joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000ddd0
Capabilities:
Access peb ldr_data
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov ebp, edx
mov r15, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, qword gs:[0x60]
mov r12, rax
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop word [rax + rax]
mov rbx, qword [rcx + 0x30]
movsxd rdx, dword [rbx + 0x3c]
mov edi, dword [rdx + rbx + 0x88]
add rdi, rbx
cmp rdi, rbx
je 0x14000de97
mov r11d, dword [rdi + 0x18]
test r11d, r11d
je 0x14000de97
mov r14d, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
mov r10d, 0x565a7cac
lea rax, [r14 + r11*4]
mov r9d, dword [rax + rbx]
add r9, rbx
movzx eax, byte [r9]
inc r9
test al, al
je 0x14000de92
nop
movsx edx, al
lea r9, [r9 + 1]
sub al, 0x41
mov r8d, edx
or r8d, 0x20
cmp al, 0x19
movzx eax, byte [r9 - 1]
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
test al, al
jne 0x14000de60
cmp r10d, 0xd181d126
je 0x14000de9f
test r11d, r11d
jne 0x14000de40
mov rcx, qword [rcx]
jmp 0x14000de10
mov ecx, dword [rdi + 0x24]
mov r9d, 5
add rcx, rbx
mov qword [rsp + 0x20], 0
mov rdx, r15
movzx r8d, word [rcx + r11*2]
mov ecx, dword [rdi + 0x1c]
add rcx, rbx
mov eax, dword [rcx + r8*4]
lea r8, [0x140100ff0]
add rax, rbx
mov rcx, r12
call rax
test ebp, ebp
je 0x14000df8c
sub ebp, 1
je 0x14000df43
cmp ebp, 1
jne 0x14000dfde
movzx eax, byte [0x140100ff8]
cmp byte [0x140100ff0], al
jne 0x14000dfde
movzx eax, byte [0x140100ff9]
cmp byte [0x140100ff1], al
jne 0x14000dfde
movzx eax, byte [0x140100ffa]
cmp byte [0x140100ff2], al
jne 0x14000dfde
movzx eax, byte [0x140100ffb]
cmp byte [0x140100ff3], al
jne 0x14000dfde
movzx eax, byte [0x140100ffc]
jmp 0x14000dfcf
movzx eax, byte [0x140100f90]
cmp byte [0x140100ff0], al
jne 0x14000dfde
movzx eax, byte [0x140100f91]
cmp byte [0x140100ff1], al
jne 0x14000dfde
movzx eax, byte [0x140100f92]
cmp byte [0x140100ff2], al
jne 0x14000dfde
movzx eax, byte [0x140100f93]
cmp byte [0x140100ff3], al
jne 0x14000dfde
movzx eax, byte [0x140100f94]
jmp 0x14000dfcf
movzx eax, byte [0x140100fd8]
cmp byte [0x140100ff0], al
jne 0x14000dfde
movzx eax, byte [0x140100fd9]
cmp byte [0x140100ff1], al
jne 0x14000dfde
movzx eax, byte [0x140100fda]
cmp byte [0x140100ff2], al
jne 0x14000dfde
movzx eax, byte [0x140100fdb]
cmp byte [0x140100ff3], al
jne 0x14000dfde
movzx eax, byte [0x140100fdc]
cmp byte [0x140100ff4], al
jne 0x14000dfde
mov eax, 1
jmp 0x14000dfe0
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14000ff50
Capabilities:
Access peb ldr_data
Encode data using xor
Get process filename
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x500
mov rax, qword [0x140095080]
xor rax, rsp
mov qword [rsp + 0x4f0], rax
mov rbp, rdx
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x4d0
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x50], 0x100010
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x14001003d
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x14001003d
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
mov r10d, 0xf00bc8c5
lea rcx, [r14 + r11*4]
mov ecx, dword [rcx + rbx]
add rcx, rbx
movzx r9d, byte [rcx]
inc rcx
test r9b, r9b
je 0x140010038
nop
movsx edx, r9b
lea rcx, [rcx + 1]
sub r9b, 0x41
mov r8d, edx
or r8d, 0x20
cmp r9b, 0x19
movzx r9d, byte [rcx - 1]
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
test r9b, r9b
jne case.0x1400244c7.47
cmp r10d, 0x42986a5e
je 0x140010045
test r11d, r11d
jne 0x14000ffe0
mov rax, qword [rax]
jmp 0x14000ffb0
mov edx, dword [rsi + 0x24]
mov rcx, rbp
add rdx, rbx
movzx r8d, word [rdx + r11*2]
mov edx, dword [rsi + 0x1c]
add rdx, rbx
mov eax, dword [rdx + r8*4]
lea rdx, [rsp + 0x20]
add rax, rbx
call rax
test eax, eax
je 0x1400100a4
cmp qword [rsp + 0x68], 0
jne 0x1400100cc
cmp qword [rsp + 0x70], 0
jne 0x1400100cc
cmp qword [rsp + 0x78], 0
jne 0x1400100cc
cmp qword [rsp + 0x80], 0
jne 0x1400100cc
cmp qword [rsp + 0x88], 0
jne 0x1400100cc
cmp qword [rsp + 0x90], 0
jne 0x1400100cc
mov rcx, qword [rsp + 0x4f0]
xor rcx, rsp
call fcn.140073450
lea r11, [rsp + 0x500]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.14000fb90
int3
Function at 0x1400100e0
Capabilities:
Access peb ldr_data
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x50
xor r14b, r14b
mov rax, qword gs:[0x60]
add byte [rax - 0x75], cl
sbb byte [rax - 0x75], cl
adc byte [rdi], cl
invalid
add byte [rax], 0
add byte [rax], al
mov r9, qword [rax + 0x30]
mov qword [rsp + 0x30], r9
movsxd rcx, dword [r9 + 0x3c]
mov rdx, qword [rcx + r9 + 0x88]
mov qword [rsp + 0x60], rdx
mov r11d, edx
add r11, r9
mov qword [rsp + 0x38], r11
shr rdx, 0x20
mov dword [rsp + 0x40], edx
cmp r11, r9
je 0x1400101de
mov edi, dword [r11 + 0x18]
mov dword [rsp + 0x20], edi
nop
mov ecx, edi
dec edi
mov dword [rsp + 0x20], edi
test ecx, ecx
je 0x1400101de
mov edx, dword [r11 + 0x20]
add rdx, r9
mov ecx, dword [rdx + rdi*4]
add rcx, r9
mov qword [rsp + 0x28], rcx
mov ebx, 0x48c461e6
nop word [rax + rax]
movsx r10d, byte [rcx]
inc rcx
mov qword [rsp + 0x28], rcx
test r10b, r10b
jne 0x1400101bc
cmp ebx, 0xf86fdd3c
jne 0x1400101ba
mov ecx, dword [r11 + 0x1c]
add rcx, r9
mov eax, dword [r11 + 0x24]
add rax, r9
movzx eax, word [rax + rdi*2]
mov edx, dword [rcx + rax*4]
add rdx, r9
mov ecx, 0xdeadbeef
call rdx
jmp 0x1400101e9
jmp 0x140010150
mov edx, r10d
sub r10b, 0x41
mov r8d, edx
or r8d, 0x20
cmp r10b, 0x19
cmova r8d, edx
xor r8d, ebx
imul ebx, r8d, 0x1000193
jmp 0x140010180
mov rax, qword [rax]
jmp 0x140010110
cmp r14b, 1
je 0x140010205
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret
call fcn.14000fb90
nop
int3
Function at 0x1400121e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x140012214
mov eax, esi
lea ecx, [rax + 0x18]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x140012200
mov byte [r8 + 7], sil
lea rax, [r8 + 6]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], sil
cmp r9, rax
je 0x140012244
mov r8d, 6
mov rdx, r9
lea rcx, [rsp + 0x20]
call fcn.140004800
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140012252
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.14000af20
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1400122c6
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400122c1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400122c1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400734b4
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400122e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x140012314
mov eax, esi
lea ecx, [rax + 0x18]
xor byte [r8 + rax], cl
inc rax
cmp rax, 8
jb 0x140012300
mov byte [r8 + 9], sil
lea rax, [r8 + 8]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], sil
cmp r9, rax
je 0x140012344
mov r8d, 8
mov rdx, r9
lea rcx, [rsp + 0x20]
call fcn.140004800
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140012352
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.14000af20
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1400123c6
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400123c1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400123c1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400734b4
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400123e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
cmp byte [r8 + 6], 0
je 0x140012425
xor ecx, ecx
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x18]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x140012410
mov byte [r8 + 6], 0
lea rax, [r8 + 5]
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], 0
cmp r9, rax
je 0x140012459
mov r8d, 5
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.140004800
nop
cmp byte [rbx + 0xa], 0
je 0x140012474
xor ecx, ecx
lea eax, [rcx + 0x18]
xor byte [rcx + rbx], al
inc rcx
cmp rcx, 9
jb 0x140012461
mov byte [rbx + 0xa], 0
lea rax, [rbx + 9]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x1400124a8
mov r8d, 9
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140004800
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
movzx edx, byte [rsp + 0x20]
mov rcx, rdi
call fcn.140018220
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x140012501
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400124fb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400124fb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400734b4
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x140012541
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001253c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001253c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400734b4
mov rax, rdi
mov rbx, qword [rsp + 0x98]
add rsp, 0x70
pop rdi
ret
Function at 0x140012560
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x140012594
mov eax, esi
lea ecx, [rax + 0x18]
xor byte [r8 + rax], cl
inc rax
cmp rax, 9
jb 0x140012580
mov byte [r8 + 0xa], sil
lea rax, [r8 + 9]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], sil
cmp r9, rax
je 0x1400125c4
mov r8d, 9
mov rdx, r9
lea rcx, [rsp + 0x20]
call fcn.140004800
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1400125d2
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.14000af20
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140012646
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140012641
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140012641
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400734b4
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140012660
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x140012694
mov eax, esi
lea ecx, [rax + 0x18]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0xb
jb 0x140012680
mov byte [r8 + 0xc], sil
lea rax, [r8 + 0xb]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], sil
cmp r9, rax
je 0x1400126c4
mov r8d, listen
mov rdx, r9
lea rcx, [rsp + 0x20]
call fcn.140004800
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1400126d2
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.14000af20
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140012746
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140012741
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140012741
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400734b4
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x140012760
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
cmp byte [r8 + 6], 0
je 0x1400127a5
xor ecx, ecx
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x18]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x140012790
mov byte [r8 + 6], 0
lea rax, [r8 + 5]
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], 0
cmp r9, rax
je 0x1400127d9
mov r8d, 5
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.140004800
nop
cmp byte [rbx + 0xd], 0
je 0x1400127f4
xor ecx, ecx
lea eax, [rcx + 0x18]
xor byte [rcx + rbx], al
inc rcx
cmp rcx, 0xc
jb 0x1400127e1
mov byte [rbx + 0xd], 0
lea rax, [rbx + 0xc]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x140012828
mov r8d, listen
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140004800
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
movzx edx, byte [rsp + 0x20]
mov rcx, rdi
call fcn.140018220
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x140012881
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001287b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001287b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400734b4
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x1400128c1
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400128bc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400128bc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400734b4
mov rax, rdi
mov rbx, qword [rsp + 0x98]
add rsp, 0x70
pop rdi
ret

Function at 0x140019470
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
cmp byte [rcx + 5], 0
mov rbx, rdx
mov qword [rsp + 0x20], rbx
mov rdx, rcx
je 0x1400194a3
xor ecx, ecx
nop dword [rax]
lea eax, [rcx + 0x18]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 4
jb 0x140019490
mov byte [rdx + 5], 0
lea rcx, [rdx + 4]
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
cmp rdx, rcx
je 0x1400194cd
mov r8d, 4
mov rcx, rbx
call fcn.140004800
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x1400194e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
cmp byte [rcx + 8], 0
mov rbx, rdx
mov qword [rsp + 0x20], rbx
mov rdx, rcx
je 0x140019513
xor ecx, ecx
nop dword [rax]
lea eax, [rcx + 0x18]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 7
jb 0x140019500
mov byte [rdx + 8], 0
lea rcx, [rdx + 7]
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
cmp rdx, rcx
je 0x14001953d
mov r8d, 7
mov rcx, rbx
call fcn.140004800
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140019550
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
cmp byte [rcx + 9], 0
mov rbx, rdx
mov qword [rsp + 0x20], rbx
mov rdx, rcx
je 0x140019583
xor ecx, ecx
nop dword [rax]
lea eax, [rcx + 0x18]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 8
jb 0x140019570
mov byte [rdx + 9], 0
lea rcx, [rdx + 8]
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
cmp rdx, rcx
je 0x1400195ad
mov r8d, 8
mov rcx, rbx
call fcn.140004800
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x1400195c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
cmp byte [rcx + 0x10], 0
mov rbx, rdx
mov qword [rsp + 0x20], rbx
mov rdx, rcx
je 0x1400195f3
xor ecx, ecx
nop dword [rax]
lea eax, [rcx + 0x18]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 0xf
jb 0x1400195e0
mov byte [rdx + 0x10], 0
lea rcx, [rdx + 0xf]
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
cmp rdx, rcx
je 0x14001961d
mov r8d, reloc.WS2_32.dll_ntohs
mov rcx, rbx
call fcn.140004800
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140019630
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
cmp byte [rcx + 0xb], 0
mov rbx, rdx
mov qword [rsp + 0x20], rbx
mov rdx, rcx
je 0x140019663
xor ecx, ecx
nop dword [rax]
lea eax, [rcx + 0x18]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 0xa
jb 0x140019650
mov byte [rdx + 0xb], 0
lea rcx, [rdx + 0xa]
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
cmp rdx, rcx
je 0x14001968d
mov r8d, 0xa
mov rcx, rbx
call fcn.140004800
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140019720
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x140095080]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, rdx
mov dword [rsp + 0x40], 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9, [rsp + 0x40]
xor edx, edx
mov rcx, rax
lea r8, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
xor esi, esi
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [rsi + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x1400197cd
mov qword [rsp + 0x28], rsi
lea r8d, [rsi + 2]
xor r9d, r9d
mov dword [rsp + 0x20], esi
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test rax, rax
jne 0x1400197fc
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 8], rsi
mov qword [rbx], rsi
mov rax, rbx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140073450
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rbx + 8], rax
mov qword [rbx], rdi
jmp 0x1400197d4
Function at 0x14001aac0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x14001aae3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x18]
xor byte [rax + rcx], dl
inc rax
cmp rax, 4
jb 0x14001aad0
mov byte [rcx + 5], 0
mov rax, rcx
ret

Function at 0x14001aaf0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x136], 0
je 0x14001ab18
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x18]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x135
jb 0x14001ab00
mov byte [rcx + 0x136], 0
mov rax, rcx
ret

Function at 0x14001ab20
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x44], 0
je 0x14001ab43
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x18]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x43
jb 0x14001ab30
mov byte [rcx + 0x44], 0
mov rax, rcx
ret

Function at 0x14001ab50
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x14001ab73
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x18]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x46
jb 0x14001ab60
mov byte [rcx + 0x47], 0
mov rax, rcx
ret
Function at 0x14001ab80
Capabilities:
Allocate or change rwx memory
Enumerate pe sections
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x140095080]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbp, rcx
mov byte [rsp + 0x20], dl
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r14, rax
test rax, rax
je 0x14001ad76
mov r12d, 0x5a4d
cmp word [rax], r12w
jne 0x14001ad76
movsxd rdi, dword [rax + 0x3c]
add rdi, rax
cmp dword [rdi], 0x4550
jne 0x14001ad76
movzx ebx, word [rdi + 0x14]
lea rdx, [rsp + 0x30]
add rbx, 0x18
lea rcx, [rsp + 0x21]
mov r8, rax
add rbx, rdi
call fcn.140019720
mov r15, qword [rsp + 0x38]
test r15, r15
je 0x14001ad76
mov rsi, qword [rsp + 0x30]
lea rax, [rsi - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14001ad76
cmp word [r15], r12w
jne 0x14001ad64
movsxd rcx, dword [r15 + 0x3c]
add rcx, r15
cmp dword [rcx], 0x4550
jne 0x14001ad64
mov eax, dword [rdi + 8]
cmp dword [rcx + 8], eax
jne 0x14001ad64
movzx edx, word [rcx + 6]
cmp dx, word [rdi + 6]
jne 0x14001ad64
movzx eax, word [rcx + 0x14]
lea r12, [rcx + 0x18]
xor esi, esi
mov qword [rsp + 0x80], r13
add r12, rax
xor r13b, r13b
mov r9d, esi
mov r10d, edx
test edx, edx
je 0x14001ad42
nop
mov r8, rbp
mov rax, rbx
sub r8, rbx
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x14001aca3
inc rax
test ecx, ecx
jne 0x14001ac90
test edx, edx
jne 0x14001acb0
test dword [rbx + 0x24], 0x20000000
jne 0x14001acc5
inc r9d
add rbx, 0x28
add r12, 0x28
cmp r9d, r10d
jl 0x14001ac80
jmp 0x14001ad42
cmp dword [rbx + 0x10], esi
jbe 0x14001ad42
nop word [rax + rax]
mov eax, dword [r12 + 0x14]
mov ecx, dword [rbx + 0xc]
mov edi, esi
add rax, rdi
add rcx, rdi
add rcx, r14
movzx ebp, byte [rax + r15]
cmp byte [rcx], bpl
je 0x14001ad3b
cmp byte [rsp + 0x20], 0
je 0x14001ad38
mov edx, 1
mov dword [rsp + 0x24], 0x40
lea r9, [rsp + 0x28]
lea r8d, [rdx + 0x3f]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [rbx + 0xc]
lea r9, [rsp + 0x24]
add rax, rdi
mov edx, 1
mov byte [rax + r14], bpl
mov ecx, dword [rbx + 0xc]
mov r8d, dword [rsp + 0x28]
add rcx, rdi
add rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r13b, 1
inc esi
cmp esi, dword [rbx + 0x10]
jb 0x14001acd0
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, r13b
mov r13, qword [rsp + 0x80]
jmp 0x14001ad78
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140073450
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret