joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140034f10
Capabilities:
Convert ip address from string

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r15
sub rsp, 0x58
mov rax, qword [0x14011a028]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebx, ebx
mov qword [rsp + 0x28], rcx
cmp qword [rcx + 0x20], 0x10
lea rsi, [rcx + 8]
mov rbp, rdx
mov byte [rsp + 0x20], 0
mov edi, 2
mov r15d, ebx
mov rdx, rsi
jb 0x140034f54
mov rdx, qword [rsi]
lea r8, [rsp + 0x38]
mov ecx, reloc.WS2_32.dll_socket
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
je 0x140034f70
mov r15d, reloc.WS2_32.dll_recv
jmp 0x140034f94
cmp qword [rsi + 0x18], 0x10
jb 0x140034f7a
mov rsi, qword [rsi]
lea r8, [rsp + 0x30]
mov rdx, rsi
mov ecx, edi
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
je 0x140034f99
mov r15d, 4
mov edi, 7
xor r9d, r9d
xor r8d, r8d
mov rcx, rbp
lea edx, [r9 + 0x55]
call qword [sym.imp.libcrypto_3_x64.dll_X509_get_ext_d2i]
mov r12, rax
test rax, rax
je 0x140035085
mov qword [rsp + 0xa0], r13
mov rcx, rax
mov qword [rsp + 0x50], r14
xor r13b, r13b
xor r14b, r14b
call qword [sym.imp.libcrypto_3_x64.dll_OPENSSL_sk_num]
mov dword [rsp + 0x24], eax
test eax, eax
jle 0x140035078
test r14b, r14b
jne 0x140035073
mov edx, ebx
mov rcx, r12
call qword [sym.imp.libcrypto_3_x64.dll_OPENSSL_sk_value]
mov rsi, rax
cmp dword [rax], edi
jne 0x14003505d
mov rcx, qword [rax + 8]
call qword [sym.imp.libcrypto_3_x64.dll_ASN1_STRING_get0_data]
mov rcx, qword [rsi + 8]
mov rbp, rax
call qword [sym.imp.libcrypto_3_x64.dll_ASN1_STRING_length]
movsxd r8, eax
cmp edi, 2
je 0x14003504c
cmp edi, 7
jne 0x14003505d
mov r8, r15
lea rcx, [rsp + 0x38]
mov rdx, rbp
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140035047
mov r8, r15
lea rcx, [rsp + 0x30]
mov rdx, rbp
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14003505d
mov r13b, 1
jmp 0x14003505d
mov rcx, qword [rsp + 0x28]
mov rdx, rbp
call fcn.1400350b0
movzx r14d, al
inc ebx
cmp ebx, dword [rsp + 0x24]
jl 0x140034fe0
test r14b, r14b
jne 0x140035073
test r13b, r13b
je 0x140035078
mov byte [rsp + 0x20], 1
mov r13, qword [rsp + 0xa0]
mov r14, qword [rsp + 0x50]
mov rcx, r12
call qword [sym.imp.libcrypto_3_x64.dll_GENERAL_NAMES_free]
movzx eax, byte [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400cd0f0
add rsp, 0x58
pop r15
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400363b0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x78
mov rax, qword [0x14011a028]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov ecx, 1
call fcn.1400cd110
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140046370]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140036451
cmp dword [rsp + 0x38], 0
jne 0x140036414
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x50]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
je 0x140036436
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400cd0f0
add rsp, 0x78
ret
mov dword [rsp + 0x38], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x140036640
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x1b0
mov rax, qword [0x14011a028]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
xor r14d, r14d
mov ebx, r14d
mov dword [rsp + 0x20], ebx
mov edi, r14d
mov dword [rsp + 0x28], r14d
xor edx, edx
mov r8d, 0x150
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memset
mov rdx, qword [0x140124ae0]
add rdx, 0x140
lea rcx, [rsp + 0x50]
call fcn.1400077b0
nop
mov rdx, qword [0x140124840]
cmp qword [0x140124838], rdx
cmovne rdx, qword [0x140124838]
mov qword [0x140124840], rdx
mov sil, 1
mov r11d, r14d
movabs r13, 0xcbf29ce484222325
movabs r12, 0x100000001b3
mov r15d, 0x2f6
mov r9, qword [rsp + 0x128]
test sil, sil
je 0x140036804
imul eax, edi, 0x64
add eax, ebx
mov r10d, eax
shr eax, 8
movzx r8d, al
movzx eax, r10b
xor rax, r13
imul rax, r12
xor r8, rax
imul r8, r12
mov eax, r10d
shr eax, 0x10
movzx ecx, al
xor r8, rcx
imul r8, r12
mov eax, r10d
shr rax, 0x18
xor r8, rax
imul r8, r12
mov rcx, qword [rsp + 0x150]
and rcx, r8
shl rcx, 4
mov rax, qword [rsp + 0x138]
add rax, rcx
mov rcx, qword [rax + 8]
cmp rcx, r9
je 0x140036772
mov rax, qword [rax]
cmp r10d, dword [rcx + 0x10]
je 0x140036775
cmp rcx, rax
jne 0x1400367fb
mov rcx, r14
mov rax, r9
test rcx, rcx
cmovne rax, rcx
cmp word [rax + 0x18], r15w
jne 0x1400367cc
cmp rdx, qword [0x140124848]
je 0x1400367a8
mov dword [rdx], ebx
mov dword [rdx + 4], edi
mov rdx, qword [0x140124840]
add rdx, 8
mov qword [0x140124840], rdx
jmp 0x1400367be
lea r9, [rsp + 0x28]
lea r8, [rsp + 0x20]
call fcn.140043740
mov rdx, qword [0x140124840]
mov r11d, 1
mov r9, qword [rsp + 0x128]
cmp ebx, 0x63
jne 0x1400367f0
cmp edi, 0x35
jne 0x1400367de
xor sil, sil
jmp 0x1400366f5
mov ebx, r14d
mov dword [rsp + 0x20], ebx
inc edi
mov dword [rsp + 0x28], edi
jmp 0x1400366f5
inc ebx
mov dword [rsp + 0x20], ebx
jmp 0x1400366f5
mov rcx, qword [rcx + 8]
jmp 0x140036763
xorps xmm0, xmm0
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], r14
lea rcx, [rsp + 0x30]
movups xmmword [rsp + 0x30], xmm0
cmp r11d, 1
jne 0x140036842
lea r8d, [r11 + 0x19]
lea rdx, str.Roulette_Troll_Starting...
call fcn.140025ca0
lea rcx, [rsp + 0x30]
call fcn.140098e70
call fcn.1400363b0
jmp 0x14003685f
mov r8d, 0x1e
lea rdx, str.Roulette_Not_Found_In_World...
call fcn.140025ca0
lea rcx, [rsp + 0x30]
call fcn.140098e70
nop
lea rcx, [rsp + 0x160]
call fcn.140007b80
lea rcx, [rsp + 0x120]
call fcn.140007bf0
lea rcx, [rsp + 0xe8]
call fcn.1400245d0
lea rcx, [rsp + 0xa8]
call fcn.1400245d0
lea rcx, [rsp + 0x88]
call fcn.1400245d0
lea rcx, [rsp + 0x70]
call fcn.140024320
lea rcx, [rsp + 0x50]
call fcn.1400245d0
nop
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1400cd0f0
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
Function at 0x1400378d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x5c], 0
je 0x1400378f3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x5b
jb 0x1400378e0
mov byte [rcx + 0x5c], 0
mov rax, rcx
ret

Function at 0x140037900
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x70], 0
je 0x140037923
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x6f
jb 0x140037910
mov byte [rcx + 0x70], 0
mov rax, rcx
ret

Function at 0x140037950
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x140
mov rax, qword [0x14011a028]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov eax, edx
mov qword [rsp + 0x28], rcx
mov rbx, rcx
xor edx, edx
mov ecx, eax
xor edi, edi
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
shl eax, 0x10
mov r8d, 0x100
mov ecx, eax
lea rdx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetKeyNameTextA]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
test eax, eax
je 0x1400379d0
lea rax, [rsp + 0x30]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], dil
jne 0x1400379c0
lea rdx, [rsp + 0x30]
jmp 0x1400379dd
mov r8d, 7
lea rdx, str.Unknown
mov rcx, rbx
call fcn.140025ca0
mov rax, rbx
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1400cd0f0
mov rbx, qword [rsp + 0x160]
add rsp, 0x140
pop rdi
ret
Function at 0x14003dcc0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x5c], 0
je 0x14003dce3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x5b
jb 0x14003dcd0
mov byte [rcx + 0x5c], 0
ret

Function at 0x14003e1d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x14003e204
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x14003e1f0
ret
Function at 0x14003f770
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xa0
mov rax, qword [0x14011a028]
xor rax, rsp
mov qword [rbp - 1], rax
mov rbx, rdx
mov rsi, qword [rbp + 0x77]
mov qword [rbp - 0x69], rsi
mov r15, qword [rbp + 0x7f]
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x21], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x11], xmm1
mov qword [rbp - 0x29], 1
xor r12d, r12d
movzx eax, byte [rdx]
test al, al
je 0x14003f7d0
mov qword [rbp - 0x31], 4
jmp 0x14003f7d8
mov dword [rbp - 0x2d], r9d
mov dword [rbp - 0x31], r12d
test al, al
cmove rbx, rcx
mov edx, r8d
lea rcx, [rbp - 0x51]
call fcn.1400030e0
nop
lea rdx, [rbp - 0x51]
cmp qword [rbp - 0x39], 0x10
cmovae rdx, qword [rbp - 0x51]
lea r9, [rbp - 0x61]
lea r8, [rbp - 0x31]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x14003f915
mov rbx, qword [rbp - 0x61]
test rbx, rbx
je 0x14003f90b
movzx r14d, byte [rbp + 0x6f]
nop dword [rax]
nop dword [rax + rax]
mov dword [rsp + 0x28], 0x81
mov dword [rsp + 0x20], r12d
xor r9d, r9d
mov r8d, dword [rbx + 0xc]
mov edx, dword [rbx + 8]
mov ecx, dword [rbx + 4]
call qword [sym.imp.WS2_32.dll_WSASocketW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14003f876
mov r8d, dword [rbx + 0xc]
mov edx, dword [rbx + 8]
mov ecx, dword [rbx + 4]
call qword [sym.imp.WS2_32.dll_socket]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14003f8fa
test r14b, r14b
je 0x14003f8a0
mov dword [rbp - 0x59], 1
mov dword [rsp + 0x20], 4
lea r9, [rbp - 0x59]
mov edx, 6
lea r8d, [rdx - 5]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rsi + 0x38]
test rcx, rcx
je 0x14003f8b7
mov qword [rbp - 0x59], rdi
mov rax, qword [rcx]
lea rdx, [rbp - 0x59]
call qword [rax + reloc.WS2_32.dll_recv]
cmp dword [rbx + 4], 0x17
jne 0x14003f8df
mov dword [rbp - 0x59], r12d
mov dword [rsp + 0x20], 4
lea r9, [rbp - 0x59]
mov edx, 0x29
lea r8d, [rdx - 0xe]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_setsockopt]
mov r8, rbx
mov rdx, rdi
mov rcx, r15
call fcn.14002af80
test al, al
jne 0x14003f95d
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
mov rbx, qword [rbx + 0x28]
test rbx, rbx
jne 0x14003f830
mov rbx, qword [rbp - 0x61]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
nop
lea rcx, [rbp - 0x51]
call fcn.1400245d0
nop
mov rcx, qword [rsi + 0x38]
test rcx, rcx
je 0x14003f938
cmp rcx, rsi
mov rax, qword [rcx]
setne dl
call qword [rax + 0x20]
mov qword [rsi + 0x38], r12
mov rax, 0xffffffffffffffff
mov rcx, qword [rbp - 1]
xor rcx, rsp
call fcn.1400cd0f0
add rsp, 0xa0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rcx, qword [rbp - 0x61]
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
nop
lea rcx, [rbp - 0x51]
call fcn.1400245d0
nop
mov rcx, qword [rsi + 0x38]
test rcx, rcx
je 0x14003f98b
mov rax, qword [rcx]
cmp rcx, rsi
setne dl
call qword [rax + 0x20]
mov qword [rsi + 0x38], r12
mov rax, rdi
jmp 0x14003f93f
Function at 0x140041730
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x14011a028]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
mov ecx, 1
call fcn.1400cd110
mov qword [rsp + 0x30], rax
lea rdi, [rbx + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1400463a0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x1400417a3
mov rax, rbx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400cd0f0
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov dword [rdi], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x1400417c0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x14011a028]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
mov ecx, 1
call fcn.1400cd110
mov qword [rsp + 0x30], rax
lea rdi, [rbx + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140046440]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x140041833
mov rax, rbx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400cd0f0
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov dword [rdi], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x140041850
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x14011a028]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rdx
mov rdi, rcx
mov ecx, 8
call fcn.1400cd110
mov r9, rax
mov rax, qword [rbx]
mov qword [r9], rax
mov qword [rsp + 0x30], r9
lea rbx, [rdi + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0
lea r8, [0x1400464f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rdi], rax
test rax, rax
je 0x1400418cc
mov rax, rdi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400cd0f0
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov dword [rbx], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x1400418e0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x14011a028]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
mov ecx, 1
call fcn.1400cd110
mov qword [rsp + 0x30], rax
lea rdi, [rbx + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1400465a0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x140041953
mov rax, rbx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400cd0f0
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov dword [rdi], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x14004a530
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
movsx ecx, byte [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x14004a5fc
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x14004a5fc
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x14004a615
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx + 0x10]
cmp rax, rcx
je 0x14004a5ec
cmp byte [rax], 0x5c
jne 0x14004a5e6
lea rdx, [rax + 1]
cmp rdx, rcx
je 0x14004a5e6
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x14004a5d2
movzx ecx, byte [rdx]
sub cl, 0x28
cmp cl, 1
jbe 0x14004a5e3
test r8b, 0x10
jne 0x14004a5e6
movzx ecx, byte [rdx]
sub cl, 0x7b
test cl, 0xfd
jne 0x14004a5e6
mov rax, rdx
inc rax
mov qword [rbx], rax
mov rcx, rbx
call fcn.1400459b0
test edi, edi
jne 0x14004a550
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
call fcn.1400459a0
int3

Function at 0x14004c7f0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
movdqa xmm0, xmmword [0x1400f6c70]
xor eax, eax
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x30], 0x1004136
nop dword [rax]
lea edx, [rax + 0x3a]
xor byte [rsp + rax + 0x20], dl
inc rax
cmp rax, 0x12
jb 0x14004c810
mov byte [rsp + 0x33], 0
lea rax, [rsp + 0x20]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x14004c831
lea rdx, [rsp + 0x20]
call fcn.140024800
add rsp, 0x48
ret
Function at 0x14004c850
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xe0
mov ebx, edx
mov rsi, rcx
xor r14d, r14d
mov edx, r8d
lea rcx, [rbp + 0x27]
call fcn.1400030e0
mov rdi, rax
mov edx, ebx
lea rcx, [rbp + 7]
call fcn.1400030e0
mov rdx, rax
movdqa xmm0, xmmword [0x1400f6bb0]
movdqu xmmword [rbp - 0x79], xmm0
mov dword [rbp - 0x69], 0x77343724
mov word [rbp - 0x65], 0x100
mov ecx, r14d
nop dword [rax]
lea eax, [rcx + 0x3a]
xor byte [rbp + rcx - 0x79], al
inc rcx
cmp rcx, 0x14
jb 0x14004c8b0
mov byte [rbp - 0x64], 0
lea rax, [rbp - 0x79]
mov rbx, 0xffffffffffffffff
mov r9, rbx
inc r9
cmp byte [rax + r9], 0
jne 0x14004c8d2
lea r8, [rbp - 0x79]
mov rcx, rdx
call fcn.140026c80
xorps xmm0, xmm0
movups xmmword [rbp - 0x59], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x49], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x59], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x49], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov dword [rbp + 0x67], 0x64201
mov byte [rbp + 0x6b], 1
mov rcx, r14
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x3a]
xor byte [rbp + rcx + 0x67], al
inc rcx
cmp rcx, 3
jb 0x14004c930
mov byte [rbp + 0x6b], 0
lea rax, [rbp + 0x67]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14004c950
lea rdx, [rbp + 0x67]
lea rcx, [rbp - 0x59]
call fcn.140024800
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x39], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x29], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, rdi
lea r8, [rbp - 0x39]
lea rcx, [rbp - 0x19]
call fcn.140026780
nop
mov dword [rbp + 0x67], 0x1003146
mov rcx, r14
lea eax, [rcx + 0x3a]
xor byte [rbp + rcx + 0x67], al
inc rcx
cmp rcx, 2
jb 0x14004c9a0
mov byte [rbp + 0x6a], 0
lea rax, [rbp + 0x67]
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14004c9c0
mov r8, rbx
lea rdx, [rbp + 0x67]
lea rcx, [rbp - 0x19]
call fcn.140024800
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x79], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x69], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rdx, [rbp - 0x79]
movq rcx, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 0x10
cmovae rdx, rcx
movq r8, xmm1
mov rcx, rsi
call fcn.140024800
nop
lea rcx, [rbp - 0x79]
call fcn.1400245d0
nop
lea rcx, [rbp - 0x19]
call fcn.1400245d0
nop
lea rcx, [rbp - 0x39]
call fcn.1400245d0
nop
lea rcx, [rbp - 0x59]
call fcn.1400245d0
nop
lea rcx, [rbp + 7]
call fcn.1400245d0
nop
lea rcx, [rbp + 0x27]
call fcn.1400245d0
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14004dc80
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xb0
mov rax, qword [0x14011a028]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rdi, rdx
mov rsi, rcx
mov qword [rbp + 0x2f], rdx
mov dword [rbp - 0x29], 0x9aa0a7a3
mov dword [rbp - 0x25], 0xbdb0a2b2
mov dword [rbp - 0x21], 0xb1b4a4a8
mov word [rbp - 0x1d], 0x100
xor eax, eax
nop dword [rax]
lea ecx, [rax - 0x3e]
xor byte [rbp + rax - 0x29], cl
inc rax
cmp rax, 0xc
jb 0x14004dcd0
mov byte [rbp - 0x1c], 0
lea rax, [rbp - 0x29]
mov rbx, 0xffffffffffffffff
mov rcx, rbx
inc rcx
cmp byte [rax + rcx], 0
jne 0x14004dcf2
mov rdx, qword [rdx + 0x10]
movabs rax, 0x7fffffffffffffff
sub rax, rdx
cmp rax, rcx
jb 0x14004de23
mov rax, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x14004dd22
mov rax, qword [rdi]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, [rbp - 0x29]
lea rcx, [rbp + 0xf]
call fcn.140026970
nop
mov dword [rbp - 0x29], 0x5b595746
mov dword [rbp - 0x25], 0x4a434a
mov byte [rbp - 0x21], 1
xor ecx, ecx
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x3a]
xor byte [rbp + rcx - 0x29], al
inc rcx
cmp rcx, 7
jb 0x14004dd60
mov byte [rbp - 0x21], 0
lea rax, [rbp - 0x29]
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14004dd80
mov r8, rbx
lea rdx, [rbp - 0x29]
lea rcx, [rbp + 0xf]
call fcn.140024800
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x11], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 1], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rdx, [rbp - 0x11]
movq r8, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 0x10
cmovae rdx, r8
movq r8, xmm1
mov rcx, rsi
call fcn.140024800
nop
lea rcx, [rbp - 0x11]
call fcn.1400245d0
nop
lea rcx, [rbp + 0xf]
call fcn.1400245d0
nop
mov rcx, rdi
call fcn.1400245d0
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1400cd0f0
mov rbx, qword [rsp + 0xe0]
add rsp, 0xb0
pop rdi
pop rsi
pop rbp
ret
call fcn.140003030
nop
int3

Function at 0x14004de30
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xd], 0
je 0x14004de53
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x3e]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xc
jb 0x14004de40
mov byte [rcx + 0xd], 0
mov rax, rcx
ret
Function at 0x14004de60
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rax, qword [0x14011a028]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rdi, rdx
mov rsi, rcx
mov qword [rbp + 0x2f], rdx
mov dword [rbp - 0x11], 0x62585f5b
mov dword [rbp - 0xd], 0x2d21524d
mov dword [rbp - 9], 0x3d21372e
mov dword [rbp - 5], 0x1003b32
xor eax, eax
nop word [rax + rax]
lea ecx, [rax + 0x3a]
xor byte [rbp + rax - 0x11], cl
inc rax
cmp rax, 0xe
jb 0x14004deb0
mov byte [rbp - 2], 0
lea rax, [rbp - 0x11]
mov rbx, 0xffffffffffffffff
mov rcx, rbx
inc rcx
cmp byte [rax + rcx], 0
jne 0x14004ded2
mov rdx, qword [rdx + 0x10]
movabs rax, 0x7fffffffffffffff
sub rax, rdx
cmp rax, rcx
jb 0x14004dff3
mov rax, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x14004df02
mov rax, qword [rdi]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, [rbp - 0x11]
lea rcx, [rbp + 0xf]
call fcn.140026970
nop
mov dword [rbp - 0x19], 0x1003146
xor ecx, ecx
nop dword [rax + rax]
lea eax, [rcx + 0x3a]
xor byte [rbp + rcx - 0x19], al
inc rcx
cmp rcx, 2
jb 0x14004df30
mov byte [rbp - 0x16], 0
lea rax, [rbp - 0x19]
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14004df50
mov r8, rbx
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 0xf]
call fcn.140024800
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x11], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 1], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rdx, [rbp - 0x11]
movq r8, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 0x10
cmovae rdx, r8
movq r8, xmm1
mov rcx, rsi
call fcn.140024800
nop
lea rcx, [rbp - 0x11]
call fcn.1400245d0
nop
lea rcx, [rbp + 0xf]
call fcn.1400245d0
nop
mov rcx, rdi
call fcn.1400245d0
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1400cd0f0
mov rbx, qword [rsp + 0xd0]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret
call fcn.140003030
nop
int3

Function at 0x14004e3d0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
movdqa xmm0, xmmword [0x1400f7560]
xor eax, eax
movdqu xmmword [rsp + 0x20], xmm0
mov word [rsp + 0x30], 0x100
nop dword [rax + rax]
lea edx, [rax + 0x3a]
xor byte [rsp + rax + 0x20], dl
inc rax
cmp rax, 0x10
jb 0x14004e3f0
mov byte [rsp + 0x31], 0
lea rax, [rsp + 0x20]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x14004e411
lea rdx, [rsp + 0x20]
call fcn.140024800
add rsp, 0x48
ret
Function at 0x14004e870
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xd], 0
je 0x14004e893
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x3e]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xc
jb 0x14004e880
mov byte [rcx + 0xd], 0
ret