joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000c660
Capabilities:
Access peb ldr_data
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov ebp, edx
mov r15, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, qword gs:[0x60]
mov r12, rax
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop word [rax + rax]
mov rbx, qword [rcx + 0x30]
movsxd rdx, dword [rbx + 0x3c]
mov edi, dword [rdx + rbx + 0x88]
add rdi, rbx
cmp rdi, rbx
je 0x14000c727
mov r11d, dword [rdi + 0x18]
test r11d, r11d
je 0x14000c727
mov r14d, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
mov r10d, 0x53358017
lea rax, [r14 + r11*4]
mov r9d, dword [rax + rbx]
add r9, rbx
movzx eax, byte [r9]
inc r9
test al, al
je 0x14000c722
nop
movsx edx, al
lea r9, [r9 + 1]
sub al, 0x41
mov r8d, edx
or r8d, 0x20
cmp al, 0x19
movzx eax, byte [r9 - 1]
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
test al, al
jne 0x14000c6f0
cmp r10d, 0x371f9ab3
je 0x14000c72f
test r11d, r11d
jne 0x14000c6d0
mov rcx, qword [rcx]
jmp 0x14000c6a0
mov ecx, dword [rdi + 0x24]
mov rdx, r15
add rcx, rbx
movzx r8d, word [rcx + r11*2]
mov ecx, dword [rdi + 0x1c]
add rcx, rbx
mov eax, dword [rcx + r8*4]
lea r8, [0x14009bf88]
add rax, rbx
mov rcx, r12
xor ebx, ebx
mov qword [rsp + 0x20], rbx
lea r9d, [rbx + 5]
call rax
test ebp, ebp
je 0x14000c829
sub ebp, 1
je 0x14000c7d7
cmp ebp, 1
jne 0x14000c7be
movzx eax, byte [0x14009bf90]
cmp byte [0x14009bf88], al
jne 0x14000c7be
movzx eax, byte [0x14009bf91]
cmp byte [0x14009bf89], al
jne 0x14000c7be
movzx eax, byte [0x14009bf92]
cmp byte [0x14009bf8a], al
jne 0x14000c7be
movzx eax, byte [0x14009bf93]
cmp byte [0x14009bf8b], al
jne 0x14000c7be
movzx eax, byte [0x14009bf94]
cmp byte [0x14009bf8c], al
je 0x14000c822
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
movzx eax, byte [0x14009bf28]
cmp byte [0x14009bf88], al
jne 0x14000c7be
movzx eax, byte [0x14009bf29]
cmp byte [0x14009bf89], al
jne 0x14000c7be
movzx eax, byte [0x14009bf2a]
cmp byte [0x14009bf8a], al
jne 0x14000c7be
movzx eax, byte [0x14009bf2b]
cmp byte [0x14009bf8b], al
jne 0x14000c7be
movzx eax, byte [0x14009bf2c]
cmp byte [0x14009bf8c], al
jne 0x14000c7be
mov eax, 1
jmp 0x14000c7c0
movzx eax, byte [0x14009bf70]
cmp byte [0x14009bf88], al
jne 0x14000c7be
movzx eax, byte [0x14009bf71]
cmp byte [0x14009bf89], al
jne 0x14000c7be
movzx ecx, byte [0x14009bf72]
cmp byte [0x14009bf8a], cl
jne 0x14000c7be
movzx ecx, byte [0x14009bf73]
cmp byte [0x14009bf8b], cl
jne 0x14000c7be
movzx ecx, byte [0x14009bf74]
cmp byte [0x14009bf8c], cl
sete bl
mov eax, ebx
jmp 0x14000c7c0
Function at 0x14000e820
Capabilities:
Access peb ldr_data
Encode data using xor
Get process filename
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x500
mov rax, qword [0x14009b080]
xor rax, rsp
mov qword [rsp + 0x4f0], rax
mov rbp, rdx
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x4d0
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x50], 0x100010
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x14000e90d
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x14000e90d
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
mov r10d, 0x99c94d58
lea rcx, [r14 + r11*4]
mov ecx, dword [rcx + rbx]
add rcx, rbx
movzx r9d, byte [rcx]
inc rcx
test r9b, r9b
je 0x14000e908
nop
movsx edx, r9b
lea rcx, [rcx + 1]
sub r9b, 0x41
mov r8d, edx
or r8d, 0x20
cmp r9b, 0x19
movzx r9d, byte [rcx - 1]
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
test r9b, r9b
jne 0x14000e8d0
cmp r10d, 0x6b4fb6bf
je 0x14000e915
test r11d, r11d
jne 0x14000e8b0
mov rax, qword [rax]
jmp 0x14000e880
mov edx, dword [rsi + 0x24]
mov rcx, rbp
add rdx, rbx
movzx r8d, word [rdx + r11*2]
mov edx, dword [rsi + 0x1c]
add rdx, rbx
mov eax, dword [rdx + r8*4]
lea rdx, [rsp + 0x20]
add rax, rbx
call rax
test eax, eax
je 0x14000e974
cmp qword [rsp + 0x68], 0
jne 0x14000e99c
cmp qword [rsp + 0x70], 0
jne 0x14000e99c
cmp qword [rsp + 0x78], 0
jne 0x14000e99c
cmp qword [rsp + 0x80], 0
jne 0x14000e99c
cmp qword [rsp + 0x88], 0
jne 0x14000e99c
cmp qword [rsp + 0x90], 0
jne 0x14000e99c
mov rcx, qword [rsp + 0x4f0]
xor rcx, rsp
call fcn.140075200
lea r11, [rsp + 0x500]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.14000e470
int3
Function at 0x14000e9b0
Capabilities:
Access peb ldr_data
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x50
xor r14b, r14b
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
mov qword [rsp + 0x30], r10
movsxd rcx, dword [r10 + 0x3c]
mov rdx, qword [rcx + r10 + 0x88]
mov qword [rsp + 0x60], rdx
mov r11d, edx
add r11, r10
mov qword [rsp + 0x38], r11
shr rdx, 0x20
mov dword [rsp + 0x40], edx
cmp r11, r10
je 0x14000eaae
mov edi, dword [r11 + 0x18]
mov dword [rsp + 0x20], edi
nop
mov ecx, edi
dec edi
mov dword [rsp + 0x20], edi
test ecx, ecx
je 0x14000eaae
mov edx, dword [r11 + 0x20]
add rdx, r10
mov ecx, dword [rdx + rdi*4]
add rcx, r10
mov qword [rsp + 0x28], rcx
mov ebx, 0x2aef4c34
nop word [rax + rax]
movsx r9d, byte [rcx]
inc rcx
mov qword [rsp + 0x28], rcx
test r9b, r9b
jne 0x14000ea8c
cmp ebx, 0x201f4d7e
jne 0x14000ea8a
mov ecx, dword [r11 + 0x1c]
add rcx, r10
mov eax, dword [r11 + 0x24]
add rax, r10
movzx eax, word [rax + rdi*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov ecx, 0xdeadbeef
call rdx
jmp 0x14000eab9
jmp 0x14000ea20
mov edx, r9d
sub r9b, 0x41
mov r8d, edx
or r8d, 0x20
cmp r9b, 0x19
cmova r8d, edx
xor r8d, ebx
imul ebx, r8d, 0x1000193
jmp 0x14000ea50
mov rax, qword [rax]
jmp 0x14000e9e0
cmp r14b, 1
je 0x14000ead5
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret
call fcn.14000e470
nop
int3
Function at 0x140011cb0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov r15d, ecx
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x140011d69
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x140011d69
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
mov r10d, 0xd566331f
lea rcx, [r14 + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
movzx ecx, byte [r9]
inc r9
test cl, cl
je 0x140011d64
nop
movsx edx, cl
lea r9, [r9 + 1]
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
movzx ecx, byte [r9 - 1]
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
test cl, cl
jne 0x140011d30
cmp r10d, 0xcfe544f8
je 0x140011d71
test r11d, r11d
jne 0x140011d10
mov rax, qword [rax]
jmp 0x140011ce0
mov ecx, dword [rsi + 0x24]
add rcx, rbx
movzx edx, word [rcx + r11*2]
mov ecx, dword [rsi + 0x1c]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
mov ecx, 0xfffffff5
add rax, rbx
call rax
mov rcx, qword gs:[0x60]
mov rbp, rax
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop dword [rax]
nop word [rax + rax]
mov rbx, qword [rcx + 0x30]
movsxd rdx, dword [rbx + 0x3c]
mov esi, dword [rdx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x140011e3a
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x140011e3a
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
mov r10d, 0x4a363f4b
lea rax, [r14 + r11*4]
mov r8d, dword [rax + rbx]
add r8, rbx
movzx r9d, byte [r8]
inc r8
test r9b, r9b
je 0x140011e35
movsx eax, r9b
lea r8, [r8 + 1]
sub r9b, 0x41
mov edx, eax
or edx, 0x20
cmp r9b, 0x19
movzx r9d, byte [r8 - 1]
cmova edx, eax
xor edx, r10d
imul r10d, edx, 0x1000193
test r9b, r9b
jne 0x140011e00
cmp r10d, 0xa1ec45b7
je 0x140011e42
test r11d, r11d
jne 0x140011de0
mov rcx, qword [rcx]
jmp 0x140011db0
mov ecx, dword [rsi + 0x24]
movzx edx, r15w
add rcx, rbx
movzx r8d, word [rcx + r11*2]
mov ecx, dword [rsi + 0x1c]
add rcx, rbx
mov eax, dword [rcx + r8*4]
mov rcx, rbp
add rax, rbx
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
jmp rax
Function at 0x140013620
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 7], dil
je 0x140013654
mov ecx, edi
nop dword [rax]
lea eax, [rcx + 0x7d]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 6
jb 0x140013640
mov byte [r8 + 7], dil
lea rax, [r8 + 6]
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x140013681
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x1400136a0
mov qword [rsp + 0x30], 6
mov eax, dword [r8]
mov dword [rsp + 0x20], eax
movzx eax, word [r8 + 4]
mov word [rsp + 0x24], ax
mov byte [rsp + 0x26], dil
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x1400136ae
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140021230
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140013725
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140013720
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140013720
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140075590
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x140013740
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 9], dil
je 0x140013774
mov ecx, edi
nop dword [rax]
lea eax, [rcx + 0x7d]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 8
jb 0x140013760
mov byte [r8 + 9], dil
lea rax, [r8 + 8]
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x1400137a1
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x1400137b7
mov qword [rsp + 0x30], 8
mov rax, qword [r8]
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x28], dil
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x1400137c5
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140021230
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14001383c
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140013837
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140013837
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140075590
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x140013850
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rbx, rcx
mov qword [rbp - 0x10], rcx
xor r9d, r9d
cmp byte [r8 + 6], r9b
je 0x140013894
mov ecx, r9d
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x7d]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x140013880
mov byte [r8 + 6], r9b
lea rax, [r8 + 5]
mov qword [rbp - 0x38], r9
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], r9
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x1400138bb
mov qword [rbp - 0x28], r9
mov byte [rbp - 0x38], r9b
jmp 0x1400138d5
mov qword [rbp - 0x28], 5
mov eax, dword [r8]
mov dword [rbp - 0x38], eax
movzx eax, byte [r8 + 4]
mov byte [rbp - 0x34], al
mov byte [rbp - 0x33], r9b
cmp byte [rdx + 0xa], 0
je 0x1400138f3
mov rcx, r9
nop
lea eax, [rcx + 0x7d]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 9
jb 0x1400138e0
mov byte [rdx + 0xa], 0
lea rax, [rdx + 9]
mov qword [rbp - 0x58], r9
mov qword [rbp - 0x48], r9
mov qword [rbp - 0x40], r9
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
cmp rdx, rax
jne 0x14001391a
mov qword [rbp - 0x48], r9
mov byte [rbp - 0x58], 0
jmp 0x140013936
mov qword [rbp - 0x48], 9
movsd xmm0, qword [rdx]
movsd qword [rbp - 0x58], xmm0
movzx eax, byte [rdx + 8]
mov byte [rbp - 0x50], al
mov byte [rbp - 0x4f], 0
lea r9, [rbp - 0x38]
lea r8, [rbp - 0x58]
movzx edx, byte [rbp - 0x60]
mov rcx, rbx
call fcn.140019c80
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x14001398a
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140013984
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140013984
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140075590
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x1400139c8
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400139c3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400139c3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140075590
mov rax, rbx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rbp
ret
Function at 0x1400139e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rbx, rcx
mov qword [rbp - 0x10], rcx
xor r9d, r9d
cmp byte [r8 + 9], r9b
je 0x140013a24
mov ecx, r9d
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x7d]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 8
jb 0x140013a10
mov byte [r8 + 9], r9b
lea rax, [r8 + 8]
mov qword [rbp - 0x38], r9
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], r9
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x140013a4b
mov qword [rbp - 0x28], r9
mov byte [rbp - 0x38], r9b
jmp 0x140013a5e
mov qword [rbp - 0x28], 8
mov rax, qword [r8]
mov qword [rbp - 0x38], rax
mov byte [rbp - 0x30], r9b
cmp byte [rdx + 0xa], 0
je 0x140013a83
mov rcx, r9
nop word [rax + rax]
lea eax, [rcx + 0x7d]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 9
jb 0x140013a70
mov byte [rdx + 0xa], 0
lea rax, [rdx + 9]
mov qword [rbp - 0x58], r9
mov qword [rbp - 0x48], r9
mov qword [rbp - 0x40], r9
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
cmp rdx, rax
jne 0x140013aaa
mov qword [rbp - 0x48], r9
mov byte [rbp - 0x58], 0
jmp 0x140013ac6
mov qword [rbp - 0x48], 9
movsd xmm0, qword [rdx]
movsd qword [rbp - 0x58], xmm0
movzx eax, byte [rdx + 8]
mov byte [rbp - 0x50], al
mov byte [rbp - 0x4f], 0
lea r9, [rbp - 0x38]
lea r8, [rbp - 0x58]
movzx edx, byte [rbp - 0x60]
mov rcx, rbx
call fcn.140019c80
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x140013b1a
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140013b14
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140013b14
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140075590
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x140013b58
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140013b53
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140013b53
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140075590
mov rax, rbx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rbp
ret
Function at 0x140013b70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 0xa], dil
je 0x140013ba4
mov ecx, edi
nop dword [rax]
lea eax, [rcx + 0x7d]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 9
jb 0x140013b90
mov byte [r8 + 0xa], dil
lea rax, [r8 + 9]
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x140013bd1
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x140013bf3
mov qword [rsp + 0x30], 9
movsd xmm0, qword [r8]
movsd qword [rsp + 0x20], xmm0
movzx eax, byte [r8 + 8]
mov byte [rsp + 0x28], al
mov byte [rsp + 0x29], dil
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x140013c01
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140021230
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140013c78
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140013c73
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140013c73
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140075590
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x140013c90
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x80
mov rbx, rdx
mov rdi, rcx
mov qword [rbp - 0x10], rcx
xor edx, edx
cmp byte [r8 + 7], dl
je 0x140013cd4
mov ecx, edx
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x7d]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 6
jb 0x140013cc0
mov byte [r8 + 7], dl
lea rax, [r8 + 6]
mov qword [rbp - 0x58], rdx
mov qword [rbp - 0x48], rdx
mov qword [rbp - 0x40], rdx
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x140013cfa
mov qword [rbp - 0x48], rdx
mov byte [rbp - 0x58], dl
jmp 0x140013d14
mov qword [rbp - 0x48], 6
mov eax, dword [r8]
mov dword [rbp - 0x58], eax
movzx eax, word [r8 + 4]
mov word [rbp - 0x54], ax
mov byte [rbp - 0x52], dl
cmp byte [rbx + 0x14], 0
je 0x140013d33
mov rcx, rdx
nop dword [rax]
lea eax, [rcx + 0x7d]
xor byte [rbx + rcx], al
inc rcx
cmp rcx, 0x13
jb 0x140013d20
mov byte [rbx + 0x14], 0
lea rax, [rbx + 0x13]
mov qword [rbp - 0x38], rdx
mov qword [rbp - 0x28], rdx
mov qword [rbp - 0x20], rdx
cmp rbx, rax
jne 0x140013d5a
mov qword [rbp - 0x28], rdx
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x38], 0
jmp 0x140013d98
mov edx, reloc.WLDAP32.dll_Ordinal_32
lea rcx, [rbp - 0x38]
call fcn.140007870
mov rcx, rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x28], reloc.WS2_32.dll_send
mov qword [rbp - 0x20], Ordinal_32
movups xmm0, xmmword [rbx]
movups xmmword [rax], xmm0
movzx eax, word [rbx + 0x10]
mov word [rcx + 0x10], ax
movzx eax, byte [rbx + 0x12]
mov byte [rcx + 0x12], al
mov byte [rcx + 0x13], 0
lea r9, [rbp - 0x58]
lea r8, [rbp - 0x38]
movzx edx, byte [rbp - 0x60]
mov rcx, rdi
call fcn.140019c80
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x140013dec
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140013de6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140013de6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140075590
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x140013e2a
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140013e25
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140013e25
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140075590
mov rax, rdi
add rsp, 0x80
pop rdi
pop rbx
pop rbp
ret
Function at 0x140013e40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 0xc], dil
je 0x140013e74
mov ecx, edi
nop dword [rax]
lea eax, [rcx + 0x7d]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xb
jb 0x140013e60
mov byte [r8 + 0xc], dil
lea rax, [r8 + 0xb]
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
cmp r8, rax
jne 0x140013ea1
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x140013ecd
mov qword [rsp + 0x30], ntohl
movsd xmm0, qword [r8]
movsd qword [rsp + 0x20], xmm0
movzx eax, word [r8 + 8]
mov word [rsp + 0x28], ax
movzx eax, byte [r8 + 0xa]
mov byte [rsp + 0x2a], al
mov byte [rsp + 0x2b], dil
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x140013edb
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140021230
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140013f52
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140013f4d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140013f4d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140075590
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret