joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140043ec0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xc0
mov rax, qword [0x140081840]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rsi, qword [rcx + 0x20]
lea r8, [rsp + 0x20]
mov rdi, rcx
lea rdx, [rsp + 0x30]
mov rbx, qword [rsi + 0x228]
mov rcx, rbx
mov qword [rsp + 0x28], 0xffffffffffffffff
mov dword [rsp + 0x20], 0x80
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x140043f3c
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], 0x80
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_accept]
mov qword [rsp + 0x28], rax
jmp 0x140043f41
mov rax, qword [rsp + 0x28]
mov rcx, rdi
cmp rax, 0xffffffffffffffff
jne 0x140043f60
lea rdx, str.Error_accept__ing_server_connect
call fcn.14001b7f0
mov eax, reloc.WLDAP32.dll_Ordinal_30
jmp 0x140043ffa
lea rdx, str.Connection_accepted_from_server
call fcn.14001b8e0
mov byte [rsi + 0x375], 0
mov edx, 1
mov rcx, qword [rsp + 0x28]
call fcn.1400583d0
lea r9, [rsp + 0x28]
mov r8d, 1
mov rdx, rsi
mov rcx, rdi
call fcn.140024c50
mov ebx, eax
test eax, eax
je 0x140043fad
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.WS2_32.dll_closesocket]
mov eax, ebx
jmp 0x140043ffa
cmp qword [rdi + 0x280], 0
je 0x140043ff8
mov dl, 1
mov rcx, rdi
call fcn.140007790
mov rdx, qword [rsp + 0x28]
mov r8d, 1
mov rcx, qword [rdi + 0x288]
call qword [rdi + 0x280]
xor edx, edx
mov rcx, rdi
mov ebx, eax
call fcn.140007790
test ebx, ebx
je 0x140043ff8
mov rcx, rdi
call fcn.1400446f0
mov eax, Ordinal_46
jmp 0x140043ffa
xor eax, eax
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140065140
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x140045ee0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0x1b8]
mov rbx, rcx
mov rdi, qword [rcx + 0x20]
cmp dword [rax + 0x10], 0
je 0x140045f53
movzx eax, byte [rdi + 0x74e]
cmp al, 0xd
je 0x140045f35
test rdi, rdi
je 0x140045f1b
lea r8, str.STOP
mov r8, qword [r8 + rax*8]
jmp 0x140045f22
lea r8, [0x140072cb8]
lea r9, str.RETR_PREQUOTE
lea rdx, str.__s_______s_
call fcn.14001baa0
mov r8b, reloc.WS2_32.dll_listen
mov byte [rdi + 0x74e], 0xd
mov dl, 1
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400460a0
cmp byte [rcx + 0xa4e], 0
je 0x140045f6d
xor edx, edx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140046d80
cmp byte [rcx + 0xa51], 0
je 0x140045ff0
mov r9, qword [rdi + 0x6f8]
lea rdx, [rdi + 0x640]
test r9, r9
jne 0x140045fb7
mov r9, qword [rcx + 0x7f8]
test r9, r9
jne 0x140045fae
cmp byte [rcx + 0x12a9], 0
lea rax, str.NLST
lea r9, str.LIST
cmovne r9, rax
lea r8, str.PRET__s
jmp 0x140045fce
cmp byte [rcx + 0x12ad], 0
lea r8, str.PRET_STOR__s
jne 0x140045fce
lea r8, str.PRET_RETR__s
call fcn.140061210
mov edi, eax
test eax, eax
jne 0x140045fe3
mov dl, Ordinal_30
mov rcx, rbx
call fcn.140044690
mov eax, edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rdx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140046ca0
Function at 0x140046340
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x1b8]
add rdx, 0x640
mov rbx, rcx
cmp dword [rax + 0x10], 0
je 0x140046398
cmp qword [rdx + 0xb8], 0
je 0x140046398
xor r9d, r9d
mov qword [rsp + 0x30], rdi
lea r8, str.REST__d
call fcn.140061210
mov edi, eax
test eax, eax
jne 0x14004638d
mov dl, reloc.WLDAP32.dll_Ordinal_26
mov rcx, rbx
call fcn.140044690
mov eax, edi
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
add rsp, 0x20
pop rbx
jmp fcn.140045ee0

Function at 0x140046850
Capabilities:
Check http status code

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
mov rbp, qword [rcx + 0x20]
lea eax, [rdx - 0xc8]
xor edi, edi
movzx esi, r8b
mov rbx, rcx
cmp eax, 0x64
jb 0x140046892
lea rdx, str.Couldnt_set_desired_mode
call fcn.14001b7f0
mov eax, reloc.WS2_32.dll_recvfrom
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
cmp edx, 0xc8
je 0x1400468a9
mov r8d, edx
lea rdx, str.Got_a__03d_response_code_instead_of_the_assumed_200
call fcn.14001b8e0
cmp sil, 0x13
jne 0x1400468c6
mov rdx, rbp
mov rcx, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
jmp fcn.140046560
cmp sil, 0x14
jne 0x140046a0a
cmp byte [rbx + 0x6f0], 2
mov qword [rsp + 0x58], r14
mov r14, qword [rbx + 0x20]
jne 0x14004694d
mov rax, qword [rbx + 0x1b8]
mov rcx, qword [rax]
test rcx, rcx
je 0x14004694d
xor r9d, r9d
mov qword [rsp + 0x50], rdi
lea r8, [rsp + 0x50]
mov dword [rsp + 0x20], 3
xor edx, edx
call fcn.140026a60
mov esi, eax
test eax, eax
jne 0x1400469f6
mov rcx, qword [rsp + 0x50]
mov edx, Ordinal_50
call sub.VCRUNTIME140.dll_strrchr
test rax, rax
je 0x140046942
mov rdi, qword [rsp + 0x50]
mov ecx, 1
sub rax, rdi
cmovne rcx, rax
mov byte [rcx + rdi], sil
jmp 0x14004694d
mov rcx, qword [rsp + 0x50]
call qword [fcn.14006611a]
mov rdx, qword [rbx + 0x7f8]
test rdx, rdx
jne 0x140046972
cmp byte [rbx + 0x12a9], 0
lea rax, str.NLST
lea rdx, str.LIST
cmovne rdx, rax
lea r8, [0x140069ee6]
test rdi, rdi
mov r9, r8
lea rax, [0x14006abac]
cmovne r9, rdi
lea rcx, [0x14006b61c]
cmovne r8, rax
call fcn.1400221a0
mov rcx, rdi
mov rbp, rax
call qword [fcn.14006611a]
test rbp, rbp
jne 0x1400469c4
mov r14, qword [rsp + 0x58]
mov esi, reloc.WLDAP32.dll_Ordinal_27
mov eax, esi
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
lea rdx, [r14 + 0x640]
mov r9, rbp
lea r8, [0x140068eb4]
mov rcx, rbx
call fcn.140061210
mov rcx, rbp
mov esi, eax
call qword [fcn.14006611a]
test esi, esi
jne 0x1400469f6
mov dl, Ordinal_32
mov rcx, rbx
call fcn.140044690
mov r14, qword [rsp + 0x58]
mov eax, esi
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
cmp sil, 0x15
jne 0x140046a15
mov r8b, reloc.WS2_32.dll_listen
jmp 0x140046a1e
cmp sil, 0x16
jne 0x140046a2a
mov r8b, recv
mov dl, 1
mov rcx, rbx
call fcn.1400460a0
mov edi, eax
mov rbx, qword [rsp + 0x60]
mov eax, edi
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400628a0
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movsxd rbx, edx
mov rdi, rcx
mov edx, ebx
mov byte [rcx], 0
call qword [sym.imp.WS2_32.dll_gethostname]
mov byte [rbx + rdi - 1], 0
test eax, eax
jne 0x1400628db
mov edx, reloc.WLDAP32.dll_Ordinal_46
mov rcx, rdi
call sub.VCRUNTIME140.dll_strchr
test rax, rax
je 0x1400628d9
mov byte [rax], 0
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140063d80
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r15
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbp, rcx
mov ecx, dword [rcx + 0x20]
mov rsi, rdx
add rcx, 0x18
mov r15d, r8d
lea r9d, [rax + rax]
add rcx, r9
call qword [section..data]
mov rbx, rax
test rax, rax
jne 0x140063dc3
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop rsi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbp
mov qword [rax + 8], rcx
mov eax, dword [rbp + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rdi
mov qword [rbx + 0x10], rax
lea rdi, [rbp + 8]
mov qword [rsp + 0x50], r14
cmp r15d, dword [rbp + 0x1c]
jbe 0x140063e10
call qword [rbp]
mov rcx, qword [rbx + 8]
mov r8d, r15d
mov rdx, rsi
call qword [rdi]
mov esi, dword [rbp + 0x18]
add rsi, qword [rbx + 0x10]
mov rdx, qword [rbx + 8]
mov rcx, rsi
call qword [rbp + reloc.WS2_32.dll_recv]
mov r15d, dword [rbp + 0x20]
mov rcx, qword [rbx + 8]
call qword [rbp]
mov rcx, qword [rbx + 0x10]
call qword [rbp]
xor r14d, r14d
test r15, r15
je 0x140063e72
mov r14, r15
nop dword [rax]
movzx eax, byte [rsi]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rbx + 8]
call qword [rdi]
movzx eax, byte [rsi]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea rsi, [rsi + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rbx + 0x10]
call qword [rdi]
sub r15, 1
jne 0x140063e30
lea rdi, [rbp + 8]
mov eax, dword [rbp + 0x1c]
cmp r14, rax
jae 0x140063eb1
nop word [rax + rax]
mov rcx, qword [rbx + 8]
lea rdx, [0x1400783f9]
mov r8d, 1
call qword [rdi]
mov rcx, qword [rbx + 0x10]
lea rdx, [0x1400783fa]
mov r8d, 1
call qword [rdi]
mov eax, dword [rbp + 0x1c]
inc r14
cmp r14, rax
jb 0x140063e80
mov r14, qword [rsp + 0x50]
mov rax, rbx
mov rbx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rsi
pop rbp
ret
Function at 0x1400640a0
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140081840]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbp, r8
mov dword [rsp + 0x20], 0xf0000040
mov rsi, rdx
mov rdi, rcx
xor r8d, r8d
lea rcx, [rsp + 0x38]
xor edx, edx
mov r9d, Ordinal_27
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x1400640ec
mov eax, reloc.WLDAP32.dll_Ordinal_27
jmp 0x1400641bf
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x140064130
mov rcx, qword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 2
mov qword [rsp + 0x38], 0
jmp 0x1400641bf
mov rcx, rbp
call fcn.14001f980
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
mov r8d, eax
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov dword [rsp + 0x30], 0
mov edx, 2
mov dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [rsp + 0x30], 0x20
jne 0x14006419b
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x30]
mov r8, rdi
mov dword [rsp + 0x20], 0
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400641ab
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400641bd
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140065140
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret

Function at 0x140064f80
Capabilities:
Encode data using xor

Disassembly:
mov r10, rcx
test rdx, rdx
je 0x140064fe5
nop dword [rax + rax]
movzx r8d, byte [r10]
lea r10, [r10 + 1]
movzx eax, r8b
movzx r9d, r8b
shr r9b, 1
and al, 0xfe
not r9b
movzx eax, al
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
or r8b, 1
test r9b, 2
movzx ecx, r8b
cmove ecx, eax
mov byte [r10 - 1], cl
sub rdx, 1
jne 0x140064f90
ret
Function at 0x140064ff0
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140081840]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rsi, r8
mov dword [rsp + 0x20], 0xf0000040
mov rdi, rdx
mov rbx, rcx
xor ebp, ebp
lea rcx, [rsp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x38], rbp
xor edx, edx
mov qword [rsp + 0x40], rbp
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x140065073
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x8002
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x140065095
mov rcx, qword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 2
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140065140
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
mov rcx, rsi
call fcn.14001f980
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
mov r8d, eax
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov dword [rsp + 0x30], ebp
mov edx, 2
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [rsp + 0x30], 0x10
jne 0x1400650f4
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x30]
mov r8, rbx
mov dword [rsp + 0x20], ebp
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140065104
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140065116
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
jmp 0x140065078

Function at 0x140065cb0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140065cfa
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140065cfa
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140065cfa
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140065cfa
cmp dword [rcx + 0x84], 0xe
jbe 0x140065cfa
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140065cfc
xor al, al
add rsp, 0x28
ret

Function at 0x1423b8dbc
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1423b8dc6
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x1423b8def
pop rbp
sub rbp, 0x33
sub rbp, 0x23b8dbc
sub rsp, 0x20
jmp 0x1423b8e0e
mov rax, 0x23b8dbc
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xffffffffc17753d4
xor byte [rax], dl
inc rax
dec rcx
jne 0x1423b8e2d
jmp 0x1423b8e44
pushfq
pop rbp
cmp eax, 0xd4e85d5f
invalid
Function at 0x1400042d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x1400042f3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x14]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x46
jb 0x1400042e0
mov byte [rcx + 0x47], 0
mov rax, rcx
ret

Function at 0x140004300
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x60], rcx
xor esi, esi
cmp byte [r8 + 6], sil
je 0x140004334
mov ecx, esi
lea eax, [rcx - 0x14]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x140004320
mov byte [r8 + 6], sil
lea rax, [r8 + 5]
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x40], sil
cmp r9, rax
je 0x140004369
mov r8d, 5
mov rdx, r9
lea rcx, [rsp + 0x40]
call fcn.1400097a0
nop
cmp byte [rbx + 0xa], 0
je 0x140004393
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x14]
xor byte [rcx + rbx], al
inc rcx
cmp rcx, 9
jb 0x140004380
mov byte [rbx + 0xa], 0
lea rax, [rbx + 9]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], 0
cmp rbx, rax
je 0x1400043c8
mov r8d, 9
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.1400097a0
nop
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x20]
mov rcx, rdi
call fcn.14000b820
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14000441c
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004416
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004416
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007733c
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x14000445c
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004457
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004457
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007733c
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x140004470
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x1400044a4
mov ecx, esi
lea eax, [rcx - 0x14]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 6
jb 0x140004490
mov byte [r8 + 7], sil
lea rax, [r8 + 6]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], sil
cmp r9, rax
je 0x1400044d9
mov r8d, 6
mov rdx, r9
lea rcx, [rsp + 0x20]
call fcn.1400097a0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1400044e7
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x20]
call fcn.14000c9c0
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14000455c
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004557
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004557
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007733c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140004570
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x1400045a4
mov ecx, esi
lea eax, [rcx - 0x14]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 9
jb 0x140004590
mov byte [r8 + 0xa], sil
lea rax, [r8 + 9]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], sil
cmp r9, rax
je 0x1400045d9
mov r8d, 9
mov rdx, r9
lea rcx, [rsp + 0x20]
call fcn.1400097a0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1400045e7
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x20]
call fcn.14000c9c0
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14000465c
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004657
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004657
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007733c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140004670
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x136], 0
je 0x140004698
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x14]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x135
jb 0x140004680
mov byte [rcx + 0x136], 0
mov rax, rcx
ret
Function at 0x140005200
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x60], rcx
xor esi, esi
cmp byte [r8 + 0xb], sil
je 0x140005234
mov ecx, esi
lea eax, [rcx - 0x14]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x140005220
mov byte [r8 + 0xb], sil
lea rax, [r8 + 0xa]
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x40], sil
cmp r9, rax
je 0x140005269
mov r8d, 0xa
mov rdx, r9
lea rcx, [rsp + 0x40]
call fcn.1400097a0
nop
cmp byte [rbx + 0xb], 0
je 0x140005293
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x14]
xor byte [rcx + rbx], al
inc rcx
cmp rcx, 0xa
jb 0x140005280
mov byte [rbx + 0xb], 0
lea rax, [rbx + 0xa]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], 0
cmp rbx, rax
je 0x1400052c8
mov r8d, 0xa
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.1400097a0
nop
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x20]
mov rcx, rdi
call fcn.14000b820
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14000531c
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005316
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005316
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007733c
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x14000535c
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005357
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005357
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007733c
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x140005370
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x1400053a4
mov ecx, esi
lea eax, [rcx - 0x14]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xb
jb 0x140005390
mov byte [r8 + 0xc], sil
lea rax, [r8 + 0xb]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], sil
cmp r9, rax
je 0x1400053d9
mov r8d, ntohs
mov rdx, r9
lea rcx, [rsp + 0x20]
call fcn.1400097a0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1400053e7
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x20]
call fcn.14000c9c0
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14000545c
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005457
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005457
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007733c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400060b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x60], rcx
xor esi, esi
cmp byte [r8 + 0xb], sil
je 0x1400060e4
mov ecx, esi
lea eax, [rcx - 0x14]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x1400060d0
mov byte [r8 + 0xb], sil
lea rax, [r8 + 0xa]
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x40], sil
cmp r9, rax
je 0x140006119
mov r8d, 0xa
mov rdx, r9
lea rcx, [rsp + 0x40]
call fcn.1400097a0
nop
cmp byte [rbx + 0xe], 0
je 0x140006143
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x14]
xor byte [rcx + rbx], al
inc rcx
cmp rcx, 0xd
jb 0x140006130
mov byte [rbx + 0xe], 0
lea rax, [rbx + 0xd]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], 0
cmp rbx, rax
je 0x140006178
mov r8d, reloc.WS2_32.dll_listen
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.1400097a0
nop
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x20]
mov rcx, rdi
call fcn.14000b820
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1400061cc
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400061c6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400061c6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007733c
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x14000620c
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006207
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006207
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007733c
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret