joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140131c90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x60
call fcn.140189b00
sub rsp, rax
mov rax, qword [0x1401f3660]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xc0]
mov r14, qword [rsp + 0xd8]
mov rbp, rcx
mov rcx, qword [rsp + 0xc8]
mov ebx, dword [r14]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xd0]
mov r15, r9
mov esi, r8d
movzx r9d, byte [rax]
movzx r8d, byte [rax + 4]
lea rdi, [rax + 1]
mov qword [rsp + 0x48], rax
movzx eax, byte [rdi]
mov qword [rsp + 0x28], rcx
movzx ecx, byte [rdi + 6]
shl eax, 8
xor r13d, r13d
or r9d, eax
movzx eax, byte [rdi + 1]
shl ecx, 8
shl eax, 0x10
mov r12, rdx
mov qword [rsp + 0x40], r14
or r9d, eax
movzx eax, byte [rdi + 2]
mov qword [rsp + 0x30], rdi
shl eax, 0x18
or r9d, eax
movzx eax, byte [rdi + 4]
shl eax, 8
mov dword [rsp + 0x20], r9d
mov byte [rsp + 0x50], r9b
or r8d, eax
movzx eax, byte [rdi + 5]
or ecx, eax
mov eax, r9d
shr eax, 8
shl ecx, 0x10
mov byte [rsp + 0x51], al
or r8d, ecx
mov eax, r9d
shr eax, 0x10
mov dword [rsp + 0x24], r8d
mov byte [rsp + 0x54], r8b
mov byte [rsp + 0x52], al
mov eax, r9d
shr eax, 0x18
mov byte [rsp + 0x53], al
mov eax, r8d
shr eax, 8
mov byte [rsp + 0x55], al
mov eax, r8d
shr eax, 0x10
mov byte [rsp + 0x56], al
mov eax, r8d
shr eax, 0x18
test esi, esi
mov byte [rsp + 0x57], al
je 0x140131e98
mov r14, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x28]
sub esi, 1
test ebx, ebx
jne 0x140131e24
lea rcx, [rsp + 0x20]
mov r9, rdi
mov r8, r14
mov rdx, r15
call fcn.140132540
mov r9d, dword [rsp + 0x20]
mov r8d, dword [rsp + 0x24]
movzx eax, r9b
mov byte [rsp + 0x50], al
mov eax, r9d
shr eax, 8
mov byte [rsp + 0x51], al
mov eax, r9d
shr eax, 0x10
mov byte [rsp + 0x52], al
mov eax, r9d
shr eax, 0x18
mov byte [rsp + 0x53], al
movzx eax, r8b
mov byte [rsp + 0x54], al
mov eax, r8d
shr eax, 8
mov byte [rsp + 0x55], al
mov eax, r8d
shr eax, 0x10
mov byte [rsp + 0x56], al
mov eax, r8d
shr eax, 0x18
add r13d, 1
mov byte [rsp + 0x57], al
movsxd rax, ebx
add ebx, 1
add r12, 1
movzx ecx, byte [rsp + rax + 0x50]
add rbp, 1
and ebx, 7
xor cl, byte [rbp - 1]
test esi, esi
mov byte [r12 - 1], cl
jne 0x140131db0
test r13d, r13d
mov rdi, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
je 0x140131e98
mov rax, qword [rsp + 0x48]
mov byte [rax], r9b
mov eax, r9d
shr eax, 8
mov byte [rdi], al
mov eax, r9d
shr r9d, 0x18
shr eax, 0x10
mov byte [rdi + 1], al
mov byte [rdi + 2], r9b
mov byte [rdi + 3], r8b
mov eax, r8d
shr eax, 8
mov byte [rdi + 4], al
mov eax, r8d
shr eax, 0x10
shr r8d, 0x18
mov byte [rdi + 5], al
mov byte [rdi + 6], r8b
mov dword [r14], ebx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140041910
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140134da0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x40
call fcn.140189b00
sub rsp, rax
mov rax, qword [0x1401f3660]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xa0]
mov r14, qword [rsp + 0xa8]
mov rbp, rcx
movzx r10d, byte [rax]
mov ebx, dword [r14]
lea rdi, [rax + 1]
movzx ecx, byte [rdi + 6]
mov qword [rsp + 0x28], rax
movzx eax, byte [rdi]
shl eax, 8
mov r12, rdx
movzx edx, byte [rdi + 3]
or r10d, eax
movzx eax, byte [rdi + 1]
shl ecx, 8
shl eax, 0x10
mov r15, r9
lea r9, [rdi + 5]
or r10d, eax
movzx eax, byte [rdi + 2]
xor r13d, r13d
shl eax, 0x18
mov esi, r8d
or r10d, eax
movzx eax, byte [rdi + 4]
shl eax, 8
mov dword [rsp + 0x20], r10d
mov byte [rsp + 0x30], r10b
or edx, eax
movzx eax, byte [r9]
or ecx, eax
mov eax, r10d
shr eax, 8
shl ecx, 0x10
mov byte [rsp + 0x31], al
or edx, ecx
mov eax, r10d
shr eax, 0x10
mov dword [rsp + 0x24], edx
mov byte [rsp + 0x34], dl
mov byte [rsp + 0x32], al
mov eax, r10d
shr eax, 0x18
mov byte [rsp + 0x33], al
mov eax, edx
shr eax, 8
mov byte [rsp + 0x35], al
mov eax, edx
shr eax, 0x10
mov byte [rsp + 0x36], al
mov eax, edx
shr eax, 0x18
test r8d, r8d
mov byte [rsp + 0x37], al
je 0x140134f6f
movzx r8d, dl
movzx r9d, r10b
sub esi, 1
test ebx, ebx
jne 0x140134f09
lea r8d, [rbx + 1]
lea rcx, [rsp + 0x20]
mov rdx, r15
call fcn.140131ec0
mov r10d, dword [rsp + 0x20]
mov edx, dword [rsp + 0x24]
mov r9b, byte [rsp + 0x20]
mov r8b, byte [rsp + 0x24]
mov eax, r10d
shr eax, 8
mov byte [rsp + 0x30], r9b
mov byte [rsp + 0x34], r8b
mov byte [rsp + 0x31], al
mov eax, r10d
shr eax, 0x10
mov byte [rsp + 0x32], al
mov eax, r10d
shr eax, 0x18
mov byte [rsp + 0x33], al
mov eax, edx
shr eax, 8
mov byte [rsp + 0x35], al
mov eax, edx
shr eax, 0x10
mov byte [rsp + 0x36], al
mov eax, edx
shr eax, 0x18
add r13d, 1
mov byte [rsp + 0x37], al
movsxd rax, ebx
add ebx, 1
add r12, 1
movzx ecx, byte [rsp + rax + 0x30]
add rbp, 1
and ebx, 7
xor cl, byte [rbp - 1]
test esi, esi
mov byte [r12 - 1], cl
jne 0x140134e97
test r13d, r13d
je 0x140134f6f
mov rax, qword [rsp + 0x28]
mov byte [rax], r9b
mov eax, r10d
shr eax, 8
mov byte [rdi], al
mov eax, r10d
shr r10d, 0x18
shr eax, 0x10
mov byte [rdi + 1], al
mov byte [rdi + 2], r10b
mov byte [rdi + 3], r8b
mov eax, edx
shr eax, 8
mov byte [rdi + 4], al
mov eax, edx
shr eax, 0x10
shr edx, 0x18
mov byte [rdi + 5], al
mov byte [rdi + 6], dl
mov dword [r14], ebx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140041910
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401371a0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x40
call fcn.140189b00
sub rsp, rax
test r8, r8
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
jne 0x1401371d8
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
test rcx, rcx
je 0x140137270
test rdx, rdx
je 0x140137234
mov rcx, qword [rcx + 0x10]
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x28], r8
call fcn.1400c9c70
test rax, rax
jne 0x14013725c
lea rdx, [0x140230588]
sub rdx, rbx
nop
movzx ecx, byte [rbx]
movzx eax, byte [rbx + rdx]
sub ecx, eax
jne 0x140137223
add rbx, 1
test eax, eax
jne 0x140137210
test ecx, ecx
jne 0x140137234
mov rcx, rdi
call fcn.140061250
test rax, rax
jne 0x140137278
mov rcx, qword [rsi + 0x10]
lea rax, str.default
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rdi
call fcn.1400c9c70
test rax, rax
je 0x1401371c6
mov rax, qword [rax + 0x10]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov rcx, r8
call fcn.140061250
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x140138380
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
mov eax, 0x2e8
call fcn.140189b00
sub rsp, rax
mov rax, qword [0x1401f3660]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
mov rsi, qword [rsp + 0x348]
mov rbp, qword [rsp + 0x358]
mov rdi, rcx
mov rcx, rsi
mov dword [rsp + 0x34], r9d
mov qword [rsp + 0x38], r8
mov ebx, edx
mov r14d, 1
call fcn.1400dce40
test eax, eax
movsxd r15, eax
jns 0x1401383e3
xor eax, eax
jmp 0x14013861f
lea rcx, [rsp + 0x160]
mov qword [rsp + 0x2e0], r12
call fcn.14010ee30
test rdi, rdi
mov r12d, dword [rsp + 0x350]
jne 0x140138409
xor ebx, ebx
jmp 0x14013842e
cmp ebx, 0xffffffff
jne 0x14013842e
xor ebx, ebx
mov rax, rdi
cmp byte [rdi], bl
je 0x14013842a
cmp ebx, 0x80000000
jae 0x14013842a
add rax, r14
add ebx, r14d
cmp byte [rax], 0
jne 0x140138417
btr ebx, 0x1f
lea rcx, [rsp + 0x160]
mov r9, rsi
mov r8d, ebx
mov rdx, rdi
mov qword [rsp + 0x20], 0
call fcn.14010eac0
test eax, eax
jne 0x140138465
lea rcx, [rsp + 0x160]
call fcn.14010ef10
xor eax, eax
jmp 0x140138617
test r12d, r12d
mov qword [rsp + 0x2d8], r13
je 0x1401385fd
mov esi, dword [rsp + 0x340]
nop
mov eax, r14d
mov r13d, r12d
cmp r12d, r15d
cmovg r13d, r15d
shr eax, 0x18
lea rdx, [rsp + 0x160]
mov byte [rsp + 0x30], al
mov eax, r14d
lea rcx, [rsp + 0x40]
shr eax, 0x10
mov byte [rsp + 0x33], r14b
mov byte [rsp + 0x31], al
mov eax, r14d
shr eax, 8
mov byte [rsp + 0x32], al
call fcn.14010ee70
test eax, eax
je 0x14013865a
movsxd r8, dword [rsp + 0x34]
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x40]
call fcn.14010ed50
test eax, eax
je 0x14013863f
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
mov r8d, 4
call fcn.14010ed50
test eax, eax
je 0x14013863f
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x40]
xor r8d, r8d
call fcn.14010ed80
test eax, eax
je 0x14013863f
lea rcx, [rsp + 0x40]
call fcn.14010ef10
movsxd rdi, r13d
lea rdx, [rsp + 0x280]
mov r8, rdi
mov rcx, rbp
call fcn.140042d30
mov ebx, 1
cmp esi, ebx
jle 0x1401385ed
nop
nop
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x40]
call fcn.14010ee70
test eax, eax
je 0x14013865a
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x40]
mov r8, r15
call fcn.14010ed50
test eax, eax
je 0x14013863f
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x40]
xor r8d, r8d
call fcn.14010ed80
test eax, eax
je 0x14013863f
lea rcx, [rsp + 0x40]
call fcn.14010ef10
test r13d, r13d
jle 0x1401385e2
lea r8, [rsp + 0x280]
mov rcx, rbp
mov rdx, rdi
sub r8, rbp
nop
nop
nop
movzx eax, byte [r8 + rcx]
add rcx, 1
xor byte [rcx - 1], al
sub rdx, 1
jne 0x1401385d0
add ebx, 1
cmp ebx, esi
jl 0x140138550
add r14d, 1
add rbp, rdi
sub r12d, r13d
jne 0x140138480
lea rcx, [rsp + 0x160]
call fcn.14010ef10
mov eax, 1
mov r13, qword [rsp + 0x2d8]
mov r12, qword [rsp + 0x2e0]
mov rcx, qword [rsp + 0x2c0]
xor rcx, rsp
call fcn.140041910
add rsp, 0x2e8
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
lea rcx, [rsp + 0x160]
call fcn.14010ef10
lea rcx, [rsp + 0x40]
call fcn.14010ef10
xor eax, eax
jmp 0x14013860f
lea rcx, [rsp + 0x160]
call fcn.14010ef10
xor eax, eax
jmp 0x14013860f
Function at 0x140152680
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r12
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov r12d, r8d
lea r9d, [rax + rax]
mov eax, dword [rcx + 0x20]
mov rbp, rdx
lea rcx, [r9 + rax + 0x18]
call qword [fcn.140048900]
test rax, rax
mov rdi, rax
jne 0x1401526c1
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r12
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rsp + 0x48], rsi
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rdi + 0x10], rax
cmp r12d, dword [rbx + 0x1c]
jbe 0x140152705
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, r12d
mov rdx, rbp
call qword [rbx + reloc.WS2_32.dll_htonl]
mov ebp, dword [rbx + 0x18]
mov rdx, qword [rdi + 8]
add rbp, qword [rdi + 0x10]
mov rcx, rbp
call qword [rbx + reloc.WS2_32.dll_recv]
mov r12d, dword [rbx + 0x20]
mov rcx, qword [rdi + 8]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test r12, r12
je 0x140152766
mov rsi, r12
nop
nop
movzx eax, byte [rbp]
lea rdx, [rsp + 0x40]
mov r8d, 1
xor al, 0x36
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx r11d, byte [rbp]
lea rdx, [rsp + 0x40]
xor r11b, 0x5c
mov r8d, 1
add rbp, 1
mov byte [rsp + 0x40], r11b
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub r12, 1
jne 0x140152720
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x1401527a4
nop
mov rcx, qword [rdi + 8]
lea rdx, [0x1401c1be0]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x1401c1be1]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
add rsi, 1
cmp rsi, rax
jb 0x140152770
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
mov rax, rdi
add rsp, 0x20
pop r12
pop rdi
pop rbp
ret
Function at 0x140154030
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push r12
push r13
push r14
push r15
mov eax, 0xb0
call fcn.140189b00
sub rsp, rax
mov rax, qword [0x1401f3660]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbp, qword [rsp + 0x120]
mov rax, qword [rsp + 0x110]
mov r14, qword [rsp + 0x128]
test rbp, rbp
mov ebx, r9d
mov qword [rsp + 0x40], r8
mov r13, rcx
mov qword [rsp + 0x38], rax
lea esi, [rdx - 1]
mov dword [rsp + 0x30], ebx
jne 0x140154097
call fcn.1400dcc50
mov rbp, rax
test r14, r14
mov rcx, rbp
cmove r14, rbp
call fcn.1400dce40
mov r15d, esi
movsxd r12, eax
lea eax, [r12 + r12]
sub r15d, eax
lea ecx, [r15 - 1]
cmp ebx, ecx
jle 0x1401540e4
mov edx, 0xa0
lea r9, [0x140234fd8]
mov ecx, 4
lea r8d, [rdx - 0x32]
mov dword [rsp + 0x20], Ordinal_60
call fcn.1400a5900
xor eax, eax
jmp 0x140154286
add eax, 1
cmp esi, eax
jge 0x140154114
mov edx, 0xa0
lea r9, [0x140234ff0]
mov ecx, 4
lea r8d, [rdx - 0x28]
mov dword [rsp + 0x20], 0x40
call fcn.1400a5900
xor eax, eax
jmp 0x140154286
movsxd rdx, dword [rsp + 0x118]
mov rcx, qword [rsp + 0x38]
mov byte [r13], 0
lea rbx, [r13 + 1]
lea r13, [r12 + r13 + 1]
xor r9d, r9d
mov r8, r13
mov qword [rsp + 0xa8], rdi
mov qword [rsp + 0x28], 0
mov rdi, r12
mov qword [rsp + 0x20], rbp
call fcn.1400dab10
test eax, eax
je 0x1401541e2
mov ebp, dword [rsp + 0x30]
lea rcx, [r12 + r13]
xor edx, edx
sub r15d, ebp
sub r15d, 1
movsxd r8, r15d
call fcn.140041940
mov rdx, qword [rsp + 0x40]
movsxd r11, ebp
movsxd rcx, esi
mov r8, rbp
sub rcx, r11
sub rcx, r12
add rcx, r13
mov byte [rcx - 1], 1
call fcn.140042d30
mov edx, r12d
mov rcx, rbx
call fcn.14009f500
test eax, eax
jle 0x1401541e2
sub esi, r12d
lea rdx, [0x140235008]
mov r8d, 0x55
mov ecx, esi
call fcn.1400adb80
test rax, rax
mov rbp, rax
jne 0x1401541e9
lea r9, [0x140235020]
lea ecx, [rax + 4]
lea r8d, [rax + 0x41]
mov edx, 0xa0
mov dword [rsp + 0x20], 0x57
call fcn.1400a5900
xor eax, eax
jmp 0x14015427e
mov r9d, r12d
mov r8, rbx
mov edx, esi
mov rcx, rax
mov qword [rsp + 0x20], r14
call fcn.140153eb0
test eax, eax
js 0x1401541e2
test esi, esi
jle 0x140154232
mov r9, rbp
mov rcx, r13
mov edx, esi
sub r9, r13
nop
nop
nop
nop
movzx eax, byte [r9 + rcx]
add rcx, 1
xor byte [rcx - 1], al
sub rdx, 1
jne 0x140154220
lea rcx, [rsp + 0x50]
mov r9d, esi
mov r8, r13
mov edx, r12d
mov qword [rsp + 0x20], r14
call fcn.140153eb0
test eax, eax
js 0x1401541e2
test r12d, r12d
jle 0x140154271
lea rcx, [rsp + 0x50]
sub rcx, rbx
nop
nop
movzx eax, byte [rcx + rbx]
add rbx, 1
xor byte [rbx - 1], al
sub rdi, 1
jne 0x140154260
mov rcx, rbp
call fcn.1400ae010
mov eax, 1
mov rdi, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140041910
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rbp
pop rbx
ret
Function at 0x1401547d0
Capabilities:
Check for software breakpoints

Disassembly:
mov eax, reloc.WS2_32.dll_getservbyport
call fcn.140189b00
sub rsp, rax
cmp dword [rsp + 0x60], r9d
mov r10, rcx
jne 0x1401548bf
movzx eax, byte [r8]
cmp al, 0x6a
je 0x1401547fb
cmp al, 0x6b
jne 0x1401548bf
cmp al, 0x6b
mov qword [rsp + 0x30], rbx
lea rdx, [r8 + 1]
jne 0x14015486e
lea ebx, [r9 - 3]
xor eax, eax
test ebx, ebx
jle 0x14015482a
movzx ecx, byte [rdx]
add rdx, 1
cmp cl, 0xba
je 0x14015482a
cmp cl, 0xbb
jne 0x14015485d
add eax, 1
cmp eax, ebx
jl 0x140154812
sub ebx, eax
test eax, eax
jne 0x140154872
mov dword [rsp + 0x20], 0x83
lea r9, [0x1402350f8]
mov edx, 0x80
lea ecx, [rdx - 0x7c]
lea r8d, [rdx + 0xa]
call fcn.1400a5900
mov rbx, qword [rsp + 0x30]
or eax, 0xffffffff
add rsp, 0x38
ret
mov dword [rsp + 0x20], 0x7b
lea r9, [0x1402350e0]
jmp 0x14015483f
lea ebx, [r9 - 2]
movsxd rax, ebx
cmp byte [rax + rdx], 0xcc
je 0x1401548a8
mov edx, 0x80
lea r9, str..crypto_rsa_rsa_x931.c
mov dword [rsp + 0x20], Ordinal_143
lea ecx, [rdx - 0x7c]
lea r8d, [rdx + 0xb]
call fcn.1400a5900
mov rbx, qword [rsp + 0x30]
or eax, 0xffffffff
add rsp, 0x38
ret
mov r8d, ebx
mov rcx, r10
call fcn.140042d30
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
ret
mov edx, 0x80
lea r9, [0x1402350c8]
mov dword [rsp + 0x20], reloc.WS2_32.dll_WSASetLastError
lea ecx, [rdx - 0x7c]
lea r8d, [rdx + 9]
call fcn.1400a5900
or eax, 0xffffffff
add rsp, 0x38
ret
Function at 0x14015bbc0
Capabilities:
Encode data using add xor sub operations

Disassembly:
test r8, r8
je 0x14015bdc8
push rbp
mov eax, 0xe0
call fcn.140189b00
sub rsp, rax
mov rax, qword [0x1401f3660]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0x100], rbx
mov qword [rsp + 0xd8], rsi
mov qword [rsp + 0xd0], rdi
mov qword [rsp + 0xc8], r12
lea rsi, [r8 - 1]
mov qword [rsp + 0xc0], r13
shr rsi, 3
mov rbp, rdx
lea r12, [rcx + 0xc]
add rsi, 1
lea r13, [rcx + 0x14]
nop
nop
movzx eax, byte [rbp + 1]
movzx ebx, byte [rbp]
movzx edi, byte [rbp + 4]
shl eax, 8
mov rcx, r12
add rbp, 8
or ebx, eax
movzx eax, byte [rbp - 6]
shl eax, 0x10
or ebx, eax
movzx eax, byte [rbp - 5]
shl eax, 0x18
or ebx, eax
movzx eax, byte [rbp - 3]
shl eax, 8
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
or edi, eax
movzx eax, byte [rbp - 2]
shl eax, 0x10
or edi, eax
movzx eax, byte [rbp - 1]
and byte [r12], 0xdf
and byte [r13], 0xbf
or byte [r12], 0x40
or byte [r13], 0x20
shl eax, 0x18
or edi, eax
mov dword [rsp + 0x2c], edi
mov dword [rsp + 0x24], edi
call fcn.140134930
lea rdx, [rsp + 0x30]
mov rcx, r12
call fcn.140134990
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
mov r8d, 1
call fcn.140131ec0
mov rcx, r13
call fcn.140134930
lea rdx, [rsp + 0x30]
mov rcx, r13
call fcn.140134990
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x28]
mov r8d, 1
call fcn.140131ec0
mov r11d, dword [rsp + 0x28]
mov edx, dword [rsp + 0x2c]
xor r11d, ebx
xor ebx, dword [rsp + 0x20]
xor edx, edi
xor edi, dword [rsp + 0x24]
mov byte [r12], bl
mov eax, ebx
shr eax, 8
mov byte [r12 + 1], al
mov eax, ebx
shr ebx, 0x18
shr eax, 0x10
mov byte [r12 + 2], al
mov byte [r12 + 3], bl
mov byte [r12 + 4], dl
mov eax, edx
shr eax, 8
mov byte [r12 + 5], al
mov eax, edx
shr edx, 0x18
shr eax, 0x10
mov byte [r12 + 6], al
mov byte [r12 + 7], dl
mov byte [r13], r11b
mov eax, r11d
shr eax, 8
mov byte [r13 + 1], al
mov eax, r11d
shr eax, 0x10
shr r11d, 0x18
mov byte [r13 + 2], al
mov byte [r13 + 3], r11b
mov byte [r13 + 4], dil
mov eax, edi
shr eax, 8
mov byte [r13 + 5], al
mov eax, edi
shr edi, 0x18
shr eax, 0x10
sub rsi, 1
mov byte [r13 + 6], al
mov byte [r13 + 7], dil
jne 0x14015bc30
mov r13, qword [rsp + 0xc0]
mov r12, qword [rsp + 0xc8]
mov rdi, qword [rsp + 0xd0]
mov rsi, qword [rsp + 0xd8]
mov rbx, qword [rsp + 0x100]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140041910
add rsp, 0xe0
pop rbp
ret 0
Function at 0x14015bbc9
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
test r8, r8
je 0x14015bdc8
push rbp
mov eax, 0xe0
call fcn.140189b00
sub rsp, rax
mov rax, qword [0x1401f3660]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0x100], rbx
mov qword [rsp + 0xd8], rsi
mov qword [rsp + 0xd0], rdi
mov qword [rsp + 0xc8], r12
lea rsi, [r8 - 1]
mov qword [rsp + 0xc0], r13
shr rsi, 3
mov rbp, rdx
lea r12, [rcx + 0xc]
add rsi, 1
lea r13, [rcx + 0x14]
nop
nop
movzx eax, byte [rbp + 1]
movzx ebx, byte [rbp]
movzx edi, byte [rbp + 4]
shl eax, 8
mov rcx, r12
add rbp, 8
or ebx, eax
movzx eax, byte [rbp - 6]
shl eax, 0x10
or ebx, eax
movzx eax, byte [rbp - 5]
shl eax, 0x18
or ebx, eax
movzx eax, byte [rbp - 3]
shl eax, 8
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
or edi, eax
movzx eax, byte [rbp - 2]
shl eax, 0x10
or edi, eax
movzx eax, byte [rbp - 1]
and byte [r12], 0xdf
and byte [r13], 0xbf
or byte [r12], 0x40
or byte [r13], 0x20
shl eax, 0x18
or edi, eax
mov dword [rsp + 0x2c], edi
mov dword [rsp + 0x24], edi
call fcn.140134930
lea rdx, [rsp + 0x30]
mov rcx, r12
call fcn.140134990
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
mov r8d, 1
call fcn.140131ec0
mov rcx, r13
call fcn.140134930
lea rdx, [rsp + 0x30]
mov rcx, r13
call fcn.140134990
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x28]
mov r8d, 1
call fcn.140131ec0
mov r11d, dword [rsp + 0x28]
mov edx, dword [rsp + 0x2c]
xor r11d, ebx
xor ebx, dword [rsp + 0x20]
xor edx, edi
xor edi, dword [rsp + 0x24]
mov byte [r12], bl
mov eax, ebx
shr eax, 8
mov byte [r12 + 1], al
mov eax, ebx
shr ebx, 0x18
shr eax, 0x10
mov byte [r12 + 2], al
mov byte [r12 + 3], bl
mov byte [r12 + 4], dl
mov eax, edx
shr eax, 8
mov byte [r12 + 5], al
mov eax, edx
shr edx, 0x18
shr eax, 0x10
mov byte [r12 + 6], al
mov byte [r12 + 7], dl
mov byte [r13], r11b
mov eax, r11d
shr eax, 8
mov byte [r13 + 1], al
mov eax, r11d
shr eax, 0x10
shr r11d, 0x18
mov byte [r13 + 2], al
mov byte [r13 + 3], r11b
mov byte [r13 + 4], dil
mov eax, edi
shr eax, 8
mov byte [r13 + 5], al
mov eax, edi
shr edi, 0x18
shr eax, 0x10
sub rsi, 1
mov byte [r13 + 6], al
mov byte [r13 + 7], dil
jne 0x14015bc30
mov r13, qword [rsp + 0xc0]
mov r12, qword [rsp + 0xc8]
mov rdi, qword [rsp + 0xd0]
mov rsi, qword [rsp + 0xd8]
mov rbx, qword [rsp + 0x100]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140041910
add rsp, 0xe0
pop rbp
ret 0
Function at 0x14015f200
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x40
call fcn.140189b00
sub rsp, rax
mov rax, qword [0x1401f3660]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xa0]
mov r14, qword [rsp + 0xa8]
mov esi, r8d
movzx r10d, byte [rax]
movzx r8d, byte [rax + 4]
mov ebx, dword [r14]
lea rdi, [rax + 1]
mov qword [rsp + 0x28], rax
shl r10d, 0x18
movzx eax, byte [rdi]
mov rbp, rcx
movzx ecx, byte [rdi + 5]
shl eax, 0x10
shl r8d, 0x18
shl ecx, 8
or r10d, eax
movzx eax, byte [rdi + 1]
mov r12, rdx
shl eax, 8
lea rdx, [rdi + 5]
xor r13d, r13d
or r10d, eax
movzx eax, byte [rdi + 2]
mov r15, r9
or r10d, eax
movzx eax, byte [rdi + 4]
shl eax, 0x10
mov dword [rsp + 0x20], r10d
mov byte [rsp + 0x33], r10b
or r8d, eax
movzx eax, byte [rdx + 1]
or ecx, eax
mov eax, r10d
shr eax, 0x18
or r8d, ecx
mov byte [rsp + 0x30], al
mov eax, r10d
mov dword [rsp + 0x24], r8d
shr eax, 0x10
mov byte [rsp + 0x37], r8b
mov byte [rsp + 0x31], al
mov eax, r10d
shr eax, 8
mov byte [rsp + 0x32], al
mov eax, r8d
shr eax, 0x18
mov byte [rsp + 0x34], al
mov eax, r8d
shr eax, 0x10
mov byte [rsp + 0x35], al
mov eax, r8d
shr eax, 8
test esi, esi
mov byte [rsp + 0x36], al
je 0x14015f3d6
movzx edx, r8b
movzx r9d, r10b
sub esi, 1
test ebx, ebx
jne 0x14015f36d
lea rcx, [rsp + 0x20]
mov rdx, r15
call fcn.14015def0
mov r10d, dword [rsp + 0x20]
mov r8d, dword [rsp + 0x24]
mov eax, r10d
mov dl, r8b
mov r9b, r10b
shr eax, 0x18
mov byte [rsp + 0x33], r10b
mov byte [rsp + 0x37], dl
mov byte [rsp + 0x30], al
mov eax, r10d
shr eax, 0x10
mov byte [rsp + 0x31], al
mov eax, r10d
shr eax, 8
mov byte [rsp + 0x32], al
mov eax, r8d
shr eax, 0x18
mov byte [rsp + 0x34], al
mov eax, r8d
shr eax, 0x10
mov byte [rsp + 0x35], al
mov eax, r8d
shr eax, 8
add r13d, 1
mov byte [rsp + 0x36], al
movsxd rax, ebx
add ebx, 1
add r12, 1
movzx ecx, byte [rsp + rax + 0x30]
add rbp, 1
and ebx, 7
xor cl, byte [rbp - 1]
test esi, esi
mov byte [r12 - 1], cl
jne 0x14015f300
test r13d, r13d
je 0x14015f3d6
mov rcx, qword [rsp + 0x28]
mov eax, r10d
shr eax, 0x18
mov byte [rcx], al
mov eax, r10d
shr r10d, 8
shr eax, 0x10
mov byte [rdi], al
mov byte [rdi + 1], r10b
mov byte [rdi + 2], r9b
mov eax, r8d
shr eax, 0x18
mov byte [rdi + 3], al
mov eax, r8d
shr eax, 0x10
shr r8d, 8
mov byte [rdi + 4], al
mov byte [rdi + 5], r8b
mov byte [rdi + 6], dl
mov dword [r14], ebx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140041910
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret