joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140032c50
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x4f0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x4d0
call sub.VCRUNTIME140.dll_memset
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov r11, rsi
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140032d08
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140032d08
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rdi + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x140032d03
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x140032ce0
cmp edx, 0x9bc5a608
je 0x140032e2e
test r8d, r8d
jne 0x140032cc0
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x140032d1e
cmp qword [rax + 0x30], 0
jne 0x140032c90
xor eax, eax
call rax
mov dword [rsp + 0x50], 0x100010
mov rbp, rax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rbx, rsi
nop dword [rax]
nop dword [rax + rax]
mov r9, qword [rbx + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov r11d, dword [rax + r9 + 0x88]
add r11, r9
cmp r11, r9
je 0x140032dc8
mov r8d, dword [r11 + 0x18]
test r8d, r8d
je 0x140032dc8
mov edi, dword [r11 + 0x20]
nop word [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rdi + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140032dc3
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x140032da0
cmp edx, 0x85cca27e
je 0x140032e4a
test r8d, r8d
jne 0x140032d80
mov rax, qword [rbx]
mov rbx, rax
cmp rax, rsi
je 0x140032dde
cmp qword [rax + 0x30], 0
jne 0x140032d50
xor eax, eax
lea rdx, [rsp + 0x20]
mov rcx, rbp
call rax
test eax, eax
je 0x140032e68
cmp qword [rsp + 0x68], 0
jne 0x140032e27
cmp qword [rsp + 0x70], 0
jne 0x140032e27
cmp qword [rsp + 0x78], 0
jne 0x140032e27
cmp qword [rsp + 0x80], 0
jne 0x140032e27
cmp qword [rsp + 0x88], 0
jne 0x140032e27
cmp qword [rsp + 0x90], 0
je 0x140032e68
mov eax, 1
jmp 0x140032e6a
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x140032d20
mov ecx, dword [r11 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x140032de0
xor eax, eax
lea r11, [rsp + 0x4f0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140032e90
Capabilities:
Get session user name

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x260
mov rbx, rcx
xor ebp, ebp
mov dword [rax + 8], 0x101
lea rdx, [rax + 8]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x28]
call fcn.140037af0
nop
lea rcx, [rsp + 0x28]
mov r8, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
cmp rdx, 7
cmova rcx, r8
mov rax, qword [rsp + 0x38]
lea r14, [rcx + rax*2]
lea rdi, [rsp + 0x28]
cmova rdi, r8
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
cmp rdi, r14
jne 0x140032f1d
mov byte [rbx], bpl
jmp 0x140033003
mov rax, r14
sub rax, rdi
sar rax, 1
movabs rsi, 0x7fffffffffffffff
cmp rax, rsi
ja 0x14003305c
cmp rax, 0xf
jbe 0x140032fc0
or rax, 0xf
cmp rax, rsi
jbe 0x140032f75
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14009acb8
test rax, rax
je 0x140032fa0
lea rbp, [rax + 0x27]
and rbp, 0xffffffffffffffe0
mov qword [rbp - 8], rax
jmp 0x140032fb4
mov rsi, rax
mov ecx, reloc.WLDAP32.dll_Ordinal_22
cmp rax, rcx
cmovb rsi, rcx
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x140032fa7
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140033062
jmp 0x140032f5a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140032fb4
call fcn.14009acb8
mov rbp, rax
mov qword [rbx], rbp
mov qword [rbx + 0x18], rsi
nop dword [rax + rax]
mov rdx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x140032fcd
mov rdx, qword [rbx]
movzx ecx, byte [rdi]
mov rax, qword [rbx + 0x10]
mov byte [rdx + rax], cl
inc qword [rbx + 0x10]
mov rax, qword [rbx + 0x10]
add rdi, 2
cmp rdi, r14
jne 0x140032fc0
mov rcx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x140032ff5
mov rcx, qword [rbx]
mov byte [rax + rcx], 0
mov rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x28]
cmp rdx, 7
jbe 0x140033041
lea rdx, [rdx*2 + 2]
mov rax, r8
cmp rdx, 0x1000
jb 0x140033039
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140033039
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r8
call fcn.14009ab20
mov rax, rbx
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.140030390
nop
call fcn.14002c1c0
int3
Function at 0x140034d20
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x180
xor edx, edx
mov rsi, rcx
xor r14d, r14d
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x140034e8d
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x130
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140034e84
mov r15, 0xffffffffffffffff
nop
mov dword [rsp + 0x28], r14d
lea r8, [rsp + 0x7c]
mov r9d, r15d
mov qword [rsp + 0x20], r14
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov eax, 2
mul rbx
cmovo rax, r15
mov rcx, rax
call fcn.14009af68
mov r9d, r15d
mov dword [rsp + 0x28], ebx
lea r8, [rsp + 0x7c]
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.140037af0
mov rcx, rdi
call fcn.14009ab20
mov rax, r15
nop dword [rax]
inc rax
cmp word [rsi + rax*2], r14w
jne 0x140034df0
mov r10, qword [rsp + 0x48]
lea r8, [rsp + 0x30]
mov r9, qword [rsp + 0x30]
cmp r10, 7
mov rdx, qword [rsp + 0x40]
cmova r8, r9
cmp rdx, rax
jne 0x140034ead
mov rax, rsi
test rdx, rdx
je 0x140034e44
sub r8, rsi
nop word [rax + rax]
movzx ecx, word [r8 + rax]
cmp cx, word [rax]
jne 0x140034ead
add rax, 2
sub rdx, 1
jne 0x140034e30
mov r14d, dword [rsp + 0x58]
cmp r10, 7
jbe 0x140034e84
lea rdx, [r10*2 + 2]
mov rax, r9
cmp rdx, 0x1000
jb 0x140034e7c
mov r9, qword [r9 - 8]
add rdx, 0x27
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140034efc
mov rcx, r9
call fcn.14009ab20
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x180]
mov eax, r14d
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
cmp r10, 7
jbe 0x140034ee4
lea rdx, [r10*2 + 2]
mov rax, r9
cmp rdx, 0x1000
jb 0x140034edc
mov r9, qword [r9 - 8]
add rdx, 0x27
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140034efc
mov rcx, r9
call fcn.14009ab20
lea rdx, [rsp + 0x50]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140034d80
jmp 0x140034e84
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140034f10
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x480
mov edx, ecx
mov ecx, Ordinal_27
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x238
mov rcx, rax
mov rbx, rax
xor edi, edi
call qword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x140034fb9
nop dword [rax]
lea rax, [rsp + 0x270]
mov dword [rsp + 0x28], 0x104
mov r9d, 0xffffffff
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x60]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rdx, str.GTAProcess
lea rcx, [rsp + 0x270]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
jne 0x140034fa8
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x140034f50
jmp 0x140034fb9
lea rcx, [rsp + 0x270]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsdup]
mov rdi, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x490]
mov rax, rdi
add rsp, 0x480
pop rdi
ret

Function at 0x140034fe0
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x460
mov rdi, rdx
xor esi, esi
mov edx, ecx
lea ecx, [rsi + 0x18]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003505b
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x438
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x14003505b
nop word [rax + rax]
mov rdx, rdi
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140035056
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x140035030
jmp 0x14003505b
mov rsi, qword [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x460]
mov rax, rsi
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x1400393b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 7], dil
je 0x1400393e4
mov eax, edi
nop dword [rax]
lea ecx, [rax + 0x34]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x1400393d0
mov byte [r8 + 7], dil
lea rax, [r8 + 6]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x140039414
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x14003942e
mov qword [rsp + 0x30], 6
mov eax, dword [r8]
mov dword [rsp + 0x20], eax
movzx eax, word [r8 + 4]
mov word [rsp + 0x24], ax
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x14003943c
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140045e00
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1400394b6
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400394b1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400394b1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009ab20
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x1400394d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 9], dil
je 0x140039504
mov eax, edi
nop dword [rax]
lea ecx, [rax + 0x34]
xor byte [r8 + rax], cl
inc rax
cmp rax, 8
jb 0x1400394f0
mov byte [r8 + 9], dil
lea rax, [r8 + 8]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x140039534
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x140039545
mov qword [rsp + 0x30], 8
mov rax, qword [r8]
mov qword [rsp + 0x20], rax
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x140039553
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140045e00
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1400395cd
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400395c8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400395c8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009ab20
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x1400395e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rbx, rcx
mov qword [rbp - 0x10], rcx
xor r9d, r9d
cmp byte [r8 + 6], r9b
je 0x140039624
mov ecx, r9d
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x34]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x140039610
mov byte [r8 + 6], r9b
lea rax, [r8 + 5]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], r9
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x14003964e
mov qword [rbp - 0x28], r9
mov byte [rbp - 0x38], r9b
jmp 0x140039664
mov qword [rbp - 0x28], 5
mov eax, dword [r8]
mov dword [rbp - 0x38], eax
movzx eax, byte [r8 + 4]
mov byte [rbp - 0x34], al
cmp byte [rdx + 0xa], 0
je 0x140039683
mov rcx, r9
nop dword [rax]
lea eax, [rcx + 0x34]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 9
jb 0x140039670
mov byte [rdx + 0xa], 0
lea rax, [rdx + 9]
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], r9
mov qword [rbp - 0x40], r9
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
cmp rdx, rax
jne 0x1400396ad
mov qword [rbp - 0x48], r9
mov byte [rbp - 0x58], 0
jmp 0x1400396c5
mov qword [rbp - 0x48], 9
movsd xmm0, qword [rdx]
movsd qword [rbp - 0x58], xmm0
movzx eax, byte [rdx + 8]
mov byte [rbp - 0x50], al
lea r9, [rbp - 0x38]
lea r8, [rbp - 0x58]
movzx edx, byte [rbp - 0x60]
mov rcx, rbx
call fcn.14003f800
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x140039719
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140039713
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140039713
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009ab20
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x140039757
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140039752
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140039752
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009ab20
mov rax, rbx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rbp
ret
Function at 0x140039770
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 0xa], dil
je 0x1400397a4
mov eax, edi
nop dword [rax]
lea ecx, [rax + 0x34]
xor byte [r8 + rax], cl
inc rax
cmp rax, 9
jb 0x140039790
mov byte [r8 + 0xa], dil
lea rax, [r8 + 9]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x1400397d4
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x1400397f1
mov qword [rsp + 0x30], 9
movsd xmm0, qword [r8]
movsd qword [rsp + 0x20], xmm0
movzx eax, byte [r8 + 8]
mov byte [rsp + 0x28], al
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x1400397ff
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140045e00
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140039879
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140039874
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140039874
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009ab20
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x140039890
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rbx, rcx
mov qword [rbp - 0x10], rcx
xor r9d, r9d
cmp byte [r8 + 0xb], r9b
je 0x1400398d4
mov ecx, r9d
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x34]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x1400398c0
mov byte [r8 + 0xb], r9b
lea rax, [r8 + 0xa]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], r9
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x1400398fe
mov qword [rbp - 0x28], r9
mov byte [rbp - 0x38], r9b
jmp 0x140039919
mov qword [rbp - 0x28], 0xa
movsd xmm0, qword [r8]
movsd qword [rbp - 0x38], xmm0
movzx eax, word [r8 + 8]
mov word [rbp - 0x30], ax
cmp byte [rdx + 0xb], 0
je 0x140039943
mov rcx, r9
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x34]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x140039930
mov byte [rdx + 0xb], 0
lea rax, [rdx + 0xa]
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], r9
mov qword [rbp - 0x40], r9
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
cmp rdx, rax
jne 0x14003996d
mov qword [rbp - 0x48], r9
mov byte [rbp - 0x58], 0
jmp 0x140039986
mov qword [rbp - 0x48], 0xa
movsd xmm0, qword [rdx]
movsd qword [rbp - 0x58], xmm0
movzx eax, word [rdx + 8]
mov word [rbp - 0x50], ax
lea r9, [rbp - 0x38]
lea r8, [rbp - 0x58]
movzx edx, byte [rbp - 0x60]
mov rcx, rbx
call fcn.14003f800
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x1400399da
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400399d4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400399d4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009ab20
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x140039a18
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140039a13
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140039a13
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009ab20
mov rax, rbx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rbp
ret
Function at 0x140039a30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 0xc], dil
je 0x140039a64
mov eax, edi
nop dword [rax]
lea ecx, [rax + 0x34]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0xb
jb 0x140039a50
mov byte [r8 + 0xc], dil
lea rax, [r8 + 0xb]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x140039a94
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x140039abb
mov qword [rsp + 0x30], recvfrom
movsd xmm0, qword [r8]
movsd qword [rsp + 0x20], xmm0
movzx eax, word [r8 + 8]
mov word [rsp + 0x28], ax
movzx eax, byte [r8 + 0xa]
mov byte [rsp + 0x2a], al
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x140039ac9
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140045e00
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140039b43
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140039b3e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140039b3e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009ab20
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret

Function at 0x140040a40
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 9], al
je 0x140040a63
lea edx, [rax + 0x34]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x140040a50
mov byte [rcx + 9], 0
lea r8, [rcx + 8]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.140038fc0
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140040a80
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0x10], al
je 0x140040aa3
lea edx, [rax + 0x34]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xf
jb 0x140040a90
mov byte [rcx + 0x10], 0
lea r8, [rcx + 0xf]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.140038fc0
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140041df0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x140041e13
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x34]
xor byte [rax + rcx], dl
inc rax
cmp rax, 4
jb 0x140041e00
mov byte [rcx + 5], 0
mov rax, rcx
ret

Function at 0x140041e20
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x136], 0
je 0x140041e48
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x34]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x135
jb 0x140041e30
mov byte [rcx + 0x136], 0
mov rax, rcx
ret
Function at 0x140041e50
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x44], 0
je 0x140041e73
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x34]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x43
jb 0x140041e60
mov byte [rcx + 0x44], 0
mov rax, rcx
ret

Function at 0x140041e80
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x140041ea3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x34]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x46
jb 0x140041e90
mov byte [rcx + 0x47], 0
mov rax, rcx
ret