joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140052d00
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
vmovdqu xmm4, xmmword [rcx - 0x80]
vmovdqu xmm2, xmmword [r11 + 0x20]
lea r13, [rbp - 1]
vmovups xmm15, xmmword [rcx - 0x70]
lea r12, [rcx - 0x60]
vpxor xmm9, xmm1, xmm4
add ebx, 0x6000000
jb 0x140052e20
vpaddb xmm10, xmm1, xmm2
vpaddb xmm11, xmm10, xmm2
vpxor xmm10, xmm10, xmm4
vpaddb xmm12, xmm11, xmm2
vpxor xmm11, xmm11, xmm4
vpaddb xmm13, xmm12, xmm2
vpxor xmm12, xmm12, xmm4
vpaddb xmm14, xmm13, xmm2
vpxor xmm13, xmm13, xmm4
vpaddb xmm1, xmm14, xmm2
vpxor xmm14, xmm14, xmm4
jmp 0x140052d60
vaesenc xmm9, xmm9, xmm15
vaesenc xmm10, xmm10, xmm15
vaesenc xmm11, xmm11, xmm15
vaesenc xmm12, xmm12, xmm15
vaesenc xmm13, xmm13, xmm15
vaesenc xmm14, xmm14, xmm15
vmovups xmm15, xmmword [r12]
lea r12, [r12 + 0x10]
dec r13d
jne 0x140052d60
vmovdqu xmm3, xmmword [r12]
vaesenc xmm9, xmm9, xmm15
vpxor xmm4, xmm3, xmmword [rdi]
vaesenc xmm10, xmm10, xmm15
vpxor xmm5, xmm3, xmmword [rdi + 0x10]
vaesenc xmm11, xmm11, xmm15
vpxor xmm6, xmm3, xmmword [rdi + 0x20]
vaesenc xmm12, xmm12, xmm15
vpxor xmm8, xmm3, xmmword [rdi + 0x30]
vaesenc xmm13, xmm13, xmm15
vpxor xmm2, xmm3, xmmword [rdi + 0x40]
vaesenc xmm14, xmm14, xmm15
vpxor xmm3, xmm3, xmmword [rdi + 0x50]
lea rdi, [rdi + 0x60]
vaesenclast xmm9, xmm9, xmm4
vaesenclast xmm10, xmm10, xmm5
vaesenclast xmm11, xmm11, xmm6
vaesenclast xmm12, xmm12, xmm8
vaesenclast xmm13, xmm13, xmm2
vaesenclast xmm14, xmm14, xmm3
vmovups xmmword [rsi], xmm9
vmovups xmmword [rsi + 0x10], xmm10
vmovups xmmword [rsi + 0x20], xmm11
vmovups xmmword [rsi + 0x30], xmm12
vmovups xmmword [rsi + 0x40], xmm13
vmovups xmmword [rsi + 0x50], xmm14
lea rsi, [rsi + 0x60]
repz ret
vpshufb xmm6, xmm1, xmm0
vmovdqu xmm5, xmmword [r11 + 0x30]
vpaddd xmm10, xmm6, xmmword [r11 + 0x40]
vpaddd xmm11, xmm6, xmm5
vpaddd xmm12, xmm10, xmm5
vpshufb xmm10, xmm10, xmm0
vpaddd xmm13, xmm11, xmm5
vpshufb xmm11, xmm11, xmm0
vpxor xmm10, xmm10, xmm4
vpaddd xmm14, xmm12, xmm5
vpshufb xmm12, xmm12, xmm0
vpxor xmm11, xmm11, xmm4
vpaddd xmm1, xmm13, xmm5
vpshufb xmm13, xmm13, xmm0
vpxor xmm12, xmm12, xmm4
vpshufb xmm14, xmm14, xmm0
vpxor xmm13, xmm13, xmm4
vpshufb xmm1, xmm1, xmm0
vpxor xmm14, xmm14, xmm4
jmp 0x140052d60
Function at 0x140078a00
Capabilities:
Encode data using xor

Disassembly:
sub rdx, r8
sub rcx, r8
mov r10, r9
shr r9, 4
je 0x140078a35
nop
movdqu xmm0, xmmword [rdx + r8]
pxor xmm0, xmmword [r8]
movdqu xmmword [rcx + r8], xmm0
movdqa xmmword [r8], xmm0
lea r8, [r8 + 0x10]
dec r9
jne 0x140078a10
and r10, 0xf
je 0x140078a65
mov r9d, reloc.WS2_32.dll_recv
sub r9, r10
xor eax, eax
mov al, byte [rdx + r8]
xor al, byte [r8]
mov byte [rcx + r8], al
mov byte [r8], al
lea r8, [r8 + 1]
dec r10
jne 0x140078a40
xor eax, eax
mov byte [r8], al
lea r8, [r8 + 1]
dec r9
jne 0x140078a59
mov rax, r8
repz ret

Function at 0x140078a70
Capabilities:
Encode data using xor

Disassembly:
sub rdx, r8
sub rcx, r8
mov r10, r9
shr r9, 4
je 0x140078aad
nop
movdqu xmm0, xmmword [rdx + r8]
movdqa xmm1, xmmword [r8]
pxor xmm1, xmm0
movdqu xmmword [rcx + r8], xmm1
movdqa xmmword [r8], xmm0
lea r8, [r8 + 0x10]
dec r9
jne 0x140078a80
pxor xmm1, xmm1
and r10, 0xf
je 0x140078ae3
mov r9d, reloc.WS2_32.dll_recv
sub r9, r10
xor eax, eax
xor r11, r11
mov r11b, byte [rdx + r8]
mov al, byte [r8]
xor al, r11b
mov byte [rcx + r8], al
mov byte [r8], r11b
lea r8, [r8 + 1]
dec r10
jne 0x140078abb
xor eax, eax
mov byte [r8], al
lea r8, [r8 + 1]
dec r9
jne 0x140078ad7
mov rax, r8
repz ret
Function at 0x14007e9d0
Capabilities:
Encode data using xor

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xf0
movdqa xmm0, xmmword [0x1402ddf70]
xor eax, eax
movdqa xmm1, xmmword [0x1402ddef0]
movdqa xmmword [rbp - 0x79], xmm0
movdqa xmm0, xmmword [str.HMSVXW2._1___j_9__o_74s_:_2HISO]
movdqa xmmword [rbp - 0x69], xmm1
movdqa xmm1, xmmword [0x1402dde00]
movdqa xmmword [rbp - 0x59], xmm0
movdqa xmm0, xmmword [str._.03_6_]
movdqa xmmword [rbp - 0x49], xmm1
movdqa xmm1, xmmword [0x1402ddd00]
movdqa xmmword [rbp - 0x39], xmm0
movdqa xmm0, xmmword [0x1402de2c0]
movdqa xmmword [rbp - 0x29], xmm1
movdqa xmm1, xmmword [0x1402de2a0]
movdqa xmmword [rbp - 0x19], xmm0
movdqa xmm0, xmmword [0x1402de230]
movdqa xmmword [rbp - 9], xmm1
movdqa xmm1, xmmword [0x1402de250]
movdqa xmmword [rbp + 7], xmm0
movdqa xmm0, xmmword [0x1402de180]
movdqa xmmword [rbp + 0x17], xmm1
movdqa xmm1, xmmword [0x1402de170]
movdqa xmmword [rbp + 0x27], xmm0
movdqa xmmword [rbp + 0x37], xmm1
mov dword [rbp + 0x47], 0xbeadbfb9
mov dword [rbp + 0x4b], 0xb9bbaaba
mov dword [rbp + 0x4f], 0x1008497
nop dword [rax]
nop word [rax + rax]
lea ecx, [rax + 0x18]
xor byte [rbp + rax - 0x79], cl
inc rax
cmp rax, 0xca
jb 0x14007eaa0
mov byte [rbp + 0x52], 0
lea rax, [rbp - 0x79]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x14007eac1
lea rdx, [rbp - 0x79]
lea rcx, [0x1406ba990]
call fcn.140088990
add rsp, 0xf0
pop rbp
ret
Function at 0x14007f010
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
push rbp
push rbx
push rdi
lea rbp, [r11 - 0x5f]
sub rsp, 0xa0
mov rax, qword [0x1402fd960]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov rax, qword [0x1406bd6b0]
mov edi, r8d
dec rax
mov rbx, rcx
cmp rax, 0xfffffffffffffffd
ja 0x14007f150
mov eax, dword [0x1406bd6a8]
mov qword [r11 - 0x20], rsi
xor esi, esi
mov qword [rbp + 0x1b], rsi
mov dword [rbp + 0x23], esi
mov dword [rbp - 0xd], esi
mov qword [r11 - 0x28], r14
mov dword [rbp - 1], reloc.WLDAP32.dll_Ordinal_200
mov dword [rbp + 3], eax
mov qword [rbp + 7], rdx
mov qword [rbp + 0xf], rcx
mov dword [rbp + 0x17], r8d
mov dword [rbp - 0x29], Ordinal_301
mov dword [rbp - 0x25], eax
mov qword [rbp - 0x21], rcx
mov dword [rbp - 0x15], 0x40
mov dword [rbp - 0x19], r8d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [0x1406bd6b0]
lea r14, [0x1406bd6e8]
lea r9, [rbp + 0x27]
mov dword [rbp - 0x11], eax
lea r8d, [rsi + 0x29]
mov qword [rbp - 9], r14
lea rdx, [rbp - 0x29]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x1406bd6b0]
lea r9, [rbp + 0x2b]
lea r8d, [rsi + 0x28]
mov qword [rsp + 0x20], rsi
lea rdx, [rbp - 1]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rax, qword [0x1406bd6b0]
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x14007f140
mov eax, dword [0x1406bd6a8]
mov dword [rbp - 0x25], eax
mov eax, dword [0x1406bd6e8]
mov dword [rbp - 0x15], eax
mov dword [rbp - 0xd], esi
mov dword [rbp - 0x29], Ordinal_301
mov qword [rbp - 0x21], rbx
mov dword [rbp - 0x19], edi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [0x1406bd6b0]
lea r9, [rbp + 0x27]
lea r8d, [rsi + 0x29]
mov dword [rbp - 0x11], eax
lea rdx, [rbp - 0x29]
mov qword [rbp - 9], r14
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rsi, qword [rsp + 0x98]
mov r14, qword [rsp + 0x90]
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.140233900
add rsp, 0xa0
pop rdi
pop rbx
pop rbp
ret

Function at 0x14007f170
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x270
mov rax, qword [0x1402fd960]
xor rax, rsp
mov qword [rsp + 0x268], rax
mov rax, qword [0x1406bd6b0]
mov rbx, rcx
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x14007f23b
xor edx, edx
mov qword [rsp + 0x30], 0
mov r8d, 0x218
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memset
mov eax, dword [0x1406bd6a8]
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x40], 0x258
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x248], eax
mov r8, 0xffffffffffffffff
lea rax, [rsp + 0x30]
mov qword [rsp + 0x250], rax
inc r8
cmp byte [rbx + r8], 0
jne 0x14007f1f0
inc r8
lea rcx, [rsp + 0x48]
mov rdx, rbx
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_mbstowcs]
mov rcx, qword [0x1406bd6b0]
lea r9, [rsp + 0x260]
mov r8d, 0x219
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rax, qword [rsp + 0x30]
jmp 0x14007f23d
xor eax, eax
mov rcx, qword [rsp + 0x268]
xor rcx, rsp
call fcn.140233900
add rsp, 0x270
pop rbx
ret
Function at 0x14007fad0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov dword [rbp - 0x50], 0x77596d56
mov dword [rbp - 0x4c], 0x7b6e73
mov byte [rbp - 0x48], 1
xor ebx, ebx
mov ecx, ebx
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x18]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 7
jb 0x14007fb00
mov byte [rbp - 0x48], bl
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x10], rbx
mov qword [rbp - 8], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x20], bl
lea rax, [rbp - 0x50]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], bl
jne 0x14007fb31
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.140088990
nop
mov dword [rbp - 0x40], 0x75687c73
mov dword [rbp - 0x3c], 0x7e7c7179
mov dword [rbp - 0x38], 0x470c4453
mov dword [rbp - 0x34], 0x1004948
nop dword [rax]
nop dword [rax + rax]
lea eax, [rbx + 0x18]
xor byte [rbp + rbx - 0x40], al
inc rbx
cmp rbx, 0xe
jb 0x14007fb70
mov byte [rbp - 0x31], 0
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x30]
call fcn.14007f490
nop
lea r8, [rbp - 0x20]
lea rdx, [rbp - 0x50]
mov rcx, rax
call fcn.14008bb70
mov rcx, qword [rax]
mov rbx, qword [rcx + 0x40]
mov r8, qword [rbp - 0x30]
mov r8, qword [r8 + 8]
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x30]
call fcn.14008d100
mov edx, 0x48
mov rcx, qword [rbp - 0x30]
call fcn.140233920
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x14007fc0b
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007fc06
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007fc06
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140233920
mov rax, rbx
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret

Function at 0x14007fc20
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xf], 0
je 0x14007fc43
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x18]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xe
jb 0x14007fc30
mov byte [rcx + 0xf], 0
mov rax, rcx
ret
Function at 0x140080010
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xa], 0
je 0x140080033
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x18]
xor byte [rax + rcx], dl
inc rax
cmp rax, 9
jb 0x140080020
mov byte [rcx + 0xa], 0
mov rax, rcx
ret

Function at 0x140080040
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1402fd960]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov rsi, r8
mov dword [rsp + 0x28], 0x80
mov rdi, rdx
mov dword [rsp + 0x40], 0
xor r8d, r8d
mov dword [rsp + 0x20], 2
lea edx, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov rcx, rax
mov r8d, esi
mov rdx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140233900
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x140080140
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x1340]
mov eax, 0x1440
call fcn.140234360
sub rsp, rax
mov rax, qword [0x1402fd960]
xor rax, rsp
mov qword [rbp + 0x1330], rax
mov r15d, edx
mov rbx, rcx
mov qword [rsp + 0x70], rcx
xor edi, edi
mov dword [rsp + 0x20], edi
movdqa xmm0, xmmword [0x1402de070]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x1402ddf80]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmm0, xmmword [0x1402ddde0]
movdqa xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x60], 0x3133313f
mov dword [rsp + 0x64], 0x7c7c7c7c
mov dword [rsp + 0x68], 0x64646464
mov dword [rsp + 0x6c], 0x1006c6c
mov eax, edi
nop word [rax + rax]
lea ecx, [rax + 0x18]
xor byte [rsp + rax + 0x30], cl
inc rax
cmp rax, 0x3e
jb 0x1400801e0
mov byte [rsp + 0x6f], dil
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x78], rdi
mov qword [rbp - 0x70], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x78], dil
lea rax, [rsp + 0x30]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], dil
jne 0x140080217
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x78]
call fcn.140088990
nop
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov edi, 1
mov dword [rsp + 0x20], edi
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov ecx, eax
mov dword [rbp + 0x1324], 0xffffffff
mov dword [rbp - 0x5c], eax
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, edi
mov dword [rbp + rdi*4 - 0x5c], ecx
inc rdi
cmp rdi, 0x270
jb 0x140080260
mov dword [rbp - 0x60], 0x270
mov r14, qword [rbp - 0x70]
mov rsi, qword [rsp + 0x78]
test r15d, r15d
jle 0x140080334
mov rdi, r15
nop dword [rax + rax]
lea rcx, [rbp - 0x60]
call fcn.14008d410
mov r8d, eax
mov eax, 0x8421085
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 4
cmp eax, 0x8421084
jae 0x1400802a0
mov eax, 0x8421085
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 4
imul eax, eax, 0x1f
sub r8d, eax
lea rcx, [rsp + 0x78]
cmp r14, 0x10
cmovae rcx, rsi
movsxd rax, r8d
movzx r9d, byte [rax + rcx]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x140080322
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x140080317
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14008032a
mov rcx, rbx
call fcn.14008c370
sub rdi, 1
jne 0x1400802a0
cmp r14, 0x10
jb 0x14008036e
lea rdx, [r14 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140080366
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140080366
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.140233920
mov rax, rbx
mov rcx, qword [rbp + 0x1330]
xor rcx, rsp
call fcn.140233900
lea r11, [rsp + 0x1440]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140080bd0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x15], 0
je 0x140080bf3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x18]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x14
jb 0x140080be0
mov byte [rcx + 0x15], 0
mov rax, rcx
ret

Function at 0x140080c00
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x140080c23
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x18]
xor byte [rax + rcx], dl
inc rax
cmp rax, 4
jb 0x140080c10
mov byte [rcx + 5], 0
mov rax, rcx
ret

Function at 0x140080c30
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x61], 0
je 0x140080c53
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x18]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x60
jb 0x140080c40
mov byte [rcx + 0x61], 0
mov rax, rcx
ret
Function at 0x1400817a0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x13c0
call fcn.140234360
sub rsp, rax
mov rax, qword [0x1402fd960]
xor rax, rsp
mov qword [rsp + 0x13b0], rax
mov edi, edx
mov ebx, ecx
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rsp + 0x13a4], 0xffffffff
mov r8d, 1
mov dword [rsp + 0x24], eax
nop
mov r9d, eax
shr r9d, 0x1e
xor r9d, eax
imul eax, r9d, 0x6c078965
add eax, r8d
mov dword [rsp + r8*4 + 0x24], eax
inc r8
cmp r8, 0x270
jb 0x1400817f0
lea eax, [rbx - 0x80000000]
mov dword [rsp + 0x20], 0x270
mov ebp, 0x80000000
cmp ebx, ebp
lea esi, [rbx + rbp]
cmovae esi, eax
lea ebx, [rdi + rbp]
cmp edi, ebp
lea eax, [rdi - 0x80000000]
cmovae ebx, eax
sub ebx, esi
cmp ebx, 0xffffffff
jne 0x140081853
lea rcx, [rsp + 0x20]
call fcn.14008d410
mov edx, eax
jmp 0x140081891
lea edi, [rbx + 1]
xor r8d, r8d
xor eax, eax
test ebx, ebx
je 0x140081871
lea rcx, [rsp + 0x20]
call fcn.14008d410
mov r8d, eax
mov eax, 0xffffffff
xor edx, edx
div edi
mov ecx, eax
mov r9d, edx
xor edx, edx
mov eax, r8d
div edi
cmp eax, ecx
jb 0x14008188a
cmp r9d, ebx
jne 0x140081856
xor edx, edx
mov eax, r8d
div edi
add edx, esi
cmp edx, ebp
lea ecx, [rdx - 0x80000000]
lea eax, [rdx + rbp]
cmovae eax, ecx
mov rcx, qword [rsp + 0x13b0]
xor rcx, rsp
call fcn.140233900
lea r11, [rsp + 0x13c0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x1400818d0
Capabilities:
Create process on windows

Disassembly:
mov r11, rsp
sub rsp, 0xf8
mov rax, qword [0x1402fd960]
xor rax, rsp
mov qword [rsp + 0xe0], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x74], xmm0
mov dword [r11 - 0x24], eax
mov rdx, rcx
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea rax, [rsp + 0x70]
xor ecx, ecx
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
movups xmmword [r11 - 0x74], xmm0
mov dword [rsp + 0x28], 0x8000000
movups xmmword [r11 - 0x64], xmm0
mov dword [rsp + 0x20], eax
movups xmmword [r11 - 0x54], xmm0
movups xmmword [r11 - 0x44], xmm0
movups xmmword [r11 - 0x34], xmm0
mov dword [rsp + 0x70], WSAGetLastError
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rcx, qword [rsp + 0x50]
mov edx, 0x3e8
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.140233900
add rsp, 0xf8
ret

Function at 0x1400819a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 3], 0
je 0x1400819c3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x18]
xor byte [rax + rcx], dl
inc rax
cmp rax, 2
jb 0x1400819b0
mov byte [rcx + 3], 0
mov rax, rcx
ret
Function at 0x1400819d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x1402fd960]
xor rax, rsp
mov qword [rsp + 0x68], rax
movdqa xmm0, xmmword [0x1402dde90]
xor edx, edx
movdqa xmm1, xmmword [0x1402ddea0]
mov eax, edx
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x40], 0x4143414f
movdqu xmmword [rsp + 0x30], xmm1
mov word [rsp + 0x44], 0x100
nop dword [rax]
nop dword [rax + rax]
lea ecx, [rax + 0x18]
xor byte [rsp + rax + 0x20], cl
inc rax
cmp rax, 0x24
jb 0x140081a20
mov byte [rsp + 0x45], dl
lea rax, [rsp + 0x20]
mov qword [rsp + 0x48], rdx
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
inc r8
cmp byte [rax + r8], dl
jne 0x140081a53
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x48]
call fcn.140088990
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
movabs rax, 0x842108421084211
and r8d, 0x1f
mul r8
mov ecx, r8d
lea rax, [rsp + 0x48]
sub rcx, rdx
shr rcx, 1
add rcx, rdx
mov rdx, qword [rsp + 0x60]
shr rcx, 4
imul rcx, rcx, 0x1f
sub r8, rcx
mov rcx, qword [rsp + 0x48]
cmp rdx, 0x10
cmovae rax, rcx
movzx ebx, byte [rax + r8 + 1]
jb 0x140081aeb
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140081ae6
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140081ae6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140233920
movzx eax, bl
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140233900
add rsp, 0x70
pop rbx
ret

Function at 0x140081b10
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xc], 0
je 0x140081b33
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x18]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xb
jb 0x140081b20
mov byte [rcx + 0xc], 0
mov rax, rcx
ret
Function at 0x140082ae0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x81], 0
je 0x140082b08
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x18]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x80
jb 0x140082af0
mov byte [rcx + 0x81], 0
mov rax, rcx
ret

Function at 0x140082b10
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xe], 0
je 0x140082b33
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x18]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xd
jb 0x140082b20
mov byte [rcx + 0xe], 0
mov rax, rcx
ret

Function at 0x140082b60
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xb], 0
je 0x140082b83
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x18]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xa
jb 0x140082b70
mov byte [rcx + 0xb], 0
mov rax, rcx
ret

Function at 0x140082b90
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x11], 0
je 0x140082bb3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x18]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x10
jb 0x140082ba0
mov byte [rcx + 0x11], 0
mov rax, rcx
ret

Function at 0x140082bc0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 9], 0
je 0x140082be3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x18]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x140082bd0
mov byte [rcx + 9], 0
mov rax, rcx
ret
Function at 0x140083f80
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x4c], 0
je 0x140083fa3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x18]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x4b
jb 0x140083f90
mov byte [rcx + 0x4c], 0
mov rax, rcx
ret

Function at 0x140083fb0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2c], 0
je 0x140083fd3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x18]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x2b
jb 0x140083fc0
mov byte [rcx + 0x2c], 0
mov rax, rcx
ret
Function at 0x140084460
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1c], 0
je 0x140084483
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x18]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1b
jb 0x140084470
mov byte [rcx + 0x1c], 0
mov rax, rcx
ret
Function at 0x140084850
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xc3], 0
je 0x140084878
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x18]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xc2
jb 0x140084860
mov byte [rcx + 0xc3], 0
mov rax, rcx
ret
Function at 0x140084e20
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x18], 0
je 0x140084e43
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x18]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x17
jb 0x140084e30
mov byte [rcx + 0x18], 0
mov rax, rcx
ret

Function at 0x140084e50
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x4a], 0
je 0x140084e73
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x18]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x49
jb 0x140084e60
mov byte [rcx + 0x4a], 0
mov rax, rcx
ret

Function at 0x140084e80
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x6f], 0
je 0x140084ea3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x18]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x6e
jb 0x140084e90
mov byte [rcx + 0x6f], 0
mov rax, rcx
ret