joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401f5059
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x1401f5257
push rbp
mov eax, 0xe0
call fcn.1402563f0
sub rsp, rax
mov rax, qword [0x1403bb2d8]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0x100], rbx
mov qword [rsp + 0xd8], rsi
mov qword [rsp + 0xd0], rdi
mov qword [rsp + 0xc8], r12
lea rsi, [r8 - 1]
mov qword [rsp + 0xc0], r13
shr rsi, 3
mov rbp, rdx
lea r12, [rcx + 0xc]
inc rsi
lea r13, [rcx + 0x14]
nop word [rax + rax]
movzx eax, byte [rbp + 1]
movzx ebx, byte [rbp]
movzx edi, byte [rbp + 4]
shl eax, 8
mov rcx, r12
add rbp, 8
or ebx, eax
movzx eax, byte [rbp - 6]
shl eax, 0x10
or ebx, eax
movzx eax, byte [rbp - 5]
shl eax, 0x18
or ebx, eax
movzx eax, byte [rbp - 3]
shl eax, 8
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
or edi, eax
movzx eax, byte [rbp - 2]
shl eax, 0x10
or edi, eax
movzx eax, byte [rbp - 1]
and byte [r12], 0xdf
and byte [r13], 0xbf
or byte [r12], 0x40
or byte [r13], 0x20
shl eax, 0x18
or edi, eax
mov dword [rsp + 0x2c], edi
mov dword [rsp + 0x24], edi
call fcn.1401e9c00
lea rdx, [rsp + 0x30]
mov rcx, r12
call fcn.1401e9c60
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
mov r8d, 1
call fcn.1401e5e50
mov rcx, r13
call fcn.1401e9c00
lea rdx, [rsp + 0x30]
mov rcx, r13
call fcn.1401e9c60
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x28]
mov r8d, 1
call fcn.1401e5e50
mov r11d, dword [rsp + 0x28]
mov edx, dword [rsp + 0x2c]
xor r11d, ebx
xor ebx, dword [rsp + 0x20]
xor edx, edi
xor edi, dword [rsp + 0x24]
mov byte [r12], bl
mov eax, ebx
shr eax, 8
mov byte [r12 + 1], al
mov eax, ebx
shr ebx, 0x18
shr eax, 0x10
mov byte [r12 + 2], al
mov byte [r12 + 3], bl
mov byte [r12 + 4], dl
mov eax, edx
shr eax, 8
mov byte [r12 + 5], al
mov eax, edx
shr edx, 0x18
shr eax, 0x10
mov byte [r12 + 6], al
mov byte [r12 + 7], dl
mov byte [r13], r11b
mov eax, r11d
shr eax, 8
mov byte [r13 + 1], al
mov eax, r11d
shr eax, 0x10
shr r11d, 0x18
mov byte [r13 + 2], al
mov byte [r13 + 3], r11b
mov byte [r13 + 4], dil
mov eax, edi
shr eax, 8
mov byte [r13 + 5], al
mov eax, edi
shr edi, 0x18
shr eax, 0x10
dec rsi
mov byte [r13 + 6], al
mov byte [r13 + 7], dil
jne 0x1401f50c0
mov r13, qword [rsp + 0xc0]
mov r12, qword [rsp + 0xc8]
mov rdi, qword [rsp + 0xd0]
mov rsi, qword [rsp + 0xd8]
mov rbx, qword [rsp + 0x100]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140254fb0
add rsp, 0xe0
pop rbp
repz ret

Function at 0x1401f53a0
Capabilities:
Hash data using sha1

Disassembly:
push rbx
mov eax, 0x20
call fcn.1402563f0
sub rsp, rax
mov rbx, rcx
call fcn.1401afff0
test eax, eax
jne 0x1401f53c1
add rsp, 0x20
pop rbx
ret
lea rcx, [rbx + 0x5c]
add rsp, 0x20
pop rbx
jmp fcn.140181ee0
Function at 0x1401fc3c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x20
call fcn.1402563f0
sub rsp, rax
mov eax, dword [r8 + 8]
mov rsi, rdx
mov rdi, rcx
cmp dword [rdx + 8], eax
jge 0x1401fc3ec
mov rbx, r8
jmp 0x1401fc3f2
mov rbx, rdx
mov rsi, r8
mov edx, dword [rbx + 8]
call fcn.14011b570
test rax, rax
jne 0x1401fc40f
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor r8d, r8d
cmp dword [rsi + 8], r8d
jle 0x1401fc444
mov r9d, r8d
nop dword [rax + rax]
mov rax, qword [rsi]
mov rcx, qword [rbx]
inc r8d
mov rdx, qword [rcx + r9]
add r9, 8
xor rdx, qword [rax + r9 - 8]
mov rax, qword [rdi]
mov qword [r9 + rax - 8], rdx
cmp r8d, dword [rsi + 8]
jl 0x1401fc420
movsxd rdx, r8d
cmp r8d, dword [rbx + 8]
jge 0x1401fc46d
shl rdx, 3
mov rax, qword [rbx]
mov rcx, qword [rdi]
inc r8d
mov rax, qword [rdx + rax]
add rdx, 8
mov qword [rdx + rcx - 8], rax
cmp r8d, dword [rbx + 8]
jl 0x1401fc451
mov eax, dword [rbx + 8]
mov rcx, rdi
mov dword [rdi + 8], eax
call fcn.14011ad90
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov eax, 1
add rsp, 0x20
pop rdi
ret
Function at 0x140224470
Capabilities:
Encode data using xor

Disassembly:
mov r11, rdx
mov r9, rcx
test rdx, rdx
je 0x1402244e9
test r8, r8
je 0x1402244e9
mov r10, qword [rcx + 0x28]
cmp r8, r10
cmovb r10, r8
test r10, r10
je 0x1402244b0
add rcx, 0x34
sub rdx, r9
nop word [rax + rax]
movzx eax, byte [rdx + rcx - 0x34]
inc rcx
xor byte [rcx - 1], al
dec r10
jne 0x1402244a0
mov rax, qword [r9 + 0x28]
cmp r8, rax
jbe 0x1402244e9
sub r8, rax
mov eax, reloc.WS2_32.dll_recv
cmp r8, rax
cmova r8, rax
xor ecx, ecx
test r8, r8
je 0x1402244e9
nop
mov rax, qword [r9 + 0x28]
add rax, rcx
inc rcx
movzx eax, byte [rax + r11]
xor byte [r9 + rcx + 0x53], al
cmp rcx, r8
jb 0x1402244d0
repz ret

Function at 0x1402244f0
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov eax, reloc.WS2_32.dll_WSASetLastError
call fcn.1402563f0
sub rsp, rax
mov rax, qword [0x1403bb2d8]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rax, qword [rdx]
mov r11, rcx
mov cl, 2
cmp qword [r11 + 0x28], 0x10
mov qword [rsp + 0x38], rax
mov rax, qword [rdx + 8]
mov qword [rsp + 0x40], rax
mov rax, qword [rdx]
mov qword [rsp + 0x48], rax
mov rax, qword [rdx + 8]
mov qword [rsp + 0x50], rax
je 0x14022454f
mov rax, qword [rdx]
mov cl, 3
mov qword [rsp + 0x58], rax
mov rax, qword [rdx + 8]
mov qword [rsp + 0x60], rax
movzx ebx, cl
lea rdx, [r11 + 0x80]
mov dword [rsp + 0x30], reloc.WS2_32.dll_recv
shl ebx, 4
movsxd r9, ebx
test ebx, ebx
jle 0x140224591
lea r10, [rsp + 0x38]
mov r8, rdx
sub r10, rdx
nop word [rax + rax]
movzx eax, byte [r10 + r8]
inc r8
xor byte [r8 - 1], al
dec r9
jne 0x140224580
mov rcx, qword [r11 + 0x10]
lea r8, [rsp + 0x30]
mov r9, rdx
mov dword [rsp + 0x20], ebx
call fcn.1400db860
test eax, eax
je 0x1402245c8
cmp dword [rsp + 0x30], ebx
jne 0x1402245c8
mov eax, 1
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140254fb0
add rsp, 0x70
pop rbx
ret
xor eax, eax
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140254fb0
add rsp, 0x70
pop rbx
ret
Function at 0x1402245e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov eax, reloc.WS2_32.dll_WSASetLastError
call fcn.1402563f0
sub rsp, rax
mov rax, qword [0x1403bb2d8]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor eax, eax
lea rdx, [rcx + 0x80]
xor ebx, ebx
mov qword [rdx], rax
mov qword [rdx + 8], rax
mov qword [rdx + 0x10], rax
mov qword [rdx + 0x18], rax
mov qword [rdx + 0x20], rax
mov qword [rdx + 0x28], rax
cmp qword [rcx + 0x28], 0x10
mov qword [rsp + 0x49], rax
mov qword [rsp + 0x59], rax
setne bl
mov byte [rsp + 0x38], 0
mov qword [rsp + 0x39], rax
add ebx, 2
mov qword [rsp + 0x41], rax
mov qword [rsp + 0x51], rax
shl ebx, 4
mov dword [rsp + 0x61], eax
mov word [rsp + 0x65], ax
mov byte [rsp + 0x67], al
mov byte [rsp + 0x4b], 1
mov byte [rsp + 0x5b], 2
mov dword [rsp + 0x30], reloc.WS2_32.dll_recv
movsxd r9, ebx
test ebx, ebx
jle 0x140224691
lea r10, [rsp + 0x38]
mov r8, rdx
sub r10, rdx
nop dword [rax]
movzx eax, byte [r10 + r8]
inc r8
xor byte [r8 - 1], al
dec r9
jne 0x140224680
mov rcx, qword [rcx + 0x10]
lea r8, [rsp + 0x30]
mov r9, rdx
mov dword [rsp + 0x20], ebx
call fcn.1400db860
test eax, eax
je 0x1402246c8
cmp dword [rsp + 0x30], ebx
jne 0x1402246c8
mov eax, 1
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140254fb0
add rsp, 0x70
pop rbx
ret
xor eax, eax
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140254fb0
add rsp, 0x70
pop rbx
ret
Function at 0x1402246e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rdi
mov eax, 0x80
call fcn.1402563f0
sub rsp, rax
mov rax, qword [0x1403bb2d8]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rbx, r8
mov rdi, rdx
mov rbp, rcx
test rdx, rdx
je 0x14022486c
test rbx, rbx
je 0x14022486c
mov rax, qword [rcx + 0x78]
mov qword [rsp + 0x78], rsi
test rax, rax
je 0x140224765
mov esi, reloc.WS2_32.dll_recv
sub rsi, rax
cmp rbx, rsi
jb 0x140224765
lea rcx, [rax + rcx + 0x64]
mov r8, rsi
call fcn.140255100
lea rdx, [rbp + 0x64]
mov rcx, rbp
call fcn.1402244f0
test eax, eax
je 0x14022484b
sub rbx, rsi
mov qword [rbp + 0x78], 0
add rdi, rsi
mov qword [rsp + 0x70], r12
cmp rbx, 0x10
jb 0x140224824
lea r12, [rbp + 0x80]
nop dword [rax + rax]
cmp qword [rbp + 0x28], 0x10
mov rax, qword [rdi]
mov cl, 2
mov qword [rsp + 0x38], rax
mov rax, qword [rdi + 8]
mov qword [rsp + 0x40], rax
mov rax, qword [rdi]
mov qword [rsp + 0x48], rax
mov rax, qword [rdi + 8]
mov qword [rsp + 0x50], rax
je 0x1402247be
mov rax, qword [rdi]
mov cl, 3
mov qword [rsp + 0x58], rax
mov rax, qword [rdi + 8]
mov qword [rsp + 0x60], rax
movzx esi, cl
mov dword [rsp + 0x30], reloc.WS2_32.dll_recv
shl esi, 4
movsxd rdx, esi
test esi, esi
jle 0x1402247f0
lea r8, [rsp + 0x38]
mov rcx, r12
sub r8, r12
nop
movzx eax, byte [r8 + rcx]
inc rcx
xor byte [rcx - 1], al
dec rdx
jne 0x1402247e0
mov rcx, qword [rbp + 0x10]
lea r8, [rsp + 0x30]
mov r9, r12
mov rdx, r12
mov dword [rsp + 0x20], esi
call fcn.1400db860
test eax, eax
je 0x140224868
cmp dword [rsp + 0x30], esi
jne 0x140224868
sub rbx, 0x10
add rdi, 0x10
cmp rbx, 0x10
jae 0x140224780
test rbx, rbx
je 0x140224841
mov rax, qword [rbp + 0x78]
mov r8, rbx
mov rdx, rdi
lea rcx, [rax + rbp + 0x64]
call fcn.140255100
add qword [rbp + 0x78], rbx
mov eax, 1
mov r12, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140254fb0
add rsp, 0x80
pop rdi
pop rbp
pop rbx
ret
xor eax, eax
jmp 0x140224846
mov eax, 1
jmp 0x140224850
Function at 0x140229000
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push rbx
push r12
push r13
mov eax, gethostbyname
call fcn.1402563f0
sub rsp, rax
mov qword [rsp + 0x60], rdi
mov rdi, qword [rsp + 0x78]
mov qword [rsp + 0x28], r14
mov r12, rdx
mov qword [rsp + 0x20], r15
mov r13, r9
shl r12, 5
mov r14, rdx
mov rbx, rcx
mov r15, r8
test r12, r12
je 0x140229073
mov r10, r12
movzx eax, byte [rcx]
add rdi, 4
add rcx, 4
mov dword [rdi - 4], eax
movzx eax, byte [rcx - 3]
shl eax, 8
or dword [rdi - 4], eax
movzx eax, byte [rcx - 2]
shl eax, 0x10
or dword [rdi - 4], eax
movzx eax, byte [rcx - 1]
shl eax, 0x18
or dword [rdi - 4], eax
dec r10
jne 0x140229042
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rsi
cmp r8, 1
jbe 0x1402290a9
mov rsi, rdx
lea rbp, [r8 - 1]
shl rsi, 7
nop
mov rdx, rdi
mov r8, r14
mov rcx, rdi
sub rdx, rsi
call fcn.140228bf0
add rdi, rsi
dec rbp
jne 0x140229090
lea rdx, [r15 - 1]
mov r8, r14
mov rcx, r13
imul rdx, r14
shl rdx, 7
add rdx, qword [rsp + 0x78]
call fcn.140228bf0
test r15, r15
je 0x14022913b
mov rdi, qword [rsp + 0x70]
mov rbp, r14
mov rsi, r15
shl rbp, 7
nop dword [rax]
mov eax, dword [r13 + rbp - 0x40]
xor edx, edx
div r15
mov r8d, edx
imul r8, r14
shl r8, 7
add r8, qword [rsp + 0x78]
test r12, r12
je 0x140229128
mov r9, r13
mov rcx, rdi
mov rdx, r12
sub r9, rdi
nop dword [rax + rax]
mov eax, dword [r9 + rcx]
add rcx, 4
add r8, 4
xor eax, dword [r8 - 4]
dec rdx
mov dword [rcx - 4], eax
jne 0x140229110
mov r8, r14
mov rdx, rdi
mov rcx, r13
call fcn.140228bf0
dec rsi
jne 0x1402290e0
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
xor edx, edx
test r12, r12
je 0x14022918a
nop dword [rax + rax]
mov ecx, dword [r13 + rdx*4]
inc rdx
add rbx, 4
mov byte [rbx - 4], cl
mov eax, ecx
shr eax, 8
mov byte [rbx - 3], al
mov eax, ecx
shr ecx, 0x18
shr eax, 0x10
mov byte [rbx - 2], al
mov byte [rbx - 1], cl
cmp rdx, r12
jb 0x140229160
add rsp, 0x30
pop r13
pop r12
pop rbx
ret
Function at 0x14022b790
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r12
push r13
mov eax, 0x50
call fcn.1402563f0
sub rsp, rax
mov r13, rdx
test rdx, rdx
mov r12, r9
mov rdx, r8
mov rbp, r8
je 0x14022b911
mov qword [rsp + 0x70], rbx
mov rbx, qword [rsp + 0xa0]
mov qword [rsp + 0x80], rdi
mov rdi, qword [rsp + 0xa8]
mov qword [rsp + 0x48], r14
lea r14, [r9 + 1]
mov r9, qword [rsp + 0x90]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], r15
mov r15, qword [rsp + 0x98]
shr r14, 1
mov qword [rsp + 0x28], rbx
mov r8, r14
mov qword [rsp + 0x20], r15
call fcn.14022b580
test eax, eax
je 0x14022b867
lea rdx, str.providersimplementationskdfs_tls1_prf.c
mov r8d, 0x186
mov rcx, rdi
mov qword [rsp + 0x78], rsi
call fcn.1400b4570
mov rsi, rax
test rax, rax
jne 0x14022b888
call fcn.1400baf40
lea r8, str.tls1_prf_alg
lea rcx, str.providersimplementationskdfs_tls1_prf.c
mov edx, 0x187
call fcn.1400bafb0
lea ecx, [rsi + 0x39]
xor r8d, r8d
mov edx, 0xc0100
call fcn.1400bb200
xor eax, eax
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
mov r14, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x70]
mov r15, qword [rsp + 0x40]
add rsp, 0x50
pop r13
pop r12
pop rbp
ret
mov r9, qword [rsp + 0x90]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rax
sub rbp, r14
mov r8, r14
mov rcx, r13
lea rdx, [r12 + rbp]
mov qword [rsp + 0x20], r15
call fcn.14022b580
test eax, eax
jne 0x14022b8cf
lea r8, str.providersimplementationskdfs_tls1_prf.c
mov r9d, 0x18d
mov rdx, rdi
mov rcx, rsi
call fcn.1400b4670
jmp 0x14022b860
test rdi, rdi
je 0x14022b8ef
mov rdx, rsi
mov rcx, rdi
sub rdx, rbx
nop dword [rax]
movzx eax, byte [rdx + rbx]
inc rbx
xor byte [rbx - 1], al
dec rcx
jne 0x14022b8e0
lea r8, str.providersimplementationskdfs_tls1_prf.c
mov r9d, 0x192
mov rdx, rdi
mov rcx, rsi
call fcn.1400b4670
mov eax, 1
jmp 0x14022b862
mov rax, qword [rsp + 0xa8]
mov r9, qword [rsp + 0x90]
mov r8, r12
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x20], rax
call fcn.14022b580
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x50
pop r13
pop r12
pop rbp
ret
Function at 0x14023c020
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, reloc.WS2_32.dll_WSASetLastError
call fcn.1402563f0
sub rsp, rax
mov rax, qword [0x1403bb2d8]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, r9
mov rbx, rcx
cmp edx, 0x1d
je 0x1401835c7
mov eax, 0xfffffffe
jmp 0x1401836ec
test rcx, rcx
jne 0x1401835d3
xor eax, eax
jmp 0x1401836ec
cmp r8d, 0x30
jne 0x1401835cc
mov r8d, gethostbyname
mov rdx, r9
call fcn.1401832b0
test eax, eax
jle 0x1401835cc
movabs rax, 0x3636363636363636
lea rdx, [rsp + 0x20]
mov r8d, 0x28
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
call fcn.1401832b0
test eax, eax
je 0x1401835cc
lea rcx, [rsp + 0x48]
mov rdx, rbx
call fcn.140183400
test eax, eax
je 0x1401835cc
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 0x60]
call fcn.140254810
mov r8d, gethostbyname
mov rdx, rdi
mov rcx, rbx
mov dword [rbx], 0x67452301
mov dword [rbx + 4], 0xefcdab89
mov dword [rbx + 8], 0x98badcfe
mov dword [rbx + 0xc], 0x10325476
mov dword [rbx + 0x10], 0xc3d2e1f0
call fcn.1401832b0
test eax, eax
jle 0x1401835cc
movabs rax, 0x5c5c5c5c5c5c5c5c
lea rdx, [rsp + 0x20]
mov r8d, 0x28
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
call fcn.1401832b0
test eax, eax
je 0x1401835cc
lea rdx, [rsp + 0x48]
mov r8d, socket
mov rcx, rbx
call fcn.1401832b0
test eax, eax
je 0x1401835cc
lea rcx, [rsp + 0x48]
mov edx, socket
call fcn.1400f5f80
mov eax, 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140254fb0
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
push rbx
mov eax, 0x20
call fcn.1402563f0
sub rsp, rax
mov rax, rdx
mov rbx, rcx
test rcx, rcx
jne 0x14023c042
xor eax, eax
add rsp, 0x20
pop rbx
ret
test rdx, rdx
je 0x14023c07b
lea rdx, str.ssl3_ms
mov rcx, rax
call fcn.140103f50
test rax, rax
je 0x14023c07b
cmp dword [rax + 8], 5
jne 0x14023c07b
mov r9, qword [rax + 0x10]
mov r8d, dword [rax + 0x18]
mov edx, 0x1d
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x140183590
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x14024c930
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x20
call fcn.1402563f0
sub rsp, rax
add qword [rcx], r8
mov rsi, qword [rcx + 8]
mov rdi, qword [rcx + 0x10]
mov rbp, qword [rcx + 0x18]
mov rbx, qword [rcx + 0x20]
mov r12, rcx
mov ecx, dword [rcx + 0x28]
mov r13, r8
mov r14, rdx
test ecx, ecx
je 0x14024ca58
mov r15d, 8
sub r15d, ecx
lea rcx, [rcx + r12 + 0x38]
cmp r8, r15
jae 0x14024c99e
call fcn.140255100
add dword [r12 + 0x28], r13d
jmp 0x14024cb61
mov r8, r15
call fcn.140255100
movzx eax, byte [r12 + 0x3e]
movzx ecx, byte [r12 + 0x3f]
shl rcx, 8
sub r13, r15
add r14, r15
or rcx, rax
movzx eax, byte [r12 + 0x3d]
shl rcx, 8
or rcx, rax
movzx eax, byte [r12 + 0x3c]
shl rcx, 8
or rcx, rax
movzx eax, byte [r12 + 0x3b]
shl rcx, 8
or rcx, rax
movzx eax, byte [r12 + 0x3a]
shl rcx, 8
or rcx, rax
movzx eax, byte [r12 + 0x39]
shl rcx, 8
or rcx, rax
movzx eax, byte [r12 + 0x38]
shl rcx, 8
or rcx, rax
xor rbx, rcx
cmp dword [r12 + 0x30], 0
jbe 0x14024ca55
mov eax, dword [r12 + 0x30]
nop dword [rax]
add rsi, rdi
add rbp, rbx
rol rdi, 0xd
xor rdi, rsi
rol rbx, 0x10
xor rbx, rbp
rol rsi, 0x20
add rbp, rdi
add rsi, rbx
rol rbx, 0x15
xor rbx, rsi
rol rdi, 0x11
xor rdi, rbp
rol rbp, 0x20
dec rax
jne 0x14024ca20
xor rsi, rcx
mov r15d, r13d
mov rdx, r14
and r15d, 7
movsxd r8, r15d
sub rdx, r8
add rdx, r13
cmp r14, rdx
je 0x14024cb39
mov r10d, dword [r12 + 0x30]
lea r9, [r14 + 6]
nop dword [rax]
movzx eax, byte [r9]
movzx ecx, byte [r9 + 1]
shl rcx, 8
or rcx, rax
movzx eax, byte [r9 - 1]
shl rcx, 8
or rcx, rax
movzx eax, byte [r9 - 2]
shl rcx, 8
or rcx, rax
movzx eax, byte [r9 - 3]
shl rcx, 8
or rcx, rax
movzx eax, byte [r9 - 4]
shl rcx, 8
or rcx, rax
movzx eax, byte [r9 - 5]
shl rcx, 8
or rcx, rax
movzx eax, byte [r9 - 6]
shl rcx, 8
or rcx, rax
xor rbx, rcx
test r10d, r10d
je 0x14024cb25
mov eax, dword [r12 + 0x30]
nop word [rax + rax]
add rsi, rdi
add rbp, rbx
rol rdi, 0xd
xor rdi, rsi
rol rbx, 0x10
xor rbx, rbp
rol rsi, 0x20
add rbp, rdi
add rsi, rbx
rol rbx, 0x15
xor rbx, rsi
rol rdi, 0x11
xor rdi, rbp
rol rbp, 0x20
dec rax
jne 0x14024caf0
add r9, 8
xor rsi, rcx
lea rax, [r9 - 6]
cmp rax, rdx
jne 0x14024ca80
test r15d, r15d
je 0x14024cb48
lea rcx, [r12 + 0x38]
call fcn.140255100
mov dword [r12 + 0x28], r15d
mov qword [r12 + 8], rsi
mov qword [r12 + 0x10], rdi
mov qword [r12 + 0x18], rbp
mov qword [r12 + 0x20], rbx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14024cb80
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
mov r10, qword [rcx + 0x10]
mov r11, qword [rcx + 0x18]
mov r9, qword [rcx + 0x20]
mov rax, r8
mov r8, qword [rcx]
mov rdi, rdx
mov rdx, qword [rcx + 8]
shl r8, 0x38
cmp dword [rcx + 0x30], 0
mov rbx, rcx
je 0x14024cdd2
test rax, rax
je 0x14024cdd2
mov ebp, dword [rcx + 0x2c]
cmp rax, rbp
jne 0x14024cdd2
mov eax, dword [rcx + 0x28]
dec eax
cmp eax, 6
ja case.default.0x14024cbf0
mov qword [rsp + 0x10], r12
lea r12, [0x140000000]
mov ecx, dword [r12 + rax*4 + 0x24cde0]
add rcx, r12
mov r12, qword [rsp + 0x10]
jmp rcx
movzx eax, byte [rbx + 0x3e]
shl rax, 0x30
or r8, rax
movzx eax, byte [rbx + 0x3d]
shl rax, 0x28
or r8, rax
movzx eax, byte [rbx + 0x3c]
shl rax, 0x20
or r8, rax
movzx eax, byte [rbx + 0x3b]
shl rax, 0x18
or r8, rax
movzx eax, byte [rbx + 0x3a]
shl rax, 0x10
or r8, rax
movzx eax, byte [rbx + 0x39]
shl rax, 8
or r8, rax
movzx eax, byte [rbx + 0x38]
or r8, rax
xor r9, r8
cmp dword [rbx + 0x30], 0
jbe 0x14024cc85
mov eax, dword [rbx + 0x30]
nop word [rax + rax]
add rdx, r10
add r11, r9
rol r10, 0xd
xor r10, rdx
rol r9, 0x10
xor r9, r11
rol rdx, 0x20
add r11, r10
add rdx, r9
rol r9, 0x15
xor r9, rdx
rol r10, 0x11
xor r10, r11
rol r11, 0x20
dec rax
jne 0x14024cc50
xor rdx, r8
cmp ebp, 0x10
jne 0x14024cc96
xor r11, 0xee
jmp 0x14024cc9d
xor r11, 0xff
mov eax, dword [rbx + 0x34]
test eax, eax
je 0x14024cce5
mov ecx, eax
nop word [rax + rax]
add rdx, r10
add r11, r9
rol r10, 0xd
xor r10, rdx
rol r9, 0x10
xor r9, r11
rol rdx, 0x20
add r11, r10
add rdx, r9
rol r9, 0x15
xor r9, rdx
rol r10, 0x11
xor r10, r11
rol r11, 0x20
dec rcx
jne 0x14024ccb0
mov rcx, r9
xor rcx, r11
xor rcx, r10
xor rcx, rdx
mov eax, ecx
mov byte [rdi], cl
shr eax, 8
mov byte [rdi + 1], al
mov eax, ecx
shr eax, 0x10
mov byte [rdi + 2], al
mov eax, ecx
shr rcx, 0x20
shr eax, 0x18
mov byte [rdi + 4], cl
mov byte [rdi + 3], al
mov eax, ecx
shr eax, 8
mov byte [rdi + 5], al
mov eax, ecx
shr ecx, 0x18
shr eax, 0x10
mov byte [rdi + 7], cl
mov byte [rdi + 6], al
cmp dword [rbx + 0x2c], 8
je 0x14024cdc1
mov eax, dword [rbx + 0x34]
xor r10, 0xdd
test eax, eax
je 0x14024cd77
mov ecx, eax
add rdx, r10
add r11, r9
rol r10, 0xd
xor r10, rdx
rol r9, 0x10
xor r9, r11
rol rdx, 0x20
add r11, r10
add rdx, r9
rol r9, 0x15
xor r9, rdx
rol r10, 0x11
xor r10, r11
rol r11, 0x20
dec rcx
jne 0x14024cd42
xor r9, r11
xor r9, r10
xor r9, rdx
mov eax, r9d
mov byte [rdi + 8], r9b
shr eax, 8
mov byte [rdi + 9], al
mov eax, r9d
shr eax, 0x10
mov byte [rdi + 0xa], al
mov eax, r9d
shr r9, 0x20
shr eax, 0x18
mov byte [rdi + 0xc], r9b
mov byte [rdi + 0xb], al
mov eax, r9d
shr eax, 8
mov byte [rdi + 0xd], al
mov eax, r9d
shr eax, 0x10
shr r9d, 0x18
mov byte [rdi + 0xf], r9b
mov byte [rdi + 0xe], al
mov eax, 1
mov rbx, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
pop rdi
ret
mov rbx, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
xor eax, eax
pop rdi
ret
Function at 0x14024ce00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movzx r9d, byte [rdx]
lea eax, [r8 - 1]
xor edi, edi
movzx r11d, r9b
mov esi, r8d
mov rbx, rcx
shr r11b, 7
test eax, eax
jle 0x14024ce62
mov r10, rcx
sub rdx, rcx
mov edi, eax
mov r8d, eax
nop word [rax + rax]
movzx ecx, byte [rdx + r10 + 1]
add r9b, r9b
inc r10
movzx eax, cl
shr al, 7
or al, r9b
dec r8
movzx r9d, cl
mov byte [r10 - 1], al
jne 0x14024ce40
mov eax, 0x87
cmp esi, 0x10
mov rsi, qword [rsp + 0x10]
mov ecx, 0x1b
cmove ecx, eax
movsxd rax, edi
mov rdi, qword [rsp + 0x18]
neg r11b
add r9b, r9b
and cl, r11b
xor cl, r9b
mov byte [rax + rbx], cl
mov rbx, qword [rsp + 8]
ret
Function at 0x14024ee00
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
mov eax, reloc.WS2_32.dll_WSASetLastError
call fcn.1402563f0
sub rsp, rax
mov rax, qword [0x1403bb2d8]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, r9
mov rbx, r9
mov rsi, r8
and edi, 0xf
mov r12, rdx
mov rbp, rcx
jne 0x14024ee57
mov rax, qword [rcx + 0xa8]
mov r8, rdx
mov rdx, rsi
call qword [rax + reloc.WS2_32.dll_htonl]
xor ecx, ecx
test eax, eax
cmove rbx, rcx
mov rax, rbx
jmp 0x14024ef8d
mov rax, 0xfffffffffffffff0
sub rax, rdi
add rbx, rax
je 0x14024ee8a
mov rax, qword [rcx + 0xa8]
mov r8, rdx
mov r9, rbx
mov rdx, rsi
call qword [rax + reloc.WS2_32.dll_htonl]
test eax, eax
jne 0x14024ee84
xor eax, eax
jmp 0x14024ef8d
add r12, rbx
add rsi, rbx
mov rax, qword [rbp + 0x9c]
lea r8, [r12 + rdi]
mov qword [rsp + 0x68], r13
mov r13, qword [r8]
mov qword [rsp + 0x20], rax
xor eax, eax
mov qword [rsp + 0x60], r14
mov r14, qword [r8 + 8]
mov qword [rsp + 0x58], r15
mov r15, qword [rbp + 0x94]
mov qword [rbp + 0x94], rax
mov qword [rbp + 0x9c], rax
mov rax, qword [rbp + 0xa8]
lea rdx, [rsp + 0x38]
mov r9d, reloc.WS2_32.dll_recv
mov rcx, rbp
call qword [rax + reloc.WS2_32.dll_htonl]
test eax, eax
je 0x14024ef67
lea rcx, [rsp + 0x28]
mov r8, rdi
mov rdx, r12
call fcn.140255100
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + rdi + 0x38]
lea rcx, [rsp + rdi + 0x28]
sub r8, rdi
call fcn.140255100
xor ecx, ecx
test rdi, rdi
je 0x14024ef35
nop word [rax + rax]
movzx eax, byte [rsp + rcx + 0x28]
inc rcx
xor al, byte [rsp + rcx + 0x37]
mov byte [rsi + rcx + 0xf], al
cmp rcx, rdi
jb 0x14024ef20
mov rax, qword [rsp + 0x20]
mov qword [rbp + 0x94], r15
lea r8, [rsp + 0x28]
mov qword [rbp + 0x9c], rax
mov rax, qword [rbp + 0xa8]
mov r9d, reloc.WS2_32.dll_recv
mov rdx, rsi
mov rcx, rbp
call qword [rax + reloc.WS2_32.dll_htonl]
test eax, eax
jne 0x14024ef6b
xor eax, eax
jmp 0x14024ef7e
mov qword [rbp + 0x94], r13
lea rax, [rbx + rdi + 0x10]
mov qword [rbp + 0x9c], r14
mov r14, qword [rsp + 0x60]
mov r13, qword [rsp + 0x68]
mov r15, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140254fb0
add rsp, 0x70
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret