joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140109c60
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r8
call fcn.140109ed0
test eax, eax
js 0x140109ec4
mov ecx, dword [rbx + 0xf0]
lea eax, [rcx*4]
movsxd r9, eax
test eax, eax
jle 0x140109cf3
lea r8, [rbx + 8]
xor r10d, r10d
lea r8, [r8 + r9*4]
lea rax, [rbx + 8]
nop dword [rax]
mov edx, dword [rax - 8]
add r10, 4
mov ecx, dword [r8 - 8]
lea r8, [r8 - 0x10]
mov dword [rax - 8], ecx
lea rax, [rax + 0x10]
mov ecx, dword [r8 + 0xc]
sub r9, 4
mov dword [r8 + 8], edx
mov edx, dword [rax - 0x14]
mov dword [rax - 0x14], ecx
mov ecx, dword [r8 + 0x10]
mov dword [r8 + 0xc], edx
mov edx, dword [rax - 0x10]
mov dword [rax - 0x10], ecx
mov ecx, dword [r8 + 0x14]
mov dword [r8 + 0x10], edx
mov edx, dword [rax - 0xc]
mov dword [rax - 0xc], ecx
mov dword [r8 + 0x14], edx
cmp r10, r9
jl 0x140109ca0
mov ecx, dword [rbx + 0xf0]
mov r11d, 1
cmp ecx, r11d
jle 0x140109ec2
mov qword [rsp + 0x30], rdi
lea r10, [rbx + 4]
lea rdi, [0x140000000]
nop dword [rax]
nop word [rax + rax]
mov r9d, dword [r10 + 0x10]
lea r10, [r10 + 0x10]
mov edx, dword [r10 - 4]
inc r11d
movzx eax, byte [r10 - 3]
movzx ecx, byte [rdi + rax*4 + 0x1fd130]
mov eax, edx
shr rax, 0x18
mov r8d, dword [rdi + rcx*4 + 0x1fe530]
movzx eax, byte [rdi + rax*4 + 0x1fd130]
xor r8d, dword [rdi + rax*4 + 0x1fdd30]
movzx eax, dl
movzx ecx, byte [rdi + rax*4 + 0x1fd130]
movzx eax, byte [r10 - 2]
xor r8d, dword [rdi + rcx*4 + 0x1fe930]
movzx ecx, byte [rdi + rax*4 + 0x1fd130]
mov eax, r9d
shr eax, 0x10
xor r8d, dword [rdi + rcx*4 + 0x1fe130]
movzx ecx, al
mov eax, r9d
shr eax, 8
mov dword [r10 - 4], r8d
movzx edx, byte [rdi + rcx*4 + 0x1fd130]
movzx ecx, al
mov r8d, dword [rdi + rdx*4 + 0x1fe130]
movzx eax, byte [rdi + rcx*4 + 0x1fd130]
xor r8d, dword [rdi + rax*4 + 0x1fe530]
mov eax, r9d
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0x1fd130]
movzx eax, r9b
mov r9d, dword [r10 + 4]
xor r8d, dword [rdi + rcx*4 + 0x1fdd30]
movzx ecx, byte [rdi + rax*4 + 0x1fd130]
mov eax, r9d
shr eax, 0x10
xor r8d, dword [rdi + rcx*4 + 0x1fe930]
movzx ecx, al
mov eax, r9d
shr eax, 8
mov dword [r10], r8d
movzx edx, byte [rdi + rcx*4 + 0x1fd130]
movzx ecx, al
mov r8d, dword [rdi + rdx*4 + 0x1fe130]
movzx eax, byte [rdi + rcx*4 + 0x1fd130]
xor r8d, dword [rdi + rax*4 + 0x1fe530]
mov eax, r9d
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0x1fd130]
movzx eax, r9b
mov r9d, dword [r10 + 8]
xor r8d, dword [rdi + rcx*4 + 0x1fdd30]
movzx ecx, byte [rdi + rax*4 + 0x1fd130]
mov eax, r9d
shr eax, 0x10
xor r8d, dword [rdi + rcx*4 + 0x1fe930]
movzx ecx, al
mov eax, r9d
shr eax, 8
mov dword [r10 + 4], r8d
movzx edx, byte [rdi + rcx*4 + 0x1fd130]
movzx ecx, al
mov r8d, dword [rdi + rdx*4 + 0x1fe130]
movzx eax, byte [rdi + rcx*4 + 0x1fd130]
xor r8d, dword [rdi + rax*4 + 0x1fe530]
mov eax, r9d
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0x1fd130]
movzx eax, r9b
xor r8d, dword [rdi + rcx*4 + 0x1fdd30]
movzx ecx, byte [rdi + rax*4 + 0x1fd130]
xor r8d, dword [rdi + rcx*4 + 0x1fe930]
mov dword [r10 + 8], r8d
cmp r11d, dword [rbx + 0xf0]
jl 0x140109d20
mov rdi, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x14010b320
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x40
mov r15, qword [rsp + 0xa8]
mov r14, rdx
mov rdx, qword [rsp + 0xb0]
mov r10, r9
mov rdi, r8
mov rbp, rcx
mov ebx, dword [rdx]
test ebx, ebx
je 0x14010b377
test rdi, rdi
je 0x14010b377
mov eax, ebx
dec rdi
movzx ecx, byte [rax + r15]
xor cl, byte [rbp]
inc rbp
mov byte [r14], cl
inc r14
inc ebx
and ebx, 0xf
jne 0x14010b355
mov r9, qword [rsp + 0xb8]
mov r13d, reloc.WS2_32.dll_recv
mov qword [rsp + 0x38], r12
mov esi, 1
cmp rdi, r13
jb 0x14010b49b
mov rcx, rdi
xor ebx, ebx
shr rcx, 4
mov r15, r14
imul rax, rcx, 0xfffffffffffffff0
mov r12, rbp
mov dword [rsp + 0x20], ebx
mov rbx, qword [rsp + 0xa8]
add rdi, rax
mov rax, rcx
mov qword [rsp + 0x90], rdi
mov rdi, qword [rsp + 0x98]
sub r15, rbx
shl rax, 4
sub r12, rbx
add r14, rax
add rbp, rax
mov qword [rsp + 0x88], r14
mov qword [rsp + 0x80], rbp
mov r14, rcx
mov rbp, qword [rsp + 0xa0]
nop dword [rax + rax]
mov r8, rdi
mov rdx, rbx
mov rcx, rbp
call r9
mov r8d, r13d
lea rdx, [rbp + 0x10]
mov ecx, esi
nop word [rax + rax]
movzx eax, byte [rdx - 1]
lea rdx, [rdx - 1]
add ecx, eax
mov byte [rdx], cl
shr ecx, 8
add r8d, 0xffffffff
jne 0x14010b420
mov rax, rbx
lea edx, [r8 + 2]
nop dword [rax]
mov rcx, qword [r12 + rax]
xor rcx, qword [rax]
mov qword [r15 + rax], rcx
lea rax, [rax + 8]
sub rdx, rsi
jne 0x14010b440
mov r9, qword [rsp + 0xb8]
add r15, r13
add r12, r13
sub r14, rsi
jne 0x14010b400
mov ebx, dword [rsp + 0x20]
mov rdi, qword [rsp + 0x90]
mov r14, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x80]
mov r15, qword [rsp + 0xa8]
mov rdx, qword [rsp + 0xb0]
mov r10, qword [rsp + 0x98]
test rdi, rdi
je 0x14010b502
mov r12, qword [rsp + 0xa0]
mov r8, r10
mov rcx, r12
mov rdx, r15
call r9
lea rcx, [r12 + 0x10]
nop dword [rax]
movzx eax, byte [rcx - 1]
lea rcx, [rcx - 1]
add esi, eax
mov byte [rcx], sil
shr esi, 8
add r13d, 0xffffffff
jne 0x14010b4c0
nop word [rax + rax]
mov ecx, ebx
inc ebx
movzx eax, byte [rcx + rbp]
xor al, byte [rcx + r15]
mov byte [rcx + r14], al
sub rdi, 1
jne 0x14010b4e0
mov rax, qword [rsp + 0xb0]
mov dword [rax], ebx
jmp 0x14010b504
mov dword [rdx], ebx
mov r12, qword [rsp + 0x38]
add rsp, 0x40
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14010b520
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x40
mov r11, r9
mov rbx, r8
mov r9, qword [rsp + 0xb0]
mov r14, rdx
mov rbp, rcx
mov edi, dword [r9]
mov dword [rsp + 0x30], edi
test edi, edi
je 0x14010b585
mov rdx, qword [rsp + 0xa8]
nop word [rax + rax]
test rbx, rbx
je 0x14010b581
mov eax, edi
dec rbx
movzx ecx, byte [rax + rdx]
xor cl, byte [rbp]
inc rbp
mov byte [r14], cl
inc r14
inc edi
and edi, 0xf
jne 0x14010b560
mov dword [rsp + 0x30], edi
mov rax, qword [rsp + 0xa0]
mov esi, 1
mov r8d, dword [rax + 0xc]
lea r15, [rax + 0xc]
mov r10, qword [rsp + 0xb8]
mov qword [rsp + 0x80], r12
lea r13d, [rsi + 0xb]
bswap r8d
mov dword [rsp + 0x90], r8d
cmp rbx, 0x10
jb 0x14010b6a5
mov rdi, qword [rsp + 0xa0]
mov eax, 0x10000000
mov rdx, rbx
mov qword [rsp + 0x20], rdi
shr rdx, 4
mov r9, r11
cmp rdx, rax
cmova rdx, rax
add r8d, edx
mov r12, rdx
mov eax, r8d
mov ecx, r8d
sub r12, rax
cmp rax, rdx
cmovae r12, rdx
xor r8d, r8d
cmp rax, rdx
mov rdx, r14
cmovae r8d, ecx
mov rcx, rbp
mov dword [rsp + 0x90], r8d
mov r8, r12
call r10
mov r8d, dword [rsp + 0x90]
mov eax, r8d
bswap eax
mov dword [r15], eax
test r8d, r8d
jne 0x14010b65d
mov r8d, r13d
mov eax, esi
mov rdx, r15
nop word [rax + rax]
movzx ecx, byte [rdx - 1]
lea rdx, [rdx - 1]
add eax, ecx
mov byte [rdx], al
shr eax, 8
add r8d, 0xffffffff
jne 0x14010b640
mov r8d, dword [rsp + 0x90]
mov r10, qword [rsp + 0xb8]
mov eax, 0x10000000
mov r11, qword [rsp + 0x98]
shl r12, 4
sub rbx, r12
add r14, r12
add rbp, r12
cmp rbx, 0x10
jae 0x14010b5d0
mov edi, dword [rsp + 0x30]
mov r9, qword [rsp + 0xb0]
mov rax, qword [rsp + 0xa0]
mov dword [rsp + 0x90], r8d
test rbx, rbx
je 0x14010b732
mov r12, qword [rsp + 0xa8]
xor ecx, ecx
mov r9, r11
mov qword [rsp + 0x20], rax
mov r8, rsi
mov rdx, r12
mov qword [r12], rcx
mov qword [r12 + 8], rcx
mov rcx, r12
call r10
mov r8d, dword [rsp + 0x90]
add r8d, esi
bswap r8d
mov dword [r15], r8d
jne 0x14010b710
nop dword [rax + rax]
movzx eax, byte [r15 - 1]
lea r15, [r15 - 1]
add esi, eax
mov byte [r15], sil
shr esi, 8
add r13d, 0xffffffff
jne 0x14010b6f0
nop word [rax + rax]
mov ecx, edi
inc edi
movzx eax, byte [rcx + rbp]
xor al, byte [rcx + r12]
mov byte [rcx + r14], al
sub rbx, 1
jne 0x14010b710
mov rax, qword [rsp + 0xb0]
mov dword [rax], edi
jmp 0x14010b735
mov dword [r9], edi
mov r12, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14010b750
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r12
push r15
sub rsp, 0x28
mov rsi, qword [rsp + 0x88]
mov r10, r9
mov rbp, qword [rsp + 0x80]
mov rdi, r8
mov r15, rdx
mov r12, rcx
mov ebx, dword [rsi]
test ebx, ebx
je 0x14010b7a5
test rdi, rdi
je 0x14010b7a5
mov eax, ebx
dec rdi
movzx ecx, byte [rax + rbp]
xor cl, byte [r12]
inc r12
mov byte [r15], cl
inc r15
inc ebx
and ebx, 0xf
jne 0x14010b783
mov r9, qword [rsp + 0x90]
cmp rdi, 0x10
jb 0x14010b869
mov qword [rsp + 0x60], r13
mov rsi, r15
mov r13, rdi
mov qword [rsp + 0x20], r14
shr r13, 4
mov r14, r12
imul rax, r13, 0xfffffffffffffff0
sub rsi, rbp
sub r14, rbp
add rdi, rax
mov rax, r13
shl rax, 4
add r15, rax
mov qword [rsp + 0x68], r15
add r12, rax
mov r15, qword [rsp + 0x78]
mov r8, r15
mov rdx, rbp
mov rcx, rbp
call r9
cmp ebx, 0x10
jae 0x14010b835
mov edx, recvfrom
mov eax, ebx
sub edx, ebx
add rax, rbp
shr edx, 3
inc edx
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [r14 + rax]
xor rcx, qword [rax]
mov qword [rsi + rax], rcx
lea rax, [rax + 8]
sub rdx, 1
jne 0x14010b820
mov r9, qword [rsp + 0x90]
add rsi, 0x10
add r14, 0x10
xor ebx, ebx
sub r13, 1
jne 0x14010b7f2
mov r15, qword [rsp + 0x68]
mov r10, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x88]
mov r14, qword [rsp + 0x20]
mov r13, qword [rsp + 0x60]
test rdi, rdi
je 0x14010b896
mov r8, r10
mov rdx, rbp
mov rcx, rbp
call r9
nop word [rax + rax]
mov ecx, ebx
inc ebx
movzx eax, byte [rcx + r12]
xor al, byte [rcx + rbp]
mov byte [rcx + r15], al
sub rdi, 1
jne 0x14010b880
mov dword [rsi], ebx
add rsp, 0x28
pop r15
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14010b8b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test r8, r8
je 0x14010baf0
mov rax, rsp
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rbx
push rbp
push r14
push r15
sub rsp, 0x68
mov rbx, qword [rsp + 0xb0]
mov r14, r9
mov qword [rax + 8], rsi
mov r15, rcx
mov qword [rax - 0x28], rdi
xor ebp, ebp
mov qword [rax - 0x30], r12
mov r12, qword [rsp + 0xc8]
mov qword [rax - 0x38], r13
mov r13d, dword [rsp + 0xc0]
nop
movups xmm0, xmmword [rbx]
movzx eax, bpl
mov ecx, 7
and al, 7
mov rsi, rbp
sub cl, al
shr rsi, 3
mov eax, 1
mov r8, r14
shl eax, cl
mov rdx, rbx
mov rcx, rbx
and al, byte [rsi + r15]
neg al
movups xmmword [rsp + 0x20], xmm0
sbb dil, dil
and dil, 0x80
call r12
movzx r9d, dil
xor r9b, byte [rbx]
movzx eax, r9b
test r13d, r13d
jne 0x14010b950
movzx r9d, dil
movzx r8d, byte [rsp + 0x21]
movzx edx, byte [rsp + 0x20]
movzx ecx, r8b
shr cl, 7
add dl, dl
or dl, cl
add r8b, r8b
mov byte [rbx], dl
movzx edx, byte [rsp + 0x22]
movzx ecx, dl
add dl, dl
shr cl, 7
or cl, r8b
movzx r8d, byte [rsp + 0x23]
mov byte [rbx + 1], cl
movzx ecx, r8b
shr cl, 7
add r8b, r8b
or cl, dl
movzx edx, byte [rsp + 0x24]
mov byte [rbx + 2], cl
movzx ecx, dl
shr cl, 7
add dl, dl
or cl, r8b
movzx r8d, byte [rsp + 0x25]
mov byte [rbx + 3], cl
movzx ecx, r8b
shr cl, 7
add r8b, r8b
or cl, dl
movzx edx, byte [rsp + 0x26]
mov byte [rbx + 4], cl
movzx ecx, dl
shr cl, 7
add dl, dl
or cl, r8b
movzx r8d, byte [rsp + 0x27]
mov byte [rbx + 5], cl
movzx ecx, r8b
shr cl, 7
add r8b, r8b
or cl, dl
movzx edx, byte [rsp + 0x28]
mov byte [rbx + 6], cl
movzx ecx, dl
shr cl, 7
add dl, dl
or cl, r8b
movzx r8d, byte [rsp + 0x29]
mov byte [rbx + 7], cl
movzx ecx, r8b
shr cl, 7
add r8b, r8b
or cl, dl
movzx edx, byte [rsp + 0x2a]
mov byte [rbx + 8], cl
movzx ecx, dl
shr cl, 7
add dl, dl
or cl, r8b
movzx r8d, byte [rsp + 0x2b]
mov byte [rbx + 9], cl
movzx ecx, r8b
shr cl, 7
add r8b, r8b
or cl, dl
movzx edx, byte [rsp + 0x2c]
mov byte [rbx + 0xa], cl
movzx ecx, dl
shr cl, 7
add dl, dl
or cl, r8b
movzx r8d, byte [rsp + 0x2d]
mov byte [rbx + 0xb], cl
movzx ecx, r8b
shr cl, 7
or cl, dl
movzx edx, byte [rsp + 0x2e]
mov byte [rbx + 0xc], cl
add r8b, r8b
movzx ecx, dl
shr r9b, 7
shr cl, 7
add dl, dl
or r8b, cl
and al, 0x80
mov byte [rbx + 0xd], r8b
movzx r8d, byte [rsp + 0x2f]
movzx ecx, r8b
add r8b, r8b
or r9b, r8b
shr cl, 7
or cl, dl
mov byte [rbx + 0xf], r9b
mov r9, qword [rsp + 0x98]
mov edx, ebp
mov byte [rbx + 0xe], cl
and edx, 7
mov ecx, 7
sub ecx, edx
movzx r8d, byte [rsi + r9]
btr r8d, ecx
movzx ecx, bpl
and cl, 7
inc rbp
shr al, cl
or r8b, al
mov byte [rsi + r9], r8b
cmp rbp, qword [rsp + 0xa0]
jb 0x14010b900
mov r13, qword [rsp + 0x50]
mov r12, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x90]
add rsp, 0x68
pop r15
pop r14
pop rbp
pop rbx
ret
Function at 0x14010bbb0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
cmp dword [rsp + 0x90], 0
mov r10, r9
mov r15, qword [rsp + 0x88]
mov rdi, r8
mov rbp, qword [rsp + 0x80]
mov rsi, rdx
mov r14, rcx
mov ebx, dword [r15]
je 0x14010bd0e
test ebx, ebx
je 0x14010bc24
nop word [rax + rax]
test rdi, rdi
je 0x14010bc24
movzx eax, byte [r14]
dec rdi
mov ecx, ebx
inc r14
xor byte [rcx + rbp], al
movzx eax, byte [rcx + rbp]
mov byte [rsi], al
inc rsi
inc ebx
and ebx, 0xf
jne 0x14010bc00
mov r9, qword [rsp + 0x98]
cmp rdi, 0x10
jb 0x14010bcd4
mov r15, rsi
mov r13, rdi
shr r13, 4
mov r12, r14
imul rax, r13, 0xfffffffffffffff0
sub r15, rbp
sub r12, rbp
add rdi, rax
mov rax, r13
shl rax, 4
add rsi, rax
mov qword [rsp + 0x68], rsi
add r14, rax
mov rsi, qword [rsp + 0x78]
nop word [rax + rax]
mov r8, rsi
mov rdx, rbp
mov rcx, rbp
call r9
cmp ebx, 0x10
jae 0x14010bcaa
mov edx, recvfrom
mov ecx, ebx
sub edx, ebx
add rcx, rbp
shr edx, 3
inc edx
mov rax, qword [r12 + rcx]
xor qword [rcx], rax
mov rax, qword [rcx]
mov qword [r15 + rcx], rax
lea rcx, [rcx + 8]
sub rdx, 1
jne 0x14010bc92
mov r9, qword [rsp + 0x98]
add r15, 0x10
add r12, 0x10
xor ebx, ebx
sub r13, 1
jne 0x14010bc70
mov rsi, qword [rsp + 0x68]
mov r10, qword [rsp + 0x78]
mov r15, qword [rsp + 0x88]
test rdi, rdi
je 0x14010be1b
mov r8, r10
mov rdx, rbp
mov rcx, rbp
call r9
nop dword [rax]
mov ecx, ebx
inc ebx
movzx eax, byte [rcx + r14]
xor byte [rcx + rbp], al
movzx eax, byte [rcx + rbp]
mov byte [rcx + rsi], al
sub rdi, 1
jne 0x14010bcf0
jmp 0x14010be1b
test ebx, ebx
je 0x14010bd38
test rdi, rdi
je 0x14010bd38
movzx edx, byte [r14]
dec rdi
mov ecx, ebx
inc r14
movzx eax, byte [rcx + rbp]
xor al, dl
mov byte [rsi], al
inc rsi
inc ebx
mov byte [rcx + rbp], dl
and ebx, 0xf
jne 0x14010bd12
mov r13, qword [rsp + 0x98]
cmp rdi, 0x10
jb 0x14010bde5
mov r12, rdi
mov r15, rsi
shr r12, 4
sub r15, rbp
imul rax, r12, 0xfffffffffffffff0
add rdi, rax
mov qword [rsp + 0x70], rdi
mov rdi, qword [rsp + 0x78]
nop dword [rax + rax]
mov r8, rdi
mov rdx, rbp
mov rcx, rbp
call r13
cmp ebx, 0x10
jae 0x14010bdbf
mov r9d, recvfrom
mov r8d, ebx
sub r9d, ebx
mov r10, r14
shr r9d, 3
add r8, rbp
sub r10, rsi
inc r9d
nop dword [rax]
mov rax, qword [r8]
lea rcx, [r15 + r8]
mov rdx, qword [rcx + r10]
lea r8, [r8 + 8]
xor rax, rdx
mov qword [rcx], rax
mov qword [r8 - 8], rdx
sub r9, 1
jne 0x14010bda0
add rsi, 0x10
add r15, 0x10
add r14, 0x10
xor ebx, ebx
sub r12, 1
jne 0x14010bd70
mov rdi, qword [rsp + 0x70]
mov r10, qword [rsp + 0x78]
mov r15, qword [rsp + 0x88]
test rdi, rdi
je 0x14010be1b
mov r8, r10
mov rdx, rbp
mov rcx, rbp
call r13
nop word [rax + rax]
mov ecx, ebx
inc ebx
movzx edx, byte [rcx + r14]
movzx eax, byte [rcx + rbp]
xor al, dl
mov byte [rcx + rsi], al
mov byte [rcx + rbp], dl
sub rdi, 1
jne 0x14010be00
mov dword [r15], ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14010be40
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x38], 0
mov rdi, r8
mov r14, rdx
mov rbp, rcx
je 0x14010be67
mov eax, 0xfffffffe
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
mov rcx, qword [rcx + 0x30]
movabs rax, 0x2000000000000000
add rcx, r8
cmp rcx, rax
ja 0x14010bf62
cmp rcx, r8
jb 0x14010bf62
mov qword [rsp + 0x40], rbx
lea rbx, [rbp + 0x40]
mov qword [rsp + 0x48], rsi
mov esi, dword [rbp + 0x174]
mov qword [rsp + 0x50], r12
mov qword [rbp + 0x30], rcx
test esi, esi
je 0x14010bef5
nop dword [rax + rax]
test rdi, rdi
je 0x14010bee0
movzx eax, byte [r14]
lea rbx, [rbp + 0x40]
mov ecx, esi
inc r14
dec rdi
xor byte [rcx + rbx], al
inc esi
and esi, 0xf
jne 0x14010beb0
lea r12, [rbp + 0x60]
mov rcx, rbx
mov rdx, r12
call fcn.14010d210
jmp 0x14010bef9
test esi, esi
jne 0x14010bf42
lea r12, [rbp + 0x60]
mov rcx, rbx
mov rdx, r12
call fcn.14010d210
jmp 0x14010bef9
lea r12, [rbp + 0x60]
mov qword [rsp + 0x58], r15
mov r15, rdi
and r15, 0xfffffffffffffff0
je 0x14010bf1e
mov r9, r15
mov r8, r14
mov rdx, r12
mov rcx, rbx
call fcn.14010d0b0
add r14, r15
sub rdi, r15
mov r15, qword [rsp + 0x58]
test rdi, rdi
je 0x14010bf42
mov esi, edi
sub r14, rbp
nop dword [rax]
movzx eax, byte [r14 + rbx - 0x40]
xor byte [rbx], al
lea rbx, [rbx + 1]
sub rdi, 1
jne 0x14010bf30
mov rbx, qword [rsp + 0x40]
xor eax, eax
mov r12, qword [rsp + 0x50]
mov dword [rbp + 0x174], esi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
or eax, 0xffffffff
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
Function at 0x14010cde0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
push r13
sub rsp, 0x28
xor r13d, r13d
mov rdi, r8
mov qword [rcx + 0x30], r13
mov rsi, rdx
mov qword [rcx + 0x38], r13
mov rbx, rcx
mov qword [rcx + 0x170], r13
cmp r8, 0xc
jne 0x14010ce29
movsd xmm0, qword [rdx]
lea edi, [r8 - 0xb]
movsd qword [rcx], xmm0
mov eax, dword [rdx + 8]
mov dword [rcx + 8], eax
mov dword [rcx + 0xc], 0x1000000
jmp 0x14010cf60
mov qword [rsp + 0x50], rbp
mov rbp, rdi
mov qword [rsp + 0x58], r12
mov qword [rcx + 0x40], r13
mov qword [rsp + 0x60], r14
mov qword [rcx + 0x48], r13
cmp rdi, 0x10
jb 0x14010ceef
mov qword [rsp + 0x20], r15
mov r15, rdi
shr r15, 4
imul rax, r15, 0xfffffffffffffff0
add rdi, rax
movzx eax, byte [rsi]
lea rdx, [rbx + 0x60]
xor byte [rbx + 0x40], al
lea rcx, [rbx + 0x40]
movzx eax, byte [rsi + 1]
xor byte [rbx + 0x41], al
movzx eax, byte [rsi + 2]
xor byte [rbx + 0x42], al
movzx eax, byte [rsi + 3]
xor byte [rbx + 0x43], al
movzx eax, byte [rsi + 4]
xor byte [rbx + 0x44], al
movzx eax, byte [rsi + 5]
xor byte [rbx + 0x45], al
movzx eax, byte [rsi + 6]
xor byte [rbx + 0x46], al
movzx eax, byte [rsi + 7]
xor byte [rbx + 0x47], al
movzx eax, byte [rsi + 8]
xor byte [rbx + 0x48], al
movzx eax, byte [rsi + 9]
xor byte [rbx + 0x49], al
movzx eax, byte [rsi + 0xa]
xor byte [rbx + 0x4a], al
movzx eax, byte [rsi + 0xb]
xor byte [rbx + 0x4b], al
movzx eax, byte [rsi + 0xc]
xor byte [rbx + 0x4c], al
movzx eax, byte [rsi + 0xd]
xor byte [rbx + 0x4d], al
movzx eax, byte [rsi + 0xe]
xor byte [rbx + 0x4e], al
movzx eax, byte [rsi + 0xf]
xor byte [rbx + 0x4f], al
call fcn.14010d210
add rsi, 0x10
sub r15, 1
jne 0x14010ce60
mov r15, qword [rsp + 0x20]
test rdi, rdi
je 0x14010cf1e
lea rcx, [rbx + 0x40]
sub rsi, rbx
nop dword [rax + rax]
movzx eax, byte [rsi + rcx - 0x40]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub rdi, 1
jne 0x14010cf00
lea rdx, [rbx + 0x60]
lea rcx, [rbx + 0x40]
call fcn.14010d210
shl rbp, 3
lea rdx, [rbx + 0x60]
bswap rbp
xor qword [rbx + 0x48], rbp
lea rcx, [rbx + 0x40]
call fcn.14010d210
mov rax, qword [rbx + 0x40]
mov edi, dword [rbx + 0x4c]
mov r14, qword [rsp + 0x60]
mov r12, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
mov qword [rbx], rax
mov rax, qword [rbx + 0x48]
mov qword [rbx + 8], rax
bswap edi
nop dword [rax]
mov qword [rbx + 0x40], r13
lea rdx, [rbx + 0x20]
mov qword [rbx + 0x48], r13
mov rcx, rbx
mov r8, qword [rbx + 0x180]
call qword [rbx + 0x178]
inc edi
bswap edi
mov dword [rbx + 0xc], edi
add rsp, 0x28
pop r13
pop rdi
pop rsi
pop rbx
ret
Function at 0x14010d0b0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
push r15
movzx eax, byte [rcx + 0xf]
lea rsi, [r8 + 0xe]
mov rbx, rcx
lea r13, [0x1401fef20]
sub rbx, r8
mov rbp, r9
mov r14, rdx
mov r15, rcx
nop word [rax + rax]
movzx r8d, byte [rsi + 1]
mov rdi, rsi
movzx edx, al
mov r12d, recvfrom
xor r8, rdx
mov rcx, r8
and r8d, 0xf
add r8, r8
and rcx, 0xfffffffffffffff0
mov rax, qword [r14 + r8*8 + 8]
mov r9, qword [r14 + r8*8]
mov rdx, rax
lea r8, [rcx + r14]
shr rax, 4
and edx, 0xf
mov rcx, r9
shr rcx, 4
shl r9, 0x3c
or rax, r9
mov r11, qword [r13 + rdx*8]
xor r11, rcx
xor r11, qword [r8]
xor rax, qword [r8 + 8]
nop word [rax + rax]
movzx ecx, byte [rdi]
movzx edx, byte [rbx + rdi]
lea rdi, [rdi - 1]
xor rdx, rcx
mov rcx, r11
mov r10, rdx
shl r11, 0x3c
and edx, 0xf
shr rcx, 4
add rdx, rdx
and r10, 0xfffffffffffffff0
lea r8, [r14 + rdx*8]
mov rdx, rax
shr rax, 4
and edx, 0xf
or r11, rax
xor r11, qword [r8 + 8]
mov r9, qword [r13 + rdx*8]
mov rdx, r11
xor r9, rcx
shr rdx, 4
xor r9, qword [r8]
mov rcx, r11
and ecx, 0xf
mov rax, r9
shr rax, 4
mov r11, qword [r13 + rcx*8]
xor r11, rax
mov rax, r9
xor r11, qword [r10 + r14]
shl rax, 0x3c
or rax, rdx
xor rax, qword [r10 + r14 + 8]
sub r12, 1
jne 0x14010d150
bswap rax
mov qword [r15 + 8], rax
add rsi, 0x10
shr rax, 0x38
sub rbx, 0x10
bswap r11
mov qword [r15], r11
sub rbp, 0x10
jne 0x14010d0f0
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
ret

Function at 0x14010d210
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
movzx eax, byte [rcx + 0xf]
lea r14, [0x1401fef20]
mov r8d, eax
mov rdi, rdx
and eax, 0xf
mov rbx, rcx
add rax, rax
and r8, 0xfffffffffffffff0
mov esi, recvfrom
mov r9, qword [rdx + rax*8]
mov rax, qword [rdx + rax*8 + 8]
mov rcx, r9
mov rdx, rax
shr rcx, 4
and edx, 0xf
shr rax, 4
shl r9, 0x3c
or rax, r9
mov r11, qword [r14 + rdx*8]
xor r11, rcx
xor r11, qword [r8 + rdi]
xor rax, qword [r8 + rdi + 8]
nop dword [rax + rax]
movzx ecx, byte [rsi + rbx]
mov rdx, rax
shr rax, 4
mov r10d, ecx
and ecx, 0xf
and edx, 0xf
add rcx, rcx
and r10, 0xfffffffffffffff0
lea r8, [rdi + rcx*8]
mov rcx, r11
shl r11, 0x3c
mov r9, qword [r14 + rdx*8]
or r11, rax
xor r11, qword [r8 + 8]
shr rcx, 4
mov rdx, r11
xor r9, rcx
shr rdx, 4
xor r9, qword [r8]
mov rcx, r11
and ecx, 0xf
mov rax, r9
shr rax, 4
mov r11, qword [r14 + rcx*8]
xor r11, rax
mov rax, r9
xor r11, qword [r10 + rdi]
shl rax, 0x3c
or rax, rdx
xor rax, qword [r10 + rdi + 8]
sub rsi, 1
jns 0x14010d280
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
mov r14, qword [rsp + 0x20]
bswap r11
bswap rax
mov qword [rbx], r11
mov qword [rbx + 8], rax
mov rbx, qword [rsp + 8]
ret