joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14019c810
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0x90
lea rax, [rbp + 0xf]
mov qword [rbp + 0x2f], rax
movdqa xmm0, xmmword [0x1402a33c0]
movdqu xmmword [rbp - 0x29], xmm0
mov word [rbp - 0x19], 0x43
xor r12d, r12d
mov eax, r12d
nop word [rax + rax]
movzx ecx, byte [rbp - 0x29]
xor byte [rbp + rax - 0x28], cl
inc rax
cmp rax, 0x10
jb 0x14019c860
mov byte [rbp - 0x18], r12b
mov qword [rbp + 0xf], r12
mov qword [rbp + 0x1f], r12
mov qword [rbp + 0x27], reloc.WS2_32.dll_ntohs
lea rax, [rbp - 0x28]
mov r14, 0xffffffffffffffff
mov r8, r14
inc r8
cmp byte [rax + r8], r12b
jne 0x14019c893
lea rdx, [rbp - 0x28]
lea rcx, [rbp + 0xf]
call fcn.14014d7f0
lea rax, [rbp + 0xf]
mov qword [rbp + 0x37], rax
mov byte [rbp - 0x29], 0x53
mov al, 6
mov cl, reloc.WLDAP32.dll_Ordinal_32
mov dl, 0x36
mov r8b, reloc.WLDAP32.dll_Ordinal_33
mov r9b, 0x60
mov r10b, 0x61
mov r11b, 0x7d
mov bl, 0x37
mov dil, 0x3f
movzx esi, dil
xor r15d, r15d
xor al, 0x53
mov byte [rbp - 0x28], al
xor cl, 0x53
mov byte [rbp - 0x27], cl
xor dl, 0x53
mov byte [rbp - 0x26], dl
xor r8b, 0x53
mov byte [rbp - 0x25], r8b
xor r9b, 0x53
mov byte [rbp - 0x24], r9b
xor r10b, 0x53
mov byte [rbp - 0x23], r10b
xor r11b, 0x53
mov byte [rbp - 0x22], r11b
xor bl, 0x53
mov byte [rbp - 0x21], bl
xor dil, 0x53
mov byte [rbp - 0x20], dil
xor sil, 0x53
mov byte [rbp - 0x1f], sil
mov byte [rbp - 0x1e], r15b
mov qword [rbp - 0x11], r12
mov qword [rbp - 1], r12
mov qword [rbp + 7], reloc.WS2_32.dll_ntohs
lea rax, [rbp - 0x28]
inc r14
cmp byte [rax + r14], r15b
jne 0x14019c932
mov r8, r14
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x11]
call fcn.14014d7f0
lea rax, [rbp - 0x11]
mov qword [rbp - 0x29], rax
lea rcx, [rbp - 0x11]
cmp qword [rbp + 7], 0x10
cmovae rcx, qword [rbp - 0x11]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [rbp + 0xf]
cmp qword [rbp + 0x27], 0x10
cmovae rdx, qword [rbp + 0xf]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x1403248b8]
call rax
mov rbx, rax
mov rdx, qword [rbp + 7]
cmp rdx, 0x10
jb 0x14019c9c8
inc rdx
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14019c9c3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14019c9c3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140268610
mov qword [rbp - 1], r12
mov qword [rbp + 7], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x11], 0
mov rdx, qword [rbp + 0x27]
cmp rdx, 0x10
jb 0x14019ca16
inc rdx
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14019ca11
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14019ca11
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140268610
mov rax, rbx
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14019ca40
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0x98
mov qword [rbp - 1], r9
mov r13, r8
mov r12d, edx
mov qword [rbp - 9], rcx
lea rax, [rbp - 0x29]
mov qword [rbp + 7], rax
movdqa xmm0, xmmword [0x1402a2fd0]
movdqu xmmword [rbp - 0x59], xmm0
xor edx, edx
mov eax, edx
movzx ecx, byte [rbp - 0x59]
xor byte [rbp + rax - 0x58], cl
inc rax
cmp rax, 0xe
jb 0x14019ca80
mov byte [rbp - 0x4a], dl
mov qword [rbp - 0x29], rdx
mov qword [rbp - 0x19], rdx
mov qword [rbp - 0x11], reloc.WS2_32.dll_ntohs
lea rax, [rbp - 0x58]
mov r14, 0xffffffffffffffff
mov r8, r14
inc r8
cmp byte [rax + r8], dl
jne 0x14019cab2
lea rdx, [rbp - 0x58]
lea rcx, [rbp - 0x29]
call fcn.14014d7f0
lea rax, [rbp - 0x29]
mov qword [rbp + 0xf], rax
mov byte [rbp - 0x59], reloc.SecureEngineSDK64.dll_Ordinal_29
mov al, 0x48
mov cl, WSAGetLastError
mov dl, 0x78
mov r8b, reloc.WS2_32.dll_WSAGetLastError
mov r9b, reloc.WLDAP32.dll_Ordinal_46
mov r10b, 0x2f
mov r11b, 0x33
mov bl, 0x79
mov dil, WSAStartup
movzx esi, dil
xor r15d, r15d
xor al, 0x1d
mov byte [rbp - 0x58], al
xor cl, 0x1d
mov byte [rbp - 0x57], cl
xor dl, 0x1d
mov byte [rbp - 0x56], dl
xor r8b, 0x1d
mov byte [rbp - 0x55], r8b
xor r9b, 0x1d
mov byte [rbp - 0x54], r9b
xor r10b, 0x1d
mov byte [rbp - 0x53], r10b
xor r11b, 0x1d
mov byte [rbp - 0x52], r11b
xor bl, 0x1d
mov byte [rbp - 0x51], bl
xor dil, 0x1d
mov byte [rbp - 0x50], dil
xor sil, 0x1d
mov byte [rbp - 0x4f], sil
mov byte [rbp - 0x4e], r15b
xor edi, edi
mov qword [rbp - 0x49], rdi
mov qword [rbp - 0x39], rdi
mov qword [rbp - 0x31], reloc.WS2_32.dll_ntohs
lea rax, [rbp - 0x58]
mov r15, qword [rbp - 9]
inc r14
cmp byte [rax + r14], dil
jne 0x14019cb57
mov r8, r14
lea rdx, [rbp - 0x58]
lea rcx, [rbp - 0x49]
call fcn.14014d7f0
lea rax, [rbp - 0x49]
mov qword [rbp - 0x59], rax
lea rcx, [rbp - 0x49]
cmp qword [rbp - 0x31], 0x10
cmovae rcx, qword [rbp - 0x49]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [rbp - 0x29]
cmp qword [rbp - 0x11], 0x10
cmovae rdx, qword [rbp - 0x29]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r9, qword [rbp - 1]
mov r8, r13
mov edx, r12d
mov rcx, r15
call rax
mov rbx, rax
mov rdx, qword [rbp - 0x31]
cmp rdx, 0x10
jb 0x14019cbf3
inc rdx
mov rcx, qword [rbp - 0x49]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14019cbee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14019cbee
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140268610
mov qword [rbp - 0x39], rdi
mov qword [rbp - 0x31], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x49], 0
mov rdx, qword [rbp - 0x11]
cmp rdx, 0x10
jb 0x14019cc41
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14019cc3c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14019cc3c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140268610
mov rax, rbx
add rsp, 0x98
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14019cc60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov r15, rdx
mov r12, rcx
lea rax, [rbp - 0x40]
mov qword [rbp + 0x50], rax
mov r8b, Ordinal_60
mov dword [rbp - 0x50], 0x4f5e7c3b
mov dword [rbp - 0x4c], 0x5f55526c
mov dword [rbp - 0x48], 0x5e694c54
mov word [rbp - 0x44], 0x4f58
xor eax, eax
mov byte [rbp - 0x42], al
xor ecx, ecx
nop word [rax + rax]
xor byte [rbp + rax - 0x4f], r8b
inc rax
cmp rax, 0xd
jae 0x14019ccc5
movzx r8d, byte [rbp - 0x50]
jmp 0x14019ccb0
mov byte [rbp - 0x42], cl
mov qword [rbp - 0x40], rcx
mov qword [rbp - 0x30], rcx
mov qword [rbp - 0x28], reloc.WS2_32.dll_ntohs
lea rax, [rbp - 0x4f]
mov r14, 0xffffffffffffffff
mov r8, r14
inc r8
cmp byte [rax + r8], cl
jne 0x14019cce6
lea rdx, [rbp - 0x4f]
lea rcx, [rbp - 0x40]
call fcn.14014d7f0
nop
mov byte [rbp - 0x50], reloc.WS2_32.dll_recvfrom
mov al, 0x44
mov cl, 0x62
mov dl, reloc.WS2_32.dll_WSACleanup
mov r8b, 0x63
mov r9b, Ordinal_35
mov r10b, reloc.WLDAP32.dll_Ordinal_35
mov r11b, 0x3f
mov bl, 0x75
mov dil, 0x7d
movzx esi, dil
xor r13d, r13d
xor al, 0x11
mov byte [rbp - 0x4f], al
xor cl, 0x11
mov byte [rbp - 0x4e], cl
xor dl, 0x11
mov byte [rbp - 0x4d], dl
xor r8b, 0x11
mov byte [rbp - 0x4c], r8b
xor r9b, 0x11
mov byte [rbp - 0x4b], r9b
xor r10b, 0x11
mov byte [rbp - 0x4a], r10b
xor r11b, 0x11
mov byte [rbp - 0x49], r11b
xor bl, 0x11
mov byte [rbp - 0x48], bl
xor dil, 0x11
mov byte [rbp - 0x47], dil
xor sil, 0x11
mov byte [rbp - 0x46], sil
mov byte [rbp - 0x45], r13b
xor eax, eax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], reloc.WS2_32.dll_ntohs
lea rax, [rbp - 0x4f]
inc r14
cmp byte [rax + r14], r13b
jne 0x14019cd80
mov r8, r14
lea rdx, [rbp - 0x4f]
lea rcx, [rbp - 0x20]
call fcn.14014d7f0
nop
mov r9, r15
mov r8, r12
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x20]
call fcn.14019ea40
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14019d020
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rdi, rcx
lea rax, [rbp + 0x1f]
mov qword [rbp + 0x3f], rax
movdqa xmm0, xmmword [0x1402a31a0]
movdqu xmmword [rbp - 0x19], xmm0
mov dword [rbp - 9], 0x3e37323d
mov word [rbp - 5], reloc.WLDAP32.dll_Ordinal_26
xor esi, esi
mov eax, esi
nop word [rax + rax]
movzx ecx, byte [rbp - 0x19]
xor byte [rbp + rax - 0x18], cl
inc rax
cmp rax, 0x14
jb 0x14019d070
mov byte [rbp - 4], sil
mov qword [rbp + 0x1f], rsi
mov qword [rbp + 0x2f], rsi
mov qword [rbp + 0x37], reloc.WS2_32.dll_ntohs
lea rax, [rbp - 0x18]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], sil
jne 0x14019d0a3
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0x1f]
call fcn.14014d7f0
lea rax, [rbp + 0x1f]
mov qword [rbp + 0x47], rax
mov cl, 0x7a
mov dword [rbp - 0x19], 0xc1e3b7a
mov dword [rbp - 0x15], 0x49130a1b
mov dword [rbp - 0x11], 0x161e5448
mov word [rbp - 0xd], reloc.WLDAP32.dll_Ordinal_22
mov rax, rsi
xor byte [rbp + rax - 0x18], cl
inc rax
cmp rax, 0xc
jae 0x14019d0f4
movzx ecx, byte [rbp - 0x19]
jmp 0x14019d0e1
mov byte [rbp - 0xc], 0
mov qword [rbp - 1], rsi
mov qword [rbp + 0xf], rsi
mov qword [rbp + 0x17], reloc.WS2_32.dll_ntohs
lea rax, [rbp - 0x18]
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14019d110
mov r8, rbx
lea rdx, [rbp - 0x18]
lea rcx, [rbp - 1]
call fcn.14014d7f0
lea rax, [rbp - 1]
mov qword [rbp - 0x19], rax
lea rcx, [rbp - 1]
cmp qword [rbp + 0x17], 0x10
cmovae rcx, qword [rbp - 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [rbp + 0x1f]
cmp qword [rbp + 0x37], 0x10
cmovae rdx, qword [rbp + 0x1f]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rdi
call rax
mov ebx, eax
mov rdx, qword [rbp + 0x17]
cmp rdx, 0x10
jb 0x14019d1a1
inc rdx
mov rcx, qword [rbp - 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14019d19c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14019d19c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140268610
mov qword [rbp + 0xf], rsi
mov qword [rbp + 0x17], reloc.WS2_32.dll_ntohs
mov byte [rbp - 1], 0
mov rdx, qword [rbp + 0x37]
cmp rdx, 0x10
jb 0x14019d1ef
inc rdx
mov rcx, qword [rbp + 0x1f]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14019d1ea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14019d1ea
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140268610
mov eax, ebx
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14019d210
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x27]
sub rsp, 0xb0
mov rsi, r9
mov rdi, rcx
lea rax, [rbp - 0x11]
mov qword [rbp + 0xf], rax
movdqa xmm0, xmmword [0x1402a33f0]
movdqu xmmword [rbp - 0x49], xmm0
mov dword [rbp - 0x39], 0x6b6d7065
mov word [rbp - 0x35], 0x456a
xor eax, eax
mov byte [rbp - 0x33], al
xor r14d, r14d
nop word [rax + rax]
movzx ecx, byte [rbp - 0x49]
xor byte [rbp + rax - 0x48], cl
inc rax
cmp rax, 0x15
jb 0x14019d260
mov byte [rbp - 0x33], r14b
mov qword [rbp - 0x11], r14
mov qword [rbp - 1], r14
mov qword [rbp + 7], reloc.WS2_32.dll_ntohs
lea rax, [rbp - 0x48]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], r14b
jne 0x14019d293
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x11]
call fcn.14014d7f0
lea rax, [rbp - 0x11]
mov qword [rbp + 0x17], rax
mov cl, 0x48
mov dword [rbp - 0x49], 0x3a2d0348
mov dword [rbp - 0x45], 0x7b242d26
mov dword [rbp - 0x41], 0x242c667a
mov word [rbp - 0x3d], Ordinal_41
mov rax, r14
xor byte [rbp + rax - 0x48], cl
inc rax
cmp rax, 0xc
jae 0x14019d2e4
movzx ecx, byte [rbp - 0x49]
jmp 0x14019d2d1
mov byte [rbp - 0x3c], 0
mov qword [rbp - 0x31], r14
mov qword [rbp - 0x21], r14
mov qword [rbp - 0x19], reloc.WS2_32.dll_ntohs
lea rax, [rbp - 0x48]
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14019d300
mov r8, rbx
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x31]
call fcn.14014d7f0
lea rax, [rbp - 0x31]
mov qword [rbp - 0x49], rax
lea rcx, [rbp - 0x31]
cmp qword [rbp - 0x19], 0x10
cmovae rcx, qword [rbp - 0x31]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [rbp - 0x11]
cmp qword [rbp + 7], 0x10
cmovae rdx, qword [rbp - 0x11]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
mov r9, rsi
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call rax
mov ebx, eax
mov rdx, qword [rbp - 0x19]
cmp rdx, 0x10
jb 0x14019d3ad
inc rdx
mov rcx, qword [rbp - 0x31]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14019d3a8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14019d3a8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140268610
mov qword [rbp - 0x21], r14
mov qword [rbp - 0x19], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x31], 0
mov rdx, qword [rbp + 7]
cmp rdx, 0x10
jb 0x14019d3fb
inc rdx
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14019d3f6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14019d3f6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140268610
mov eax, ebx
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14019d420
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rdi, rdx
lea rax, [rbp + 0x1f]
mov qword [rbp + 0x3f], rax
movdqa xmm0, xmmword [0x1402a3430]
movdqu xmmword [rbp - 0x19], xmm0
mov dword [rbp - 9], 0x50747c
xor esi, esi
mov eax, esi
nop
movzx ecx, byte [rbp - 0x19]
xor byte [rbp + rax - 0x18], cl
inc rax
cmp rax, 0x12
jb 0x14019d460
mov byte [rbp - 6], sil
mov qword [rbp + 0x1f], rsi
mov qword [rbp + 0x2f], rsi
mov qword [rbp + 0x37], reloc.WS2_32.dll_ntohs
lea rax, [rbp - 0x18]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], sil
jne 0x14019d493
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0x1f]
call fcn.14014d7f0
lea rax, [rbp + 0x1f]
mov qword [rbp + 0x47], rax
mov cl, 0x51
mov dword [rbp - 0x19], 0x23341a51
mov dword [rbp - 0x15], 0x623d343f
mov dword [rbp - 0x11], 0x3d357f63
mov word [rbp - 0xd], 0x3d
mov rax, rsi
xor byte [rbp + rax - 0x18], cl
inc rax
cmp rax, 0xc
jae 0x14019d4e4
movzx ecx, byte [rbp - 0x19]
jmp 0x14019d4d1
mov byte [rbp - 0xc], 0
mov qword [rbp - 1], rsi
mov qword [rbp + 0xf], rsi
mov qword [rbp + 0x17], reloc.WS2_32.dll_ntohs
lea rax, [rbp - 0x18]
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14019d500
mov r8, rbx
lea rdx, [rbp - 0x18]
lea rcx, [rbp - 1]
call fcn.14014d7f0
lea rax, [rbp - 1]
mov qword [rbp - 0x19], rax
lea rcx, [rbp - 1]
cmp qword [rbp + 0x17], 0x10
cmovae rcx, qword [rbp - 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [rbp + 0x1f]
cmp qword [rbp + 0x37], 0x10
cmovae rdx, qword [rbp + 0x1f]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8d, 0x104
mov rdx, rdi
xor ecx, ecx
call rax
mov ebx, eax
mov rdx, qword [rbp + 0x17]
cmp rdx, 0x10
jb 0x14019d599
inc rdx
mov rcx, qword [rbp - 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14019d594
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14019d594
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140268610
mov qword [rbp + 0xf], rsi
mov qword [rbp + 0x17], reloc.WS2_32.dll_ntohs
mov byte [rbp - 1], 0
mov rdx, qword [rbp + 0x37]
cmp rdx, 0x10
jb 0x14019d5e7
inc rdx
mov rcx, qword [rbp + 0x1f]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14019d5e2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14019d5e2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140268610
mov eax, ebx
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14019d610
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
lea rax, [rbp + 0x27]
mov qword [rbp + 0x47], rax
movdqa xmm0, xmmword [str._n_HLYHyBBAEHA_]
movdqu xmmword [rbp - 0x19], xmm0
mov dword [rbp - 9], 0x4c437e1f
mov dword [rbp - 5], 0x42455e5d
mov word [rbp - 1], 0x59
xor edi, edi
mov eax, edi
nop dword [rax]
nop dword [rax + rax]
movzx ecx, byte [rbp - 0x19]
xor byte [rbp + rax - 0x18], cl
inc rax
cmp rax, 0x18
jb 0x14019d660
mov byte [rbp], dil
mov qword [rbp + 0x27], rdi
mov qword [rbp + 0x37], rdi
mov qword [rbp + 0x3f], reloc.WS2_32.dll_ntohs
lea rax, [rbp - 0x18]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], dil
jne 0x14019d693
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0x27]
call fcn.14014d7f0
lea rax, [rbp + 0x27]
mov qword [rbp + 0x4f], rax
mov cl, 0x66
mov dword [rbp - 0x19], 0x14032d66
mov dword [rbp - 0x15], 0x550a0308
mov dword [rbp - 0x11], 0xa024854
mov word [rbp - 0xd], 0xa
mov rax, rdi
xor byte [rbp + rax - 0x18], cl
inc rax
cmp rax, 0xc
jae 0x14019d6e4
movzx ecx, byte [rbp - 0x19]
jmp 0x14019d6d1
mov byte [rbp - 0xc], 0
mov qword [rbp + 7], rdi
mov qword [rbp + 0x17], rdi
mov qword [rbp + 0x1f], reloc.WS2_32.dll_ntohs
lea rax, [rbp - 0x18]
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14019d700
mov r8, rbx
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 7]
call fcn.14014d7f0
lea rax, [rbp + 7]
mov qword [rbp - 0x19], rax
lea rcx, [rbp + 7]
cmp qword [rbp + 0x1f], 0x10
cmovae rcx, qword [rbp + 7]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [rbp + 0x27]
cmp qword [rbp + 0x3f], 0x10
cmovae rdx, qword [rbp + 0x27]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea ecx, [rdx + 2]
call rax
mov rbx, rax
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0x10
jb 0x14019d794
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14019d78f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14019d78f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140268610
mov qword [rbp + 0x17], rdi
mov qword [rbp + 0x1f], reloc.WS2_32.dll_ntohs
mov byte [rbp + 7], 0
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0x10
jb 0x14019d7e2
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14019d7dd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14019d7dd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140268610
mov rax, rbx
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x14019d800
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
mov rdi, rdx
mov rsi, rcx
lea rax, [rbp - 0x40]
mov qword [rbp + 0x30], rax
movdqa xmm0, xmmword [0x1402a2fb0]
movdqu xmmword [rbp - 0x50], xmm0
xor r14d, r14d
mov r8d, r14d
nop word [rax + rax]
movzx eax, byte [rbp - 0x50]
xor byte [rbp + r8 - 0x4f], al
inc r8
cmp r8, 0xe
jb 0x14019d840
mov byte [rbp - 0x41], r14b
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], reloc.WS2_32.dll_ntohs
lea rax, [rbp - 0x4f]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], r14b
jne 0x14019d874
lea rdx, [rbp - 0x4f]
lea rcx, [rbp - 0x40]
call fcn.14014d7f0
nop
mov cl, 0x77
mov dword [rbp - 0x50], 0x5123c77
mov dword [rbp - 0x4c], 0x441b1219
mov dword [rbp - 0x48], 0x1b135945
mov word [rbp - 0x44], reloc.WLDAP32.dll_Ordinal_27
mov rax, r14
nop dword [rax + rax]
xor byte [rbp + rax - 0x4f], cl
inc rax
cmp rax, 0xc
jae 0x14019d8c3
movzx ecx, byte [rbp - 0x50]
jmp 0x14019d8b0
mov byte [rbp - 0x43], 0
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x10], r14
mov qword [rbp - 8], reloc.WS2_32.dll_ntohs
lea rax, [rbp - 0x4f]
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14019d8e0
mov r8, rbx
lea rdx, [rbp - 0x4f]
lea rcx, [rbp - 0x20]
call fcn.14014d7f0
nop
mov r9, rdi
mov r8, rsi
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x20]
call fcn.14019ea40
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14019d930
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
mov rdi, rdx
mov rsi, rcx
lea rax, [rbp - 0x40]
mov qword [rbp + 0x30], rax
mov r8b, reloc.WLDAP32.dll_Ordinal_32
mov dword [rbp - 0x50], 0x4f527020
mov dword [rbp - 0x4c], 0x53534543
mov dword [rbp - 0x48], 0x456e1213
mov word [rbp - 0x44], 0x5458
xor eax, eax
mov byte [rbp - 0x42], al
xor r14d, r14d
nop dword [rax]
xor byte [rbp + rax - 0x4f], r8b
inc rax
cmp rax, 0xd
jae 0x14019d995
movzx r8d, byte [rbp - 0x50]
jmp 0x14019d980
mov byte [rbp - 0x42], r14b
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], reloc.WS2_32.dll_ntohs
lea rax, [rbp - 0x4f]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], r14b
jne 0x14019d9b7
lea rdx, [rbp - 0x4f]
lea rcx, [rbp - 0x40]
call fcn.14014d7f0
nop
mov cl, 0x47
mov dword [rbp - 0x50], 0x35220c47
mov dword [rbp - 0x4c], 0x742b2229
mov dword [rbp - 0x48], 0x2b236975
mov word [rbp - 0x44], Ordinal_46
mov rax, r14
nop
xor byte [rbp + rax - 0x4f], cl
inc rax
cmp rax, 0xc
jae 0x14019da03
movzx ecx, byte [rbp - 0x50]
jmp 0x14019d9f0
mov byte [rbp - 0x43], 0
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x10], r14
mov qword [rbp - 8], reloc.WS2_32.dll_ntohs
lea rax, [rbp - 0x4f]
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14019da20
mov r8, rbx
lea rdx, [rbp - 0x4f]
lea rcx, [rbp - 0x20]
call fcn.14014d7f0
nop
mov r9, rdi
mov r8, rsi
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x20]
call fcn.14019ea40
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret