joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001e40
Capabilities:
Encode data using xor

Disassembly:
movsxd r8, dword [0x1400084ac]
lea r9, [0x1400084c0]
movsxd rax, edx
mov r10, rcx
mov r9, qword [r9 + r8*8]
inc r8d
dec rax
mov dword [0x1400084ac], r8d
test rax, rax
jle 0x140001f25
mov rdx, r9
sub r10, r9
mov r8, rax
nop word [rax + rax]
movzx ecx, byte [rdx + r10]
mov byte [rdx], cl
lea rdx, [rdx + 1]
xor cl, byte [0x140008017]
mov byte [rdx - 1], cl
xor cl, byte [0x140008016]
mov byte [rdx - 1], cl
xor cl, byte [0x140008015]
mov byte [rdx - 1], cl
xor cl, byte [0x140008014]
mov byte [rdx - 1], cl
xor cl, byte [0x140008013]
mov byte [rdx - 1], cl
xor cl, byte [0x140008012]
mov byte [rdx - 1], cl
xor cl, byte [0x140008011]
mov byte [rdx - 1], cl
xor cl, byte [0x140008010]
mov byte [rdx - 1], cl
xor cl, byte [0x14000800f]
mov byte [rdx - 1], cl
xor cl, byte [0x14000800e]
mov byte [rdx - 1], cl
xor cl, byte [0x14000800d]
mov byte [rdx - 1], cl
xor cl, byte [0x14000800c]
mov byte [rdx - 1], cl
xor cl, byte [0x14000800b]
mov byte [rdx - 1], cl
xor cl, byte [0x14000800a]
mov byte [rdx - 1], cl
xor cl, byte [0x140008009]
mov byte [rdx - 1], cl
xor cl, byte [0x140008008]
mov byte [rdx - 1], cl
sub r8, 1
jne 0x140001e80
mov byte [rax + r9], 0
xor eax, eax
mov ecx, dword [0x1400084ac]
cmp ecx, 0xf
cmovge ecx, eax
mov rax, r9
mov dword [0x1400084ac], ecx
ret

Function at 0x140002620
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1400081c8]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400026f3
cmp byte [rcx + 0x71], 0
je 0x1400026f3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x1400026ef
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400026b4
sub eax, 1
je 0x1400026b8
cmp eax, 2
jne 0x1400026ef
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140003da0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1400026e6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1400026ef
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14000269c
xor al, al
jmp 0x14000269c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140003da0
add rsp, 0x60
pop rbx
ret
Function at 0x140002c70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
movsxd rax, dword [rcx + 0x3c]
xor r9d, r9d
mov rdi, rdx
mov r11, rcx
mov r8d, dword [rax + rcx + 0x88]
add r8, rcx
mov esi, dword [r8 + 0x1c]
mov ebp, dword [r8 + 0x24]
add rsi, rcx
mov r10d, dword [r8 + 0x20]
add rbp, rcx
mov ebx, dword [r8 + 0x18]
add r10, rcx
test ebx, ebx
je 0x140002cf3
nop dword [rax]
mov r8d, dword [r10]
mov rax, rdi
add r8, r11
sub r8, rdi
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140002ce3
inc rax
test ecx, ecx
jne 0x140002cd0
test edx, edx
je 0x140002d0a
inc r9d
add r10, 4
cmp r9d, ebx
jb 0x140002cc0
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
movzx ecx, word [rbp + r9*2]
mov eax, dword [rsi + rcx*4]
add rax, r11
jmp 0x140002cf5
Function at 0x140002d20
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1400081c8]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140002d4d
xor eax, eax
jmp 0x140002ea2
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x140002d78
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x140002d78
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x140002ea2
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140002e95
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x140002dbb
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140002de6
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140002e9a
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140002e55
sub eax, 1
je 0x140002e55
cmp eax, 2
jne 0x140002e95
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140002e9a
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140002e83
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140002e95
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x140002e9a
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140003da0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x1400035f0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140003612
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x140003628
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140003644
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140003646
xor ecx, ecx
mov qword [rsp + 0x20], rdi
movsxd rax, ecx
test ecx, ecx
je 0x140003680
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
sub rbx, rdi
add r14, rdi
mov r8, rbx
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140003727
mov r9, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r9], rax
jne 0x1400036bb
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov rdi, r8
cmp r8, 0xfff
jbe 0x140003701
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
add r14, rax
mov rdi, rbx
cmp rax, 0xfff
jne 0x140003740
cmp rbx, rax
ja 0x1400036d0
mov r8, rdi
test rdi, rdi
je 0x140003727
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov r8, rdi
sub r8, rax
sub rbp, r8
mov rdi, qword [rsp + 0x20]
mov rax, rbp
mov rbx, qword [rsp + 0x28]
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
sub rbp, rbx
jmp 0x14000372a
Function at 0x140003750
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x140003787
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x1400037a8
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x1400037aa
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140003803
test ecx, ecx
jle 0x1400037e3
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
sub rbx, rbp
add r14, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140003803
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140003803
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14000b9ac
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140016950], eax
call fcn.14000b730
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_UnhandledExceptionFilter]
cmp dword [0x140016950], 0
jne case.default.0x14000ba02
mov ecx, 1
call fcn.14000b730
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
std
movabs dword [0x87df05357c340bc6], eax
invalid
Function at 0x14000fdd0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 7], 0
je 0x14000fdf3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 9]
xor byte [rax + rcx], dl
inc rax
cmp rax, 6
jb 0x14000fde0
mov byte [rcx + 7], 0
mov rax, rcx
ret

Function at 0x14000fe00
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xd], 0
je 0x14000fe23
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 9]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xc
jb 0x14000fe10
mov byte [rcx + 0xd], 0
mov rax, rcx
ret

Function at 0x14000fe30
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 4], 0
je 0x14000fe53
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 9]
xor byte [rax + rcx], dl
inc rax
cmp rax, 3
jb 0x14000fe40
mov byte [rcx + 4], 0
mov rax, rcx
ret

Function at 0x14000fe60
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xf], 0
je 0x14000fe83
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 9]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xe
jb 0x14000fe70
mov byte [rcx + 0xf], 0
mov rax, rcx
ret

Function at 0x14000fe90
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 8], 0
je 0x14000feb3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 9]
xor byte [rax + rcx], dl
inc rax
cmp rax, 7
jb 0x14000fea0
mov byte [rcx + 8], 0
mov rax, rcx
ret

Function at 0x14000fec0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 6], 0
je 0x14000fee3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 9]
xor byte [rax + rcx], dl
inc rax
cmp rax, 5
jb 0x14000fed0
mov byte [rcx + 6], 0
mov rax, rcx
ret

Function at 0x14000fef0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x14000ff13
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 9]
xor byte [rax + rcx], dl
inc rax
cmp rax, 4
jb 0x14000ff00
mov byte [rcx + 5], 0
mov rax, rcx
ret

Function at 0x14000ff20
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 9], 0
je 0x14000ff43
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 9]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x14000ff30
mov byte [rcx + 9], 0
mov rax, rcx
ret

Function at 0x14000ff50
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xa], 0
je 0x14000ff73
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 9]
xor byte [rax + rcx], dl
inc rax
cmp rax, 9
jb 0x14000ff60
mov byte [rcx + 0xa], 0
mov rax, rcx
ret
Function at 0x140013e10
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rcx + r8], 0
jne 0x140013e20
mov rdx, rcx
lea rbx, [0x1401d1550]
mov rcx, rbx
call fcn.140008610
mov rdx, qword [0x1401d1560]
xor ecx, ecx
mov qword [0x1401e2968], rdx
test rdx, rdx
je 0x140013e70
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
mov rax, rbx
cmovae rax, qword [0x1401d1550]
xor byte [rax + rcx], 0x35
inc rcx
cmp rcx, rdx
jb 0x140013e51
add rsp, 0x20
pop rbx
ret

Function at 0x140013e80
Capabilities:
Encode data using xor
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x70
mov rax, qword [0x1401d12b0]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor ebx, ebx
lea r14, [0x1401d1550]
mov rbp, rdx
mov rsi, rcx
mov rdx, qword [0x1401e2968]
mov ecx, ebx
test rdx, rdx
je 0x140013edf
nop word [rax + rax]
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
mov rax, r14
cmovae rax, qword [0x1401d1550]
xor byte [rax + rcx], 0x35
inc rcx
cmp rcx, rdx
jb 0x140013ec0
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
lea rcx, [rsp + 0x30]
xorps xmm0, xmm0
mov rdi, r14
cmovae rdi, qword [0x1401d1550]
mov edx, r8d
movups xmmword [rsp + 0x50], xmm0
call fcn.140009c90
cmp qword [rax + 0x18], 0x10
jb 0x140013f11
mov rax, qword [rax]
mov qword [rsp + 0x28], rdi
lea r9, [rsp + 0x50]
mov r8, rax
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140013f72
mov rcx, qword [rsp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140013f6d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140013f6d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012eab4
mov rcx, qword [0x1401e2968]
test rcx, rcx
je 0x140013f9f
nop
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
mov rax, r14
cmovae rax, qword [0x1401d1550]
xor byte [rax + rbx], 0x35
inc rbx
cmp rbx, rcx
jb 0x140013f80
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14012e570
add rsp, 0x70
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140013fd0
Capabilities:
Encode data using xor
Read .ini file

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1401d12b0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, r9
mov r10, r8
mov rdi, rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x30], rbx
xor ecx, ecx
lea rsi, [0x1401d1550]
mov rdx, qword [0x1401e2968]
test rdx, rdx
je 0x14001402f
nop
mov rax, rsi
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae rax, qword [0x1401d1550]
xor byte [rax + rcx], 0x35
inc rcx
cmp rcx, rdx
jb 0x140014010
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov rax, rsi
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae rax, qword [0x1401d1550]
mov r8, rbx
cmp qword [r9 + 0x18], 0x10
jb 0x140014057
mov r8, qword [r9]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
lea r9, [rsp + 0x38]
mov rdx, r10
lea rcx, str.COLORS
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
xor ecx, ecx
mov rdx, qword [0x1401e2968]
test rdx, rdx
je 0x1400140af
nop word [rax + rax]
mov rax, rsi
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae rax, qword [0x1401d1550]
xor byte [rax + rcx], 0x35
inc rcx
cmp rcx, rdx
jb 0x140014090
mov qword [rdi], 0
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
lea rax, [rsp + 0x38]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x1400140d5
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.140008610
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140014123
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14001411e
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001414e
mov rcx, r8
call fcn.14012eab4
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rax, rdi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14012e570
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140014160
Capabilities:
Encode data using xor
Read .ini file

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x80
movaps xmmword [rsp + 0x70], xmm6
mov rax, qword [0x1401d12b0]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor esi, esi
lea r15, [0x1401d1550]
mov r14, rdx
mov rbp, rcx
mov rdx, qword [0x1401e2968]
mov ecx, esi
test rdx, rdx
je 0x1400141c3
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
mov rax, r15
cmovae rax, qword [0x1401d1550]
xor byte [rax + rcx], 0x35
inc rcx
cmp rcx, rdx
jb 0x1400141a4
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
lea rcx, [0x140179a48]
xorps xmm6, xmm6
xorps xmm0, xmm0
cvtss2sd xmm6, xmm2
mov rdi, r15
cmovae rdi, qword [0x1401d1550]
movups xmmword [rsp + 0x50], xmm0
movaps xmm1, xmm6
movq rdx, xmm6
call fcn.140013db0
movsxd rbx, eax
lea rcx, [rsp + 0x30]
mov rdx, rbx
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], reloc.WS2_32.dll_ntohs
call fcn.14000d000
cmp qword [rsp + 0x48], 0x10
lea rcx, [rsp + 0x30]
lea rdx, [rbx + 1]
movaps xmm3, xmm6
cmovae rcx, qword [rsp + 0x30]
lea r8, [0x140179a48]
movq r9, xmm6
call fcn.140013d50
cmp qword [rsp + 0x48], 0x10
lea r8, [rsp + 0x30]
mov qword [rsp + 0x28], rdi
lea r9, [rsp + 0x50]
cmovae r8, qword [rsp + 0x30]
mov rdx, r14
mov rcx, rbp
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x1400142b4
mov rcx, qword [rsp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400142af
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400142af
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012eab4
mov rcx, qword [0x1401e2968]
test rcx, rcx
je 0x1400142df
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
mov rax, r15
cmovae rax, qword [0x1401d1550]
xor byte [rax + rsi], 0x35
inc rsi
cmp rsi, rcx
jb 0x1400142c0
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
cvtsd2ss xmm0, xmm0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14012e570
mov rbx, qword [rsp + 0xc8]
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140014320
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1401d12b0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rsi, rdx
mov rdi, rcx
mov edx, r8d
lea rcx, [rsp + 0x20]
call fcn.140009c90
mov rdx, qword [0x1401e2968]
lea rbp, [0x1401d1550]
xor ebx, ebx
mov ecx, ebx
test rdx, rdx
je 0x140014384
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
mov rax, rbp
cmovae rax, qword [0x1401d1550]
xor byte [rax + rcx], 0x35
inc rcx
cmp rcx, rdx
jb 0x140014365
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
lea r8, [rsp + 0x20]
mov r9, rbp
mov rdx, rsi
cmovae r9, qword [0x1401d1550]
mov rcx, rdi
cmp qword [rsp + 0x38], 0x10
cmovae r8, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov rcx, qword [0x1401e2968]
test rcx, rcx
je 0x1400143df
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
mov rax, rbp
cmovae rax, qword [0x1401d1550]
xor byte [rax + rbx], 0x35
inc rbx
cmp rbx, rcx
jb 0x1400143c0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14001441f
mov rcx, qword [rsp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001441a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001441a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012eab4
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14012e570
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x140014440
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x60
movaps xmmword [rsp + 0x50], xmm6
mov rax, qword [0x1401d12b0]
xor rax, rsp
mov qword [rsp + 0x40], rax
xorps xmm6, xmm6
mov rbp, rdx
cvtss2sd xmm6, xmm2
mov rsi, rcx
lea rcx, [0x140179a48]
movaps xmm1, xmm6
movq rdx, xmm6
call fcn.140013db0
movsxd rbx, eax
lea rcx, [rsp + 0x20]
xor edi, edi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov rdx, rbx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rdi
call fcn.14000d000
cmp qword [rsp + 0x38], 0x10
lea rcx, [rsp + 0x20]
lea rdx, [rbx + 1]
movaps xmm3, xmm6
cmovae rcx, qword [rsp + 0x20]
lea r8, [0x140179a48]
movq r9, xmm6
call fcn.140013d50
mov rdx, qword [0x1401e2968]
lea rbx, [0x1401d1550]
mov ecx, edi
test rdx, rdx
je 0x140014503
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
mov rax, rbx
cmovae rax, qword [0x1401d1550]
xor byte [rax + rcx], 0x35
inc rcx
cmp rcx, rdx
jb 0x1400144e4
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
lea r8, [rsp + 0x20]
mov r9, rbx
mov rdx, rbp
cmovae r9, qword [0x1401d1550]
mov rcx, rsi
cmp qword [rsp + 0x38], 0x10
cmovae r8, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov rcx, qword [0x1401e2968]
test rcx, rcx
je 0x14001455f
nop
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
mov rax, rbx
cmovae rax, qword [0x1401d1550]
xor byte [rax + rdi], 0x35
inc rdi
cmp rdi, rcx
jb 0x140014540
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14001459f
mov rcx, qword [rsp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001459a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001459a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012eab4
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14012e570
mov rbx, qword [rsp + 0x98]
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400145d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r10, rdx
lea rdi, [0x1401d1550]
mov rdx, qword [0x1401e2968]
xor ecx, ecx
mov rbx, r8
test rdx, rdx
je 0x140014614
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
mov rax, rdi
cmovae rax, qword [0x1401d1550]
xor byte [rax + rcx], 0x35
inc rcx
cmp rcx, rdx
jb 0x1400145f5
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
mov r9, rdi
cmovae r9, qword [0x1401d1550]
cmp qword [r8 + 0x18], 0x10
jb 0x140014631
mov r8, qword [r8]
mov rdx, r10
lea rcx, str.COLORS
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov rdx, qword [0x1401e2968]
xor ecx, ecx
test rdx, rdx
je 0x14001466f
nop
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
mov rax, rdi
cmovae rax, qword [0x1401d1550]
xor byte [rax + rcx], 0x35
inc rcx
cmp rcx, rdx
jb 0x140014650
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1400146a5
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x1400146a0
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400146c3
mov rcx, r8
call fcn.14012eab4
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3