joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401ba340
Capabilities:
Encrypt data using curve25519

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1a8
call fcn.1402563a0
sub rsp, rax
mov rax, qword [0x1403bb2d8]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov r14, qword [rsp + 0x210]
mov r13, r8
mov r8, qword [rsp + 0x220]
mov rsi, rcx
mov rcx, qword [rsp + 0x218]
mov r12, rdx
lea rdx, str.SHA512
mov r15, r9
call fcn.1400b3c60
mov rdi, rax
call fcn.1400b2520
xor ebp, ebp
mov rbx, rax
test rdi, rdi
je 0x1401ba54b
test rax, rax
je 0x1401ba54b
xor r8d, r8d
mov rdx, rdi
mov rcx, rax
call fcn.1400b43c0
test eax, eax
je 0x1401ba54b
lea r8d, [rbp + 0x20]
mov rdx, r14
mov rcx, rbx
call fcn.1400b2550
test eax, eax
je 0x1401ba54b
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0xd0]
mov rcx, rbx
call fcn.1400b2670
test eax, eax
je 0x1401ba54b
movzx eax, byte [rsp + 0xef]
and byte [rsp + 0xd0], 0xf8
xor r8d, r8d
and al, 0x3f
mov rdx, rdi
mov rcx, rbx
or al, 0x40
mov byte [rsp + 0xef], al
call fcn.1400b43c0
test eax, eax
je 0x1401ba54b
lea r8d, [rbp + 0x20]
lea rdx, [rsp + 0xf0]
mov rcx, rbx
call fcn.1400b2550
test eax, eax
je 0x1401ba54b
mov r8, r13
mov rdx, r12
mov rcx, rbx
call fcn.1400b2550
test eax, eax
je 0x1401ba54b
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x110]
mov rcx, rbx
call fcn.1400b2670
test eax, eax
je 0x1401ba54b
lea rcx, [rsp + 0x110]
call fcn.1401b7450
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x30]
call fcn.1401b5f20
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.1401b4670
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call fcn.1400b43c0
test eax, eax
je 0x1401ba54b
lea r8d, [rbp + 0x20]
mov rdx, rsi
mov rcx, rbx
call fcn.1400b2550
test eax, eax
je 0x1401ba54b
lea r8d, [rbp + 0x20]
mov rdx, r15
mov rcx, rbx
call fcn.1400b2550
test eax, eax
je 0x1401ba54b
mov r8, r13
mov rdx, r12
mov rcx, rbx
call fcn.1400b2550
test eax, eax
je 0x1401ba54b
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x150]
mov rcx, rbx
call fcn.1400b2670
test eax, eax
je 0x1401ba54b
lea rcx, [rsp + 0x150]
call fcn.1401b7450
lea rcx, [rsi + 0x20]
lea r9, [rsp + 0x110]
lea r8, [rsp + 0xd0]
lea rdx, [rsp + 0x150]
call fcn.1401b8490
mov ebp, 1
lea rcx, [rsp + 0x110]
mov edx, 0x40
call fcn.1400f5f30
lea rcx, [rsp + 0xd0]
mov edx, 0x40
call fcn.1400f5f30
mov rcx, rdi
call fcn.1400b2e60
mov rcx, rbx
call fcn.1400b3090
mov eax, ebp
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.140254f60
add rsp, 0x1a8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1401ba870
Capabilities:
Encrypt data using curve25519

Disassembly:
push rbx
push rsi
push rdi
mov eax, 0x1a0
call fcn.1402563a0
sub rsp, rax
mov rax, qword [0x1403bb2d8]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov rsi, rdx
mov rbx, r8
lea rdx, str.SHA512
mov r8, r9
call fcn.1400b3c60
mov rdi, rax
test rax, rax
je 0x1401ba8f3
xor r9d, r9d
lea r8, [rsp + 0x150]
mov rcx, rbx
lea edx, [r9 + 0x20]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
call fcn.1400b4420
mov rcx, rdi
mov ebx, eax
call fcn.1400b2e60
test ebx, ebx
jne 0x1401ba8fa
lea edx, [rbx + 0x40]
lea rcx, [rsp + 0x150]
call fcn.1400f5f30
xor eax, eax
jmp 0x1401ba9ae
movzx eax, byte [rsp + 0x16f]
and byte [rsp + 0x150], 0xf8
lea rdx, [rsp + 0x150]
and al, 0x3f
lea rcx, [rsp + 0xb0]
or al, 0x40
mov byte [rsp + 0x16f], al
call fcn.1401b5f20
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0x30]
call fcn.1401b3b50
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x58]
call fcn.1401b2c40
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x80]
call fcn.1401b2c40
lea rdx, [rsp + 0x80]
mov rcx, rsi
call fcn.1401b29a0
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x30]
call fcn.1401b29a0
movzx eax, byte [rsp + 0x30]
lea rcx, [rsp + 0x150]
shl al, 7
mov edx, 0x40
xor byte [rsi + 0x1f], al
call fcn.1400f5f30
mov eax, 1
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.140254f60
add rsp, 0x1a0
pop rdi
pop rsi
pop rbx
ret
Function at 0x1401baa10
Capabilities:
Encrypt data using curve25519

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x70]
mov eax, 0x170
call fcn.1402563a0
sub rsp, rax
mov rax, qword [0x1403bb2d8]
xor rax, rsp
mov qword [rbp + 0x60], rax
mov rax, qword [rdx]
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x50]
mov qword [rbp + 0x40], rax
mov rax, qword [rdx + 8]
and byte [rbp + 0x40], 0xf8
mov qword [rbp + 0x48], rax
mov rax, qword [rdx + 0x10]
mov qword [rbp + 0x50], rax
mov rax, qword [rdx + 0x18]
lea rdx, [rbp + 0x40]
mov qword [rbp + 0x58], rax
shr rax, 0x38
and al, 0x3f
or al, 0x40
mov byte [rbp + 0x5f], al
call fcn.1401b5f20
mov r15d, dword [rbp - 0x80]
mov eax, dword [rsp + 0x78]
mov r13d, dword [rbp - 0x7c]
mov edx, dword [rbp - 0x64]
add eax, dword [rbp - 0x60]
mov esi, dword [rbp - 0x78]
mov r14d, dword [rbp - 0x4c]
mov ebx, dword [rbp - 0x74]
mov r12d, dword [rbp - 0x48]
mov r10d, dword [rbp - 0x70]
mov edi, dword [rbp - 0x44]
mov ecx, dword [rbp - 0x6c]
mov r11d, dword [rbp - 0x40]
mov r8d, dword [rbp - 0x68]
mov r9d, dword [rbp - 0x3c]
mov dword [rbp - 0x10], eax
mov eax, dword [rsp + 0x7c]
add eax, dword [rbp - 0x5c]
mov dword [rbp - 0xc], eax
mov eax, dword [rbp - 0x58]
add eax, r15d
mov dword [rbp - 8], eax
mov eax, dword [rbp - 0x54]
add eax, r13d
mov dword [rbp - 4], eax
mov eax, dword [rbp - 0x50]
add eax, esi
mov dword [rbp], eax
lea eax, [r14 + rbx]
sub r14d, ebx
mov dword [rbp + 4], eax
lea eax, [r12 + r10]
sub r12d, r10d
mov dword [rbp + 8], eax
lea eax, [rdi + rcx]
sub edi, ecx
mov dword [rbp + 0xc], eax
lea eax, [r11 + r8]
sub r11d, r8d
mov dword [rbp + 0x10], eax
lea eax, [r9 + rdx]
mov dword [rbp + 0x2c], r14d
mov dword [rbp + 0x14], eax
mov eax, dword [rbp - 0x60]
mov dword [rbp + 0x30], r12d
sub eax, dword [rsp + 0x78]
mov dword [rbp + 0x34], edi
mov dword [rbp + 0x38], r11d
mov dword [rbp + 0x18], eax
mov eax, dword [rbp - 0x5c]
sub eax, dword [rsp + 0x7c]
mov dword [rbp + 0x1c], eax
mov eax, dword [rbp - 0x58]
sub eax, r15d
mov dword [rbp + 0x20], eax
mov eax, dword [rbp - 0x54]
sub eax, r13d
mov dword [rbp + 0x24], eax
mov eax, dword [rbp - 0x50]
sub eax, esi
sub r9d, edx
lea rdx, [rbp + 0x18]
mov dword [rbp + 0x3c], r9d
mov dword [rbp + 0x28], eax
lea rcx, [rsp + 0x28]
call fcn.1401b3b50
lea r8, [rsp + 0x28]
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x10]
call fcn.1401b2c40
mov rcx, qword [rsp + 0x20]
lea rdx, [rbp - 0x10]
call fcn.1401b29a0
lea rcx, [rbp + 0x40]
mov edx, 0x20
call fcn.1400f5f30
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.140254f60
mov rbx, qword [rsp + 0x1c0]
add rsp, 0x170
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401bebc0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0xe8
call fcn.1402563a0
sub rsp, rax
mov rax, qword [0x1403bb2d8]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov r13, qword [rsp + 0x150]
mov rdi, qword [rsp + 0x158]
mov r14, qword [rsp + 0x170]
mov rax, rcx
mov qword [rsp + 0x30], rcx
mov rcx, qword [rsp + 0x168]
mov ebp, dword [rcx]
mov qword [rsp + 0x38], rcx
mov rcx, rax
mov rbx, r9
mov qword [rsp + 0x40], r8
mov r15, rdx
xor r12d, r12d
call fcn.14016bb60
mov r8d, ebp
xor edx, edx
mov rcx, r14
mov qword [rsp + 0x48], rax
call fcn.1401fa270
test eax, eax
je 0x1401bed63
mov esi, dword [rsp + 0x160]
inc ebp
test esi, esi
je 0x1401bec73
mov rcx, qword [rsp + 0x48]
xor r9d, r9d
mov r8, rdi
mov rdx, r13
call fcn.1400ec860
test eax, eax
jle 0x1401bed65
mov r8, rdi
mov rdx, r13
mov rcx, rbx
call fcn.1402550b0
lea rcx, [rsp + 0x90]
mov r8, rdi
mov rdx, r13
call fcn.1402550b0
lea r11d, [rdi - 1]
movsxd rax, r11d
test r11d, r11d
js 0x1401becaa
inc byte [rax + rbx]
jne 0x1401becaa
dec rax
jns 0x1401beca0
mov rsi, qword [rsp + 0x40]
lea r8, [rsp + 0x50]
xor r9d, r9d
mov rdx, rdi
mov rcx, r13
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rsi
call fcn.1400b4420
test eax, eax
je 0x1401bed65
lea r8, [rsp + 0x90]
xor r9d, r9d
mov rdx, rdi
mov rcx, rbx
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rsi
call fcn.1400b4420
test eax, eax
je 0x1401bed65
test edi, edi
jle 0x1401bed15
mov rcx, r12
mov edx, edi
movzx eax, byte [rsp + rcx + 0x90]
inc rcx
xor byte [rsp + rcx + 0x4f], al
dec rdx
jne 0x1401bed01
or byte [rsp + 0x50], 0x80
or byte [rsp + rdi + 0x4f], 1
lea rcx, [rsp + 0x50]
mov r8, r15
mov edx, edi
call fcn.14011b670
test rax, rax
je 0x1401bed65
mov rdx, qword [rsp + 0x30]
mov r8, r14
mov rcx, r15
call fcn.1401fb3c0
test eax, eax
jg 0x1401bed93
jne 0x1401bed65
mov r8d, ebp
xor edx, edx
mov rcx, r14
mov esi, 1
call fcn.1401fa270
test eax, eax
jne 0x1401bec52
inc ebp
mov rax, qword [rsp + 0x38]
mov dword [rax], ebp
mov eax, r12d
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.140254f60
add rsp, 0xe8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov r12d, 1
jmp 0x1401bed65
Function at 0x1401c0f20
Capabilities:
Check for software breakpoints

Disassembly:
mov eax, 0x28
call fcn.1402563a0
sub rsp, rax
mov r10, rcx
cmp dword [rsp + 0x50], r9d
jne 0x1401c1014
movzx eax, byte [r8]
cmp al, 0x6a
je 0x1401c0f4b
cmp al, 0x6b
jne 0x1401c1014
mov qword [rsp + 0x20], rbx
lea rdx, [r8 + 1]
cmp al, 0x6b
jne 0x1401c0fcc
lea ebx, [r9 - 3]
xor eax, eax
test ebx, ebx
jle 0x1401c0f78
movzx ecx, byte [rdx]
inc rdx
cmp cl, 0xba
je 0x1401c0f78
cmp cl, 0xbb
jne 0x1401c0fb9
inc eax
cmp eax, ebx
jl 0x1401c0f62
sub ebx, eax
test eax, eax
jne 0x1401c0fd0
call fcn.1400baef0
lea r8, str.RSA_padding_check_X931
mov edx, 0x56
lea rcx, str.crypto_rsa_rsa_x931.c
call fcn.1400baf60
mov edx, 0x8a
xor r8d, r8d
lea ecx, [r8 + 4]
call fcn.1400bb1b0
mov rbx, qword [rsp + 0x20]
or eax, 0xffffffff
add rsp, 0x28
ret
call fcn.1400baef0
lea r8, str.RSA_padding_check_X931
mov edx, 0x4e
jmp 0x1401c0f8f
lea ebx, [r9 - 2]
movsxd rax, ebx
cmp byte [rax + rdx], 0xcc
je 0x1401c0ffd
call fcn.1400baef0
lea r8, str.RSA_padding_check_X931
lea rcx, str.crypto_rsa_rsa_x931.c
mov edx, 0x5f
call fcn.1400baf60
mov edx, 0x8b
jmp 0x1401c0fa0
mov r8d, ebx
mov rcx, r10
call fcn.1402550b0
mov eax, ebx
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
call fcn.1400baef0
lea r8, str.RSA_padding_check_X931
lea rcx, str.crypto_rsa_rsa_x931.c
mov edx, 0x43
call fcn.1400baf60
xor r8d, r8d
mov edx, 0x89
lea ecx, [r8 + 4]
call fcn.1400bb1b0
or eax, 0xffffffff
add rsp, 0x28
ret
Function at 0x1401d1310
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
mov eax, 0x20
call fcn.1402563a0
sub rsp, rax
mov rbp, r9
mov rdi, r9
mov rbx, r8
shr rbp, 3
mov rsi, rdx
mov r12, rcx
cmp r8, r9
jb 0x1401d13d6
nop
xor r8d, r8d
test rbp, rbp
je 0x1401d13c2
nop dword [rax + rax]
movzx eax, byte [rsi + 6]
movzx ecx, byte [rsi + 7]
inc r8
shl rcx, 8
add rsi, 8
or rcx, rax
movzx eax, byte [rsi - 3]
shl rcx, 8
or rcx, rax
movzx eax, byte [rsi - 4]
shl rcx, 8
or rcx, rax
movzx eax, byte [rsi - 5]
shl rcx, 8
or rcx, rax
movzx eax, byte [rsi - 6]
shl rcx, 8
or rcx, rax
movzx eax, byte [rsi - 7]
shl rcx, 8
or rcx, rax
movzx eax, byte [rsi - 8]
shl rcx, 8
or rcx, rax
xor qword [r12 + r8*8 - 8], rcx
cmp r8, rbp
jb 0x1401d1360
mov rcx, r12
call fcn.1401d0e50
sub rbx, rdi
cmp rbx, rdi
jae 0x1401d1350
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r12
ret
Function at 0x1401d3a90
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x1401d3bf2
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
push r13
push r14
mov eax, 0x20
call fcn.1402563a0
sub rsp, rax
mov r14, qword [rsp + 0x60]
mov qword [rsp + 0x48], r12
mov r12, qword [rsp + 0x68]
mov r10, r14
mov r13, r9
mov rdi, r8
mov rbx, rdx
mov rbp, rcx
cmp r8, 0x10
jb 0x1401d3b38
mov qword [rsp + 0x40], rsi
mov rsi, r8
shr rsi, 4
mov rax, rsi
imul rax, rax, 0xfffffffffffffff0
add rdi, rax
nop
mov r8, rbx
sub r10, rbp
mov rcx, rbp
sub r8, rbp
mov edx, 2
mov rax, qword [r10 + rcx]
add rcx, 8
xor rax, qword [rcx - 8]
dec rdx
mov qword [r8 + rcx - 8], rax
jne 0x1401d3b01
mov r8, r13
mov rdx, rbx
mov rcx, rbx
call r12
mov r10, rbx
add rbx, 0x10
add rbp, 0x10
dec rsi
jne 0x1401d3af0
mov rsi, qword [rsp + 0x40]
test rdi, rdi
je 0x1401d3bc7
mov rdx, r10
mov r9, rbx
xor r8d, r8d
sub rdx, rbp
sub r9, rbp
mov rcx, rbp
cmp r8, rdi
jae 0x1401d3b72
movzx eax, byte [rdx + rcx]
inc r8
inc rcx
xor al, byte [rcx - 1]
mov byte [r9 + rcx - 1], al
cmp r8, 0x10
jb 0x1401d3b53
jmp 0x1401d3ba0
cmp r8, 0x10
jae 0x1401d3ba0
mov edx, reloc.WS2_32.dll_recv
sub r10, rbx
lea rcx, [r8 + rbx]
sub rdx, r8
nop word [rax + rax]
movzx eax, byte [r10 + rcx]
inc rcx
dec rdx
mov byte [rcx - 1], al
jne 0x1401d3b90
mov r8, r13
mov rdx, rbx
mov rcx, rbx
call r12
mov r10, rbx
cmp rdi, 0x10
jbe 0x1401d3bc7
add rbx, 0x10
add rbp, 0x10
sub rdi, 0x10
jne 0x1401d3b41
mov r12, qword [rsp + 0x48]
cmp r14, r10
je 0x1401d3bdf
mov rax, qword [r10]
mov qword [r14], rax
mov rax, qword [r10 + 8]
mov qword [r14 + 8], rax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop rdi
repz ret
Function at 0x1401d3c09
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x1401d3df1
push rbx
push rsi
push rdi
push r13
push r14
push r15
mov eax, 0x48
call fcn.1402563a0
sub rsp, rax
mov rax, qword [0x1403bb2d8]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov r13, qword [rsp + 0xa0]
mov r15, qword [rsp + 0xa8]
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0x40], r12
mov r14, r9
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
cmp rcx, rdx
je 0x1401d3cc5
mov r12, r13
cmp rbx, 0x10
jb 0x1401d3d24
mov rbp, rbx
shr rbp, 4
mov rax, rbp
imul rax, rax, 0xfffffffffffffff0
add rbx, rax
nop word [rax + rax]
mov r8, r14
mov rdx, rsi
mov rcx, rdi
call r15
mov r11, qword [r12]
add rsi, 0x10
xor qword [rsi - 0x10], r11
mov rax, qword [r12 + 8]
mov r12, rdi
xor qword [rsi - 8], rax
add rdi, 0x10
dec rbp
jne 0x1401d3c80
cmp r13, r12
je 0x1401d3d24
mov rax, qword [r12]
mov qword [r13], rax
mov rax, qword [r12 + 8]
mov qword [r13 + 8], rax
jmp 0x1401d3d24
cmp rbx, 0x10
jb 0x1401d3d24
mov rbp, rbx
shr rbp, 4
mov rax, rbp
imul rax, rax, 0xfffffffffffffff0
add rbx, rax
nop dword [rax]
lea rdx, [rsp + 0x20]
mov r8, r14
mov rcx, rdi
call r15
mov r11, qword [rdi]
mov rax, qword [r13]
xor rax, qword [rsp + 0x20]
add rsi, 0x10
add rdi, 0x10
mov qword [rsi - 0x10], rax
mov rax, qword [r13 + 8]
mov qword [r13], r11
mov rcx, qword [rdi - 8]
xor rax, qword [rsp + 0x28]
dec rbp
mov qword [rsi - 8], rax
mov qword [r13 + 8], rcx
jne 0x1401d3ce0
mov r12, qword [rsp + 0x40]
test rbx, rbx
je 0x1401d3dcf
lea rax, [rsp + 0x20]
mov rbp, r13
sub rbp, rax
lea rax, [rsp + 0x20]
sub rsi, rax
nop word [rax + rax]
lea rdx, [rsp + 0x20]
mov r8, r14
mov rcx, rdi
call r15
xor r11d, r11d
cmp r11, rbx
jae 0x1401d3d8f
movzx r8d, byte [rdi + r11]
movzx ecx, byte [rsp + r11 + 0x20]
lea rdx, [r11 + rbp]
xor cl, byte [rsp + rdx + 0x20]
lea rax, [rsi + r11]
inc r11
mov byte [rsp + rax + 0x20], cl
mov byte [rsp + rdx + 0x20], r8b
cmp r11, 0x10
jb 0x1401d3d61
cmp rbx, 0x10
jbe 0x1401d3da5
add rdi, 0x10
add rsi, 0x10
sub rbx, 0x10
jne 0x1401d3d50
jmp 0x1401d3dcf
cmp r11, 0x10
jae 0x1401d3dcf
mov edx, reloc.WS2_32.dll_recv
sub rdi, r13
lea rcx, [r13 + r11]
sub rdx, r11
nop dword [rax + rax]
movzx eax, byte [rdi + rcx]
inc rcx
dec rdx
mov byte [rcx - 1], al
jne 0x1401d3dc0
mov rbp, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140254f60
add rsp, 0x48
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
repz ret
Function at 0x1401d3e00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rsi
push rdi
push r12
push r13
mov eax, 0x40
call fcn.1402563a0
sub rsp, rax
mov rsi, qword [rsp + 0x98]
mov r10, r9
mov rdi, r8
mov ebx, dword [rsi]
mov r12, rdx
mov r13, rcx
test ebx, ebx
jns 0x1401d3e45
mov dword [rsi], 0xffffffff
add rsp, 0x40
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov qword [rsp + 0x38], r14
mov r14, qword [rsp + 0x90]
mov qword [rsp + 0x30], r15
test ebx, ebx
je 0x1401d3e85
nop dword [rax + rax]
test rdi, rdi
je 0x1401d3e85
mov eax, ebx
inc r12
inc r13
movzx ecx, byte [rax + r14]
dec rdi
xor cl, byte [r13 - 1]
inc ebx
and ebx, 0xf
mov byte [r12 - 1], cl
jne 0x1401d3e60
mov r9, qword [rsp + 0xa0]
movsxd r15, ebx
cmp rdi, 0x10
jb 0x1401d3f62
mov rsi, r12
mov rcx, rdi
mov qword [rsp + 0x80], rbp
shr rcx, 4
mov rbp, r13
sub rsi, r14
mov rax, rcx
sub rbp, r14
imul rax, rax, 0xfffffffffffffff0
add rdi, rax
mov rax, rcx
shl rax, 4
add r12, rax
add r13, rax
mov qword [rsp + 0x70], r13
mov r13, qword [rsp + 0x88]
mov qword [rsp + 0x78], r12
mov r12, rcx
mov r8, r13
mov rdx, r14
mov rcx, r14
call r9
cmp ebx, 0x10
jae 0x1401d3f26
mov edx, reloc.WS2_32.dll_ntohs
lea rcx, [r15 + r14]
sub edx, ebx
shr edx, 3
inc edx
nop word [rax + rax]
mov rax, qword [rcx + rbp]
add rcx, 8
xor rax, qword [rcx - 8]
dec rdx
mov qword [rsi + rcx - 8], rax
jne 0x1401d3f10
mov r9, qword [rsp + 0xa0]
add rsi, 0x10
add rbp, 0x10
xor ebx, ebx
xor r15d, r15d
dec r12
jne 0x1401d3ee1
mov r12, qword [rsp + 0x78]
mov r13, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x98]
mov r10, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x80]
mov r15, qword [rsp + 0x30]
test rdi, rdi
je 0x1401d3fa5
mov r8, r10
mov rdx, r14
mov rcx, r14
call r9
movsxd rcx, ebx
sub r13, r14
add rcx, r14
sub r12, r14
add ebx, edi
nop word [rax + rax]
movzx eax, byte [rcx + r13]
inc rcx
xor al, byte [rcx - 1]
dec rdi
mov byte [rcx + r12 - 1], al
jne 0x1401d3f90
mov dword [rsi], ebx
mov r14, qword [rsp + 0x38]
add rsp, 0x40
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x1401d45d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
mov eax, 0x50
call fcn.1402563a0
sub rsp, rax
mov r14, qword [rsp + 0xb8]
mov rbp, rdx
mov rdx, qword [rsp + 0xc0]
mov edi, dword [rdx]
mov r10, r9
mov rbx, r8
mov r12, rcx
test edi, edi
je 0x1401d4634
nop
test rbx, rbx
je 0x1401d4634
mov eax, edi
inc rbp
inc r12
movzx ecx, byte [rax + r14]
dec rbx
xor cl, byte [r12 - 1]
inc edi
and edi, 0xf
mov byte [rbp - 1], cl
jne 0x1401d4610
mov r9, qword [rsp + 0xc8]
mov r13d, reloc.WS2_32.dll_recv
mov qword [rsp + 0x48], r15
mov esi, 1
cmp rbx, r13
jb 0x1401d476d
mov rax, qword [rsp + 0xb0]
mov rcx, rbx
xor edi, edi
add rax, r13
shr rcx, 4
mov r14, rbp
mov qword [rsp + 0x30], rax
mov r15, r12
mov rax, rcx
mov dword [rsp + 0x20], edi
mov rdi, qword [rsp + 0xb8]
imul rax, rax, 0xfffffffffffffff0
add rbx, rax
mov rax, rcx
sub r14, rdi
shl rax, 4
sub r15, rdi
mov qword [rsp + 0xa0], rbx
mov rbx, qword [rsp + 0x30]
add rbp, rax
add r12, rax
mov qword [rsp + 0x90], r12
mov r12, qword [rsp + 0xb0]
mov qword [rsp + 0x98], rbp
mov rbp, rcx
nop word [rax + rax]
mov r8, r10
mov rdx, rdi
mov rcx, r12
call r9
mov r11d, r13d
mov ecx, esi
mov rdx, rbx
nop word [rax + rax]
movzx eax, byte [rdx - 1]
dec rdx
add ecx, eax
mov byte [rdx], cl
shr ecx, 8
dec r11d
jne 0x1401d46f0
mov rcx, rdi
lea edx, [r11 + 2]
nop word [rax + rax]
mov rax, qword [r15 + rcx]
add rcx, 8
xor rax, qword [rcx - 8]
dec rdx
mov qword [r14 + rcx - 8], rax
jne 0x1401d4710
mov r9, qword [rsp + 0xc8]
mov r10, qword [rsp + 0xa8]
add r14, r13
add r15, r13
dec rbp
jne 0x1401d46d0
mov rbx, qword [rsp + 0xa0]
mov edi, dword [rsp + 0x20]
mov rbp, qword [rsp + 0x98]
mov r12, qword [rsp + 0x90]
mov r14, qword [rsp + 0xb8]
mov rdx, qword [rsp + 0xc0]
test rbx, rbx
je 0x1401d47d2
mov r15, qword [rsp + 0xb0]
mov r8, r10
mov rdx, r14
mov rcx, r15
call r9
lea rcx, [r15 + 0x10]
nop word [rax + rax]
movzx eax, byte [rcx - 1]
dec rcx
add esi, eax
mov byte [rcx], sil
shr esi, 8
dec r13d
jne 0x1401d4790
movsxd rcx, edi
sub r12, r14
sub rbp, r14
add rcx, r14
add edi, ebx
movzx eax, byte [rcx + r12]
inc rcx
xor al, byte [rcx - 1]
dec rbx
mov byte [rcx + rbp - 1], al
jne 0x1401d47b2
mov rax, qword [rsp + 0xc0]
mov dword [rax], edi
jmp 0x1401d47d4
mov dword [rdx], edi
mov r15, qword [rsp + 0x48]
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1401d47f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
mov eax, 0x40
call fcn.1402563a0
sub rsp, rax
mov rbx, r8
mov r8, qword [rsp + 0xb0]
mov rsi, rdx
mov edi, dword [r8]
mov rbp, rcx
mov dword [rsp + 0x30], edi
test edi, edi
je 0x1401d4855
mov rdx, qword [rsp + 0xa8]
test rbx, rbx
je 0x1401d4851
mov eax, edi
inc rsi
inc rbp
movzx ecx, byte [rax + rdx]
dec rbx
xor cl, byte [rbp - 1]
inc edi
and edi, 0xf
mov byte [rsi - 1], cl
jne 0x1401d4830
mov dword [rsp + 0x30], edi
mov rdx, qword [rsp + 0xa0]
mov r10, qword [rsp + 0xb8]
mov r15d, reloc.WS2_32.dll_inet_ntoa
movzx eax, byte [rdx + 0xd]
movzx ecx, byte [rdx + 0xc]
lea r14, [rdx + 0xc]
shl ecx, 8
mov qword [rsp + 0x80], r13
lea r12d, [r15 - 0xb]
or ecx, eax
movzx eax, byte [rdx + 0xe]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0xf]
shl ecx, 8
or ecx, eax
mov dword [rsp + 0x90], ecx
cmp rbx, 0x10
jb 0x1401d498a
mov eax, 0x10000000
mov rdi, rdx
nop word [rax + rax]
mov r13, rbx
shr r13, 4
cmp r13, rax
cmova r13, rax
add ecx, r13d
mov eax, ecx
mov dword [rsp + 0x90], ecx
cmp rax, r13
jae 0x1401d48eb
sub r13, rax
xor ecx, ecx
mov dword [rsp + 0x90], ecx
mov r8, r13
mov rdx, rsi
mov rcx, rbp
mov qword [rsp + 0x20], rdi
call r10
mov ecx, dword [rsp + 0x90]
mov eax, ecx
mov r11d, ecx
mov byte [rdi + 0xf], cl
shr eax, 0x10
shr r11d, 0x18
mov byte [rdi + 0xd], al
mov eax, ecx
mov byte [r14], r11b
shr eax, 8
mov byte [rdi + 0xe], al
test ecx, ecx
jne 0x1401d494a
mov r8d, r15d
mov ecx, r12d
mov rdx, r14
nop dword [rax]
movzx eax, byte [rdx - 1]
dec rdx
add ecx, eax
mov byte [rdx], cl
shr ecx, 8
dec r8d
jne 0x1401d4930
mov ecx, dword [rsp + 0x90]
mov r9, qword [rsp + 0x98]
mov r10, qword [rsp + 0xb8]
shl r13, 4
sub rbx, r13
add rsi, r13
add rbp, r13
mov eax, 0x10000000
cmp rbx, 0x10
jae 0x1401d48c0
mov edi, dword [rsp + 0x30]
mov r8, qword [rsp + 0xb0]
mov rdx, qword [rsp + 0xa0]
test rbx, rbx
je 0x1401d4a3f
mov r13, qword [rsp + 0xa8]
xor eax, eax
mov qword [rsp + 0x20], rdx
mov qword [r13], rax
mov rdx, r13
mov rcx, r13
mov r8, r12
mov qword [r13 + 8], rax
call r10
mov rdx, qword [rsp + 0xa0]
mov ecx, dword [rsp + 0x90]
inc ecx
mov eax, ecx
mov byte [rdx + 0xf], cl
shr eax, 0x18
mov byte [r14], al
mov eax, ecx
shr eax, 0x10
mov byte [rdx + 0xd], al
mov eax, ecx
shr eax, 8
mov byte [rdx + 0xe], al
test ecx, ecx
jne 0x1401d4a07
nop word [rax + rax]
movzx eax, byte [r14 - 1]
dec r14
add r12d, eax
mov byte [r14], r12b
shr r12d, 8
dec r15d
jne 0x1401d49f0
movsxd rcx, edi
sub rbp, r13
sub rsi, r13
add rcx, r13
add edi, ebx
nop word [rax + rax]
movzx eax, byte [rcx + rbp]
inc rcx
xor al, byte [rcx - 1]
dec rbx
mov byte [rsi + rcx - 1], al
jne 0x1401d4a20
mov rax, qword [rsp + 0xb0]
mov dword [rax], edi
jmp 0x1401d4a42
mov dword [r8], edi
mov r13, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret