joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b37c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x140ce2080]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r10, rcx
mov ebx, edx
movzx ecx, byte [rcx]
test cl, cl
je 0x1400b3826
lea rax, [r10 + 1]
cmp cl, 0x25
jne 0x1400b37f6
cmp byte [rax], cl
jne 0x1400b3822
cmp cl, cl
cmovne rax, r10
movzx ecx, byte [rax + 1]
lea r10, [rax + 1]
test cl, cl
jne 0x1400b37e7
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1401308a0
add rsp, 0x90
pop rbx
ret
movzx ecx, byte [r10]
cmp cl, 0x25
jne 0x1400b3806
cmp byte [r10 + 1], cl
je 0x1400b3806
mov rcx, r10
lea r11, [rsp + 0x20]
call fcn.1400a44b0
mov r8, rax
cmp r10, rax
jae 0x1400b3870
movabs r9, 0x800000000000009
movzx edx, byte [r10]
inc r10
lea ecx, [rdx - 0x24]
cmp cl, 0x3b
ja 0x1400b3865
bt r9, rcx
jb 0x1400b386b
mov byte [r11], dl
inc r11
cmp r10, r8
jb 0x1400b3850
xorps xmm3, xmm3
mov byte [r11], 0
cvtss2sd xmm3, xmm2
lea r8, [rsp + 0x20]
mov edx, 0x40
lea rcx, [rsp + 0x40]
movq r9, xmm3
call fcn.140073a60
cmp byte [rsp + 0x40], 0x20
lea rcx, [rsp + 0x40]
jne 0x1400b38a8
inc rcx
cmp byte [rcx], 0x20
je 0x1400b38a0
lea eax, [rbx - 8]
cmp eax, 1
jbe 0x1400b392b
movzx r9d, byte [rcx]
movzx r8d, r9b
cmp r9b, 0x2d
jne 0x1400b38ca
movzx r8d, byte [rcx + 1]
lea rax, [rcx + 1]
mov rcx, rax
movzx eax, r8b
cmp r8b, 0x2b
jne 0x1400b38d8
movzx eax, byte [rcx + 1]
lea rdx, [rcx + 1]
xorps xmm1, xmm1
cmovne rdx, rcx
cmp al, 0x30
jl 0x1400b3916
movss xmm2, dword [0x140cc4088]
nop
cmp al, 0x39
ja 0x1400b3916
movzx eax, al
inc rdx
sub eax, 0x30
mulss xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rdx]
cvtdq2ps xmm0, xmm0
addss xmm0, xmm1
movaps xmm1, xmm0
cmp al, 0x30
jge 0x1400b38f0
cmp r9b, 0x2d
jne 0x1400b3938
xorps xmm1, xmmword [0x140cc4dd0]
movaps xmm0, xmm1
jmp 0x1400b3809
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movaps xmm0, xmm1
jmp 0x1400b3809
Function at 0x1400b39c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x140ce2080]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r10, rcx
mov ebx, edx
movzx ecx, byte [rcx]
test cl, cl
je 0x1400b3a26
lea rax, [r10 + 1]
cmp cl, 0x25
jne 0x1400b39f6
cmp byte [rax], cl
jne 0x1400b3a22
cmp cl, cl
cmovne rax, r10
movzx ecx, byte [rax + 1]
lea r10, [rax + 1]
test cl, cl
jne 0x1400b39e7
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1401308a0
add rsp, 0x90
pop rbx
ret
movzx ecx, byte [r10]
cmp cl, 0x25
jne 0x1400b3a06
cmp byte [r10 + 1], cl
je 0x1400b3a06
mov rcx, r10
lea r11, [rsp + 0x20]
call fcn.1400a44b0
mov r8, rax
cmp r10, rax
jae 0x1400b3a70
movabs r9, 0x800000000000009
movzx edx, byte [r10]
inc r10
lea ecx, [rdx - 0x24]
cmp cl, 0x3b
ja 0x1400b3a65
bt r9, rcx
jb 0x1400b3a6b
mov byte [r11], dl
inc r11
cmp r10, r8
jb 0x1400b3a50
movaps xmm3, xmm2
mov byte [r11], 0
movq r9, xmm2
lea r8, [rsp + 0x20]
mov edx, 0x40
lea rcx, [rsp + 0x40]
call fcn.140073a60
cmp byte [rsp + 0x40], 0x20
lea rcx, [rsp + 0x40]
jne 0x1400b3aa8
nop dword [rax]
inc rcx
cmp byte [rcx], 0x20
je 0x1400b3aa0
lea eax, [rbx - 8]
cmp eax, 1
jbe 0x1400b3b29
movzx r9d, byte [rcx]
movzx r8d, r9b
cmp r9b, 0x2d
jne 0x1400b3aca
movzx r8d, byte [rcx + 1]
lea rax, [rcx + 1]
mov rcx, rax
movzx eax, r8b
cmp r8b, 0x2b
jne 0x1400b3ad8
movzx eax, byte [rcx + 1]
lea rdx, [rcx + 1]
xorps xmm1, xmm1
cmovne rdx, rcx
cmp al, 0x30
jl 0x1400b3b14
movsd xmm2, qword [0x140cc4010]
nop
cmp al, 0x39
ja 0x1400b3b14
movzx eax, al
inc rdx
sub eax, 0x30
mulsd xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rdx]
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
cmp al, 0x30
jge 0x1400b3af0
cmp r9b, 0x2d
jne 0x1400b3b32
xorps xmm1, xmmword [0x140cc4dc0]
movaps xmm0, xmm1
jmp 0x1400b3a09
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
movaps xmm1, xmm0
movaps xmm0, xmm1
jmp 0x1400b3a09

Function at 0x1400b4120
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
cmp qword [r9 + 0x18], 0x10
mov rax, r9
mov edi, r8d
mov rbx, rdx
jb 0x1400b4142
mov rax, qword [r9]
mov qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rsp + 0x20], 1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400b41c4
lea r9, [rsp + 0x70]
mov dword [rsp + 0x70], 0
mov r8d, edi
mov qword [rsp + 0x20], 0
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x1400b41c4
cmp dword [rsp + 0x70], edi
jne 0x1400b41c4
mov al, 1
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov rbx, qword [rsp + 0x50]
xor al, al
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x1400b44d0
Capabilities:
Delete file
Delete service
Modify service
Stop service

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x140ce2080]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, qword [0x141281358]
cmp byte [rbx], 0
je 0x1400b45f2
mov word [rbx + 0x78], 0
xor edx, edx
mov qword [rsp + 0xb0], rdi
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rdi, rax
test rax, rax
je 0x1400b4659
cmp byte [rbx + 0x79], 0
lea rdx, [rbx + 0x48]
mov eax, 0x10020
mov qword [rsp + 0xa8], rsi
mov ecx, reloc.WLDAP32.dll_Ordinal_32
cmovne eax, ecx
mov r8d, eax
or r8d, 2
cmp byte [rbx + 0x7a], 0
cmove r8d, eax
cmp qword [rdx + 0x18], 0x10
jb 0x1400b4559
mov rdx, qword [rdx]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rsi, rax
test rax, rax
je 0x1400b4687
lea r8, [rsp + 0x60]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x1400b467e
cmp byte [rbx + 0x7a], 0
je 0x1400b45d1
xor eax, eax
mov edx, 0xffffffff
mov qword [rsp + 0x50], rax
mov r9d, edx
mov qword [rsp + 0x48], rax
mov rcx, rsi
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rax
lea r8d, [rax + 4]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
test eax, eax
je 0x1400b467e
cmp byte [rbx + 0x79], 0
je 0x1400b4600
cmp byte [rbx], 0
jne 0x1400b4600
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, 1
jmp 0x1400b4651
cmp byte [rbx + 0x78], 0
je 0x1400b4501
mov al, 1
jmp 0x1400b4661
mov rcx, rsi
mov qword [rsp + 0xa0], rbp
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, rsi
mov ebp, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp byte [rbx + 0x7b], 0
je 0x1400b467a
cmp byte [rbx], 0
je 0x1400b467a
cmp qword [rbx + 0x20], 0x10
lea rcx, [rbx + 8]
jb 0x1400b463e
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
mov rbp, qword [rsp + 0xa0]
setne al
mov rsi, qword [rsp + 0xa8]
mov rdi, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1401308a0
add rsp, 0x90
pop rbx
ret
test ebp, ebp
jmp 0x1400b4646
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
jmp 0x1400b4651
Function at 0x1400cefe0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xb0
mov rax, qword [0x140ce2080]
xor rax, rsp
mov qword [rsp + 0xa8], rax
mov rdi, rcx
mov qword [rsp + 0xa0], rcx
mov r9d, 3
lea r8, [0x140cc2d28]
xor edx, edx
call fcn.14003afd0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
mov dword [rsp + 0x30], reloc.WS2_32.dll_WSASetLastError
mov dword [rsp + 0x34], 0x40
xor ecx, ecx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rcx
lea rax, [0x140cc2d30]
mov qword [rsp + 0x48], rax
mov rax, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x1400cf07f
mov rax, qword [rdi]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rcx
mov dword [rsp + 0x60], ecx
mov qword [rsp + 0x68], rcx
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x1400cf0b0
mov rcx, rdi
call fcn.14002c7e0
mov eax, 0xffffffff
jmp 0x1400cf0f2
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rsp + 0x20]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rsp + 0x20]
mov rcx, rdi
call fcn.14002c7e0
mov eax, ebx
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.1401308a0
mov rbx, qword [rsp + 0xc8]
add rsp, 0xb0
pop rdi
ret
Function at 0x1400cffa0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 7], dil
je 0x1400cffd4
mov ecx, edi
nop dword [rax]
lea eax, [rcx + 0x4a]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 6
jb 0x1400cffc0
mov byte [r8 + 7], dil
lea rax, [r8 + 6]
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x1400d0001
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x1400d0020
mov qword [rsp + 0x30], 6
mov eax, dword [r8]
mov dword [rsp + 0x20], eax
movzx eax, word [r8 + 4]
mov word [rsp + 0x24], ax
mov byte [rsp + 0x26], dil
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x1400d002e
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.14003afd0
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1400d00a5
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d00a0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400d00a0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140130b10
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x1400d00c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 9], dil
je 0x1400d00f4
mov ecx, edi
nop dword [rax]
lea eax, [rcx + 0x4a]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 8
jb 0x1400d00e0
mov byte [r8 + 9], dil
lea rax, [r8 + 8]
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x1400d0121
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x1400d0137
mov qword [rsp + 0x30], 8
mov rax, qword [r8]
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x28], dil
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x1400d0145
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.14003afd0
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1400d01bc
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d01b7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400d01b7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140130b10
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x1400d01d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rbx, rcx
mov qword [rbp - 0x10], rcx
xor r9d, r9d
cmp byte [r8 + 6], r9b
je 0x1400d0214
mov ecx, r9d
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x4a]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x1400d0200
mov byte [r8 + 6], r9b
lea rax, [r8 + 5]
mov qword [rbp - 0x38], r9
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], r9
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x1400d023b
mov qword [rbp - 0x28], r9
mov byte [rbp - 0x38], r9b
jmp 0x1400d0255
mov qword [rbp - 0x28], 5
mov eax, dword [r8]
mov dword [rbp - 0x38], eax
movzx eax, byte [r8 + 4]
mov byte [rbp - 0x34], al
mov byte [rbp - 0x33], r9b
cmp byte [rdx + 0xa], 0
je 0x1400d0273
mov rcx, r9
nop
lea eax, [rcx + 0x4a]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 9
jb 0x1400d0260
mov byte [rdx + 0xa], 0
lea rax, [rdx + 9]
mov qword [rbp - 0x58], r9
mov qword [rbp - 0x48], r9
mov qword [rbp - 0x40], r9
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
cmp rdx, rax
jne 0x1400d029a
mov qword [rbp - 0x48], r9
mov byte [rbp - 0x58], 0
jmp 0x1400d02b6
mov qword [rbp - 0x48], 9
movsd xmm0, qword [rdx]
movsd qword [rbp - 0x58], xmm0
movzx eax, byte [rdx + 8]
mov byte [rbp - 0x50], al
mov byte [rbp - 0x4f], 0
lea r9, [rbp - 0x38]
lea r8, [rbp - 0x58]
movzx edx, byte [rbp - 0x60]
mov rcx, rbx
call fcn.14002ccd0
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x1400d030a
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d0304
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400d0304
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140130b10
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x1400d0348
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d0343
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400d0343
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140130b10
mov rax, rbx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rbp
ret
Function at 0x1400d0360
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 0xa], dil
je 0x1400d0394
mov ecx, edi
nop dword [rax]
lea eax, [rcx + 0x4a]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 9
jb 0x1400d0380
mov byte [r8 + 0xa], dil
lea rax, [r8 + 9]
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x1400d03c1
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x1400d03e3
mov qword [rsp + 0x30], 9
movsd xmm0, qword [r8]
movsd qword [rsp + 0x20], xmm0
movzx eax, byte [r8 + 8]
mov byte [rsp + 0x28], al
mov byte [rsp + 0x29], dil
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x1400d03f1
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.14003afd0
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1400d0468
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d0463
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400d0463
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140130b10
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x1400d0480
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rbx, rcx
mov qword [rbp - 0x10], rcx
xor r9d, r9d
cmp byte [r8 + 0xc], r9b
je 0x1400d04c4
mov ecx, r9d
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x4a]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xb
jb 0x1400d04b0
mov byte [r8 + 0xc], r9b
lea rax, [r8 + 0xb]
mov qword [rbp - 0x58], r9
mov qword [rbp - 0x48], r9
mov qword [rbp - 0x40], r9
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x1400d04eb
mov qword [rbp - 0x48], r9
mov byte [rbp - 0x58], r9b
jmp 0x1400d0512
mov qword [rbp - 0x48], recv
movsd xmm0, qword [r8]
movsd qword [rbp - 0x58], xmm0
movzx eax, word [r8 + 8]
mov word [rbp - 0x50], ax
movzx eax, byte [r8 + 0xa]
mov byte [rbp - 0x4e], al
mov byte [rbp - 0x4d], r9b
cmp byte [rdx + 0xb], 0
je 0x1400d0533
mov rcx, r9
nop dword [rax + rax]
lea eax, [rcx + 0x4a]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x1400d0520
mov byte [rdx + 0xb], 0
lea rax, [rdx + 0xa]
mov qword [rbp - 0x38], r9
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], r9
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
cmp rdx, rax
jne 0x1400d055a
mov qword [rbp - 0x28], r9
mov byte [rbp - 0x38], 0
jmp 0x1400d0577
mov qword [rbp - 0x28], 0xa
movsd xmm0, qword [rdx]
movsd qword [rbp - 0x38], xmm0
movzx eax, word [rdx + 8]
mov word [rbp - 0x30], ax
mov byte [rbp - 0x2e], 0
lea r9, [rbp - 0x58]
lea r8, [rbp - 0x38]
movzx edx, byte [rbp - 0x60]
mov rcx, rbx
call fcn.14002ccd0
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x1400d05cb
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d05c5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400d05c5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140130b10
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x1400d0609
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d0604
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400d0604
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140130b10
mov rax, rbx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rbp
ret
Function at 0x1400d0620
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 0xc], dil
je 0x1400d0654
mov ecx, edi
nop dword [rax]
lea eax, [rcx + 0x4a]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xb
jb 0x1400d0640
mov byte [r8 + 0xc], dil
lea rax, [r8 + 0xb]
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x1400d0681
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x1400d06ad
mov qword [rsp + 0x30], recv
movsd xmm0, qword [r8]
movsd qword [rsp + 0x20], xmm0
movzx eax, word [r8 + 8]
mov word [rsp + 0x28], ax
movzx eax, byte [r8 + 0xa]
mov byte [rsp + 0x2a], al
mov byte [rsp + 0x2b], dil
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x1400d06bb
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.14003afd0
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1400d0732
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d072d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400d072d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140130b10
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x1400d0740
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rbx, rcx
mov qword [rbp - 0x10], rcx
xor r9d, r9d
cmp byte [r8 + 6], r9b
je 0x1400d0784
mov ecx, r9d
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x4a]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x1400d0770
mov byte [r8 + 6], r9b
lea rax, [r8 + 5]
mov qword [rbp - 0x38], r9
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], r9
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x1400d07ab
mov qword [rbp - 0x28], r9
mov byte [rbp - 0x38], r9b
jmp 0x1400d07c5
mov qword [rbp - 0x28], 5
mov eax, dword [r8]
mov dword [rbp - 0x38], eax
movzx eax, byte [r8 + 4]
mov byte [rbp - 0x34], al
mov byte [rbp - 0x33], r9b
cmp byte [rdx + 0xd], 0
je 0x1400d07e3
mov rcx, r9
nop
lea eax, [rcx + 0x4a]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xc
jb 0x1400d07d0
mov byte [rdx + 0xd], 0
lea rax, [rdx + 0xc]
mov qword [rbp - 0x58], r9
mov qword [rbp - 0x48], r9
mov qword [rbp - 0x40], r9
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
cmp rdx, rax
jne 0x1400d080a
mov qword [rbp - 0x48], r9
mov byte [rbp - 0x58], 0
jmp 0x1400d0825
mov qword [rbp - 0x48], recv
movsd xmm0, qword [rdx]
movsd qword [rbp - 0x58], xmm0
mov eax, dword [rdx + 8]
mov dword [rbp - 0x50], eax
mov byte [rbp - 0x4c], 0
lea r9, [rbp - 0x38]
lea r8, [rbp - 0x58]
movzx edx, byte [rbp - 0x60]
mov rcx, rbx
call fcn.14002ccd0
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x1400d0879
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d0873
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400d0873
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140130b10
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x1400d08b7
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d08b2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400d08b2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140130b10
mov rax, rbx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rbp
ret

Function at 0x1400d81a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x136], 0
je 0x1400d81c8
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x4a]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x135
jb 0x1400d81b0
mov byte [rcx + 0x136], 0
mov rax, rcx
ret

Function at 0x1400d81d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x44], 0
je 0x1400d81f3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x4a]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x43
jb 0x1400d81e0
mov byte [rcx + 0x44], 0
mov rax, rcx
ret

Function at 0x1400d8200
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x1400d8223
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x4a]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x46
jb 0x1400d8210
mov byte [rcx + 0x47], 0
mov rax, rcx
ret