joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14019a370
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x270
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x14019a3d1
lea r8, [r10 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x14019a390
mov ecx, dword [r10]
jmp 0x14019a4ba
cmp ecx, 0x4e0
jb 0x14019a4ba
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0xe3
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14019a3f0
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14019a440
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x14019ac30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov r15d, ecx
lea rax, [rbp - 0x48]
mov qword [rbp + 0x48], rax
movdqa xmm0, xmmword [0x1402a3400]
movdqu xmmword [rbp - 0x60], xmm0
mov word [rbp - 0x50], 0x7a
xor r13d, r13d
mov eax, r13d
nop
movzx ecx, byte [rbp - 0x60]
xor byte [rbp + rax - 0x5f], cl
inc rax
cmp rax, 0x10
jb 0x14019ac70
mov byte [rbp - 0x4f], r13b
mov qword [rbp - 0x48], r13
mov qword [rbp - 0x38], r13
mov qword [rbp - 0x30], reloc.WS2_32.dll_ntohs
lea rax, [rbp - 0x5f]
mov r14, 0xffffffffffffffff
mov r8, r14
inc r8
cmp byte [rax + r8], r13b
jne 0x14019aca3
lea rdx, [rbp - 0x5f]
lea rcx, [rbp - 0x48]
call fcn.14014d7f0
nop
mov byte [rbp - 0x60], 0x78
mov al, reloc.WLDAP32.dll_Ordinal_45
mov cl, 0xb
mov dl, reloc.SecureEngineSDK64.dll_Ordinal_29
mov r8b, 0xa
mov r9b, 0x4b
mov r10b, 0x4a
mov r11b, 0x56
mov bl, Ordinal_29
mov dil, reloc.WS2_32.dll_sendto
movzx esi, dil
xor r12d, r12d
xor al, 0x78
mov byte [rbp - 0x5f], al
xor cl, 0x78
mov byte [rbp - 0x5e], cl
xor dl, 0x78
mov byte [rbp - 0x5d], dl
xor r8b, 0x78
mov byte [rbp - 0x5c], r8b
xor r9b, 0x78
mov byte [rbp - 0x5b], r9b
xor r10b, 0x78
mov byte [rbp - 0x5a], r10b
xor r11b, 0x78
mov byte [rbp - 0x59], r11b
xor bl, 0x78
mov byte [rbp - 0x58], bl
xor dil, 0x78
mov byte [rbp - 0x57], dil
xor sil, 0x78
mov byte [rbp - 0x56], sil
mov byte [rbp - 0x55], r12b
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x18], r13
mov qword [rbp - 0x10], reloc.WS2_32.dll_ntohs
lea rax, [rbp - 0x5f]
nop dword [rax + rax]
inc r14
cmp byte [rax + r14], r12b
jne 0x14019ad40
mov r8, r14
lea rdx, [rbp - 0x5f]
lea rcx, [rbp - 0x28]
call fcn.14014d7f0
nop
mov r8d, r15d
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x28]
call fcn.14019e820
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14019afc0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov r12d, r8d
mov r15, rcx
lea rax, [rbp - 0x30]
mov qword [rbp - 0x10], rax
movdqa xmm0, xmmword [0x1402a2f90]
movdqu xmmword [rbp - 0x60], xmm0
xor edx, edx
mov eax, edx
nop dword [rax]
movzx ecx, byte [rbp - 0x60]
xor byte [rbp + rax - 0x5f], cl
inc rax
cmp rax, 0xe
jb 0x14019b000
mov byte [rbp - 0x51], dl
mov qword [rbp - 0x30], rdx
mov qword [rbp - 0x20], rdx
mov qword [rbp - 0x18], reloc.WS2_32.dll_ntohs
lea rax, [rbp - 0x5f]
mov r14, 0xffffffffffffffff
mov r8, r14
inc r8
cmp byte [rax + r8], dl
jne 0x14019b032
lea rdx, [rbp - 0x5f]
lea rcx, [rbp - 0x30]
call fcn.14014d7f0
lea rax, [rbp - 0x30]
mov qword [rbp - 8], rax
mov byte [rbp - 0x60], 0x4b
mov al, reloc.WLDAP32.dll_Ordinal_30
mov cl, gethostname
mov dl, reloc.WLDAP32.dll_Ordinal_46
mov r8b, reloc.WS2_32.dll_gethostname
mov r9b, 0x78
mov r10b, 0x79
mov r11b, 0x65
mov bl, 0x2f
mov dil, Ordinal_41
movzx esi, dil
xor r13d, r13d
xor al, 0x4b
mov byte [rbp - 0x5f], al
xor cl, 0x4b
mov byte [rbp - 0x5e], cl
xor dl, 0x4b
mov byte [rbp - 0x5d], dl
xor r8b, 0x4b
mov byte [rbp - 0x5c], r8b
xor r9b, 0x4b
mov byte [rbp - 0x5b], r9b
xor r10b, 0x4b
mov byte [rbp - 0x5a], r10b
xor r11b, 0x4b
mov byte [rbp - 0x59], r11b
xor bl, 0x4b
mov byte [rbp - 0x58], bl
xor dil, 0x4b
mov byte [rbp - 0x57], dil
xor sil, 0x4b
mov byte [rbp - 0x56], sil
mov byte [rbp - 0x55], r13b
xor edi, edi
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x38], reloc.WS2_32.dll_ntohs
lea rax, [rbp - 0x5f]
inc r14
cmp byte [rax + r14], dil
jne 0x14019b0d3
mov r8, r14
lea rdx, [rbp - 0x5f]
lea rcx, [rbp - 0x50]
call fcn.14014d7f0
lea rax, [rbp - 0x50]
mov qword [rbp - 0x60], rax
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8d, r12d
mov edx, 0xffffffec
mov rcx, r15
call rax
mov ebx, eax
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x14019b16c
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14019b167
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14019b167
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140268610
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x38], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x50], 0
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x14019b1ba
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14019b1b5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14019b1b5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140268610
mov eax, ebx
mov rbx, qword [rsp + 0xc8]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14019b5b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov r15, rcx
lea rax, [rbp - 0x40]
mov qword [rbp + 0x38], rax
mov byte [rbp - 0x50], reloc.WLDAP32.dll_Ordinal_60
mov al, 0x7f
mov dl, 0x50
mov r8b, 0x53
mov r9b, reloc.WLDAP32.dll_Ordinal_79
mov r10b, 0x59
mov r11b, reloc.WS2_32.dll_WSACleanup
mov bl, 0x5d
mov dil, 0x52
mov cl, 0x58
movzx esi, dl
movzx r14d, r10b
xor r12d, r12d
xor al, 0x3c
mov byte [rbp - 0x4f], al
xor dl, 0x3c
mov byte [rbp - 0x4e], dl
xor r8b, 0x3c
mov byte [rbp - 0x4d], r8b
xor r9b, 0x3c
mov byte [rbp - 0x4c], r9b
xor r10b, 0x3c
mov byte [rbp - 0x4b], r10b
xor r11b, 0x3c
mov byte [rbp - 0x4a], r11b
xor bl, 0x3c
mov byte [rbp - 0x49], bl
xor dil, 0x3c
mov byte [rbp - 0x48], dil
xor cl, 0x3c
mov byte [rbp - 0x47], cl
xor sil, 0x3c
mov byte [rbp - 0x46], sil
xor r14b, 0x3c
mov byte [rbp - 0x45], r14b
mov byte [rbp - 0x44], r12b
xor edi, edi
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x28], reloc.WS2_32.dll_ntohs
lea rax, [rbp - 0x4f]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], dil
jne 0x14019b670
lea rdx, [rbp - 0x4f]
lea rcx, [rbp - 0x40]
call fcn.14014d7f0
nop
mov cl, 0x3e
mov dword [rbp - 0x50], 0x4c5b753e
mov dword [rbp - 0x4c], 0xd525b50
mov dword [rbp - 0x48], 0x525a100c
mov word [rbp - 0x44], 0x52
mov rax, rdi
nop word [rax + rax]
xor byte [rbp + rax - 0x4f], cl
inc rax
cmp rax, 0xc
jae 0x14019b6c3
movzx ecx, byte [rbp - 0x50]
jmp 0x14019b6b0
mov byte [rbp - 0x43], 0
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], reloc.WS2_32.dll_ntohs
lea rax, [rbp - 0x4f]
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14019b6e0
mov r8, rbx
lea rdx, [rbp - 0x4f]
lea rcx, [rbp - 0x20]
call fcn.14014d7f0
nop
mov r8, r15
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x20]
call fcn.14019e930
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x14019b960
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov r15d, ecx
lea rax, [rbp - 1]
mov qword [rbp + 0x1f], rax
movdqa xmm0, xmmword [0x1402a3180]
movdqu xmmword [rbp - 0x39], xmm0
mov word [rbp - 0x29], 0x3d
xor r13d, r13d
mov eax, r13d
nop dword [rax + rax]
movzx ecx, byte [rbp - 0x39]
xor byte [rbp + rax - 0x38], cl
inc rax
cmp rax, 0x10
jb 0x14019b9b0
mov byte [rbp - 0x28], r13b
mov qword [rbp - 1], r13
mov qword [rbp + 0xf], r13
mov qword [rbp + 0x17], reloc.WS2_32.dll_ntohs
lea rax, [rbp - 0x38]
mov r14, 0xffffffffffffffff
mov r8, r14
inc r8
cmp byte [rax + r8], r13b
jne 0x14019b9e3
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 1]
call fcn.14014d7f0
lea rax, [rbp - 1]
mov qword [rbp + 0x27], rax
mov byte [rbp - 0x39], reloc.WS2_32.dll_recvfrom
mov al, 0x44
mov cl, 0x62
mov dl, reloc.WS2_32.dll_WSACleanup
mov r8b, 0x63
mov r9b, Ordinal_35
mov r10b, reloc.WLDAP32.dll_Ordinal_35
mov r11b, 0x3f
mov bl, 0x75
mov dil, 0x7d
movzx esi, dil
xor r12d, r12d
xor al, 0x11
mov byte [rbp - 0x38], al
xor cl, 0x11
mov byte [rbp - 0x37], cl
xor dl, 0x11
mov byte [rbp - 0x36], dl
xor r8b, 0x11
mov byte [rbp - 0x35], r8b
xor r9b, 0x11
mov byte [rbp - 0x34], r9b
xor r10b, 0x11
mov byte [rbp - 0x33], r10b
xor r11b, 0x11
mov byte [rbp - 0x32], r11b
xor bl, 0x11
mov byte [rbp - 0x31], bl
xor dil, 0x11
mov byte [rbp - 0x30], dil
xor sil, 0x11
mov byte [rbp - 0x2f], sil
mov byte [rbp - 0x2e], r12b
mov qword [rbp - 0x21], r13
mov qword [rbp - 0x11], r13
mov qword [rbp - 9], reloc.WS2_32.dll_ntohs
lea rax, [rbp - 0x38]
inc r14
cmp byte [rax + r14], r12b
jne 0x14019ba82
mov r8, r14
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 0x21]
call fcn.14014d7f0
lea rax, [rbp - 0x21]
mov qword [rbp - 0x39], rax
lea rcx, [rbp - 0x21]
cmp qword [rbp - 9], 0x10
cmovae rcx, qword [rbp - 0x21]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [rbp - 1]
cmp qword [rbp + 0x17], 0x10
cmovae rdx, qword [rbp - 1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, r15d
call rax
mov ebx, eax
mov rdx, qword [rbp - 9]
cmp rdx, 0x10
jb 0x14019bb13
inc rdx
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14019bb0e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14019bb0e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140268610
mov qword [rbp - 0x11], r13
mov qword [rbp - 9], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x21], 0
mov rdx, qword [rbp + 0x17]
cmp rdx, 0x10
jb 0x14019bb61
inc rdx
mov rcx, qword [rbp - 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14019bb5c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14019bb5c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140268610
mov eax, ebx
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x14019bb90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov r15, rcx
lea rax, [rbp - 1]
mov qword [rbp + 0x1f], rax
movdqa xmm0, xmmword [str.o_n_b]
movdqu xmmword [rbp - 0x39], xmm0
mov word [rbp - 0x29], reloc.WLDAP32.dll_Ordinal_46
xor r13d, r13d
mov eax, r13d
nop dword [rax + rax]
movzx ecx, byte [rbp - 0x39]
xor byte [rbp + rax - 0x38], cl
inc rax
cmp rax, 0x10
jb 0x14019bbe0
mov byte [rbp - 0x28], r13b
mov qword [rbp - 1], r13
mov qword [rbp + 0xf], r13
mov qword [rbp + 0x17], reloc.WS2_32.dll_ntohs
lea rax, [rbp - 0x38]
mov r14, 0xffffffffffffffff
mov r8, r14
inc r8
cmp byte [rax + r8], r13b
jne 0x14019bc13
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 1]
call fcn.14014d7f0
lea rax, [rbp - 1]
mov qword [rbp + 0x27], rax
mov byte [rbp - 0x39], 0x54
mov al, 1
mov cl, 0x27
mov dl, Ordinal_50
mov r8b, 0x26
mov r9b, Ordinal_104
mov r10b, Ordinal_104
mov r11b, 0x7a
mov bl, 0x30
mov dil, gethostname
movzx esi, dil
xor r12d, r12d
xor al, 0x54
mov byte [rbp - 0x38], al
xor cl, 0x54
mov byte [rbp - 0x37], cl
xor dl, 0x54
mov byte [rbp - 0x36], dl
xor r8b, 0x54
mov byte [rbp - 0x35], r8b
xor r9b, 0x54
mov byte [rbp - 0x34], r9b
xor r10b, 0x54
mov byte [rbp - 0x33], r10b
xor r11b, 0x54
mov byte [rbp - 0x32], r11b
xor bl, 0x54
mov byte [rbp - 0x31], bl
xor dil, 0x54
mov byte [rbp - 0x30], dil
xor sil, 0x54
mov byte [rbp - 0x2f], sil
mov byte [rbp - 0x2e], r12b
mov qword [rbp - 0x21], r13
mov qword [rbp - 0x11], r13
mov qword [rbp - 9], reloc.WS2_32.dll_ntohs
lea rax, [rbp - 0x38]
inc r14
cmp byte [rax + r14], r12b
jne 0x14019bcb2
mov r8, r14
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 0x21]
call fcn.14014d7f0
lea rax, [rbp - 0x21]
mov qword [rbp - 0x39], rax
lea rcx, [rbp - 0x21]
cmp qword [rbp - 9], 0x10
cmovae rcx, qword [rbp - 0x21]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [rbp - 1]
cmp qword [rbp + 0x17], 0x10
cmovae rdx, qword [rbp - 1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, r15
call rax
movzx ebx, ax
mov rdx, qword [rbp - 9]
cmp rdx, 0x10
jb 0x14019bd44
inc rdx
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14019bd3f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14019bd3f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140268610
mov qword [rbp - 0x11], r13
mov qword [rbp - 9], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x21], 0
mov rdx, qword [rbp + 0x17]
cmp rdx, 0x10
jb 0x14019bd92
inc rdx
mov rcx, qword [rbp - 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14019bd8d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14019bd8d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140268610
movzx eax, bx
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x14019c010
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x90
mov r12, rdx
mov r15, rcx
lea rax, [rbp - 0x11]
mov qword [rbp + 0xf], rax
movdqa xmm0, xmmword [0x1402a3140]
movdqu xmmword [rbp - 0x49], xmm0
mov word [rbp - 0x39], reloc.WS2_32.dll_recvfrom
xor edx, edx
mov eax, edx
movzx ecx, byte [rbp - 0x49]
xor byte [rbp + rax - 0x48], cl
inc rax
cmp rax, 0x10
jb 0x14019c051
mov byte [rbp - 0x38], dl
mov qword [rbp - 0x11], rdx
mov qword [rbp - 1], rdx
mov qword [rbp + 7], reloc.WS2_32.dll_ntohs
lea rax, [rbp - 0x48]
mov r14, 0xffffffffffffffff
mov r8, r14
inc r8
cmp byte [rax + r8], dl
jne 0x14019c083
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x11]
call fcn.14014d7f0
lea rax, [rbp - 0x11]
mov qword [rbp + 0x17], rax
mov byte [rbp - 0x49], 0x51
mov al, 4
mov cl, Ordinal_35
mov dl, 0x34
mov r8b, reloc.WLDAP32.dll_Ordinal_35
mov r9b, 0x62
mov r10b, 0x63
mov r11b, 0x7f
mov bl, 0x35
mov dil, 0x3d
movzx esi, dil
xor r13d, r13d
xor al, 0x51
mov byte [rbp - 0x48], al
xor cl, 0x51
mov byte [rbp - 0x47], cl
xor dl, 0x51
mov byte [rbp - 0x46], dl
xor r8b, 0x51
mov byte [rbp - 0x45], r8b
xor r9b, 0x51
mov byte [rbp - 0x44], r9b
xor r10b, 0x51
mov byte [rbp - 0x43], r10b
xor r11b, 0x51
mov byte [rbp - 0x42], r11b
xor bl, 0x51
mov byte [rbp - 0x41], bl
xor dil, 0x51
mov byte [rbp - 0x40], dil
xor sil, 0x51
mov byte [rbp - 0x3f], sil
mov byte [rbp - 0x3e], r13b
xor edi, edi
mov qword [rbp - 0x31], rdi
mov qword [rbp - 0x21], rdi
mov qword [rbp - 0x19], reloc.WS2_32.dll_ntohs
lea rax, [rbp - 0x48]
inc r14
cmp byte [rax + r14], dil
jne 0x14019c124
mov r8, r14
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x31]
call fcn.14014d7f0
lea rax, [rbp - 0x31]
mov qword [rbp - 0x49], rax
lea rcx, [rbp - 0x31]
cmp qword [rbp - 0x19], 0x10
cmovae rcx, qword [rbp - 0x31]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [rbp - 0x11]
cmp qword [rbp + 7], 0x10
cmovae rdx, qword [rbp - 0x11]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, r12
mov rcx, r15
call rax
mov ebx, eax
mov rdx, qword [rbp - 0x19]
cmp rdx, 0x10
jb 0x14019c1b8
inc rdx
mov rcx, qword [rbp - 0x31]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14019c1b3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14019c1b3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140268610
mov qword [rbp - 0x21], rdi
mov qword [rbp - 0x19], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x31], 0
mov rdx, qword [rbp + 7]
cmp rdx, 0x10
jb 0x14019c206
inc rdx
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14019c201
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14019c201
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140268610
mov eax, ebx
mov rbx, qword [rsp + 0xe0]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14019c230
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov r15, qword [0x140324760]
lea rax, [rbp - 0x40]
mov qword [rbp + 0x40], rax
mov cl, reloc.WLDAP32.dll_Ordinal_46
mov dword [rbp - 0x50], 0x4a5e7b2e
mov dword [rbp - 0x4c], 0x794b5a4f
mov dword [rbp - 0x48], 0x414a4047
mov word [rbp - 0x44], 0x59
xor r13d, r13d
mov eax, r13d
nop
xor byte [rbp + rax - 0x4f], cl
inc rax
cmp rax, 0xc
jae 0x14019c293
movzx ecx, byte [rbp - 0x50]
jmp 0x14019c280
mov byte [rbp - 0x43], r13b
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], reloc.WS2_32.dll_ntohs
lea rax, [rbp - 0x4f]
mov r14, 0xffffffffffffffff
mov r8, r14
inc r8
cmp byte [rax + r8], r13b
jne 0x14019c2b5
lea rdx, [rbp - 0x4f]
lea rcx, [rbp - 0x40]
call fcn.14014d7f0
nop
mov byte [rbp - 0x50], listen
mov al, 0x59
mov cl, 0x7f
mov dl, 0x69
mov r8b, 0x7e
mov r9b, 0x3f
mov r10b, 0x3e
mov r11b, Ordinal_35
mov bl, reloc.SecureEngineSDK64.dll_Ordinal_104
mov dil, 0x60
movzx esi, dil
xor r12d, r12d
xor al, 0xc
mov byte [rbp - 0x4f], al
xor cl, 0xc
mov byte [rbp - 0x4e], cl
xor dl, 0xc
mov byte [rbp - 0x4d], dl
xor r8b, 0xc
mov byte [rbp - 0x4c], r8b
xor r9b, 0xc
mov byte [rbp - 0x4b], r9b
xor r10b, 0xc
mov byte [rbp - 0x4a], r10b
xor r11b, 0xc
mov byte [rbp - 0x49], r11b
xor bl, 0xc
mov byte [rbp - 0x48], bl
xor dil, 0xc
mov byte [rbp - 0x47], dil
xor sil, 0xc
mov byte [rbp - 0x46], sil
mov byte [rbp - 0x45], r12b
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x10], r13
mov qword [rbp - 8], reloc.WS2_32.dll_ntohs
lea rax, [rbp - 0x4f]
nop dword [rax]
inc r14
cmp byte [rax + r14], r12b
jne 0x14019c350
mov r8, r14
lea rdx, [rbp - 0x4f]
lea rcx, [rbp - 0x20]
call fcn.14014d7f0
nop
mov r8, r15
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x20]
call fcn.14019e930
mov rbx, qword [rsp + 0xc0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14019c5e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0x90
lea rax, [rbp + 0xf]
mov qword [rbp + 0x2f], rax
movdqa xmm0, xmmword [0x1402a3350]
movdqu xmmword [rbp - 0x29], xmm0
mov word [rbp - 0x19], 0x5e
xor r12d, r12d
mov eax, r12d
nop word [rax + rax]
movzx ecx, byte [rbp - 0x29]
xor byte [rbp + rax - 0x28], cl
inc rax
cmp rax, 0x10
jb 0x14019c630
mov byte [rbp - 0x18], r12b
mov qword [rbp + 0xf], r12
mov qword [rbp + 0x1f], r12
mov qword [rbp + 0x27], reloc.WS2_32.dll_ntohs
lea rax, [rbp - 0x28]
mov r14, 0xffffffffffffffff
mov r8, r14
inc r8
cmp byte [rax + r8], r12b
jne 0x14019c663
lea rdx, [rbp - 0x28]
lea rcx, [rbp + 0xf]
call fcn.14014d7f0
lea rax, [rbp + 0xf]
mov qword [rbp + 0x37], rax
mov byte [rbp - 0x29], Ordinal_79
mov al, Ordinal_26
mov cl, 0x3f
mov dl, reloc.WLDAP32.dll_Ordinal_41
mov r8b, 0x3e
mov r9b, 0x7f
mov r10b, 0x7e
mov r11b, 0x62
mov bl, Ordinal_41
mov dil, reloc.WLDAP32.dll_Ordinal_32
movzx esi, dil
xor r15d, r15d
xor al, 0x4c
mov byte [rbp - 0x28], al
xor cl, 0x4c
mov byte [rbp - 0x27], cl
xor dl, 0x4c
mov byte [rbp - 0x26], dl
xor r8b, 0x4c
mov byte [rbp - 0x25], r8b
xor r9b, 0x4c
mov byte [rbp - 0x24], r9b
xor r10b, 0x4c
mov byte [rbp - 0x23], r10b
xor r11b, 0x4c
mov byte [rbp - 0x22], r11b
xor bl, 0x4c
mov byte [rbp - 0x21], bl
xor dil, 0x4c
mov byte [rbp - 0x20], dil
xor sil, 0x4c
mov byte [rbp - 0x1f], sil
mov byte [rbp - 0x1e], r15b
mov qword [rbp - 0x11], r12
mov qword [rbp - 1], r12
mov qword [rbp + 7], reloc.WS2_32.dll_ntohs
lea rax, [rbp - 0x28]
inc r14
cmp byte [rax + r14], r15b
jne 0x14019c702
mov r8, r14
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x11]
call fcn.14014d7f0
lea rax, [rbp - 0x11]
mov qword [rbp - 0x29], rax
lea rcx, [rbp - 0x11]
cmp qword [rbp + 7], 0x10
cmovae rcx, qword [rbp - 0x11]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [rbp + 0xf]
cmp qword [rbp + 0x27], 0x10
cmovae rdx, qword [rbp + 0xf]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x1403248b8]
call rax
mov ebx, eax
mov rdx, qword [rbp + 7]
cmp rdx, 0x10
jb 0x14019c797
inc rdx
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14019c792
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14019c792
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140268610
mov qword [rbp - 1], r12
mov qword [rbp + 7], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x11], 0
mov rdx, qword [rbp + 0x27]
cmp rdx, 0x10
jb 0x14019c7e5
inc rdx
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14019c7e0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14019c7e0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140268610
mov eax, ebx
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret