
mov dword [rcx + 0x3c], eax
mov rax, qword [rbx]
mov dword [rsp + 0x30], r9d
mov qword [rsp + 0x38], rax
mov rax, qword [rbx + 8]
mov qword [rsp + 0x68], r13
mov r13, qword [rcx + 0x20]
mov qword [rsp + 0x40], rax
and byte [rsp + 0x40], 0x7f
and byte [rsp + 0x44], 0x7f
lea rax, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r13
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rax
call fcn.1400dcaa0
test eax, eax
je 0x14025377c
mov eax, dword [rsp + 0x30]
lea r8, [rsp + 0x30]
mov r9, r12
mov rdx, rbp
mov rcx, r13
mov dword [rsp + 0x20], eax
call fcn.1400d9e90
test eax, eax
je 0x14025377c
lea rdx, [rsp + 0x48]
mov r9, rdi
mov r8, rbp
mov rcx, rsi
call fcn.140253030
test eax, eax
je 0x14025377c
lea rax, [rsp + 0x48]
xor r9d, r9d
sub rbx, rax
nop dword [rax + rax]
lea r8, [rsp + r9 + 0x48]
add r9, 4
movzx eax, byte [rbx + r8]
xor byte [r8], al
movzx eax, byte [rbx + r8 + 1]
xor byte [r8 + 1], al
movzx eax, byte [rbx + r8 + 2]
xor byte [r8 + 2], al
movzx eax, byte [rbx + r8 + 3]
xor byte [r8 + 3], al
cmp r9, 0x10
jl 0x140253730
mov rax, qword [rsp + 0x50]
or rax, qword [rsp + 0x48]
je 0x14025379f
mov rdx, rdi
mov rcx, rbp
call fcn.1400f5f30
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov r13, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140254f60
add rsp, 0x78
pop r12
pop rdi
pop rsi
pop rbp
ret
mov dword [rsi + 0x38], 0
mov eax, edi
jmp 0x14025377e

Function at 0x140256e8c
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.140256cfc
Function at 0x14025eb33
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1403bb2d8]
jne 0x140254f7a
rol rcx, 0x10
test cx, 0xffff
jne 0x140254f76
repz ret
ror rcx, 0x10
jmp 0x14025ea8c
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1403bf640]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x1403bf738]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14025eb11
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1403bf640]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14025eb33
mov rax, qword [rsp + 0x88]
mov qword [0x1403bf738], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1403bf6d8], rax
mov rax, qword [0x1403bf738]
mov qword [0x1403bf5b0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1403bf6c0], rax
mov dword [0x1403bf5a0], 0xc0000409
mov dword [0x1403bf5a4], 1
mov rax, qword [0x1403bb2d8]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1403bb2e0]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x1403bf638], eax
mov ecx, 1
call fcn.1402683fc
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140393748]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1403bf638], 0
jne 0x14025ebba
mov ecx, 1
call fcn.1402683fc
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret