joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5ee270
Capabilities:
Hash data using sha224

Disassembly:
push rbx
mov eax, reloc.WLDAP32.dll_Ordinal_32
call fcn.00693bc0
sub rsp, rax
lea r8d, [rax + 0x50]
xor edx, edx
mov rbx, rcx
call sub.msvcrt.dll_memset
mov dword [rbx], 0xc1059ed8
mov dword [rbx + 4], 0x367cd507
mov dword [rbx + 8], 0x3070dd17
mov dword [rbx + 0xc], 0xf70e5939
mov dword [rbx + 0x10], 0xffc00b31
mov dword [rbx + 0x14], 0x68581511
mov dword [rbx + 0x18], 0x64f98fa7
mov dword [rbx + 0x1c], 0xbefa4fa4
mov dword [rbx + 0x6c], Ordinal_33
mov eax, 1
add rsp, 0x20
pop rbx
ret

Function at 0x5ee2e0
Capabilities:
Hash data using sha256

Disassembly:
push rbx
mov eax, reloc.WLDAP32.dll_Ordinal_32
call fcn.00693bc0
sub rsp, rax
lea r8d, [rax + 0x50]
xor edx, edx
mov rbx, rcx
call sub.msvcrt.dll_memset
mov dword [rbx], 0x6a09e667
mov dword [rbx + 4], 0xbb67ae85
mov dword [rbx + 8], 0x3c6ef372
mov dword [rbx + 0xc], 0xa54ff53a
mov dword [rbx + 0x10], 0x510e527f
mov dword [rbx + 0x14], 0x9b05688c
mov dword [rbx + 0x18], 0x1f83d9ab
mov dword [rbx + 0x1c], 0x5be0cd19
mov dword [rbx + 0x6c], reloc.WLDAP32.dll_Ordinal_32
mov eax, 1
add rsp, 0x20
pop rbx
ret

Function at 0x5eed20
Capabilities:
Hash data using sha1

Disassembly:
push rbx
mov eax, reloc.WLDAP32.dll_Ordinal_32
call fcn.00693bc0
sub rsp, rax
lea r8d, [rax + 0x40]
xor edx, edx
mov rbx, rcx
call sub.msvcrt.dll_memset
mov dword [rbx], 0x67452301
mov dword [rbx + 4], 0xefcdab89
mov dword [rbx + 8], 0x98badcfe
mov dword [rbx + 0xc], 0x10325476
mov dword [rbx + 0x10], 0xc3d2e1f0
mov eax, 1
add rsp, 0x20
pop rbx
ret

Function at 0x5ef7e0
Capabilities:
Encode data using base64

Disassembly:
push rbx
xor r11d, r11d
test r8d, r8d
mov r10, rdx
mov r9, rcx
jle 0x5ef8d7
lea rbx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
nop
nop
cmp r8d, 3
movzx ecx, byte [r10]
jl 0x5ef85f
movzx eax, byte [r10 + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [r10 + 2]
shl ecx, 8
or ecx, eax
mov eax, ecx
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rax + rbx]
mov byte [r9], al
mov eax, ecx
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rax + rbx]
mov byte [r9 + 1], al
mov eax, ecx
shr rax, 6
and eax, 0x3f
movzx eax, byte [rax + rbx]
mov byte [r9 + 2], al
mov al, cl
and eax, 0x3f
movzx eax, byte [rax + rbx]
mov byte [r9 + 3], al
jmp 0x5ef8b5
shl ecx, 0x10
cmp r8d, 2
jne 0x5ef872
movzx eax, byte [r10 + 1]
shl eax, 8
or ecx, eax
mov rax, rcx
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rax + rbx]
mov byte [r9], al
mov rax, rcx
shr rax, 0xc
and eax, 0x3f
cmp r8d, 1
movzx eax, byte [rax + rbx]
mov byte [r9 + 1], al
jne 0x5ef8a1
lea eax, [r8 + 0x3c]
jmp 0x5ef8ac
shr rcx, 6
and ecx, 0x3f
movzx eax, byte [rcx + rbx]
mov byte [r9 + 2], al
mov byte [r9 + 3], 0x3d
sub r8d, 3
add r9, 4
add r11d, 4
add r10, 3
test r8d, r8d
jg 0x5ef800
mov byte [r9], 0
mov eax, r11d
pop rbx
ret
mov byte [rcx], r11b
mov eax, r11d
pop rbx
ret
Function at 0x5efac0
Capabilities:
Encode data using base64

Disassembly:
mov eax, 0x68
call fcn.00693bc0
sub rsp, rax
mov qword [rsp + 0x58], rbp
movsxd rbp, dword [rsp + 0x90]
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r14
xor r14d, r14d
test ebp, ebp
mov qword [rsp + 0x28], r15
mov r13, r9
mov rdi, rdx
mov rsi, rcx
mov dword [r8], r14d
mov r15, r8
je 0x5efcfa
cmp dword [rcx + 4], 0x50
jle 0x5efb29
lea r8, str.ctx__length____int_sizeof_ctx__enc_data_
lea edx, [rax + 0x23]
lea rcx, [0x0074fad0]
call fcn.005cc540
movsxd rcx, dword [rsi]
mov qword [rsp + 0x40], r12
mov r12d, dword [rsi + 4]
lea eax, [rcx + rbp]
cmp eax, r12d
jge 0x5efb54
lea rcx, [rcx + rsi + 8]
mov r8, rbp
mov rdx, r13
call sub.msvcrt.dll_memcpy
add dword [rsi], ebp
jmp 0x5efcf5
test ecx, ecx
mov qword [rsp + 0x60], rbx
je 0x5efba0
sub r12d, ecx
lea rcx, [rcx + rsi + 8]
mov rdx, r13
movsxd rbx, r12d
mov r8, rbx
call sub.msvcrt.dll_memcpy
mov r8d, dword [rsi + 4]
lea rdx, [rsi + 8]
mov rcx, rdi
add r13, rbx
sub ebp, r12d
call fcn.005ef7e0
mov dword [rsi], r14d
movsxd rcx, eax
add rdi, rcx
inc rdi
mov byte [rdi - 1], 0xa
mov byte [rdi], r14b
lea r14d, [rax + 1]
cmp ebp, dword [rsi + 4]
jl 0x5efcd8
lea r12, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov r9d, dword [rsi + 4]
xor r11d, r11d
xor ebx, ebx
test r9d, r9d
mov r8, rdi
jle 0x5efcb1
lea r10, [r13 + 1]
nop
nop
cmp r9d, 3
jl 0x5efc37
movzx eax, byte [r10]
movzx ecx, byte [r10 - 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [r10 + 1]
shl ecx, 8
or ecx, eax
mov eax, ecx
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rax + r12]
mov byte [r8], al
mov eax, ecx
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rax + r12]
mov byte [r8 + 1], al
mov eax, ecx
shr rax, 6
and eax, 0x3f
movzx eax, byte [rax + r12]
mov byte [r8 + 2], al
mov al, cl
and eax, 0x3f
add r8, 4
movzx eax, byte [rax + r12]
mov byte [r8 - 1], al
jmp 0x5efc98
movzx ecx, byte [r10 - 1]
shl ecx, 0x10
cmp r9d, 2
jne 0x5efc4e
movzx eax, byte [r10]
shl eax, 8
or ecx, eax
mov rax, rcx
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rax + r12]
mov byte [r8], al
mov rax, rcx
shr rax, 0xc
and eax, 0x3f
cmp r9d, 1
movzx eax, byte [rax + r12]
mov byte [r8 + 1], al
jne 0x5efc7f
lea eax, [r9 + 0x3c]
jmp 0x5efc8b
shr rcx, 6
and ecx, 0x3f
movzx eax, byte [rcx + r12]
mov byte [r8 + 2], al
mov byte [r8 + 3], 0x3d
add r8, 4
sub r9d, 3
add r11d, 4
add rbx, 4
add r10, 3
test r9d, r9d
jg 0x5efbd0
mov byte [r8], 0
movsxd rcx, dword [rsi + 4]
add rdi, rbx
mov byte [rdi], 0xa
inc rdi
sub ebp, ecx
add r13, rcx
mov byte [rdi], 0
cmp ebp, dword [rsi + 4]
lea r14d, [r14 + r11 + 1]
jge 0x5efbb0
test ebp, ebp
mov rbx, qword [rsp + 0x60]
je 0x5efcf0
lea rcx, [rsi + 8]
movsxd r8, ebp
mov rdx, r13
call sub.msvcrt.dll_memcpy
mov dword [rsi], ebp
mov dword [r15], r14d
mov r12, qword [rsp + 0x40]
mov r15, qword [rsp + 0x28]
mov r14, qword [rsp + 0x30]
mov r13, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x68
ret
Function at 0x5fe270
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 8
call fcn.005fe2e0
shl edx, 4
test eax, eax
jne 0x5fe2ce
lea rcx, [r8 + rdx + 0x10]
movups xmm0, xmmword [r8]
movups xmm1, xmmword [rcx]
movups xmmword [rcx], xmm0
movups xmmword [r8], xmm1
lea r8, [r8 + 0x10]
lea rcx, [rcx - 0x10]
movups xmm0, xmmword [r8]
movups xmm1, xmmword [rcx]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea r8, [r8 + 0x10]
lea rcx, [rcx - 0x10]
movups xmmword [rcx + 0x10], xmm0
movups xmmword [r8 - 0x10], xmm1
cmp rcx, r8
ja 0x5fe29b
movups xmm0, xmmword [r8]
aesimc xmm0, xmm0
movups xmmword [rcx], xmm0
add rsp, 8
repz ret

Function at 0x5fe2e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 8
mov rax, 0xffffffffffffffff
test rcx, rcx
je 0x5fe4e7
test r8, r8
je 0x5fe4e7
movups xmm0, xmmword [rcx]
xorps xmm4, xmm4
lea rax, [r8 + 0x10]
cmp edx, 0x100
je 0x5fe430
cmp edx, 0xc0
je 0x5fe3b0
cmp edx, 0x80
jne 0x5fe4e0
mov edx, 9
movups xmmword [r8], xmm0
aeskeygenassist xmm1, xmm0, 1
call fcn.005fe4f7
aeskeygenassist xmm1, xmm0, 2
call fcn.005fe4f0
aeskeygenassist xmm1, xmm0, 4
call fcn.005fe4f0
aeskeygenassist xmm1, xmm0, 8
call fcn.005fe4f0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.005fe4f0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.005fe4f0
aeskeygenassist xmm1, xmm0, 0x40
call fcn.005fe4f0
aeskeygenassist xmm1, xmm0, 0x80
call fcn.005fe4f0
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.005fe4f0
aeskeygenassist xmm1, xmm0, 0x36
call fcn.005fe4f0
movups xmmword [rax], xmm0
mov dword [rax + 0x50], edx
xor eax, eax
jmp 0x5fe4e7
movq xmm2, qword [rcx + 0x10]
mov edx, reloc.WS2_32.dll_inet_addr
movups xmmword [r8], xmm0
aeskeygenassist xmm1, xmm2, 1
call fcn.005fe517
aeskeygenassist xmm1, xmm2, 2
call fcn.005fe550
aeskeygenassist xmm1, xmm2, 4
call fcn.005fe510
aeskeygenassist xmm1, xmm2, 8
call fcn.005fe550
aeskeygenassist xmm1, xmm2, 0x10
call fcn.005fe510
aeskeygenassist xmm1, xmm2, 0x20
call fcn.005fe550
aeskeygenassist xmm1, xmm2, 0x40
call fcn.005fe510
aeskeygenassist xmm1, xmm2, 0x80
call fcn.005fe550
movups xmmword [rax], xmm0
mov dword [rax + 0x30], edx
xor rax, rax
jmp 0x5fe4e7
movups xmm2, xmmword [rcx + 0x10]
mov edx, reloc.WS2_32.dll_listen
lea rax, [rax + 0x10]
movups xmmword [r8], xmm0
movups xmmword [r8 + 0x10], xmm2
aeskeygenassist xmm1, xmm2, 1
call fcn.005fe577
aeskeygenassist xmm1, xmm0, 1
call fcn.005fe590
aeskeygenassist xmm1, xmm2, 2
call fcn.005fe570
aeskeygenassist xmm1, xmm0, 2
call fcn.005fe590
aeskeygenassist xmm1, xmm2, 4
call fcn.005fe570
aeskeygenassist xmm1, xmm0, 4
call fcn.005fe590
aeskeygenassist xmm1, xmm2, 8
call fcn.005fe570
aeskeygenassist xmm1, xmm0, 8
call fcn.005fe590
aeskeygenassist xmm1, xmm2, 0x10
call fcn.005fe570
aeskeygenassist xmm1, xmm0, 0x10
call fcn.005fe590
aeskeygenassist xmm1, xmm2, 0x20
call fcn.005fe570
aeskeygenassist xmm1, xmm0, 0x20
call fcn.005fe590
aeskeygenassist xmm1, xmm2, 0x40
call fcn.005fe570
movups xmmword [rax], xmm0
mov dword [rax + 0x10], edx
xor rax, rax
jmp 0x5fe4e7
mov rax, 0xfffffffffffffffe
add rsp, 8
repz ret
Function at 0x5febc0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x48
call fcn.00693bc0
sub rsp, rax
xor eax, eax
cmp r8, 0xc
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x38], r13
mov r13, qword [rcx + 0x160]
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov qword [rcx], rax
mov qword [rcx + 8], rax
mov qword [rcx + 0x40], rax
mov qword [rcx + 0x48], rax
mov qword [rcx + 0x30], rax
mov qword [rcx + 0x38], rax
mov dword [rcx + 0x174], eax
mov dword [rcx + 0x170], eax
jne 0x5fec35
mov rax, qword [rdx]
lea edi, [r8 - 0xb]
mov qword [rcx], rax
mov eax, dword [rdx + 8]
mov byte [rcx + 0xf], 1
mov dword [rcx + 8], eax
jmp 0x5fed18
cmp r8, 0x10
mov qword [rsp + 0x30], r14
mov r14, r8
jb 0x5feccf
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x40], r12
mov r12, r8
shr r12, 4
mov rbp, rdx
mov qword [rsp + 0x28], r15
mov rax, r12
sub rbp, rcx
imul rax, rax, 0xfffffffffffffff0
add rsi, rax
nop
lea rdx, [rdi + 2]
mov rcx, rbx
mov r8d, 4
nop
movzx eax, byte [rcx + rbp]
add rcx, 4
add rdx, 4
xor byte [rcx - 4], al
movzx eax, byte [rdx - 5]
xor byte [rcx - 3], al
movzx eax, byte [rdx - 4]
xor byte [rcx - 2], al
movzx eax, byte [rdx - 3]
xor byte [rcx - 1], al
dec r8
jne 0x5fec80
lea rdx, [rbx + 0x60]
mov rcx, rbx
call r13
add rdi, 0x10
add rbp, 0x10
dec r12
jne 0x5fec70
mov r15, qword [rsp + 0x28]
mov r12, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
test rsi, rsi
je 0x5fecf9
test rsi, rsi
je 0x5fecef
mov rcx, rbx
sub rdi, rbx
nop
movzx eax, byte [rcx + rdi]
inc rcx
xor byte [rcx - 1], al
dec rsi
jne 0x5fece0
lea rdx, [rbx + 0x60]
mov rcx, rbx
call r13
shl r14, 3
lea rdx, [rbx + 0x60]
mov rcx, rbx
bswap r14
xor qword [rbx + 8], r14
call r13
mov edi, dword [rbx + 0xc]
mov r14, qword [rsp + 0x30]
bswap edi
mov r8, qword [rbx + 0x180]
lea rdx, [rbx + 0x20]
mov rcx, rbx
mov rax, qword [rbx + 0x178]
call rax
mov r13, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x60]
inc edi
bswap edi
mov dword [rbx + 0xc], edi
mov rdi, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x50]
add rsp, 0x48
ret
Function at 0x5fed50
Capabilities:
Encode data using xor

Disassembly:
mov eax, reloc.WS2_32.dll_getservbyport
call fcn.00693bc0
sub rsp, rax
cmp qword [rcx + 0x38], 0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x28], r13
mov r13, qword [rcx + 0x168]
mov rdi, r8
mov r8, qword [rcx + 0x160]
mov rbp, rdx
mov rbx, rcx
je 0x5fed99
mov eax, 0xfffffffe
jmp 0x5fee5d
mov rax, qword [rcx + 0x30]
lea rcx, [rdi + rax]
movabs rax, 0x2000000000000000
cmp rcx, rax
ja 0x5fee76
cmp rcx, rdi
jb 0x5fee76
mov qword [rsp + 0x50], rsi
mov esi, dword [rbx + 0x174]
mov qword [rbx + 0x30], rcx
test esi, esi
je 0x5fedfd
test rdi, rdi
je 0x5fedee
movzx eax, byte [rbp]
mov ecx, esi
inc rbp
xor byte [rcx + rbx + 0x40], al
dec rdi
inc esi
and esi, 0xf
jne 0x5fedd0
jmp 0x5fedf2
test esi, esi
jne 0x5fee50
lea rdx, [rbx + 0x60]
lea rcx, [rbx + 0x40]
call r8
mov qword [rsp + 0x30], r12
mov r12, rdi
and r12, 0xfffffffffffffff0
je 0x5fee22
lea rdx, [rbx + 0x60]
lea rcx, [rbx + 0x40]
mov r9, r12
mov r8, rbp
call r13
add rbp, r12
sub rdi, r12
test rdi, rdi
mov r12, qword [rsp + 0x30]
je 0x5fee50
xor ecx, ecx
test rdi, rdi
mov esi, edi
je 0x5fee50
nop
nop
nop
movzx eax, byte [rcx + rbp]
inc rcx
xor byte [rbx + rcx + 0x3f], al
cmp rcx, rdi
jb 0x5fee40
mov dword [rbx + 0x174], esi
mov rsi, qword [rsp + 0x50]
xor eax, eax
mov r13, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x38
ret
mov eax, 0xffffffff
jmp 0x5fee5d
Function at 0x5ff4c0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x88
call fcn.00693bc0
sub rsp, rax
mov rax, qword [rcx + 0x180]
mov qword [rsp + 0x80], rbx
mov rbx, qword [rcx + 0x160]
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x30], rax
mov rax, qword [rcx + 0x168]
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x38], rax
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x60], r12
mov rsi, rcx
lea rcx, [r9 + rax]
movabs rax, 0xfffffffe0
mov qword [rsp + 0x58], r13
mov rdi, r9
cmp rcx, rax
mov r13, r8
mov r12, rdx
ja 0x5ff74f
cmp rcx, r9
jb 0x5ff74f
cmp dword [rsi + 0x174], 0
mov qword [rsi + 0x38], rcx
je 0x5ff559
lea rdx, [rsi + 0x60]
lea rcx, [rsi + 0x40]
call rbx
mov dword [rsi + 0x174], 0
mov qword [rsp + 0x78], rbp
mov ebp, dword [rsi + 0x170]
mov qword [rsp + 0x50], r14
test ebp, ebp
mov r14d, dword [rsi + 0xc]
mov dword [rsp + 0x90], ebp
bswap r14d
je 0x5ff5c4
nop
nop
test rdi, rdi
je 0x5ff5b2
mov ecx, ebp
inc r13
inc r12
movzx eax, byte [rcx + rsi + 0x10]
dec rdi
xor al, byte [r12 - 1]
mov byte [r13 - 1], al
xor byte [rcx + rsi + 0x40], al
inc ebp
and ebp, 0xf
mov dword [rsp + 0x90], ebp
jne 0x5ff580
jmp 0x5ff5ba
test ebp, ebp
jne 0x5ff719
lea rdx, [rsi + 0x60]
lea rcx, [rsi + 0x40]
call rbx
cmp rdi, 0xc00
mov r10, qword [rsp + 0xb0]
mov qword [rsp + 0x48], r15
jb 0x5ff675
movabs rax, 0xaaaaaaaaaaaaaaab
mul rdi
mov rbx, rdx
shr rbx, 0xb
mov rax, rbx
imul rax, rax, 0xfffffffffffff400
add rdi, rax
mov qword [rsp + 0xa8], rdi
mov rdi, qword [rsp + 0x30]
nop
mov r9, rdi
mov r8d, 0xc0
mov rdx, r13
mov rcx, r12
mov qword [rsp + 0x20], rsi
call r10
add r14d, 0xc0
lea rdx, [rsi + 0x60]
mov eax, r14d
lea rcx, [rsi + 0x40]
mov r9d, 0xc00
bswap eax
mov r8, r13
mov dword [rsi + 0xc], eax
call qword [rsp + reloc.WS2_32.dll_getservbyport]
mov r10, qword [rsp + 0xb0]
add r13, 0xc00
add r12, 0xc00
dec rbx
jne 0x5ff610
mov rdi, qword [rsp + 0xa8]
mov ebp, dword [rsp + 0x90]
mov r15, rdi
and r15, 0xfffffffffffffff0
je 0x5ff6c1
mov r9, qword [rsp + 0x30]
mov rbx, r15
mov rdx, r13
shr rbx, 4
mov rcx, r12
mov qword [rsp + 0x20], rsi
mov r8, rbx
call r10
add r14d, ebx
lea rdx, [rsi + 0x60]
mov eax, r14d
lea rcx, [rsi + 0x40]
mov r9, r15
bswap eax
mov r8, r13
add r12, r15
mov dword [rsi + 0xc], eax
sub rdi, r15
call qword [rsp + reloc.WS2_32.dll_getservbyport]
add r13, r15
test rdi, rdi
mov r15, qword [rsp + 0x48]
je 0x5ff719
mov r8, qword [rsp + 0x30]
lea rdx, [rsi + 0x10]
mov rcx, rsi
call qword [rsi + 0x178]
movsxd rax, ebp
inc r14d
bswap r14d
sub r12, r13
add ebp, edi
lea rcx, [rax + rsi + 0x40]
lea rdx, [rax + r13]
mov dword [rsi + 0xc], r14d
nop
nop
movzx eax, byte [r12 + rdx]
inc rcx
inc rdx
xor al, byte [rcx - 0x31]
mov byte [rdx - 1], al
xor byte [rcx - 1], al
dec rdi
jne 0x5ff700
mov r14, qword [rsp + 0x50]
mov dword [rsi + 0x170], ebp
mov rbp, qword [rsp + 0x78]
xor eax, eax
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x80]
add rsp, 0x88
ret
mov eax, 0xffffffff
jmp 0x5ff72b
Function at 0x5ff760
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x88
call fcn.00693bc0
sub rsp, rax
mov rax, qword [rcx + 0x180]
mov qword [rsp + 0x80], rbx
mov rbx, qword [rcx + 0x160]
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x30], rax
mov rax, qword [rcx + 0x168]
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x38], rax
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x60], r12
mov rsi, rcx
lea rcx, [r9 + rax]
movabs rax, 0xfffffffe0
mov qword [rsp + 0x58], r13
mov rdi, r9
cmp rcx, rax
mov r13, r8
mov r12, rdx
ja 0x5ff9f2
cmp rcx, r9
jb 0x5ff9f2
cmp dword [rsi + 0x174], 0
mov qword [rsi + 0x38], rcx
je 0x5ff7f9
lea rdx, [rsi + 0x60]
lea rcx, [rsi + 0x40]
call rbx
mov dword [rsi + 0x174], 0
mov qword [rsp + 0x78], rbp
mov ebp, dword [rsi + 0x170]
mov qword [rsp + 0x50], r14
test ebp, ebp
mov r14d, dword [rsi + 0xc]
mov dword [rsp + 0x90], ebp
bswap r14d
je 0x5ff866
nop
nop
test rdi, rdi
je 0x5ff854
movzx edx, byte [r12]
mov ecx, ebp
inc r13
movzx eax, byte [rcx + rsi + 0x10]
inc r12
dec rdi
xor al, dl
mov byte [r13 - 1], al
xor byte [rcx + rsi + 0x40], dl
inc ebp
and ebp, 0xf
mov dword [rsp + 0x90], ebp
jne 0x5ff820
jmp 0x5ff85c
test ebp, ebp
jne 0x5ff9bc
lea rdx, [rsi + 0x60]
lea rcx, [rsi + 0x40]
call rbx
cmp rdi, 0xc00
mov qword [rsp + 0x48], r15
mov r15, qword [rsp + 0xb0]
jb 0x5ff90f
movabs rax, 0xaaaaaaaaaaaaaaab
mul rdi
mov rbx, rdx
shr rbx, 0xb
mov rax, rbx
imul rax, rax, 0xfffffffffffff400
add rdi, rax
mov qword [rsp + 0xa8], rdi
nop
nop
lea rdx, [rsi + 0x60]
lea rcx, [rsi + 0x40]
mov r9d, 0xc00
mov r8, r12
call qword [rsp + reloc.WS2_32.dll_getservbyport]
mov r9, qword [rsp + 0x30]
mov r8d, 0xc0
mov rdx, r13
mov rcx, r12
mov qword [rsp + 0x20], rsi
call r15
add r14d, 0xc0
add r13, 0xc00
mov eax, r14d
add r12, 0xc00
dec rbx
bswap eax
mov dword [rsi + 0xc], eax
jne 0x5ff8b0
mov rdi, qword [rsp + 0xa8]
mov ebp, dword [rsp + 0x90]
mov r15, rdi
and r15, 0xfffffffffffffff0
je 0x5ff95f
lea rdx, [rsi + 0x60]
lea rcx, [rsi + 0x40]
mov rbx, r15
mov r9, r15
mov r8, r12
shr rbx, 4
call qword [rsp + reloc.WS2_32.dll_getservbyport]
mov r9, qword [rsp + 0x30]
mov r8, rbx
mov rdx, r13
mov rcx, r12
mov qword [rsp + 0x20], rsi
call qword [rsp + 0xb0]
add r14d, ebx
add r13, r15
mov eax, r14d
add r12, r15
sub rdi, r15
bswap eax
mov dword [rsi + 0xc], eax
test rdi, rdi
mov r15, qword [rsp + 0x48]
je 0x5ff9bc
mov r8, qword [rsp + 0x30]
lea rdx, [rsi + 0x10]
mov rcx, rsi
call qword [rsi + 0x178]
movsxd rax, ebp
inc r14d
bswap r14d
sub r12, r13
add ebp, edi
lea r8, [rax + r13]
lea rdx, [rax + rsi + 0x40]
mov dword [rsi + 0xc], r14d
nop
nop
nop
movzx ecx, byte [r12 + r8]
movzx eax, byte [rdx - 0x30]
inc r8
xor byte [rdx], cl
xor al, cl
inc rdx
dec rdi
mov byte [r8 - 1], al
jne 0x5ff9a0
mov r14, qword [rsp + 0x50]
mov dword [rsi + 0x170], ebp
mov rbp, qword [rsp + 0x78]
xor eax, eax
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x80]
add rsp, 0x88
ret
mov eax, 0xffffffff
jmp 0x5ff9ce
Function at 0x600200
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x88
call fcn.00693bc0
sub rsp, rax
mov rax, qword [0x0072f1d0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x78], rbp
mov rbp, qword [rcx + 0x28]
mov qword [rsp + 0x70], rsi
movzx esi, byte [rcx]
mov qword [rsp + 0x68], rdi
test sil, 0x40
mov qword [rsp + 0x60], r12
mov r12, qword [rcx + 0x30]
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r14
mov rdi, r9
mov r14, r8
mov r13, rdx
mov rbx, rcx
mov byte [rsp + 0x20], sil
jne 0x60026a
lea rdx, [rcx + 0x10]
mov r8, r12
call rbp
mov al, sil
mov r8d, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x48], r15
and eax, 7
xor esi, esi
mov r15d, r8d
sub r15d, eax
mov byte [rbx], al
mov rcx, rsi
cmp r15d, r8d
mov dword [rsp + 0x24], r15d
movsxd rax, r15d
jae 0x6002b5
lea rdx, [rax + rbx]
sub r8d, r15d
nop
movzx eax, byte [rdx]
mov byte [rdx], sil
inc rdx
or rcx, rax
shl rcx, 8
dec r8
jne 0x6002a0
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0xf], 1
or rcx, rax
cmp rcx, rdi
je 0x6002cf
mov eax, 0xffffffff
jmp 0x600410
cmp rdi, 0x10
jb 0x600366
mov r15, rdi
shr r15, 4
mov rax, r15
imul rax, rax, 0xfffffffffffffff0
add rdi, rax
nop
nop
lea rdx, [rsp + 0x28]
mov r8, r12
mov rcx, rbx
call rbp
mov r11d, 8
lea rcx, [rbx + 0x10]
nop
nop
nop
movzx eax, byte [rcx - 1]
dec rcx
add r11d, 0xffffffff
inc al
mov byte [rcx], al
jne 0x600326
test r11d, r11d
jne 0x600310
mov rax, qword [r13]
lea rdx, [rbx + 0x10]
lea rcx, [rbx + 0x10]
xor rax, qword [rsp + 0x28]
mov r8, r12
mov qword [r14], rax
xor qword [rbx + 0x10], rax
mov rax, qword [r13 + 8]
xor rax, qword [rsp + 0x30]
mov qword [r14 + 8], rax
xor qword [rbx + 0x18], rax
call rbp
add r13, 0x10
add r14, 0x10
dec r15
jne 0x6002f0
mov r15d, dword [rsp + 0x24]
test rdi, rdi
je 0x6003cc
lea rdx, [rsp + 0x28]
mov r8, r12
mov rcx, rbx
call rbp
test rdi, rdi
je 0x6003c0
lea rax, [rsp + 0x28]
lea rdx, [rbx + 0x10]
lea rcx, [rsp + 0x28]
sub r13, rax
lea rax, [rsp + 0x28]
sub r14, rax
nop
nop
nop
movzx eax, byte [r13 + rcx]
inc esi
inc rcx
xor al, byte [rcx - 1]
inc rdx
mov byte [r14 + rcx - 1], al
xor byte [rdx - 1], al
mov eax, esi
cmp rax, rdi
jb 0x6003a0
lea rcx, [rbx + 0x10]
mov r8, r12
mov rdx, rcx
call rbp
cmp r15d, 0x10
movsxd rax, r15d
jae 0x6003e9
mov r8d, reloc.WS2_32.dll_recv
lea rcx, [rax + rbx]
xor edx, edx
sub r8d, r15d
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x28]
mov r8, r12
mov rcx, rbx
call rbp
mov rax, qword [rsp + 0x28]
xor qword [rbx + 0x10], rax
mov rax, qword [rsp + 0x30]
xor qword [rbx + 0x18], rax
mov al, byte [rsp + 0x20]
mov byte [rbx], al
xor eax, eax
mov r15, qword [rsp + 0x48]
mov r14, qword [rsp + 0x50]
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
call fcn.00693b90
add rsp, 0x88
ret
Function at 0x600770
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa8
call fcn.00693bc0
sub rsp, rax
mov rax, qword [0x0072f1d0]
mov qword [rsp + 0x58], rax
mov rax, qword [rcx + 0x28]
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0x98], rbp
mov qword [rsp + 0x88], rdi
movzx edi, byte [rcx]
mov qword [rsp + 0x78], r13
test dil, 0x40
mov r13, qword [rsp + 0xd0]
mov qword [rsp + 0x70], r14
mov r14, qword [rcx + 0x30]
mov qword [rsp + 0x68], r15
mov rbp, r9
mov r10, r8
mov qword [rsp + 0x38], r8
mov r15, rdx
mov rbx, rcx
mov byte [rsp + 0x30], dil
mov qword [rsp + 0x40], rax
jne 0x6007f2
lea rdx, [rcx + 0x10]
mov r8, r14
call rax
mov r10, qword [rsp + 0x38]
mov al, dil
mov r8d, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x90], rsi
and eax, 7
mov qword [rsp + 0x80], r12
xor esi, esi
mov r12d, r8d
mov byte [rbx], al
mov rcx, rsi
sub r12d, eax
cmp r12d, r8d
movsxd rax, r12d
jae 0x600845
lea rdx, [rax + rbx]
sub r8d, r12d
nop
nop
movzx eax, byte [rdx]
mov byte [rdx], sil
inc rdx
or rcx, rax
shl rcx, 8
dec r8
jne 0x600830
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0xf], 1
or rcx, rax
cmp rcx, rbp
je 0x60085f
mov eax, 0xffffffff
jmp 0x60099d
mov rdi, rbp
shr rdi, 4
je 0x6008e1
lea rax, [rbx + 0x10]
mov r9, r14
mov r8, rdi
mov qword [rsp + 0x28], rax
mov rdx, r10
mov rcx, r15
mov qword [rsp + 0x20], rbx
call r13
mov r13, qword [rsp + 0x38]
shl rdi, 4
add r13, rdi
add r15, rdi
sub rbp, rdi
je 0x60094d
shr rdi, 4
mov r8d, 8
mov rdx, rsi
nop
nop
movzx eax, byte [r8 + rbx + 7]
dec r8
movzx ecx, dil
add rdx, rax
shr rdi, 8
add rdx, rcx
mov byte [r8 + rbx + 8], dl
shr rdx, 8
test r8, r8
je 0x6008e6
test rdi, rdi
jne 0x6008b0
test rdx, rdx
jne 0x6008b0
jmp 0x6008e6
mov r13, qword [rsp + 0x38]
test rbp, rbp
je 0x600954
mov rdi, qword [rsp + 0x40]
lea rdx, [rsp + 0x48]
mov r8, r14
mov rcx, rbx
call rdi
test rbp, rbp
je 0x60093f
lea rax, [rsp + 0x48]
lea rdx, [rbx + 0x10]
lea rcx, [rsp + 0x48]
sub r15, rax
lea rax, [rsp + 0x48]
sub r13, rax
nop
nop
movzx eax, byte [r15 + rcx]
inc esi
inc rcx
xor al, byte [rcx - 1]
inc rdx
mov byte [r13 + rcx - 1], al
xor byte [rdx - 1], al
mov eax, esi
cmp rax, rbp
jb 0x600920
lea rcx, [rbx + 0x10]
mov r8, r14
mov rdx, rcx
call rdi
jmp 0x600959
mov rdi, qword [rsp + 0x40]
jmp 0x600959
mov rdi, qword [rsp + 0x40]
cmp r12d, 0x10
movsxd rax, r12d
jae 0x600976
mov r8d, reloc.WS2_32.dll_recv
lea rcx, [rax + rbx]
xor edx, edx
sub r8d, r12d
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x48]
mov r8, r14
mov rcx, rbx
call rdi
mov rax, qword [rsp + 0x48]
xor qword [rbx + 0x10], rax
mov rax, qword [rsp + 0x50]
xor qword [rbx + 0x18], rax
mov al, byte [rsp + 0x30]
mov byte [rbx], al
xor eax, eax
mov r15, qword [rsp + 0x68]
mov r14, qword [rsp + 0x70]
mov r13, qword [rsp + 0x78]
mov r12, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x98]
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x58]
call fcn.00693b90
add rsp, 0xa8
ret