joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14019da70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rdi, rcx
lea rax, [rbp + 0x1f]
mov qword [rbp + 0x3f], rax
movdqa xmm0, xmmword [0x1402a33a0]
movdqu xmmword [rbp - 0x19], xmm0
mov word [rbp - 9], 0x47
xor esi, esi
mov eax, esi
nop
movzx ecx, byte [rbp - 0x19]
xor byte [rbp + rax - 0x18], cl
inc rax
cmp rax, 0x10
jb 0x14019dab0
mov byte [rbp - 8], sil
mov qword [rbp + 0x1f], rsi
mov qword [rbp + 0x2f], rsi
mov qword [rbp + 0x37], reloc.WS2_32.dll_ntohs
lea rax, [rbp - 0x18]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], sil
jne 0x14019dae3
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0x1f]
call fcn.14014d7f0
lea rax, [rbp + 0x1f]
mov qword [rbp + 0x47], rax
mov cl, reloc.WLDAP32.dll_Ordinal_32
mov dword [rbp - 0x19], 0x52456b20
mov dword [rbp - 0x15], 0x134c454e
mov dword [rbp - 0x11], 0x4c440e12
mov word [rbp - 0xd], Ordinal_79
mov rax, rsi
xor byte [rbp + rax - 0x18], cl
inc rax
cmp rax, 0xc
jae 0x14019db34
movzx ecx, byte [rbp - 0x19]
jmp 0x14019db21
mov byte [rbp - 0xc], 0
mov qword [rbp - 1], rsi
mov qword [rbp + 0xf], rsi
mov qword [rbp + 0x17], reloc.WS2_32.dll_ntohs
lea rax, [rbp - 0x18]
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14019db50
mov r8, rbx
lea rdx, [rbp - 0x18]
lea rcx, [rbp - 1]
call fcn.14014d7f0
lea rax, [rbp - 1]
mov qword [rbp - 0x19], rax
lea rcx, [rbp - 1]
cmp qword [rbp + 0x17], 0x10
cmovae rcx, qword [rbp - 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [rbp + 0x1f]
cmp qword [rbp + 0x37], 0x10
cmovae rdx, qword [rbp + 0x1f]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rdi
call rax
mov rbx, rax
mov rdx, qword [rbp + 0x17]
cmp rdx, 0x10
jb 0x14019dbe2
inc rdx
mov rcx, qword [rbp - 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14019dbdd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14019dbdd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140268610
mov qword [rbp + 0xf], rsi
mov qword [rbp + 0x17], reloc.WS2_32.dll_ntohs
mov byte [rbp - 1], 0
mov rdx, qword [rbp + 0x37]
cmp rdx, 0x10
jb 0x14019dc30
inc rdx
mov rcx, qword [rbp + 0x1f]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14019dc2b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14019dc2b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140268610
mov rax, rbx
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14019dc50
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x80
lea rax, [rbp - 0x28]
mov qword [rbp + 0x20], rax
movdqa xmm0, xmmword [0x1402a3370]
movdqu xmmword [rbp - 0x60], xmm0
mov dword [rbp - 0x50], 0x5e734949
xor eax, eax
mov byte [rbp - 0x4c], al
xor edi, edi
movzx ecx, byte [rbp - 0x60]
xor byte [rbp + rax - 0x5f], cl
inc rax
cmp rax, 0x13
jb 0x14019dc81
mov byte [rbp - 0x4c], dil
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x18], rdi
mov qword [rbp - 0x10], reloc.WS2_32.dll_ntohs
lea rax, [rbp - 0x5f]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], dil
jne 0x14019dcb4
lea rdx, [rbp - 0x5f]
lea rcx, [rbp - 0x28]
call fcn.14014d7f0
lea rax, [rbp - 0x28]
mov qword [rbp + 0x28], rax
mov cl, 0x2b
mov dword [rbp - 0x60], 0x594e602b
mov dword [rbp - 0x5c], 0x18474e45
mov dword [rbp - 0x58], 0x474f0519
mov word [rbp - 0x54], 0x47
mov rax, rdi
xor byte [rbp + rax - 0x5f], cl
inc rax
cmp rax, 0xc
jae 0x14019dd05
movzx ecx, byte [rbp - 0x60]
jmp 0x14019dcf2
mov byte [rbp - 0x53], 0
mov qword [rbp - 0x48], rdi
mov qword [rbp - 0x38], rdi
mov qword [rbp - 0x30], reloc.WS2_32.dll_ntohs
lea rax, [rbp - 0x5f]
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14019dd20
mov r8, rbx
lea rdx, [rbp - 0x5f]
lea rcx, [rbp - 0x48]
call fcn.14014d7f0
lea rax, [rbp - 0x48]
mov qword [rbp + 0x20], rax
lea rcx, [rbp - 0x48]
cmp qword [rbp - 0x30], 0x10
cmovae rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae rdx, qword [rbp - 0x28]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov ebx, eax
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x14019ddae
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14019dda9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14019dda9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140268610
mov qword [rbp - 0x38], rdi
mov qword [rbp - 0x30], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x48], 0
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x14019ddfc
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14019ddf7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14019ddf7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140268610
mov eax, ebx
add rsp, 0x80
pop rdi
pop rbx
pop rbp
ret
Function at 0x14019de10
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rsi, rdx
mov rdi, rcx
lea rax, [rbp + 0xf]
mov qword [rbp + 0x2f], rax
movdqa xmm0, xmmword [0x1402a3040]
movdqu xmmword [rbp - 0x29], xmm0
mov dword [rbp - 0x19], 0x1a1a0c
xor r14d, r14d
mov eax, r14d
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [rbp - 0x29]
xor byte [rbp + rax - 0x28], cl
inc rax
cmp rax, 0x12
jb 0x14019de60
mov byte [rbp - 0x16], r14b
mov qword [rbp + 0xf], r14
mov qword [rbp + 0x1f], r14
mov qword [rbp + 0x27], reloc.WS2_32.dll_ntohs
lea rax, [rbp - 0x28]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], r14b
jne 0x14019de93
lea rdx, [rbp - 0x28]
lea rcx, [rbp + 0xf]
call fcn.14014d7f0
lea rax, [rbp + 0xf]
mov qword [rbp + 0x37], rax
mov cl, Ordinal_79
mov dword [rbp - 0x29], 0x3c2b054e
mov dword [rbp - 0x25], 0x7d222b20
mov dword [rbp - 0x21], 0x222a607c
mov word [rbp - 0x1d], Ordinal_35
mov rax, r14
xor byte [rbp + rax - 0x28], cl
inc rax
cmp rax, 0xc
jae 0x14019dee4
movzx ecx, byte [rbp - 0x29]
jmp 0x14019ded1
mov byte [rbp - 0x1c], 0
mov qword [rbp - 0x11], r14
mov qword [rbp - 1], r14
mov qword [rbp + 7], reloc.WS2_32.dll_ntohs
lea rax, [rbp - 0x28]
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14019df00
mov r8, rbx
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x11]
call fcn.14014d7f0
lea rax, [rbp - 0x11]
mov qword [rbp - 0x29], rax
lea rcx, [rbp - 0x11]
cmp qword [rbp + 7], 0x10
cmovae rcx, qword [rbp - 0x11]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [rbp + 0xf]
cmp qword [rbp + 0x27], 0x10
cmovae rdx, qword [rbp + 0xf]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, rsi
mov rcx, rdi
call rax
mov ebx, eax
mov rdx, qword [rbp + 7]
cmp rdx, 0x10
jb 0x14019df94
inc rdx
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14019df8f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14019df8f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140268610
mov qword [rbp - 1], r14
mov qword [rbp + 7], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x11], 0
mov rdx, qword [rbp + 0x27]
cmp rdx, 0x10
jb 0x14019dfe2
inc rdx
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14019dfdd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14019dfdd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140268610
mov eax, ebx
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14019e000
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rdi, rcx
lea rax, [rbp + 0x1f]
mov qword [rbp + 0x3f], rax
movdqa xmm0, xmmword [0x1402a3160]
movdqu xmmword [rbp - 0x19], xmm0
mov dword [rbp - 9], 0x3126202f
xor eax, eax
mov byte [rbp - 5], al
xor esi, esi
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [rbp - 0x19]
xor byte [rbp + rax - 0x18], cl
inc rax
cmp rax, 0x13
jb 0x14019e050
mov byte [rbp - 5], sil
mov qword [rbp + 0x1f], rsi
mov qword [rbp + 0x2f], rsi
mov qword [rbp + 0x37], reloc.WS2_32.dll_ntohs
lea rax, [rbp - 0x18]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], sil
jne 0x14019e083
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0x1f]
call fcn.14014d7f0
lea rax, [rbp + 0x1f]
mov qword [rbp + 0x47], rax
mov cl, 0x5d
mov dword [rbp - 0x19], 0x2f38165d
mov dword [rbp - 0x15], 0x6e313833
mov dword [rbp - 0x11], 0x3139736f
mov word [rbp - 0xd], Ordinal_50
mov rax, rsi
xor byte [rbp + rax - 0x18], cl
inc rax
cmp rax, 0xc
jae 0x14019e0d4
movzx ecx, byte [rbp - 0x19]
jmp 0x14019e0c1
mov byte [rbp - 0xc], 0
mov qword [rbp - 1], rsi
mov qword [rbp + 0xf], rsi
mov qword [rbp + 0x17], reloc.WS2_32.dll_ntohs
lea rax, [rbp - 0x18]
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14019e0f0
mov r8, rbx
lea rdx, [rbp - 0x18]
lea rcx, [rbp - 1]
call fcn.14014d7f0
lea rax, [rbp - 1]
mov qword [rbp - 0x19], rax
lea rcx, [rbp - 1]
cmp qword [rbp + 0x17], 0x10
cmovae rcx, qword [rbp - 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [rbp + 0x1f]
cmp qword [rbp + 0x37], 0x10
cmovae rdx, qword [rbp + 0x1f]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 0xffffffff
mov rcx, rdi
call rax
mov ebx, eax
mov rdx, qword [rbp + 0x17]
cmp rdx, 0x10
jb 0x14019e186
inc rdx
mov rcx, qword [rbp - 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14019e181
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14019e181
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140268610
mov qword [rbp + 0xf], rsi
mov qword [rbp + 0x17], reloc.WS2_32.dll_ntohs
mov byte [rbp - 1], 0
mov rdx, qword [rbp + 0x37]
cmp rdx, 0x10
jb 0x14019e1d4
inc rdx
mov rcx, qword [rbp + 0x1f]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14019e1cf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14019e1cf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140268610
mov eax, ebx
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14019e1f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
lea rax, [rbp - 0x30]
mov qword [rbp - 0x10], rax
mov cl, 0x7c
mov dword [rbp - 0x60], 0x8193b7c
mov dword [rbp - 0x5c], 0xc111928
mov dword [rbp - 0x58], 0x14081d2c
mov word [rbp - 0x54], 0x3d
xor edi, edi
mov eax, edi
nop
xor byte [rbp + rax - 0x5f], cl
inc rax
cmp rax, 0xc
jae 0x14019e243
movzx ecx, byte [rbp - 0x60]
jmp 0x14019e230
mov byte [rbp - 0x53], dil
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x18], reloc.WS2_32.dll_ntohs
lea rax, [rbp - 0x5f]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], dil
jne 0x14019e265
lea rdx, [rbp - 0x5f]
lea rcx, [rbp - 0x30]
call fcn.14014d7f0
lea rax, [rbp - 0x30]
mov qword [rbp - 8], rax
mov cl, 0x45
mov dword [rbp - 0x60], 0x37200e45
mov dword [rbp - 0x5c], 0x7629202b
mov dword [rbp - 0x58], 0x29216b77
mov word [rbp - 0x54], reloc.WLDAP32.dll_Ordinal_41
mov rax, rdi
xor byte [rbp + rax - 0x5f], cl
inc rax
cmp rax, 0xc
jae 0x14019e2b6
movzx ecx, byte [rbp - 0x60]
jmp 0x14019e2a3
mov byte [rbp - 0x53], 0
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x38], reloc.WS2_32.dll_ntohs
lea rax, [rbp - 0x5f]
nop
inc rbx
cmp byte [rax + rbx], 0
jne 0x14019e2d0
mov r8, rbx
lea rdx, [rbp - 0x5f]
lea rcx, [rbp - 0x50]
call fcn.14014d7f0
lea rax, [rbp - 0x50]
mov qword [rbp - 0x60], rax
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x140324b40]
mov ecx, 0x104
call rax
mov ebx, eax
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x14019e36a
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14019e365
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14019e365
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140268610
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x38], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x50], 0
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x14019e3b8
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14019e3b3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14019e3b3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140268610
mov eax, ebx
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x14019e3d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov r14, r8
mov r15, qword [0x140324ac0]
lea rax, [rbp - 1]
mov qword [rbp + 0x1f], rax
movdqa xmm0, xmmword [0x1402a3120]
movdqu xmmword [rbp - 0x39], xmm0
mov word [rbp - 0x29], 0x242c
mov dword [rbp - 0x27], 0x3904
xor r13d, r13d
mov eax, r13d
nop word [rax + rax]
movzx ecx, byte [rbp - 0x39]
xor byte [rbp + rax - 0x38], cl
inc rax
cmp rax, 0x14
jb 0x14019e430
mov byte [rbp - 0x24], r13b
mov qword [rbp - 1], r13
mov qword [rbp + 0xf], r13
mov qword [rbp + 0x17], reloc.WS2_32.dll_ntohs
lea rax, [rbp - 0x38]
mov rsi, 0xffffffffffffffff
mov r8, rsi
inc r8
cmp byte [rax + r8], r13b
jne 0x14019e463
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 1]
call fcn.14014d7f0
lea rax, [rbp - 1]
mov qword [rbp + 0x27], rax
mov byte [rbp - 0x39], Ordinal_46
mov al, 0x7c
mov cl, 0x5f
mov dl, 0x4d
mov r8b, 0x5c
mov r9b, 0x45
mov r10b, 2
mov r11b, 0x48
mov bl, 0x40
movzx edi, bl
xor r12d, r12d
xor al, 0x2c
mov byte [rbp - 0x38], al
xor cl, 0x2c
mov byte [rbp - 0x37], cl
xor dl, 0x2c
mov byte [rbp - 0x36], dl
xor r8b, 0x2c
mov byte [rbp - 0x35], r8b
xor r9b, 0x2c
mov byte [rbp - 0x34], r9b
xor r10b, 0x2c
mov byte [rbp - 0x33], r10b
xor r11b, 0x2c
mov byte [rbp - 0x32], r11b
xor bl, 0x2c
mov byte [rbp - 0x31], bl
xor dil, 0x2c
mov byte [rbp - 0x30], dil
mov byte [rbp - 0x2f], r12b
mov qword [rbp - 0x21], r13
mov qword [rbp - 0x11], r13
mov qword [rbp - 9], reloc.WS2_32.dll_ntohs
lea rax, [rbp - 0x38]
inc rsi
cmp byte [rax + rsi], r12b
jne 0x14019e4f6
mov r8, rsi
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 0x21]
call fcn.14014d7f0
lea rax, [rbp - 0x21]
mov qword [rbp - 0x39], rax
lea rcx, [rbp - 0x21]
cmp qword [rbp - 9], 0x10
cmovae rcx, qword [rbp - 0x21]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [rbp - 1]
cmp qword [rbp + 0x17], 0x10
cmovae rdx, qword [rbp - 1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r9d, 0x104
mov r8, r14
xor edx, edx
mov rcx, r15
call rax
mov ebx, eax
mov rdx, qword [rbp - 9]
cmp rdx, 0x10
jb 0x14019e592
inc rdx
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14019e58d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14019e58d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140268610
mov qword [rbp - 0x11], r13
mov qword [rbp - 9], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x21], 0
mov rdx, qword [rbp + 0x17]
cmp rdx, 0x10
jb 0x14019e5e0
inc rdx
mov rcx, qword [rbp - 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14019e5db
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14019e5db
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140268610
mov eax, ebx
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x14019e610
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
lea rax, [rbp - 0x28]
mov qword [rbp + 0x40], rax
movdqa xmm0, xmmword [0x1402a3420]
movdqu xmmword [rbp - 0x60], xmm0
mov dword [rbp - 0x50], 0x736b606a
xor eax, eax
mov byte [rbp - 0x4c], al
xor r12d, r12d
nop dword [rax]
movzx ecx, byte [rbp - 0x60]
xor byte [rbp + rax - 0x5f], cl
inc rax
cmp rax, 0x13
jb 0x14019e650
mov byte [rbp - 0x4c], r12b
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x18], r12
mov qword [rbp - 0x10], reloc.WS2_32.dll_ntohs
lea rax, [rbp - 0x5f]
mov r14, 0xffffffffffffffff
mov r8, r14
inc r8
cmp byte [rax + r8], r12b
jne 0x14019e683
lea rdx, [rbp - 0x5f]
lea rcx, [rbp - 0x28]
call fcn.14014d7f0
lea rax, [rbp - 0x28]
mov qword [rbp + 0x48], rax
mov byte [rbp - 0x60], gethostname
mov al, 0x6d
mov cl, 0x4b
mov dl, 0x5d
mov r8b, 0x4a
mov r9b, listen
mov r10b, 0xa
mov r11b, reloc.WLDAP32.dll_Ordinal_22
mov bl, 0x5c
mov dil, 0x54
movzx esi, dil
xor r15d, r15d
xor al, 0x38
mov byte [rbp - 0x5f], al
xor cl, 0x38
mov byte [rbp - 0x5e], cl
xor dl, 0x38
mov byte [rbp - 0x5d], dl
xor r8b, 0x38
mov byte [rbp - 0x5c], r8b
xor r9b, 0x38
mov byte [rbp - 0x5b], r9b
xor r10b, 0x38
mov byte [rbp - 0x5a], r10b
xor r11b, 0x38
mov byte [rbp - 0x59], r11b
xor bl, 0x38
mov byte [rbp - 0x58], bl
xor dil, 0x38
mov byte [rbp - 0x57], dil
xor sil, 0x38
mov byte [rbp - 0x56], sil
mov byte [rbp - 0x55], r15b
mov qword [rbp - 0x48], r12
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], reloc.WS2_32.dll_ntohs
lea rax, [rbp - 0x5f]
inc r14
cmp byte [rax + r14], r15b
jne 0x14019e722
mov r8, r14
lea rdx, [rbp - 0x5f]
lea rcx, [rbp - 0x48]
call fcn.14014d7f0
lea rax, [rbp - 0x48]
mov qword [rbp + 0x40], rax
lea rcx, [rbp - 0x48]
cmp qword [rbp - 0x30], 0x10
cmovae rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae rdx, qword [rbp - 0x28]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov rbx, rax
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x14019e7b1
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14019e7ac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14019e7ac
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140268610
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x48], 0
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x14019e7ff
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14019e7fa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14019e7fa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140268610
mov rax, rbx
add rsp, 0x80
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1401a15e0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x1402bf270]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, rcx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], rax
mov ecx, Ordinal_211
call fcn.1402688b0
mov rbx, rax
mov qword [rsp + 0x30], rax
xor edx, edx
mov r8d, Ordinal_211
mov rcx, rax
call fcn.140269632
mov rcx, rbx
call fcn.14014e3e0
mov qword [rsp + 0x38], rax
mov byte [rsp + 0x40], 0
mov byte [rsp + 0x48], 0
mov ecx, Ordinal_27
call fcn.1402688b0
lea rcx, [rsp + 0x38]
mov qword [rax], rcx
mov qword [rax + 8], rsi
lea rcx, [0x14019f200]
mov qword [rax + 0x10], rcx
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x28], rcx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
mov r9, rax
lea r8, [0x1401a1980]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x50], rax
test rax, rax
je 0x1401a17bd
movabs r15, 0x7ffffffffa0a1eff
movabs r14, 0x7fffffffffffffff
nop
mov edx, 0x69696969
lea rcx, [rsi + 0x20]
call qword [sym.imp.SecureEngineSDK64.dll_Ordinal_17]
mov edx, 0x69696969
lea rcx, [rsi + 0x24]
call qword [sym.imp.SecureEngineSDK64.dll_Ordinal_18]
cmp dword [rsi + 0x20], 0x69696969
jne 0x1401a1749
cmp dword [rsi + 0x24], 0x69696969
jne 0x1401a1749
mov ecx, reloc.WLDAP32.dll_Ordinal_45
call fcn.14019ac30
test al, 1
je 0x1401a173b
mov rax, qword [0x140323a68]
test rax, rax
jne 0x1401a1733
lea ecx, [rax + 0x14]
call fcn.1402688b0
mov qword [rsp + 0x30], rax
mov byte [rax], 0
mov dword [rax + 4], 0x2001
mov qword [rax + 8], 0x30120
mov dword [rax + 0x10], ebp
mov qword [0x140323a68], rax
cmp byte [rax], 0
sete cl
mov byte [rax], cl
mov ecx, reloc.WLDAP32.dll_Ordinal_35
call fcn.14019ac30
test al, 1
je 0x1401a174e
call fcn.14019b730
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x1401a176c
imul rax, rax, 0x64
jmp 0x1401a178a
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
imul rcx, rcx, 0x3b9aca00
add rax, rcx
cmp rax, r15
jge 0x1401a17a9
add rax, 0x5f5e100
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x30]
call fcn.14014db30
jmp 0x1401a16c0
mov qword [rsp + 0x30], r14
lea rcx, [rsp + 0x30]
call fcn.14014db30
jmp 0x1401a16c0
mov dword [rsp + 0x58], ebp
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3