joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002f130
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov ecx, 8
call fcn.14002f928
lea rcx, [0x14002d5f0]
mov qword [rax], rcx
mov qword [rsp + 0x48], rax
lea rdi, [rbx + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x14002f470]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x14002f196
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov dword [rdi], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x140022c70
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x140022c7d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x140022c8d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140022c75
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x140022ca5
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140022c92
sub eax, 3
jb 0x140022cbf
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140022cf6
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x140022ce6
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140022ce4
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140022cd3
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.140022c32
jmp 0x140022c7d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0xba00
mov dl, 5
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140022d42
cmp rsi, rcx
jae 0x140022d4a
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140022d29
cmp al, 0x8f
ja 0x140022d29
cmp byte [rsi - 2], 0xf
je 0x140022d2f
sub al, 0xe8
cmp al, 1
ja 0x140022d13
cmp rsi, rcx
jae 0x140022d4a
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140022d19
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x140022d4a
lodsb al, byte [rsi]
jmp 0x140022d29
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x20000]
mov eax, dword [rdi]
or eax, eax
je 0x140022da7
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x224ec]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140022d57
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140022da1
mov qword [rbx], rax
add rbx, 8
jmp 0x140022d77
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140022de1
cmp al, 0xef
ja 0x140022dd3
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140022db3
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x140022dc2
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.140022e60], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.140022e60
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140022e50
sub rsp, 0xffffffffffffff80
jmp 0x1400014e0
Function at 0x140062960
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14006296d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14006297d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140062965
lea eax, [rcx + 1]
jmp 0x14006298b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14006299e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140062984
sub eax, 3
jb 0x1400629be
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140062a0d
sar eax, 1
movsxd rbp, eax
jb 0x1400629f4
jmp 0x1400629cc
add ebx, ebx
jne 0x1400629ca
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1400629f4
inc ecx
add ebx, ebx
jne 0x1400629da
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1400629f4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x1400629ed
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x1400629dc
add ecx, 2
jmp 0x1400629f9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.140062922
jmp 0x14006296d
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x35000
mov dl, 7
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140062a5d
cmp rsi, rcx
jae 0x140062a65
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140062a44
cmp al, 0x8f
ja 0x140062a44
cmp byte [rsi - 2], 0xf
je 0x140062a4a
sub al, 0xe8
cmp al, 1
ja 0x140062a2e
cmp rsi, rcx
jae 0x140062a65
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140062a34
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x140062a65
lodsb al, byte [rsi]
jmp 0x140062a44
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x5f000]
mov eax, dword [rdi]
or eax, eax
je 0x140062ac2
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x6e8c0]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140062a72
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140062abc
mov qword [rbx], rax
add rbx, 8
jmp 0x140062a92
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140062afc
cmp al, 0xef
ja 0x140062aee
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140062ace
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x140062add
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x24f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140062b50
sub rsp, 0xffffffffffffff80
jmp 0x14001f950
Function at 0x1400129b0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x178
mov rax, qword [0x1401bd080]
xor rax, rsp
mov qword [rsp + 0x160], rax
cmp qword [rsp + 0x188], 0
jne 0x1400129e5
xor eax, eax
jmp 0x140012a69
mov dword [rsp + 0x24], 0
mov dword [rsp + 0x20], 0
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], 0x130
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x140012a65
mov rdx, qword [rsp + 0x188]
lea rcx, [rsp + 0x5c]
call fcn.140012440
test eax, eax
jne 0x140012a63
mov eax, dword [rsp + 0x20]
cmp dword [rsp + 0x4c], eax
jbe 0x140012a63
mov eax, dword [rsp + 0x4c]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x24], eax
jmp 0x140012a1f
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400e4810
add rsp, 0x178
ret

Function at 0x140014380
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x178
mov rax, qword [0x1401bd080]
xor rax, rsp
mov qword [rsp + 0x160], rax
cmp qword [rsp + 0x180], 0
jne 0x1400143b0
xor eax, eax
jmp 0x140014434
mov dword [rsp + 0x24], 0
mov dword [rsp + 0x20], 0
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], 0x130
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x140014430
mov rdx, qword [rsp + 0x180]
lea rcx, [rsp + 0x5c]
call fcn.140012440
test eax, eax
jne 0x14001442e
mov eax, dword [rsp + 0x20]
cmp dword [rsp + 0x4c], eax
jbe 0x14001442e
mov eax, dword [rsp + 0x4c]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x24], eax
jmp 0x1400143ea
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400e4810
add rsp, 0x178
ret

Function at 0x140014c50
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov r9d, 0x6c078965
mov r8d, 0xffffffff
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call fcn.140015360
mov rax, qword [rsp + 0x30]
add rsp, 0x28
ret
Function at 0x14001a460
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x270
jne 0x14001a482
mov rcx, qword [rsp + 0x40]
call fcn.14001a530
jmp 0x14001a499
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x4e0
jb 0x14001a499
mov rcx, qword [rsp + 0x40]
call fcn.14001a5e0
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax*4 + 4]
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
inc eax
mov rcx, qword [rsp + 0x40]
mov dword [rcx], eax
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shr eax, 0xb
mov rcx, qword [rsp + 0x40]
and eax, dword [rcx + 0x1384]
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl eax, 7
and eax, 0x9d2c5680
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl eax, 0xf
and eax, 0xefc60000
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shr eax, 0x12
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret

Function at 0x14001a530
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov qword [rsp + 8], 0x270
jmp 0x14001a551
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
cmp qword [rsp + 8], 0x4e0
jae 0x14001a5d5
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 8]
mov eax, dword [rax + rcx*4 - 0x9bc]
and eax, 0x80000000
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
mov ecx, dword [rcx + rdx*4 - 0x9b8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp], eax
mov eax, dword [rsp]
and eax, 1
test eax, eax
je 0x14001a5a0
mov dword [rsp + 4], 0x9908b0df
jmp 0x14001a5a8
mov dword [rsp + 4], 0
mov eax, dword [rsp]
shr eax, 1
xor eax, dword [rsp + 4]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x14001a544
add rsp, 0x18
ret
Function at 0x14001a5e0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x28], 0x26f
mov qword [rsp + 0x30], 0xe3
mov qword [rsp], 0
jmp 0x14001a610
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
cmp qword [rsp], 0xe3
jae 0x14001a692
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x10], eax
mov eax, dword [rsp + 0x10]
and eax, 1
test eax, eax
je 0x14001a65e
mov dword [rsp + 0x14], 0x9908b0df
jmp 0x14001a666
mov dword [rsp + 0x14], 0
mov eax, dword [rsp + 0x10]
shr eax, 1
xor eax, dword [rsp + 0x14]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
xor eax, dword [rcx + rdx*4 + 0xff8]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x14001a605
mov qword [rsp + 8], 0xe3
jmp 0x14001a6aa
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
cmp qword [rsp + 8], 0x26f
jae 0x14001a731
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 8]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x18], eax
mov eax, dword [rsp + 0x18]
and eax, 1
test eax, eax
je 0x14001a6fb
mov dword [rsp + 0x1c], 0x9908b0df
jmp 0x14001a703
mov dword [rsp + 0x1c], 0
mov eax, dword [rsp + 0x18]
shr eax, 1
xor eax, dword [rsp + 0x1c]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x14001a69d
mov qword [rsp + 0x38], 0x26f
mov eax, 4
imul rax, rax, 0x4df
mov rcx, qword [rsp + 0x50]
mov eax, dword [rcx + rax + 4]
and eax, 0x80000000
mov ecx, 4
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x50]
mov ecx, dword [rdx + rcx + 4]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
and eax, 1
test eax, eax
je 0x14001a785
mov dword [rsp + 0x24], 0x9908b0df
jmp 0x14001a78d
mov dword [rsp + 0x24], 0
mov eax, dword [rsp + 0x20]
shr eax, 1
xor eax, dword [rsp + 0x24]
mov ecx, 4
imul rcx, rcx, 0x18c
mov rdx, qword [rsp + 0x50]
xor eax, dword [rdx + rcx + 4]
mov ecx, 4
imul rcx, rcx, 0x26f
mov rdx, qword [rsp + 0x50]
mov dword [rdx + rcx + 4], eax
mov rax, qword [rsp + 0x50]
mov dword [rax], 0
add rsp, 0x48
ret
Function at 0x14001bb20
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor r9d, r9d
cmp byte [r8 + 7], r9b
je 0x14001bb54
mov ecx, r9d
nop word [rax + rax]
lea eax, [rcx - 0x75]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 6
jb 0x14001bb40
mov byte [r8 + 7], r9b
mov qword [rsp + 0x20], r9
lea rax, [r8 + 6]
cmp r8, rax
jne 0x14001bb77
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], 0
jmp 0x14001bba0
mov qword [rsp + 0x30], 6
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov eax, dword [r8]
mov dword [rsp + 0x20], eax
movzx eax, word [r8 + 4]
mov word [rsp + 0x24], ax
mov byte [rsp + 0x26], r9b
nop
lea r8, [rsp + 0x20]
mov rcx, rbx
call fcn.14001bab0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14001bbee
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001bbe9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001bbe9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e4f38
mov rax, rbx
add rsp, 0x50
pop rbx
ret

Function at 0x14001bc00
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor r9d, r9d
cmp byte [r8 + 9], r9b
je 0x14001bc34
mov ecx, r9d
nop word [rax + rax]
lea eax, [rcx - 0x75]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 8
jb 0x14001bc20
mov byte [r8 + 9], r9b
mov qword [rsp + 0x20], r9
lea rax, [r8 + 8]
cmp r8, rax
jne 0x14001bc57
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], 0
jmp 0x14001bc80
mov qword [rsp + 0x30], 8
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov rax, qword [r8]
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x28], r9b
nop word [rax + rax]
lea r8, [rsp + 0x20]
mov rcx, rbx
call fcn.14001bab0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14001bcce
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001bcc9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001bcc9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e4f38
mov rax, rbx
add rsp, 0x50
pop rbx
ret
Function at 0x14001bce0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rbx, rcx
mov qword [rbp - 0x10], rcx
xor r9d, r9d
cmp byte [r8 + 6], r9b
je 0x14001bd24
mov ecx, r9d
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x75]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x14001bd10
mov byte [r8 + 6], r9b
mov qword [rbp - 0x38], r9
lea rax, [r8 + 5]
cmp r8, rax
jne 0x14001bd43
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x38], 0
jmp 0x14001bd65
mov qword [rbp - 0x28], 5
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
mov eax, dword [r8]
mov dword [rbp - 0x38], eax
movzx eax, byte [r8 + 4]
mov byte [rbp - 0x34], al
mov byte [rbp - 0x33], r9b
cmp byte [rdx + 0xa], 0
je 0x14001bd83
mov rcx, r9
nop
lea eax, [rcx - 0x75]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 9
jb 0x14001bd70
mov byte [rdx + 0xa], 0
mov qword [rbp - 0x58], r9
lea rax, [rdx + 9]
cmp rdx, rax
jne 0x14001bda2
mov qword [rbp - 0x48], r9
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x58], 0
jmp 0x14001bdd0
mov qword [rbp - 0x48], 9
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [rdx]
movsd qword [rbp - 0x58], xmm0
movzx eax, byte [rdx + 8]
mov byte [rbp - 0x50], al
mov byte [rbp - 0x4f], 0
nop word [rax + rax]
lea r9, [rbp - 0x38]
lea r8, [rbp - 0x58]
movzx edx, byte [rbp - 0x60]
mov rcx, rbx
call fcn.140021650
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x14001be24
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001be1e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001be1e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e4f38
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x14001be62
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001be5d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001be5d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e4f38
mov rax, rbx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rbp
ret
Function at 0x14001be80
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor r9d, r9d
cmp byte [r8 + 0xa], r9b
je 0x14001beb4
mov ecx, r9d
nop word [rax + rax]
lea eax, [rcx - 0x75]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 9
jb 0x14001bea0
mov byte [r8 + 0xa], r9b
mov qword [rsp + 0x20], r9
lea rax, [r8 + 9]
cmp r8, rax
jne 0x14001bed7
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], 0
jmp 0x14001bf02
mov qword [rsp + 0x30], 9
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [r8]
movsd qword [rsp + 0x20], xmm0
movzx eax, byte [r8 + 8]
mov byte [rsp + 0x28], al
mov byte [rsp + 0x29], r9b
lea r8, [rsp + 0x20]
mov rcx, rbx
call fcn.14001bab0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14001bf50
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001bf4b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001bf4b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e4f38
mov rax, rbx
add rsp, 0x50
pop rbx
ret
Function at 0x14001bf60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rbx, rcx
mov qword [rbp - 0x10], rcx
xor r9d, r9d
cmp byte [r8 + 0xb], r9b
je 0x14001bfa4
mov ecx, r9d
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x75]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x14001bf90
mov byte [r8 + 0xb], r9b
mov qword [rbp - 0x38], r9
lea rax, [r8 + 0xa]
cmp r8, rax
jne 0x14001bfc3
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x38], 0
jmp 0x14001bff0
mov qword [rbp - 0x28], 0xa
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [r8]
movsd qword [rbp - 0x38], xmm0
movzx eax, word [r8 + 8]
mov word [rbp - 0x30], ax
mov byte [rbp - 0x2e], r9b
nop word [rax + rax]
cmp byte [rdx + 0xb], 0
je 0x14001c013
mov rcx, r9
nop dword [rax]
lea eax, [rcx - 0x75]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x14001c000
mov byte [rdx + 0xb], 0
mov qword [rbp - 0x58], r9
lea rax, [rdx + 0xa]
cmp rdx, rax
jne 0x14001c032
mov qword [rbp - 0x48], r9
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x58], 0
jmp 0x14001c060
mov qword [rbp - 0x48], 0xa
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [rdx]
movsd qword [rbp - 0x58], xmm0
movzx eax, word [rdx + 8]
mov word [rbp - 0x50], ax
mov byte [rbp - 0x4e], 0
nop word [rax + rax]
lea r9, [rbp - 0x38]
lea r8, [rbp - 0x58]
movzx edx, byte [rbp - 0x60]
mov rcx, rbx
call fcn.140021650
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x14001c0b4
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001c0ae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001c0ae
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e4f38
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x14001c0f2
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001c0ed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001c0ed
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e4f38
mov rax, rbx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rbp
ret
Function at 0x14001c110
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor r9d, r9d
cmp byte [r8 + 0xc], r9b
je 0x14001c144
mov ecx, r9d
nop word [rax + rax]
lea eax, [rcx - 0x75]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xb
jb 0x14001c130
mov byte [r8 + 0xc], r9b
mov qword [rsp + 0x20], r9
lea rax, [r8 + 0xb]
cmp r8, rax
jne 0x14001c167
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], 0
jmp 0x14001c1a0
mov qword [rsp + 0x30], recvfrom
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [r8]
movsd qword [rsp + 0x20], xmm0
movzx eax, word [r8 + 8]
mov word [rsp + 0x28], ax
movzx eax, byte [r8 + 0xa]
mov byte [rsp + 0x2a], al
mov byte [rsp + 0x2b], r9b
nop dword [rax]
lea r8, [rsp + 0x20]
mov rcx, rbx
call fcn.14001bab0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14001c1ee
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001c1e9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001c1e9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e4f38
mov rax, rbx
add rsp, 0x50
pop rbx
ret

Function at 0x140023a60
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x44], 0
je 0x140023a83
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x75]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x43
jb 0x140023a70
mov byte [rcx + 0x44], 0
mov rax, rcx
ret

Function at 0x140023a90
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x140023ab3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x75]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x46
jb 0x140023aa0
mov byte [rcx + 0x47], 0
mov rax, rcx
ret